docker service update --image no longer resolves tags to digests in v29

まず、docker service update --image を使って単一ノードの Swarm とローカルレジストリの再現を実行し、次に Docker CLI の service-update エントリポイントを追跡します。--no-resolve-image を指定した場合と指定しない場合の動作を比較します。完了条件は、デフォルトのパスが新しい digest を持つ更新済みの tag を送信して Swarm が task を置き換え、明示的なフラグを指定した場合は tag が維持されることです。

Description

docker service update --image no longer asks the registry to resolve the supplied image tag to a digest in Docker CLI v29.

When a service already stores a mutable image reference such as localhost:5000/test:latest, pushing new content to that tag and running docker service update --image localhost:5000/test:latest test leaves the service specification unchanged. No task is recreated, even though the registry now returns a different digest.

The command reports that the service has converged, but it continues running the previous image. This appears to be a Docker CLI regression rather than Swarm or registry behavior.

Actual result

The service image remains localhost:5000/test:latest. The tag is not resolved to its new digest. Because the resulting service specification is unchanged, Swarm does not create a new task.

Adding --force recreates the task, but the service is still not pinned to a digest and --force should not be required when the resolved digest changed.

Reproduce

The following example uses a single-node Swarm and a local registry.

docker swarm init

docker run -d --name registry --restart always -p 5000:5000 registry:2

docker pull alpine:3.20
docker tag alpine:3.20 localhost:5000/test:latest
docker push localhost:5000/test:latest

docker service create \
  --name test \
  --no-resolve-image \
  localhost:5000/test:latest \
  sleep 1d

docker pull alpine:3.21
docker tag alpine:3.21 localhost:5000/test:latest
docker push localhost:5000/test:latest

docker service update \
  --image localhost:5000/test:latest \
  test

docker service inspect \
  --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}' \
  test

docker service ps --no-trunc test

The inspected image remains the bare tag and the existing task is not replaced.

Expected behavior

Unless --no-resolve-image is explicitly supplied, the CLI should query the registry and send an update containing localhost:5000/test:latest@sha256:<new-digest>. The changed digest should cause Swarm to roll out a new task.

docker version

Client:
 Version:           29.1.3
 API version:       1.52
 OS/Arch:           linux/amd64

Server:
 Engine:
  Version:          29.1.3
  API version:      1.52
  OS/Arch:          linux/amd64

docker info

Server Version: 29.1.3
OSType: linux
Architecture: x86_64
Swarm: active
 Is Manager: true

Internal registry, node, and network details have been omitted.