Unable to delete container tags that have "Invalid tag: missing manifest digest"
Summary
Unable to delete container tags that have "missing manifest digest". The remove tag button is grey'ed out.
More problematic is when attempting to delete the entire image repository, the repository is scheduled for deletion then after some time, the invalid container tags remain.
These invalid tags cannot be deleted either one-by-one or by deleting the entire image repository. This has follow-on effects, like being unable to move the repository to another namespace. I would not like to delete and recreate the entire repository as a workaround.
Steps to reproduce
Create a Dockerfile. Build and push to Gitlab Registry using docker buildx
build-container:
stage: build
image: < use a base image with docker installed + buildx plugin installed >
services:
- docker:stable-dind
script:
- export IMAGE_BASE=$CI_REGISTRY_IMAGE
- export IMAGE_CACHE_TAG=$CI_COMMIT_REF_NAME
- echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
- docker buildx create --use
- docker buildx build
--tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
--tag $IMAGE_BASE:$IMAGE_CACHE_TAG
--cache-from=type=registry,ref=$IMAGE_BASE:$IMAGE_CACHE_TAG
--cache-to=type=registry,ref=$IMAGE_BASE:$IMAGE_CACHE_TAG
--push
.
- The image tags options are greyed out, there's no way to delete them.
- Then try to delete the entire image repository
- Expect that the entire image repository is deleted and no tags remain. Actually, tags remain.
Possible fixes
The root cause for the UI issue you're seeing is #232815 (closed).
Regardless of the "invalid" message on the UI, nothing should stop us from deleting this tag through the UI/API. A tag delete request against the registry will definitely succeed.
So I think we can do the following:
- If a tag is deemed as invalid (for whatever reason), we should not gray out the delete option for that tag in the UI;
- When deleting a tag (either through the UI or API), the backend (Rails) should not halt if unable to fetch/validate the underlying image manifest. It should handle such exceptions gracefully and call the container registry tag
delete
endpoint.
Proposal
This issue will focus on the backend work to ensure that when deleting a tag (either through the UI or API), the backend (Rails) should not halt if unable to fetch/validate the underlying image manifest. It should handle such exceptions gracefully and call the container registry tag delete
endpoint.
The follow-up issue, #342866 (closed) will be scheduled once this issue is complete.
Example Project
Project ID: 21998547
What is the current bug behavior?
- The image tags options are greyed out, there's no way to delete them.
- Then try to delete the entire image repository
- Tags marked "missing manifest digest" remain.
What is the expected correct behavior?
- Be able to delete invalid tags from the interface.
- Or be able to delete the entire image repository and no tags remain.
Relevant logs and/or screenshots
Output of checks
Results of GitLab environment info
Gitlab.com, GitLab Enterprise Edition 14.4.0-pre 4190ff47
Expand for output related to GitLab environment info
(For installations with omnibus-gitlab package run and paste the output of: `sudo gitlab-rake gitlab:env:info`) (For installations from source run and paste the output of: `sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)
Results of GitLab application Check
Expand for output related to the GitLab application check
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true
)(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true
)(we will only investigate if the tests are passing)