Support specifying images using sha256 digests

[boazberman]

You can run docker images by specifying the sha256 digest of the designated image instead of using a specific version.

Using sha256 is somewhat more secure as it pins the exact image, thus not allowing possible overriding of a tag by a malicious actor.

Usage can be something along:

impl Image for SomeImage {
    type Args = ();

    fn name(&self) -> String {
        "some name"
    }

    fn sha256(&self) -> String {
       "a826cb8a6a0023..."
    }
}

[boazberman]

I intend on implementing it (as this can be useful for us), and it will be nice if the project can take part of the current hacktoberfest. Thanks!

[thomaseizinger]

I am liking this idea. It would be well in line with the "Reliable" principle in our upcoming "Design principles" draft: #420

We would probably have to make it an Option.

I intend on implementing it (as this can be useful for us), and it will be nice if the project can take part of the current hacktoberfest. Thanks!

I am sorry for getting back to you too late for this to make any sense.

[boazberman]

I am liking this idea. It would be well in line with the "Reliable" principle in our upcoming "Design principles" draft: #420

We would probably have to make it an Option.

I intend on implementing it (as this can be useful for us), and it will be nice if the project can take part of the current hacktoberfest. Thanks!

I am sorry for getting back to you too late for this to make any sense.

Cool, just now saw your comment, will try to implement that tomorrow!

[boazberman]

I had created a PR: #446

[iursino]

+1, I need this because there is no other way to enforce consistency when testing with a container dependency in bazel.

[DDtKey]

If anyone is interested in implementing this feature, I’d be happy to accept a pull request.

The previous pull request was closed because it was created a long time ago against an old code base. Since testcontainers were completely rewritten to utilize the Docker API instead of the CLI, that code base is no longer relevant.

[abustany]

It feels like this would necessarily involve an API break? If specifying an image with a digest, what would Image::tag() return?

[istankovic]

It feels like this would necessarily involve an API break? If specifying an image with a digest, what would Image::tag() return?

None?

[abustany]

that's my point, the current signature returns a &str.

[istankovic]

that's my point, the current signature returns a &str.

Right, and the point is that really should have been Option<&str>.
I don't think breaking the API here would be such a big deal -- just document it, increase the version and that's it.

[bergkvist]

@DDtKey I made a PR for this (#948), would love your review! For now I didn't change the Image::tag() signature to return Option<&str> instead of &str, since docker will ignore the tag anyways if a digest is also specified.