Docker镜像仓库的垃圾回收机制深度清理后端存储空间的实现

流程示意：
开始 GC → 扫描所有 Manifest → 标记引用的 Blobs → 遍历所有 Blobs
                                      ↓
                              是否被标记？
                         是 → 保留      否 → 删除

storage:
  delete:
    enabled: true

# 进入 Registry 容器执行
docker exec registry bin/registry garbage-collect /etc/docker/registry/config.yml
# 同时清理未被任何标签引用的 manifest（推荐）
docker exec registry bin/registry garbage-collect --delete-untagged /etc/docker/registry/config.yml
# 仅模拟运行，不实际删除（用于验证）
docker exec registry bin/registry garbage-collect --dry-run /etc/docker/registry/config.yml

#!/bin/bash
# 将 Registry 切换为只读模式
docker exec registry sh -c 'sed -i "s/readonly: false/readonly: true/" /etc/docker/registry/config.yml && kill -HUP 1'
sleep 5
# 执行 GC
docker exec registry bin/registry garbage-collect /etc/docker/registry/config.yml --delete-untagged
# 恢复写入
docker exec registry sh -c 'sed -i "s/readonly: true/readonly: false/" /etc/docker/registry/config.yml && kill -HUP 1'

# 1. 先删除 repositories 中的元数据目录
cd /var/lib/registry/docker/registry/v2/repositories && rm -rf <namespace>
# 2. 再执行 GC
docker exec registry bin/registry garbage-collect /etc/docker/registry/config.yml

# 删除 14 天未更新的 tag 目录
find /var/lib/registry/docker/registry/v2/repositories/*/_manifests/tags/* \
  -type d -mtime +14 -maxdepth 1 -exec rm -rf {} \;
# 删除 14 天前的未引用 manifest revision
find /var/lib/registry/docker/registry/v2/repositories/*/_manifests/revisions/sha256/* \
  -type d -mtime +14 -maxdepth 1 -exec rm -rf {} \;
# 最后执行 GC
docker exec registry bin/registry garbage-collect -m /etc/docker/registry/config.yml

# 删除 blobs/sha256 下的空目录
for dir in $(find /var/lib/registry/docker/registry/v2/blobs/sha256/ -type d -empty); do
    rm -rf "$dir"
done

#!/bin/bash
# /opt/registry/registry-cleanup.sh
REGISTRY_CONTAINER="registry"
REGISTRY_HOME="/var/lib/registry/docker/registry/v2"
LOG="/var/log/registry-cleanup.log"
echo "[$(date)] Starting cleanup..." >> $LOG
# 1. 清理过期 tags（>30 天）
find ${REGISTRY_HOME}/repositories/*/_manifests/tags/* \
  -type d -mtime +30 -maxdepth 1 -exec rm -rf {} \; 2>/dev/null
# 2. 清理过期 revisions
find ${REGISTRY_HOME}/repositories/*/_manifests/revisions/sha256/* \
  -type d -mtime +30 -maxdepth 1 -exec rm -rf {} \; 2>/dev/null
# 3. 切换只读模式
docker exec $REGISTRY_CONTAINER sh -c \
  'sed -i "s/readonly: false/readonly: true/" /etc/docker/registry/config.yml && kill -HUP 1'
sleep 5
# 4. 执行 GC
docker exec $REGISTRY_CONTAINER bin/registry garbage-collect \
  --delete-untagged /etc/docker/registry/config.yml >> $LOG 2>&1
# 5. 恢复写入
docker exec $REGISTRY_CONTAINER sh -c \
  'sed -i "s/readonly: true/readonly: false/" /etc/docker/registry/config.yml && kill -HUP 1'
# 6. 清理空目录
find ${REGISTRY_HOME}/blobs/sha256/ -type d -empty -delete 2>/dev/null
echo "[$(date)] Cleanup completed." >> $LOG

30 2 1,15 * * /opt/registry/registry-cleanup.sh