`coast build` truncates the hash in `@sha256:` digest references

[felipebn]

(disclaimer: report mostly produced by Claude Opus 4.7)

Environment: macOS (Darwin, ARM64), Docker Desktop for Mac, Coast latest (April 2026)

---

Summary

When docker-compose.yml references an image by digest (image@sha256:<hash>
or image:tag@sha256:<hash>), coast build fails to pull the image because
the digest hash is truncated before the reference is passed to Docker. The
Docker daemon then rejects the malformed reference with invalid reference format.

The bug is purely in Coast's image-reference handling — it reproduces with a
fully public Docker Hub image, with no authentication, network restrictions,
or private registries involved.

---

Reproduction

Public Docker Hub image. No login, no VPN, no private registry.

1. Minimal Coastfile.toml

[coast]
name = "parser-repro"
compose = "./docker-compose.yml"

2. docker-compose.yml — three forms tested

services:
  web:
    image: nginx@sha256:5616878291a2eed594aee8db4dade5878cf7edcb475e59193904b198d9b830de
    ports:
      - "8080:80"

3. Run coast build

4. Results

Reference form	Result
nginx:alpine	✅ caches
nginx@sha256:5616…b830de	❌ fails
nginx:alpine@sha256:5616…b830de	❌ fails

5. Failing output

[3/4] Pulling images...    nginx@sha256:5616878291a2eed594aee8db4dade5878cf7edcb475e59193904b198d9b830de  warn

warning: Failed to cache image
'nginx@sha256:5616878291a2eed594aee8db4dade5878cf7edcb475e59193904b198d9b830de':
Docker error: failed to pull image
'nginx@sha256:5616878291a2eed594aee8db4dade5878cf7edcb475e59193904b198d9b830de':
Docker responded with status code 500:
  parsing reference nginx@sha256: invalid reference format

Note that the warning prints the full reference, but the error message from
the Docker daemon shows the reference it actually received: nginx@sha256:
with the hex digest truncated. The same pattern occurs for the tag@digest
form (nginx:alpine@sha256:).

---

Expected behavior

Per the OCI image specification, the canonical reference form is:

[registry[:port]/]repository[:tag][@algorithm:hex]

All three of the forms tested above are valid OCI references. coast build
should accept and successfully pull all of them.

docker pull nginx@sha256:5616878291a2eed594aee8db4dade5878cf7edcb475e59193904b198d9b830de
works directly against the same Docker daemon Coast is using, so the daemon
is not at fault.

---

Suspected cause

The parser appears to split on : before the @sha256: sigil is recognized,
producing a malformed reference nginx@sha256: (or nginx:alpine@sha256:)
with the hex portion dropped. A correct implementation should recognize
@<algorithm>:<hex> as a single token per the
distribution/reference grammar
before splitting on :.

---

Related context

• The OCI image spec for references:
  https://github.com/opencontainers/image-spec/blob/main/descriptor.md
• The reference grammar:
  https://github.com/distribution/reference/blob/main/reference.go
• Docker Compose accepts the image:tag@digest form natively, so users
  reasonably expect Coast to handle the same syntax.

[felipebn]

👋 Seems like https://github.com/coast-guard/coasts/pull/200/changes should address it