compose: recreate container when mounted image digest changes

pkg/compose/build.go

@@ -158,6 +158,21 @@ func (s *composeService) ensureImagesExists(ctx context.Context, project *types.
 		if ok {
 			service.CustomLabels.Add(api.ImageDigestLabel, img.ID)
 		}
+
+		// Resolve image volume sources to include digest, so ServiceHash detects changes
+		for i, vol := range service.Volumes {
+			if vol.Type == types.VolumeTypeImage {
+				imgName := vol.Source
+				if target, ok := project.Services[vol.Source]; ok {
+					imgName = api.GetImageNameOrDefault(target, project.Name)
+				}
+				if img, ok := images[imgName]; ok {
+					// Append digest to source so config hash changes when image is rebuilt
+					service.Volumes[i].Source = fmt.Sprintf("%s@%s", vol.Source, img.ID)
+				}
+			}
+		}
+
 		project.Services[name] = service
 	}
 	return nil

pkg/compose/convergence_image_mount_test.go

@@ -0,0 +1,63 @@
+package compose
+
+import (
+	"testing"
+
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/docker/compose/v5/pkg/api"
+	"github.com/docker/docker/api/types/container"
+	"gotest.tools/v3/assert"
+)
+
+func TestMustRecreateImageMounts(t *testing.T) {
+	c := &convergence{}
+	service := types.ServiceConfig{
+		Name: "test",
+		Volumes: []types.ServiceVolumeConfig{
+			{
+				Type:   types.VolumeTypeImage,
+				Source: "source@sha256:newdigest",
+			},
+		},
+	}
+
+	t.Run("image volume digest changed", func(t *testing.T) {
+		// Old service config had a different source (e.g. older digest or no digest)
+		oldService := types.ServiceConfig{
+			Name: "test",
+			Volumes: []types.ServiceVolumeConfig{
+				{
+					Type:   types.VolumeTypeImage,
+					Source: "source@sha256:olddigest",
+				},
+			},
+		}
+		oldHash, err := ServiceHash(oldService)
+		assert.NilError(t, err)
+
+		container := container.Summary{
+			Labels: map[string]string{
+				api.ConfigHashLabel: oldHash,
+			},
+		}
+		recreate, err := c.mustRecreate(service, container, api.RecreateDiverged)
+		assert.NilError(t, err)
+		assert.Assert(t, recreate, "expected recreate to be true because config hash should differ due to volume source change")
+	})
+
+	t.Run("image volume digest unchanged", func(t *testing.T) {
+		// Calculate hash for the current service (same digest)
+		hash, err := ServiceHash(service)
+		assert.NilError(t, err)
+
+		container := container.Summary{
+			Labels: map[string]string{
+				api.ConfigHashLabel: hash,
+			},
+		}
+
+		recreate, err := c.mustRecreate(service, container, api.RecreateDiverged)
+		assert.NilError(t, err)
+		assert.Assert(t, !recreate, "expected recreate to be false because config hash matches")
+	})
+}