In OpenShift, we would like to be able to access an image (i.e. docker pull/create/run) via an immutable identifier that uniquely identifies an image for all points in time. Here are some use cases:

1. During a deployment of a group of containers, the same image must be used when creating each container. If the image we're using is foo/bar:latest (let's call this Rev1) and someone pushes an updated foo/bar:latest manifest in the middle of the deployment (Rev2), some containers might be created using Rev1 and others with Rev2. The correct behavior is for all containers to be running based on Rev1.
2. A group of containers has been deployed (foo/bar:latest - Rev1). As development continues, foo/bar:latest is updated several times, but none of these newer image manifests has been deployed yet. The user decides to scale up the existing deployment, so OpenShift needs to create and start new containers using the same image that is currently deployed (Rev1). foo/bar:latest can't be used because that's no longer Rev1 - it's now something else (e.g. Rev17).

With the v1 registry, we created a custom extension that responds to the tag_created signal, creates a new tag whose name is the image's id (since a v1 image has an id), and then http posts a payload to OpenShift with

1. namespace
2. repository
3. tag
4. image id
5. image metadata

OpenShift users can create deployment triggers that watch for changes to foo/bar:latest and then perform new deployments. When deploying, OpenShift inspects the image to find its id and then translates foo/bar:latest to foo/bar:$image_id. This, combined with our custom v1 registry extension, allows us to pull an image by its id. It also lets us deploy a specific image by id, as our deployments don't refer to :latest but instead to the id.

@dmp42 suggested that OpenShift could pull foo/bar:latest, generate a new tag (based on commit id, date/time, etc) that is unique and consistent for all time, push the new tag, and then use that when deploying. This creates a couple of problems:

1. The tag isn't immutable, which could be problematic if someone accidentally pushed an updated image manifest for a tag that is meant to never change
2. The new manifest would be signed by OpenShift, not by the user creating the image; if a user wants to run an image that he/she signed, we lose this ability.

It would really be nice to have immutable identifiers for image manifests that are consistent all the time.

@dmp42 @stevvooe @smarterclayton @wking thoughts?