docker: remove images no container or declaration uses, keeping the previous (hq ADR 0251 §5) #122

2026-10-08T09:56:50Z

mesh-admin commented

2026-10-08 09:56:50 +00:00

Adds docker_prune_images to the container runtime module (hq ADR 0251 §5, to-be 51, hq PR #200).

The weekly prune takes only dangling images. An image pulled by digest is not dangling, so every machine keeps every version of every module it ever ran. On 2026-10-08 the build node held 355 unused images, about 58 GB summed.

The tool keeps:

every image a container uses, in any state;
every image the machine's declaration names, now and as last sent, asked of the controller's new images verb. With no answer, nothing is removed;
every image younger than older_than_days (default 7);
the newest other image in each line, which is the previous version.

The rest are removed by name, never forced. It is a dry run by default, and a real run needs why.

Depends on mesh-controller's images verb (invokes: seat:mesh-controller.images). Merge after the controller that serves it is running.

Tests: go vet and go test -race pass in modules/docker. merge-check.sh passes locally (without MESH_GATE).

Adds `docker_prune_images` to the container runtime module (hq ADR 0251 §5, to-be 51, hq PR #200). The weekly prune takes only dangling images. An image pulled by digest is not dangling, so every machine keeps every version of every module it ever ran. On 2026-10-08 the build node held 355 unused images, about 58 GB summed. The tool keeps: - every image a container uses, in any state; - every image the machine's declaration names, now and as last sent, asked of the controller's new `images` verb. With no answer, nothing is removed; - every image younger than `older_than_days` (default 7); - the newest other image in each line, which is the previous version. The rest are removed by name, never forced. It is a dry run by default, and a real run needs `why`. **Depends on mesh-controller's `images` verb** (`invokes: seat:mesh-controller.images`). Merge after the controller that serves it is running. Tests: go vet and go test -race pass in modules/docker. merge-check.sh passes locally (without MESH_GATE).

mesh-admin added 1 commit 2026-10-08 09:56:50 +00:00

docker: remove images no container or declaration uses, keeping the previous of each line (hq ADR 0251)

mesh/merge-gate pass: builds docker → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without (4 of 4 compose)

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery superseded: a newer delivery to the same trunk took over its walk

Details

465707d41d

Images pulled by digest are not dangling, so the weekly prune never takes an old version
and every machine keeps every image it ever ran. docker_prune_images takes them, keeps what
the declaration names (asked of the controller; no answer, nothing removed) and the one before,
and is a dry run unless asked with a why.

mesh-admin commented

2026-10-08 09:57:08 +00:00

Delivery novox/mesh-catalog@465707d41da5 — superseded since 2026-10-08T11:07:02Z

Delivery plan — builds docker → ace, g14, novox, shanks; no bus step

tier 0: docker
ace: receives docker
g14: receives docker
novox: receives docker
shanks: receives docker

Machines

docker on ace: judging — 0 healthy judging(s) so far

Transitions

2026-10-08 09:57 (new) → proposed (announced): novox/mesh-catalog#122's head announced
2026-10-08 09:59 proposed → checked (checked): the verdict names this commit
2026-10-08 09:59 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-08 11:06 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-08 11:06 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
2026-10-08 11:07 delivering → superseded (superseded): a newer delivery to the same trunk took over its walk

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@465707d41da5` — **superseded** since 2026-10-08T11:07:02Z **Delivery plan** — builds docker → ace, g14, novox, shanks; no bus step - tier 0: docker - ace: receives docker - g14: receives docker - novox: receives docker - shanks: receives docker **Machines** - docker on ace: judging — 0 healthy judging(s) so far **Transitions** - 2026-10-08 09:57 (new) → proposed (announced): novox/mesh-catalog#122's head announced - 2026-10-08 09:59 proposed → checked (checked): the verdict names this commit - 2026-10-08 09:59 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-08 11:06 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-08 11:06 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-08 11:07 delivering → superseded (superseded): a newer delivery to the same trunk took over its walk The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented

2026-10-08 09:59:13 +00:00

Merge check at 465707d4

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: docker)
mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds docker → ace, g14, novox, shanks; no bus step

tier 0: docker
ace: receives docker
g14: receives docker
novox: receives docker
shanks: receives docker

Run by the build seat on shanks as build-1791453428274588187 (builds --log build-1791453428274588187).

--- the gate: docker
docker: ok, 21 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 3
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T09:54:03Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-08T09:54:03Z

modules the change moves:
  - docker (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): docker
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 28889 strings of 534 files
long-running resources without health: 70, as kept
testing modules/docker
ok  	docker/cmd/docker-tools	1.030s

**Merge check** at `465707d4` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: docker) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds docker → ace, g14, novox, shanks; no bus step - tier 0: docker - ace: receives docker - g14: receives docker - novox: receives docker - shanks: receives docker Run by the build seat on shanks as `build-1791453428274588187` (`builds --log build-1791453428274588187`). ``` --- the gate: docker docker: ok, 21 tool(s), invokes seat:mesh-controller.images; WARNING: socket, runtime, prune stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 3 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T09:54:03Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-08T09:54:03Z modules the change moves: - docker (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): docker --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 28889 strings of 534 files long-running resources without health: 70, as kept testing modules/docker ok docker/cmd/docker-tools 1.030s ```

mesh-admin merged commit 3f552274be into main

2026-10-08 11:05:51 +00:00

mesh-admin deleted branch feat/docker-prune-images

2026-10-08 11:05:52 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#122