RFE: Support for removing tags

[bowlofeggs]

Greetings!

I'm working on adding support for Bodhi to manage container buildroot overrides. In doing so, I'm having Bodhi add a "build" tag to Fedora's container registry when the buildroot override is in place. However, buildroot overrides expire, and when this happens I need a way to remove that "build" tag from the registry.

I thought that maybe the skopeo delete would do what I want, but it turns out that it removes the image, not the tag (so it deletes all the other tags too).

Could we add a skopeo untag command, or possibly just a --untag-only flag to the existing delete command, or something along those lines?

[mtrmac]

I’m afraid the registry API (both as specified, and as actually implemented in docker/distribution) does not provide an operation removing a tag; only the whole-image deletion is possible.

Once a tag exists, you can only redirect the tag to a different (possibly already existing) image by pushing a new image to that tag. (So, it would probably be possible to generate a fresh empty image with a guaranteed-unique manifest digest, redirect the build tag to that empty image, and then delete it. Seems pretty horrible though.)

[bowlofeggs]

@mtrmac I actually just loaded up this ticket to make a similar comment. I had thought the registry API had this, and I went to write a Bodhi workaround to use what I thought existed, and found that it does not exist.

Your workaround idea might be viable though, thanks for the tip. I guess we can close this.

[mtrmac]

FWIW it might be easier to redirect the build tag to the ordinary non-override image after the override expires—at the cost of having to manage the build tag on every single build image update.

[bowlofeggs]

Haha, I tried your suggestion of pushing an empty image to the tag, and then deleting it, and it did end in removing the tag without deleting the original image. Thanks!

Only problem is that there isn't a great way for Bodhi to have an empty image to use to push to a registry to perform that workaround. I much prefer not to keep an empty image as files in Bodhi's git, because I don't want "magic files" in my repo that I generated with a tool. I'd rather have the building of Bodhi also build it an empty image, but the problem there is that building an empty image requires docker or skopeo, and both of those require root, which I don't have when building Bodhi in Koji. Sigh.

[mtrmac]

I guess that depend on what your definition of “generated” is… I imagine generating an empty tar.gz as such is easy enough, and the minimal config.json and manifest.json files could be considered manually written — especially when the manifest.json should contain either a counter or a random value, to ensure the manifest digest of the temporary image is unique. So, the git repository would contain a manually-prepared template of the manifest.json file.

[rhatdan]

Also skopeo does not require root.

[bowlofeggs]

@rhatdan Ah yes, I had meant to say it requires docker or buildah, and just mistyped skopeo.