Remove throttle on Container Registry bulk delete API

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Problem to solve

The GitLab Container Registry allows users to build, publish and share Docker images using the Docker client or their pipelines. In order to delete images, there are two required steps. First, users must untag images using either the Container Registry UI or the Container Registry API. Once the images are untagged, they can then be removed from storage by running garbage collection.

The bulk delete API is an asynchronous process that may take time to run, depending on how many tags exist in a given repository. The API is limited to run only once per hour for a given container repository. This throttle is problematic for users that have built the API into their GitLab pipelines, which may run many times per hour. This prevents our customers from expiring unneeded images, resulting in increased storage costs and slower performance for the Container Registry UI.

Intended users

• Delaney (Development Team Lead)
• Sidney (Systems Administrator)

Further details

• This problem has become more prevalent since we recently expanded permissions for CI_REGISTRY_USER to untag their own images.
• We will not be able to remove the throttle, until after we improve the performance of the API.

Use cases

• Administrator's incorporate the bulk delete API into their team's gitlab-ci.yml files to automatically untag images as part of their pipeline.

Proposal

Once we have optimized the performance of the project-level bulk delete API, we will remove the throttle and allow the process to be run without limits.

Permissions and Security

• There are no permissions changes required for this, however we will still only allow project Owners to run it.

Documentation

• Container Registry API

Testing

• Confirm that only project owners can run this (including from Gitlab CI/CD)

What does success look like, and how can we measure that?

• Success looks like we are providing tools to administrators to clean out old images from their GitLab Container Registry. We should see increased adoption of the API and lower total storage costs for our self-managed customers.

What is the type of buyer?

• This is a core feature, but it is currently more relevant for self-managed instances.

Links / references