oblachno-oss/grm
3
0
Fork 0
Code Issues 33 Pull Requests Actions Packages Projects Releases 23 Wiki Activity

fix: honor real docker filter/formatter support in cleanup script
CI / validate (pull_request) Failing after 1m34s
Details
CI / molecule-tests (1) (pull_request) Skipped
Details
CI / molecule-tests (2) (pull_request) Skipped
Details
CI / molecule-tests (3) (pull_request) Skipped
Details
CI / molecule-tests (4) (pull_request) Skipped
Details
CI / auto-merge (pull_request) Skipped
Details

Browse Source 
`docker images` has no label formatter — check leases via image inspect
per candidate. `label!=` is invalid on volume/network ls but valid on
prune; `until=` is unsupported for volumes — drop it. Expired-lease
volumes/networks are reclaimed by an explicit inspect pass; anonymous
volumes only at routine/pressure, all unused volumes at critical.
This commit is contained in:
Emil Simeonov
2026-09-22 18:48:37 +02:00
parent c3283eedc7
commit 8456a3497c
1 changed files with 35 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/gitea_runner/templates/runner-cleanup.sh.j2
+35 -11
View File
@@ -47,30 +47,54 @@ remove_stopped_containers() {
# Remove unused images older than $1 ("all" = no age limit). The keep-list
# (warm base layers) and leased images are never removed; images referenced
# by any container are refused by the daemon anyway.
# by any container are refused by the daemon anyway. `docker images` has no
# label formatter, so the lease is checked via inspect per candidate.
remove_old_images() {
local until="$1"
docker image prune -f --filter "label!=${LEASE_UNTIL_LABEL}" >/dev/null 2>&1 || true
docker image prune -f >/dev/null 2>&1 || true
local filters=(--filter "dangling=false")
[[ "$until" != "all" ]] && filters+=(--filter "until=${until}")
{ timeout 30 docker images "${filters[@]}" \
--format '{% raw %}{{.ID}}|{{.Repository}}:{{.Tag}}|{{.Label "org.oblachno.lease-until"}}{% endraw %}' \
--format '{% raw %}{{.ID}}|{{.Repository}}:{{.Tag}}{% endraw %}' \
2>/dev/null || true; } \
| while IFS='|' read -r iid ref lease_until; do
| while IFS='|' read -r iid ref; do
[[ -z "$iid" || "$ref" == *"<none>"* ]] && continue
[[ -n "$KEEP_IMAGES_RE" && "$ref" =~ $KEEP_IMAGES_RE ]] && continue
local lease_until
lease_until=$(docker image inspect "$iid" \
--format '{% raw %}{{index .Config.Labels "org.oblachno.lease-until"}}{% endraw %}' \
2>/dev/null || true)
lease_active "$lease_until" && continue
docker image rm "$iid" >/dev/null 2>&1 || true
done
}
# Reclaim volumes/networks whose lease expired. The prune filters below
# skip every leased object (label!=); this pass removes the expired ones.
reclaim_expired_leases() {
timeout 20 docker volume ls -q --filter "label=${LEASE_UNTIL_LABEL}" 2>/dev/null \
| while read -r vol; do
lease_until=$(docker volume inspect "$vol" \
--format '{% raw %}{{index .Labels "org.oblachno.lease-until"}}{% endraw %}' \
2>/dev/null || true)
lease_active "$lease_until" || docker volume rm "$vol" >/dev/null 2>&1 || true
done
timeout 20 docker network ls -q --filter "label=${LEASE_UNTIL_LABEL}" 2>/dev/null \
| while read -r net; do
lease_until=$(docker network inspect "$net" \
--format '{% raw %}{{index .Labels "org.oblachno.lease-until"}}{% endraw %}' \
2>/dev/null || true)
lease_active "$lease_until" || docker network rm "$net" >/dev/null 2>&1 || true
done
}
case "$TIER" in
routine)
remove_stopped_containers aged
remove_old_images "{{ gitea_runner_prune_until }}"
docker volume prune -f \
--filter "label!=${LEASE_UNTIL_LABEL}" \
--filter "until={{ gitea_runner_prune_until }}" >/dev/null 2>&1 || true
# Anonymous volumes only at routine tier; named volumes may belong
# to a job between create/attach steps.
docker volume prune -f --filter "label!=${LEASE_UNTIL_LABEL}" >/dev/null 2>&1 || true
docker network prune -f \
--filter "label!=${LEASE_UNTIL_LABEL}" \
--filter "until={{ gitea_runner_prune_until }}" >/dev/null 2>&1 || true
@@ -79,9 +103,7 @@ case "$TIER" in
pressure)
remove_stopped_containers aged
remove_old_images "1h"
docker volume prune -f \
--filter "label!=${LEASE_UNTIL_LABEL}" \
--filter "until=1h" >/dev/null 2>&1 || true
docker volume prune -f --filter "label!=${LEASE_UNTIL_LABEL}" >/dev/null 2>&1 || true
docker network prune -f \
--filter "label!=${LEASE_UNTIL_LABEL}" \
--filter "until=1h" >/dev/null 2>&1 || true
@@ -91,7 +113,7 @@ case "$TIER" in
# Implements: REQ-3 — age limits dropped, ownership still honored.
remove_stopped_containers all
remove_old_images all
docker volume prune -f --filter "label!=${LEASE_UNTIL_LABEL}" >/dev/null 2>&1 || true
docker volume prune -af --filter "label!=${LEASE_UNTIL_LABEL}" >/dev/null 2>&1 || true
docker network prune -f --filter "label!=${LEASE_UNTIL_LABEL}" >/dev/null 2>&1 || true
docker builder prune -af >/dev/null 2>&1 || true
;;
@@ -100,3 +122,5 @@ case "$TIER" in
exit 2
;;
esac
reclaim_expired_leases