ECS_ENABLE_UNTRACKED_IMAGE_CLEANUP does not respect the ECS_IMAGE_MINIMUM_CLEANUP_AGE setting

[AaronKalair]

Summary

When the ECS Agent runs it will delete images that the ECS Agent did not create that are younger than the ECS_IMAGE_MINIMUM_CLEANUP_AGE setting.

Description

If you set

• ECS_ENABLED_UNTRACKED_IMAGE_CLEANUP to true
• ECS_IMAGE_MINIMUM_CLEANUP_AGE to anything lets say 8h for example

When the ECS Agent runs it will delete images that the ECS Agent did not create that are younger than the ECS_IMAGE_MINIMUM_CLEANUP_AGE setting.

Looking through the code, it appears that the check for image age:

amazon-ecs-agent/agent/engine/docker_image_manager.go

Line 241 in 7e013ce

func (imageManager *dockerImageManager) isImageOldEnough(imageState *image.ImageState) bool {

Is only called for checking images that the ECS agent tracks are older than the specified threshold.

Is this intentional? Is is possible to specify the MINIMUM_CLEANUP_AGE for UNTRACKED_IMAGES ?

We're using ECS to run Jenkins agents and in our Jenkins job are building Docker images, which are then referenced in a later step, however if the ECS Agent runs between us creating the image and then using it, the image will no longer exist as it has been cleaned up.

Expected Behavior

• ECS Agent respects the ECS_IMAGE_MINIMUM_CLEANUP_AGE setting for Non ECS Tracked Images.

Observed Behavior

• ECS Agent does not respect the ECS_IMAGE_MINIMUM_CLEANUP_AGE setting for Non ECS Tracked Images

Environment Details

• ECS Agent 1.28.0 on AWS Linux 2

[petderek]

Hey,

Thanks for reaching out to us. The ECS agent will track when an image was last used, and it uses that information to determine when a managed image is ready to be cleaned up.

The challenge here is that Docker does not track the last time an image was used. We'd definitely like to improve this feature for your use case, though.

[AaronKalair]

Thanks for replying, I see why it doesn't work for us at the moment.

For our use case, clearing up the image based on how long ago it was created would be fine, I believe Docker does expose that information?

[cyastella]

Closing issue since a new set of amis have been released and can be tracked here.
The agent v1.33 here now support this enhancement.