image-builder: add safe registry GC and stop OCI-index breakageHEADmaster

The registry never reclaims blobs, so its store grows until the disk fills and the nightly builds fail with "no space left on device". Add registry-gc.sh, run weekly (Sunday 08:00), plus a daily dangling-image prune.

registry-gc.sh refuses to run while a build is active, stops the registry for a stable blob graph, deletes only untagged manifests (-m) and their blobs, restarts via an EXIT trap, and verifies a tag still pulls.

distribution 2.8.x GC does not follow OCI image indexes, so -m deletes their child manifests (distribution#3178). Default BuildKit provenance made every pushed tag an OCI index, which made -m destructive. Build scripts now pass --provenance=false (plain schema2), and registry-gc.sh refuses to run if any tag is still an index.

1 files changed, 5 insertions, 1 deletions

diff --git a/image-builder/bootstrap.sh b/image-builder/bootstrap.sh
index 7316116..e632e7a 100755
--- a/image-builder/bootstrap.sh
+++ b/image-builder/bootstrap.sh
@@ -541,7 +541,11 @@ DOCKERFILE
     # (see Main), which suppresses `set -e` in this subshell, so a failed build
     # would otherwise push a nonexistent tag and log "Done".
     _log "Building and pushing ${TAG}..."
-    if ! docker build --no-cache -t "${TAG}" "${WORKDIR}"; then
+    # --provenance=false keeps the pushed manifest a plain Docker schema2
+    # manifest rather than an OCI image index. The registry's garbage collector
+    # (distribution 2.8.x) does not follow OCI indexes and, with -m, deletes
+    # their child manifests; schema2 avoids that. See registry-gc.sh.
+    if ! docker build --provenance=false --no-cache -t "${TAG}" "${WORKDIR}"; then
         _warn "build failed for ${TAG}; not pushing."
         return 1
     fi