Unhelpful error message when docker_image and docker_container are on different docker providers

[dubo-dubon-duponey]

Terraform Version

v0.12.9

Affected Resource(s)

docker_image & docker_container

Terraform Configuration Files

resource "docker_image" "ubuntu" {
  name = "ubuntu:bionic"
}

resource "docker_container" "ubuntu" {
  provider = docker.something
  name  = "foo"
  image = docker_image.ubuntu.latest
}

Make sure that:

• you have docker running locally
• you have another, different node running docker (provided by docker.something)

Expected Behavior

Some "helpful" error message, mentioning that the docker_image resource is not available on that docker instance.

Actual Behavior

Unhelpful error message that suggest you do not have access to the image or it does not exist.

Error: Unable to create container with image sha256:2ca708c1c9ccc509b070f226d6e4712604e0c48b55d7d8f5adc9be4a4d36029a:
Unable to pull image sha256:2ca708c1c9ccc509b070f226d6e4712604e0c48b55d7d8f5adc9be4a4d36029a: error pulling image sha256:2ca708c1c9ccc509b070f226d6e4712604e0c48b55d7d8f5adc9be4a4d36029a: 
Error response from daemon: pull access denied for sha256, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

Steps to Reproduce

1. terraform apply

Important Factoids

Docker providers are accessed over ssh.

References

Originally mentioned in #15 (comment)

[mavogel]

Some "helpful" error message, mentioning that the docker_image resource is not available on that docker instance.

Hmm, I'd rather expect that the image would be pulled if is not present on the machine where the daemon is running. I wonder why the daemon says you're not authorized when pulling from the public docker hub. What do you think @dubo-dubon-duponey ?

[dubo-dubon-duponey]

I don't know.

The issue is that a container resource on docker.node B references an image resource attached to docker.node A:

resource "docker_image" "ubuntu" {
  provider = docker.NODE_A
  name = "ubuntu:bionic"
}

resource "docker_container" "ubuntu" {
  provider = docker.NODE_B
  name  = "foo"
  image = docker_image.ubuntu.latest
}

I'm not sure how this could be made smart...
It doesn't even make sense to begin with - and maybe that scenario should just not be allowed...

That being said, I'm still very new to terraform overall, and I don't really understand the internals here...

Sorry @mavogel - hope I would have a more helpful opinion on this.

[mavogel]

It doesn't even make sense, to begin with - and maybe that scenario should just not be allowed...

Well, I don't know how to prevent this in an easy way. Semantic versioning of the config file probably. I'll ask for feedback from the core devs tho.

[mavogel]

Currently, this semantic check is not supported. See hashicorp/terraform-plugin-sdk#61 for more details.