pull the image with the <image>@<digest> format

[Yiyuanzzz]

Summary

Currently, when agent receives a container image with a tag, the agent first attempts to resolve that tag to its digest. If successful, that digest is sent back to the control plane, while subsequently pulling and launching that image via digest rather than the original tag. This behavior results in the container being shown as launched with the <image>@<digest> rather than the customer defined <image>:<tag> format , so customers have lost information previously available to them, notably the image tag, thus Control Plane will be changing image@sha256:abcd to image:latest@sha256:abcd for subsequence tasks.

• On newer Docker versions (>= 1.13), Docker simply ignores the tag during image pull.
  docker image pull busybox:latest@sha256:abcd is the same as docker image pull busybox@sha256:abcd
• On older Docker versions (< 1.13), the behavior is to fail pulling the image IFF the manifest does not match the tag, potentially resulting in an image pull failure for customers who’s tags no longer matches the digest. So, Agent should ignore the tag when pulling the image. Just like how newer Docker versions do.

This pr makes agent to pull the image with the <image>@<digest> format instead of <image>:tag@<digest> format no matter what docker version is used

Implementation details

• Update methodCanonicalRef agent/utils/reference package that returns a canonical image reference without tag given an image reference and a manifest digest.
• Add a new methodDigestExists agent/utils/reference package that check if image reference contains digest
• Update *DockerTaskEngine.pullAndUpdateContainerReference method that is used for pulling container images so that it uses the container's image reference to prepare a canonical reference without tag to the image to be pulled when image name contains tag and digest e.t.<image>:tag@<digest>. The method tags the pulled image with Container.Image if a different image reference was used to pull the image and container image name not contains digest (<image>:tag@<digest> will not be tagged)
• Test updates and new tests.

Testing

• updated TestPullContainerWithAndWithoutDigestInteg to check that *DockerTaskEngine.pullContainer can pull images for containers with <image>:tag@<digest> format
• update *DockerTaskEngine.pullContainer pulls the same image with or without a tag and the image can be inspected with container.Image field in both cases.
• Ran tasks with image in <image>@<digest>, <image>:tag> and <image>:tag@<digest>format with an Agent built with changes in this PR, Checked that all tasks ran as expected. Images were pulled using digests and tagged with the image reference in the task definition.
• Create a service with desired task count 2 with image <image>:tag>, verified that a additional STSC is not being made for the second task.

New tests cover the changes:

Description for the changelog

Does this PR include breaking model changes? If so, Have you added transformation functions?

Licensing

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[prateekchaudhry]

Referencing to the previous comment, can there be case where we have image but not imageDigest? What should be the expected behavior in that case?

[prateekchaudhry]

(non blocking) nit: we may consider adding unit test case for the above