From cd4f992a29da96b835c14545a0cb05e7e87ca291 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 10 Sep 2026 21:02:49 +0200 Subject: image-builder: add safe registry GC and stop OCI-index breakage The registry never reclaims blobs, so its store grows until the disk fills and the nightly builds fail with "no space left on device". Add registry-gc.sh, run weekly (Sunday 08:00), plus a daily dangling-image prune. registry-gc.sh refuses to run while a build is active, stops the registry for a stable blob graph, deletes only untagged manifests (-m) and their blobs, restarts via an EXIT trap, and verifies a tag still pulls. distribution 2.8.x GC does not follow OCI image indexes, so -m deletes their child manifests (distribution#3178). Default BuildKit provenance made every pushed tag an OCI index, which made -m destructive. Build scripts now pass --provenance=false (plain schema2), and registry-gc.sh refuses to run if any tag is still an index. --- image-builder/test-image-builder.sh | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'image-builder/test-image-builder.sh') diff --git a/image-builder/test-image-builder.sh b/image-builder/test-image-builder.sh index 5781b22..19f3ff8 100755 --- a/image-builder/test-image-builder.sh +++ b/image-builder/test-image-builder.sh @@ -83,6 +83,12 @@ DOCKER_RC=0 ( require_docker ) 2>/dev/null; check_rc "require_docker daemon up" 0 $? unset -f docker +# --- registry-gc.sh: -V / --help parse without touching docker; syntax valid --- +gc_ver="$(sed -n 's/^PROJECT_VERSION="\([^"]*\)".*/\1/p' registry-gc.sh)" +check "registry-gc.sh -V" "registry-gc.sh $gc_ver" "$(bash ./registry-gc.sh -V)" +bash -n registry-gc.sh; check_rc "registry-gc.sh syntax" 0 $? +bash ./registry-gc.sh --help >/dev/null 2>&1; check_rc "registry-gc.sh --help" 0 $? + echo "----" echo "PASS: $pass FAIL: $fail" [[ "$fail" -eq 0 ]] -- cgit v1.2.3