From cd4f992a29da96b835c14545a0cb05e7e87ca291 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 10 Sep 2026 21:02:49 +0200 Subject: image-builder: add safe registry GC and stop OCI-index breakage The registry never reclaims blobs, so its store grows until the disk fills and the nightly builds fail with "no space left on device". Add registry-gc.sh, run weekly (Sunday 08:00), plus a daily dangling-image prune. registry-gc.sh refuses to run while a build is active, stops the registry for a stable blob graph, deletes only untagged manifests (-m) and their blobs, restarts via an EXIT trap, and verifies a tag still pulls. distribution 2.8.x GC does not follow OCI image indexes, so -m deletes their child manifests (distribution#3178). Default BuildKit provenance made every pushed tag an OCI index, which made -m destructive. Build scripts now pass --provenance=false (plain schema2), and registry-gc.sh refuses to run if any tag is still an index. --- CLAUDE.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'CLAUDE.md') diff --git a/CLAUDE.md b/CLAUDE.md index 8f079bf..14eed5d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -28,8 +28,8 @@ test-logic.sh pure-logic self-check for test-build (no docker) test-build-config.example copy to ~/.config/sbo-testbuild/config and edit overrides.example current-vs-stable dep overrides (optional) image-builder/ bootstrap.sh, build-full-image.sh, - build-sbo-testbuild.sh, lib.sh, config, - test-image-builder.sh, README + build-sbo-testbuild.sh, registry-gc.sh, lib.sh, + config, test-image-builder.sh, README docs/specs, docs/plans design specs and implementation plans ``` @@ -159,7 +159,7 @@ verified by running `test-build` against a real image. ## Releases SemVer, starting at `1.0.0`. The version is a baked `PROJECT_VERSION="X.Y.Z"` -const in every script (`test-build`, `install.sh`, and the three +const in every script (`test-build`, `install.sh`, and the four `image-builder/*.sh`); there is no VERSION file. `test-build` and `install.sh` expose `-V`/`--version`; the image-builder scripts already use `--version` for the Slackware target, so their project-version flag is `-V` only. -- cgit v1.2.3