We still serve some obsoleted, unmaintained docker images in our registry. This is wrong and potentially exposes users of those to unpatched vulnerabilities.
We should sunset and remove all such images.
To this end we need a simple cli tool to remove images (and specific tags) from the registry. -> https://wikitech.wikimedia.org/wiki/Docker-registry
We will then need to list and confirm removal of such images in this task.
Change 563482 had a related patch set uploaded (by Giuseppe Lavagetto; owner: Giuseppe Lavagetto):
[operations/docker-images/docker-report@master] Add a registryctl command-line utility
Change 563482 merged by jenkins-bot:
[operations/docker-images/docker-report@master] Add a registryctl command-line utility
Mentioned in SAL (#wikimedia-operations) [2020-01-14T17:21:36Z] <_joe_> upload docker-report 0.0.2 to {buster,stretch}-wikimedia T242604
Unfortunately removing all tags of an image (e.g. repository) does not remove the repository itself from the registry[1][2]. What that means is that the "image" will still be listed in the catalog (GET /v2/_catalog).
In addition the swift storage backend does not handle this situation very well, leading the registry to respond with a 404 to requests for the tag list of a "deleted image":
HTTP/1.1 404 Not Found
Content-Type: application/json; charset=utf-8
Docker-Distribution-Api-Version: registry/2.0
X-Content-Type-Options: nosniff
Date: Wed, 01 Jul 2020 13:33:48 GMT
Content-Length: 113
{"errors":[{"code":"NAME_UNKNOWN","message":"repository name not known to registry","detail":{"name":"baaar"}}]}The local file storage returns empty tags in that case:
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Docker-Distribution-Api-Version: registry/2.0
X-Content-Type-Options: nosniff
Date: Wed, 01 Jul 2020 13:24:06 GMT
Content-Length: 29
{"name":"baaar","tags":null}[1]https://github.com/docker/distribution/issues/2434
[2]https://github.com/docker/distribution/issues/2747
Change 608889 had a related patch set uploaded (by Giuseppe Lavagetto; owner: Giuseppe Lavagetto):
[operations/docker-images/docker-report@master] Handle cases of repositories with no tags
https://gerrit.wikimedia.org/r/c/operations/docker-images/docker-report/ /608889
Change 608889 merged by jenkins-bot:
[operations/docker-images/docker-report@master] Handle cases of repositories with no tags
https://gerrit.wikimedia.org/r/c/operations/docker-images/docker-report/ /608889
Mentioned in SAL (#wikimedia-operations) [2020-07-02T05:46:33Z] <_joe_> upload docker-report 0.0.4 on buster-wikimedia T242604
Docker-report can now support such cases, and I removed the tags for that repository.
Following this discussion on wikitech-l, marking for future deletion:
https://docker-registry.wikimedia.org/python3/tags/ superseded by python3-(buster|bullseye|bookworm)