docker image sha does not match

Summary

SHA of pulled docker image does not match docker hub

Steps to reproduce

Unfortunately my exact image is private, but my build uses MY_ORG/MY_IMG:8f1940e

Actual behavior

The build logs for my job contain

Pulling docker image MY_ORG/MY_IMG:8f1940e ...
Using docker image sha256:ad5787ebbc7910ca9a37357ded7c661d8f24ffb6f5ee11b28911ec2aa9d0f5ee for MY_ORG/MY_IMG:8f1940e ...

Expected behavior

The expected SHA for my image:tag is sha256:095f8128039a8e390ceec110426b05017df5251220346bc60249b2e5e7c15cdb

docker images --digests | grep 8f1940e
MY_ORG/MY_IMG          8f1940e                                    sha256:095f8128039a8e390ceec110426b05017df5251220346bc60249b2e5e7c15cdb   ad5787ebbc79        18 hours ago        892MB

Relevant logs and/or screenshots

There are several cancelled jobs under pipelines #44911268 and #44911474 where I noticed the SHA was unexpected.

I'm not sure where the SHA that the gitlab ci runner reports is coming from. There isn't a tag in MY_ORG/MY_IMG that has that SHA

docker images --digests | grep MY_ORG/MY_IMG
MY_ORG/MY_IMG          52b697e                                    sha256:095f8128039a8e390ceec110426b05017df5251220346bc60249b2e5e7c15cdb   ad5787ebbc79        18 hours ago        892MB
MY_ORG/MY_IMG          8e646eb                                    sha256:095f8128039a8e390ceec110426b05017df5251220346bc60249b2e5e7c15cdb   ad5787ebbc79        18 hours ago        892MB
MY_ORG/MY_IMG          8f1940e                                    sha256:095f8128039a8e390ceec110426b05017df5251220346bc60249b2e5e7c15cdb   ad5787ebbc79        18 hours ago        892MB
MY_ORG/MY_IMG          11d5e8e                                    sha256:1dff64a4c293ecb7fa85fa54eee3b9d8de854723f912351b00528a160e83defb   87ab5970a98e        2 weeks ago         895MB
MY_ORG/MY_IMG          latest                                     sha256:1dff64a4c293ecb7fa85fa54eee3b9d8de854723f912351b00528a160e83defb   87ab5970a98e        2 weeks ago         895MB

Environment description

I am using a custom docker+machine autoscale runner with ec2 backed runners. The docker image in question is being installed from docker hub using DOCKER_AUTH_CONFIG to set credentials.

Used GitLab Runner version

$ gitlab-runner --version
Version:      11.6.0
Git revision: f100a208
Git branch:   11-6-stable
GO version:   go1.8.7
Built:        2018-12-22T11:56:10+0000
OS/Arch:      linux/amd64