RFD: allow parent images to be removed (with --force)

[thaJeztah]

For historical reasons, the local image store still has code in place to disallow removing "parent" images.

For example;

$ DOCKER_BUILDKIT=0 docker build -t parent -<<EOF
FROM scratch
LABEL foo=bar
EOF

$ DOCKER_BUILDKIT=0 docker build -t child -<<EOF
FROM parent:latest
LABEL foo=baz
EOF


$ docker images ls --filter reference=parent
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
parent              latest              17789f62da6c        About an hour ago   0 B

$ docker image rm 17789f62da6c
Error response from daemon: conflict: unable to delete 17789f62da6c (cannot be forced) - image has dependent child images

Since the introduction of the content-addressable store, the "child/parent" chain
is only used for the local build cache, but is not required to run an image.

I think we should allow removing the parent image if --force is used.

Note that removing the parent image will not cleanup any disk space (because
the layers are still used by the child image), however it does allow users
to clean up images they no longer need.

related discussion #25602

/cc @tonistiigi @dmcgowan

[tonistiigi]

Would we remove the whole parent chain up to that deleted image then? That may be bit unexpected but if we don't do it then every deletion possibly creates a new dangling image.

[thaJeztah]

Good point, I think for any direct descendant of that image, that would be the case yes

[thaJeztah]

Looks like this already works if buildkit is enabled, so only an issue if images are built with the classic builder (edited the example steps to use DOCKER_BUILDKIT=0

BuildKit doesn't set the "Parent" chain;

When built with DOCKER_BUILDKIT=1:

docker inspect --format '{{json .Parent}}' child
""

When built with DOCKER_BUILDKIT=0:

docker inspect --format '{{json .Parent}}' child
"sha256:9adebf3f78911d6050aff78e1bf2815c9beabea4fea0848b3ed77679fdefeb94"