Cannot delete image from Artifactory

[nc-nvmt]

This issue have been already mentioned once here

I am able to inspect/copy the image on Artifactory but I got 406 Not acceptable why I tried to delete the image

The issue above state that is to enable delete config for Docker Registry. However I could not found any document relate to modify config.yml of Artifactory Docker Registry

I obtain the folllowing error

DEBU[0000] Using registries.d directory /etc/containers/registries.d for sigstore configuration
DEBU[0000]  Using "default-docker" configuration
DEBU[0000]   Using file:///var/lib/atomic/sigstore
DEBU[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/<REGISTRY>
DEBU[0000] GET https://<REGISTRY>/v2/
DEBU[0000] Ping https://<REGISTRY>/v2/ err <nil>
DEBU[0000] Ping https://<REGISTRY>/v2/ status 401
DEBU[0001] GET https://<REGISTRY>/v2/<IMAGE>/manifests/<VERSION>
DEBU[0002] DELETE https://<REGISTRY>/v2/<IMAGE>/manifests/sha256:<SHA>
FATA[0003] Failed to delete /v2/<IMAGE>/manifests/sha256:<SHA>: {
  "errors" : [ {
    "status" : 406,
    "message" : "Not Acceptable"
  } ]
} (406 Not Acceptable)

It would be nice to support Artifactory too. We distribute our images to both Artifactory and Openshift Regsitry so right now we need 2 different tool (jfrog cli and skopeo) to cleanup images

[mtrmac]

It would be great to add documentation to skopeo delete showing how to configure Artifactory to allow this; I’m afraid I have no idea what the documentation should say (if it is possible at all).

https://github.com/jfrog/jfrog-cli/blob/master/artifactory/commands/generic/delete.go looks quite different from the docker/distribution API, so that is probably no help for figuring out if the client is doing something wrong.

[nc-nvmt]

@mtrmac yes. the jfrog cli is using the different API from Docker. It is using the same API for deleting artifacts and it is not compatiable with standard Docker API. I hope that someone could find a solution or an implementation for it.

[rhatdan]

Can someone reach out to Jfrog to see if they would be interested in adding support for skopeo or at least explaining what should be done.

[dohnto]

We are also affected by this.

[gauravpriyolkar]

+1

Here's what the Artifactory documentation has to say on deletion - https://www.jfrog.com/confluence/display/RTF/Docker+Registry#DockerRegistry-DeletionandCleanup

The <Docker v2 repository name> should be available in the responses from Artifactory API (perhaps redacted in @nc-nvmt debug output) as follows -

DEBU[0000] GET https://<REGISTRY>/artifactory/api/docker/<Docker v2 repository name>/v2/token?account=...scope=...&service=...

For Artifactory, skopeo would then have to delete as follows -

DELETE https://<REGISTRY>/artifactory/<Docker v2 repository name>/<IMAGE>

[rhatdan]

@mtrmac @vrothberg WDYT? Artifactory has a large enough installed base, that this might make sense to special case it?

[vrothberg]

Assuming we can cleanly distinguish artifactory from docker/distribution, sure. It would be great to cover that!

[rhatdan]

If initial attempt at removing fails can we just try this method? If second try fails return first error.

[btashton]

@vrothberg There is a header returned on all api calls that identifies the artifactory server id X-Artifactory-Id. This could even be determined while making calls to things like the docker token endpoint which would then skip the first failure case.

[vrothberg]

@btashton, brilliant, thanks! We are quite busty over here, so I cannot give any ETA but we're always welcoming contributions. If someone is willing to contribute, we'd be happy to guide them through the code.

[mtrmac]

If initial attempt at removing fails can we just try this method? If second try fails return first error.

(Let’s use the positive X-Artifactory-Id identification, instead of sending DELETE requests to URL namespaces undefined by docker/distribution, which have unknown effects in principle.)

[Pvlerick]

Hello, I'm taking a look at this; I'll keep you posted :-)

[Pvlerick]

Well, this is now supported by Artifactory (at least in 7.46.11 where I just tested it).

I'm not sure if it's worth it to make a fix for older version, it's hard to find out when exactly this was fixed, if documented at all...

[mtrmac]

Thanks for checking.

Considering how long this has been open on our side, and that testing the newly-developed code would require deploying some older (increasingly obsolete) version, I’m inclined to close this issue and just recommend upgrading.

[rhatdan]

SGTM