@@ -111,7 +111,7 @@ func New(config Config) (*Cluster, error) {

 	select {

 	case <-time.After(swarmConnectTimeout):

 		logrus.Errorf("swarm component could not be started before timeout was reached")

-	case <-n.Ready(context.Background()):

+	case <-n.Ready():

 	case <-ctx.Done():

 	}

 	if ctx.Err() != nil {

@@ -213,7 +213,7 @@ func (c *Cluster) startNewNode(forceNewCluster bool, listenAddr, joinAddr, secre

 	go func() {

 		select {

-		case <-node.Ready(context.Background()):

+		case <-node.Ready():

 			c.Lock()

 			c.reconnectDelay = initialReconnectDelay

 			c.Unlock()

@@ -273,7 +273,7 @@ func (c *Cluster) Init(req types.InitRequest) (string, error) {

 	c.Unlock()

 	select {

-	case <-n.Ready(context.Background()):

+	case <-n.Ready():

 		if err := initAcceptancePolicy(n, req.Spec.AcceptancePolicy); err != nil {

 			return "", err

 		}

@@ -319,7 +319,7 @@ func (c *Cluster) Join(req types.JoinRequest) error {

 			return fmt.Errorf("Timeout reached before node was joined. Your cluster settings may be preventing this node from automatically joining. To accept this node into cluster run `docker node accept %v` in an existing cluster manager", nodeid)

 		}

 		return ErrSwarmJoinTimeoutReached

-	case <-n.Ready(context.Background()):

+	case <-n.Ready():

 		go c.reconnectOnFailure(ctx)

 		return nil

 	case <-ctx.Done():

@@ -39,7 +39,7 @@ func newContainerAdapter(b executorpkg.Backend, task *api.Task) (*containerAdapt

 func (c *containerAdapter) pullImage(ctx context.Context) error {

 	// if the image needs to be pulled, the auth config will be retrieved and updated

-	encodedAuthConfig := c.container.task.ServiceAnnotations.Labels[fmt.Sprintf("%v.registryauth", systemLabelPrefix)]

+	encodedAuthConfig := c.container.spec().RegistryAuth

 	authConfig := &types.AuthConfig{}

 	if encodedAuthConfig != "" {

@@ -2,13 +2,13 @@ package container

 import (

 	"fmt"

-	"strings"

 	executorpkg "github.com/docker/docker/daemon/cluster/executor"

 	"github.com/docker/engine-api/types"

 	"github.com/docker/swarmkit/agent/exec"

 	"github.com/docker/swarmkit/api"

 	"github.com/docker/swarmkit/log"

+	"github.com/pkg/errors"

 	"golang.org/x/net/context"

 )

@@ -84,31 +84,32 @@ func (r *controller) Prepare(ctx context.Context) error {

 		return err

 	}

-	for {

-		if err := r.checkClosed(); err != nil {

-			return err

-		}

-		if err := r.adapter.create(ctx, r.backend); err != nil {

-			if isContainerCreateNameConflict(err) {

-				if _, err := r.adapter.inspect(ctx); err != nil {

-					return err

-				}

-

-				// container is already created. success!

-				return exec.ErrTaskPrepared

-			}

+	if err := r.adapter.pullImage(ctx); err != nil {

+		// NOTE(stevvooe): We always try to pull the image to make sure we have

+		// the most up to date version. This will return an error, but we only

+		// log it. If the image truly doesn't exist, the create below will

+		// error out.

+		//

+		// This gives us some nice behavior where we use up to date versions of

+		// mutable tags, but will still run if the old image is available but a

+		// registry is down.

+		//

+		// If you don't want this behavior, lock down your image to an

+		// immutable tag or digest.

+		log.G(ctx).WithError(err).Error("pulling image failed")

+	}

-			if !strings.Contains(err.Error(), "No such image") { // todo: better error detection

-				return err

-			}

-			if err := r.adapter.pullImage(ctx); err != nil {

+	if err := r.adapter.create(ctx, r.backend); err != nil {

+		if isContainerCreateNameConflict(err) {

+			if _, err := r.adapter.inspect(ctx); err != nil {

 				return err

 			}

-			continue // retry to create the container

+			// container is already created. success!

+			return exec.ErrTaskPrepared

 		}

-		break

+		return err

 	}

 	return nil

@@ -135,7 +136,7 @@ func (r *controller) Start(ctx context.Context) error {

 	}

 	if err := r.adapter.start(ctx); err != nil {

-		return err

+		return errors.Wrap(err, "starting container failed")

 	}

 	return nil