From cd4f992a29da96b835c14545a0cb05e7e87ca291 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 10 Sep 2026 21:02:49 +0200 Subject: image-builder: add safe registry GC and stop OCI-index breakage The registry never reclaims blobs, so its store grows until the disk fills and the nightly builds fail with "no space left on device". Add registry-gc.sh, run weekly (Sunday 08:00), plus a daily dangling-image prune. registry-gc.sh refuses to run while a build is active, stops the registry for a stable blob graph, deletes only untagged manifests (-m) and their blobs, restarts via an EXIT trap, and verifies a tag still pulls. distribution 2.8.x GC does not follow OCI image indexes, so -m deletes their child manifests (distribution#3178). Default BuildKit provenance made every pushed tag an OCI index, which made -m destructive. Build scripts now pass --provenance=false (plain schema2), and registry-gc.sh refuses to run if any tag is still an index. --- image-builder/bootstrap.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'image-builder/bootstrap.sh') diff --git a/image-builder/bootstrap.sh b/image-builder/bootstrap.sh index 7316116..e632e7a 100755 --- a/image-builder/bootstrap.sh +++ b/image-builder/bootstrap.sh @@ -541,7 +541,11 @@ DOCKERFILE # (see Main), which suppresses `set -e` in this subshell, so a failed build # would otherwise push a nonexistent tag and log "Done". _log "Building and pushing ${TAG}..." - if ! docker build --no-cache -t "${TAG}" "${WORKDIR}"; then + # --provenance=false keeps the pushed manifest a plain Docker schema2 + # manifest rather than an OCI image index. The registry's garbage collector + # (distribution 2.8.x) does not follow OCI indexes and, with -m, deletes + # their child manifests; schema2 avoids that. See registry-gc.sh. + if ! docker build --provenance=false --no-cache -t "${TAG}" "${WORKDIR}"; then _warn "build failed for ${TAG}; not pushing." return 1 fi -- cgit v1.2.3