title: docker service update: "image could not be accessed on a registry to record it's digest"
body: <p>I have an image on Amazon's Elastic Container Registry (ECR) that I want to deploy as a Docker service in my Docker single-node swarm. Currently the service is running an older version of the image's <code>latest</code> tag, but I've since uploaded a newer version of the <code>latest</code> tag to ECR.</p>
  
  <p>Running <code>docker service update --force my_service</code> on my swarm node, which uses image <code>XXXXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/my_service:latest</code>, results in:</p>
  
  <blockquote>
    <p>image XXXXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/my_service:latest could not be accessed on a registry to record its digest. Each node will access XXXXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/my_service:latest independently,
    possibly leading to different nodes running different versions of the image.</p>
  </blockquote>
  
  <p>This appears to prevent the node from pulling a new copy of the <code>latest</code> tag from the registry, and the service from properly updating.</p>
  
  <p>I'm properly logged in with <code>docker login</code> to ECR, and running <code>docker pull XXXXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/my_service:latest</code> works fine (and returns a digest).</p>
  
  <p>Why is <code>docker service update</code> unable to read the digest from the ECR registry despite the image being available?</p>