tumblr / docker-registry-pruner

Tool to apply retention logic to docker images in a Docker Registry

docker-registry-pruner 🐳✂️

docker-registry-pruner is a rules-based tool that applies business logic to docker images in a Docker Registry storage system for retention.

Documentation

Quickstart

See configuration overview for how to write a config file. Then, map it into your container and run the report!

$ docker run -ti -v $(pwd)/config:/app/config --rm tumblr/docker-registry-pruner --mode report --config ./config/myconfig.yaml

Once you are happy with the report, you can perform pruning! WARNING: this is destructive!

$ docker run -ti -v $(pwd)/config:/app/config --rm tumblr/docker-registry-pruner --mode prune --config ./config/myconfig.yaml

Configuration

See the configuration overview for how to write config files to apply retention rules to images in your Registry.

Examples

Check out docs/examples.md for examples using the CLI tool.

Hacking

See docs/hacking.md for how to hack and contribute.

License

Apache 2.0

Copyright 2019, Tumblr, Inc.

docker-registry-pruner's Issues

Default (fallback) rule or match repo names with glob / regexp

Thanks for the great tool, it looks really promisingly!

We have a lot of different repos in our registry and it's not possible to add a rule for each of them.

It would be really helpful to be able to specify default rule or match repo names with glob/regexp

Interoperability with sonatype nexus

I'm trying to run it against sonatype nexus docker repo, but unfortunately, it doesn't work

It prints warnings for every image
{"level":"warn","ts":1565175668.1175723,"caller":"client/client.go:86","msg":"error fetching manifest","repo":"somerepoy/some-image","tag":"2.8.2-50-ed92e4a4","error":"unexpected manifest schema was received from registry: application/vnd.docker.distribution.manifest.v1+json"}

Not working with latest Gitlab registry (13.9.1)

Not remove images with error:
{"level":"warn","ts":1614668206.9399998,"caller":"client/client.go:86","msg":"error fetching manifest","repo":"devops/maintenance","tag":"master-13676","error":"unexpected manifest schema was received from registry: application/vnd.docker.distribution.manifest.v2+json (registry may not support the manifest type(s) you want: [application/vnd.docker.distribution.manifest.v1+prettyjws application/vnd.docker.distribution.manifest.v1+json])"}

No flag to bypass certificate verfication

My private registry is not using a signed certificate. So, when I set up a rule and try to purge old tags, I get the following error:

{"level":"fatal","ts":1581695501.6666298,"caller":"cmd/main.go:49","msg":"Get https://private-registry.testing.com/v2/: x509: certificate signed by unknown authority","stacktrace":"main.main\n\t/app/cmd/main.go:49\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:200"}

Is there an option I can use to bypass certificate verification?