Right way to delete unused docker images on OpenShift Origin

Question

I try to delete unused docker images on OpenShift origin. What is the right way to do this?

I tried:

docker rmi `docker images -aq`

This deleted all the unused images but I got something like this:

<none>                                           <none>              28e03c727eab        10 days ago         583.5 MB
172.30.xx.xx:5000/dev-mule/mule             <none>              d059900ab541        4 weeks ago         985.9 MB
172.30.xx.xx:5000/test-dev-mule/test-mule   <none>              d059900ab541        4 weeks ago         985.9 MB
<none>                                           <none>              80ccbf3e9509        8 weeks ago         415.8 MB
<none>                                           <none>              d2d658a63eb2        8 weeks ago         1.59 MB
<none>                                           <none>              eda6efd4df85        10 weeks ago        430 MB
<none>                                           <none>              2f0fc5db512e        10 weeks ago        711.6 MB

I have 7 running containers so this seems fine. The used images are still here.

But when I perform oc get images I got a very big list of very much images in this style:

sha256:830ed5ad3c2deab31836b1d65877c048107d0f6788daa4a36d158386000050a2   172.30.xx.xx:5000/dev-proj/proj@sha256:830ed5ad3c2deab31836b1d65877c048107d0f6788daa4a36d158386000050a2

What is the right way to delete unused images in OpenShift Origin? I'm on version oc v1.1.6

Solution 1

You should use the oc adm prune images command to remove unused images. Note that this will be conservative and not delete images that have recently been changed.

See https://docs.openshift.org/latest/admin_guide/pruning_resources.html for more.

Solution 2

The half-manual way I am using is to list the images' properties and the process the list further, as follows:

oc get images -o jsonpath='{range .items[*]}{.dockerImageReference}{.dockerImageMetadata.Created} {.dockerImageMetadata.Size}{"\n"}{end}'

registry.access.redhat.com/jboss-datavirt-6/datavirt63-openshift@sha256:ed82847d159ff9f5e43520b3479a3b15919195c2dc86781cc85b84368d84a7742017-06-26T10:44:21Z 571015080
registry.access.redhat.com/jboss-eap-7/eap70-openshift@sha256:eddcc75d3e7fd5e25b9599a5cb72bd48b403c308e91c501f5dcc9c157ea86c4f2017-06-12T07:37:20Z 572990540
registry.access.redhat.com/jboss-webserver-3/webserver30-tomcat7-openshift@sha256:ee09a9ae44c338c39783d559367aef63ce548d8de973e09808c4c236c5dcb4852017-08-02T14:53:32Z 190637724
registry.access.redhat.com/jboss-webserver-3/webserver30-tomcat7-openshift@sha256:ee68b3072bfabacf1272b183c09a43b8116902ac722ff2fca3185235447a453f2017-05-10T10:48:06Z 256713194
...

Then, replace '@' to have separate columns for image 'pull name' and image id, and apply sorting by the first and the third column, so image name and date:

oc get images -o jsonpath='\
  {range .items[*]}{.dockerImageReference} \
  {.dockerImageMetadata.Created} \
  {.dockerImageMetadata.Size}{"\n"}{end}' \
  | sed 's/@/ /' \
  | sort -k1,1 -k3,3

From there, I can apply a precise filter like grep -E 'myimage.*2016-', etc. Finally, I use awk to process the output and get oc commands:

  ...all the above with filters... | awk '{print "oc delete image "$2}

results in:

  oc delete image sha256:2cd7c7e0443779e2a090f326d2f0daf0dbdac719e1e254e166fac5c0e107708e
  oc delete image sha256:1d7e028ff3a3439de4a18dad307d5099db64f4e5a12819e7cf2ff72ee21e39d5
  oc delete image sha256:9f31e9f2a18b0ea07f2c0e503e01a784e9365db485f163b6699799a4b53415cf
  oc delete image sha256:dd97c061f076e2c1c8d368896a806056c9bc7d96d1065aca097d86959ce5130c

You can obviously process the list of images in a language of your choice, parsing dates and removing older duplicates, etc.

Comments

[DenCowboy]

I tried it and I don't understand it at all. It showed a lot of layers. (I also tried the confirm). But When I perform oc get images or docker images I see a lot of very old images and <none> tags