Multi Arch Build Tagging Propagation

[corinz]

Can manifest list tags be propagated to children manifests in multi-arch builds?

For example: I do a multi-arch build and tag with dev that produces arm64 and amd64 images. When I go to clean up my registry, I skip over dev tags, and clean up untagged images over n days old. At n days old, the dev tag is skipped, and the child containers are deleted, rendering a "manifest unknown" error.

I have seen some write ups on using registry clients to manually copy arch images that involve tagging the image with the arch manually. Doesn't this defeat the purpose of a manifest list? What about a feature that propagated the tags to the referenced manifests?

If something doesn't exist to distinguish multi-arch manifests from untagged manifests, they will be treated as eligible for cleanup. What other solutions do we have to handle this?

[tonistiigi]

When your single-arch manifest is referenced by manifest-list that should keep it from getting deleted. This depends on if the registry is implemented correctly to be manifest-list aware and how you trigger the deletions.

The image should not be considered "untagged image" if there is a pointer from a tagged image to it.

[corinz]

Thanks for the reply @tonistiigi. I'm seeing this in GHCR, which uses https://github.com/distribution/distribution -- but the Github Packages API uses its own delete function to delete containers. I dont think the packages delete api has a concept of dependencies or a graph.