The image name containing library is a bug. When we parse the pull spec, we’ll fill in the namespace with “library” if empty:
Paul, we should likely include a flag in image.api.DockerImageReference saying whether a namespace was specified. So we can include the default namespace only if appropriate when serializing it back out (or leave it blank and serialize it as “library” only with a flag).
Also in the 1.0.6 case, did you verify that the image stream contains the insecureRepository annotation? I believe that’s the bug that Maciej fixed between 1.0.6 to 1.1. (https://github.com/openshift/origin/pull/5574)