Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

cr.meshweaver.cloud: a governed prune — delete unprotected manifests (live deployments, overlay floors, newest sealed set), then garbage-collect

Aperta
  • Qualcosa non va?
#7,530 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
20/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
azure, csharp, docker, github
Ambito
devops, infrastructure, security

Direzione di ricerca

Start with Doc/Architecture/FleetRegistryRetention for the R0–R6 safety rules, .github/acr-retention/instances.json for the registry declaration, and lock-pinned-digests.py --check-registry-retention for the existing policy check. Map how live deployment images, committed overlay floors, and the newest sealed set are resolved, then define a dry run that fails closed and accounts for garbage collection. Done means the approved job, policy check, dry-run output, and post-run storage measurement meet the acceptance criteria.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area:hosting enhancement feature:registry-retention sev:M

Split out of #6499. The owner decided to tier now and prune later. This issue is the "prune later" half: the real storage bound for the fleet registry cr.meshweaver.cloud.

What is true now (measured read-only 2026-10-29, Azure Monitor metrics on the registry's storage account)

  • Size: 1.22 TB in about 436k blobs, up from 0.42 TB on 2026-09-29. It grows by about 28 GB a day.
  • Ingress: 1.06 TB in the last 30 days, about 35 GB a day.
  • Deletion: nothing deletes a manifest, a tag or a referenced blob (#6499, §1). distribution's uploadpurging removes abandoned upload sessions only.
  • Tiering: a Hot → Cool lifecycle rule is being added. It keys on last access (30 days unread, back to Hot on a read) and deletes nothing. It lowers the price per GB but does not bound the size. A storage lifecycle delete can never be the bound. Layers are content-addressed and shared, so neither age nor last access can tell a referenced blob from an unreferenced one (#6499 and the config repository's registry inventory).

The job this issue asks for

A governed retention job for cr.meshweaver.cloud. It is an operator action that is filed, approved and logged, not a timer that nobody sees. It does two things:

  1. Deletes manifests that nothing protects. The protected set is derived. It is never an age window. It is the union of:

    • every image a live deployment runs (each instance's running image, read from the instance, not from its record);
    • every image a committed overlay floor names;
    • every image in the newest sealed set (and its build-host / CI runner companions).

    Age may only narrow the complement (for example, "and older than 30 days"). Age never defines it. This is the R0–R6 rule on Doc/Architecture/FleetRegistryRetention. 🚨 distribution has no lock, so the derivation is the whole safety margin. An incomplete derivation must delete nothing, not less.

  2. Runs registry garbage-collect after the manifest deletes, so blobs that nothing references any more are freed. GC needs the registry to be read-only, or no pushes in flight, while it marks. Pick and document the mechanism: a maintenance window with the registry in read-only mode, or a GC that runs safely beside pushes.

Only the publisher account may DELETE (docker_auth ACL). The job runs as that account and as nothing broader.

Acceptance

  • A dry run whose output is the deliverable: the protected set, the delete set, and the bytes GC would free. Every deletion names why it is unprotected.
  • The protected-set derivation fails closed. If a live instance cannot be read, or a floor or seal cannot be resolved, the run deletes nothing and says which input was missing.
  • The registry declaration in .github/acr-retention/instances.json moves from nothing-deletes to a policy that names this job. lock-pinned-digests.py --check-registry-retention then accepts that job as the one deleter.
  • A cost check after the first real run: storage size before and after, measured.

Not this issue

  • The Hot → Cool tiering itself. It is declared in the config repository's estate infrastructure and is in flight.
  • The ACR (meshweaver.azurecr.io) retention. That is #3438.

Refs #6499

Lingua principale
C#
Stelle
12
Fork
5
Merge medio
6h 30m
PR unite (30g)
960

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Systemorph/MeshWeaver

Tutte le issue di Systemorph/MeshWeaver

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.