image-builder: add safe registry GC and stop OCI-index breakageHEADmaster

The registry never reclaims blobs, so its store grows until the disk fills and the nightly builds fail with "no space left on device". Add registry-gc.sh, run weekly (Sunday 08:00), plus a daily dangling-image prune.

registry-gc.sh refuses to run while a build is active, stops the registry for a stable blob graph, deletes only untagged manifests (-m) and their blobs, restarts via an EXIT trap, and verifies a tag still pulls.

distribution 2.8.x GC does not follow OCI image indexes, so -m deletes their child manifests (distribution#3178). Default BuildKit provenance made every pushed tag an OCI index, which made -m destructive. Build scripts now pass --provenance=false (plain schema2), and registry-gc.sh refuses to run if any tag is still an index.

1 files changed, 5 insertions, 1 deletions

diff --git a/image-builder/build-full-image.sh b/image-builder/build-full-image.sh
index 3706186..6f88db7 100755
--- a/image-builder/build-full-image.sh
+++ b/image-builder/build-full-image.sh
@@ -200,7 +200,11 @@ LABEL ${DIGEST_LABEL}="${BASE_DIGEST}"
 CMD ["/bin/bash"]
 DOCKERFILE
 
-    local BUILD_FLAGS=()
+    # --provenance=false keeps the pushed manifest a plain Docker schema2
+    # manifest rather than an OCI image index. The registry's garbage collector
+    # (distribution 2.8.x) does not follow OCI indexes and, with -m, deletes
+    # their child manifests; schema2 avoids that. See registry-gc.sh.
+    local BUILD_FLAGS=(--provenance=false)
     [[ "${FORCE}" == "true" ]] && BUILD_FLAGS+=(--no-cache)
 
     # Explicit exit checks: build_variant runs in an `if ! (...)` condition