Pull Docker images by SHA digest

[kmazurek]

Rationale

Right now, Docker images used by Golem are described using tags (e.g. golemfactory/blender_verifier:1.3). Relying on tags alone is error-prone and may lead to non-deterministic builds, since it's possible to push an entirely new Docker image under the same tag.

One example of such issue is #4143, where an incorrect Docker image under a specific tag got cached by Buildbot workers, causing tests to fail.

To avoid similar issues in the future, Golem could rely on not only tags but also the SHA digests of Docker images.

Technical specification

For all docker environments (e.g. verifier, blender, wasm) a new field should be defined (e.g. IMAGE_SHA_DIGEST). This would contain the SHA of the expected Docker image to be used by Golem.
Initial image pulls should still be based on tags, making them more readable. The SHA sum check would be done as a second step, possibly failing or pulling the correct image if a checksum mismatch occurs.

Which application modules will be updated?

• DockerEnvironment
• DockerManager