Today, newly-scheduled tasks always try to pull the image indicated in the ContainerSpec, even if that exact image tag is available on the node where the task is scheduled (as indicated in the comment at #25211 (comment))

In order to make this behavior more configurable, I would like to propose a "Service Pull Policy" feature, featuring three policies:

• "always": The image is always pulled from a remote registry, even if an image with the same name and tag exists on the node where the task is scheduled. This would be the default behavior, as
• "missing": Only pull the image from the remote registry if the image is not already present on the node
• "never": Never attempt to contact a remote registry to pull an image. If the image does not exist, the task exits with an error code

This policy would effectively be a new field in the ServiceSpec (or the TaskTemplate, if more appropriate) which could be manipulated through the service create and service update operations.

A hand-wavy CLI example:

docker service create --pull=missing <image:tag>
docker service update <service_name> --pull=always

Cute animal photo