Define restricted Kubernetes output contract (#101)

agents/services/base.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io/fs"
 	"path"
+	"sync"
 	"time"
 
 	"github.com/codefly-dev/core/builders"
@@ -68,7 +69,6 @@ type Base struct {
 	EnvironmentVariables *resources.EnvironmentVariableManager
 
 	// Configuration
-	Configuration           *basev0.Configuration
 	WorkspaceConfigurations []*basev0.Configuration
 
 	// Wrappers
@@ -90,7 +90,9 @@ type Base struct {
 	commands *CommandRegistry
 
 	// Docker Image for simple deployment convenience
-	image *resources.DockerImage
+	image          *resources.DockerImage
+	imageIsDefault bool
+	imageMu        sync.Mutex
 }
 
 func NewServiceBase(ctx context.Context, agent *resources.Agent) *Base {
@@ -184,22 +186,45 @@ func (s *Base) Load(ctx context.Context, identity *basev0.ServiceIdentity, setti
 }
 
 func (s *Base) SetDefaultDockerImage(req *builderv0.DockerBuildContext) {
-	repo := req.DockerRepository
+	s.imageMu.Lock()
+	defer s.imageMu.Unlock()
 	s.image = &resources.DockerImage{
-		Name: path.Join(repo, s.Identity.Module, s.Identity.Name),
+		Name: path.Join(req.GetDockerRepository(), s.Identity.Module, s.Identity.Name),
 		Tag:  s.Version().Version,
 	}
+	s.imageIsDefault = true
 }
 
 func (s *Base) SetDockerImage(image *resources.DockerImage) {
-	s.image = image
+	s.imageMu.Lock()
+	defer s.imageMu.Unlock()
+	s.image = cloneDockerImage(image)
+	s.imageIsDefault = false
 }
 
 func (s *Base) DockerImage(req *builderv0.DockerBuildContext) *resources.DockerImage {
+	s.imageMu.Lock()
+	defer s.imageMu.Unlock()
 	if s.image == nil {
-		s.SetDefaultDockerImage(req)
+		s.image = &resources.DockerImage{
+			Name: path.Join(req.GetDockerRepository(), s.Identity.Module, s.Identity.Name),
+			Tag:  s.Version().Version,
+		}
+		s.imageIsDefault = true
+	}
+	image := cloneDockerImage(s.image)
+	if digest := req.GetImageDigest(); digest != "" && s.imageIsDefault {
+		image.Digest = digest
+	}
+	return image
+}
+
+func cloneDockerImage(image *resources.DockerImage) *resources.DockerImage {
+	if image == nil {
+		return nil
 	}
-	return s.image
+	cloned := *image
+	return &cloned
 }
 
 type WatchConfiguration struct {