fix(router): label cascade Dockerfiles so dangling-image cleanup actually matches

[zbigniewsobiecki]

Summary

• scanAndCleanupDanglingImages (PR fix(router): periodic dangling cascade-image cleanup (close 102GB leak) #1243) was a no-op since deploy — it filters images by dangling=true AND label=cascade.managed=true, but no cascade-built image carried that label. cascade.managed=true was only ever applied to running containers (in container-manager.ts); never baked into any Dockerfile.
• Live verification on the dev host (2026-05-03): 140 dangling images present, but docker images --filter dangling=true --filter label=cascade.managed=true | wc -l returns 0. Every prod cleanup-pass log line shows removedCount=0, reclaimedBytes=0.
• Adds LABEL cascade.managed=true to all five cascade Dockerfiles. The existing strict label filter starts matching exactly the right set without any code change in the cleanup loop and without any blast-radius widening.
• Static guard test pins both halves of the contract: the filter shape AND the per-Dockerfile LABEL directive.

Why the strict filter stays strict

The cascade-router host runs other unrelated workloads (ucho-dev/prod, MySQL, Loki, etc.). Widening the filter would risk reaping their dangling images. The right fix is to make cascade-built images carry the label so the existing safety belt actually matches them.

Out of scope

• Pre-label dangling backlog (~130 images on prod) needs a one-off manual prune after deploy:

  docker image prune --filter "until=24h"
  

  Not automated — would need a separate "garbage-collect pre-label dangling images" loop with stricter age + size filters, different invariants, different review surface.
• Cascade-worker tag bloat (29 SHA-pinned tags accumulating on the registry, ~3.81GB tagged each but layer-shared). Separate retention loop, separate PR.
• Buildkit cache (15.5GB on dev). Buildkit's own gc is the right primitive; not a cascade-router responsibility.

Test plan

• npx vitest run --project unit-api tests/unit/router/dangling-image-cleanup.test.ts — green (20 tests, 5 new LABEL guards)
• npm test — full unit suite (8781 tests, 23 skipped, 0 failures)
• npm run typecheck — clean
• npm run lint — clean (13 pre-existing warnings, unrelated)
• After merge to main + first cascade-worker rebuild: confirm Loki shows [DanglingImageCleanup] Cleanup pass complete: { removedCount: N>0, reclaimedBytes: M>0 } within 30 min
• Run one-off docker image prune --filter "until=24h" on prod to clear the pre-label backlog

🤖 Generated with Claude Code

[nhopeatall]

test review

🕵️ claude-code · claude-opus-4-6 · run details

[nhopeatall]

Summary

Clean, well-scoped fix for a real production issue — the dangling-image cleanup loop was a complete no-op since deploy because no built image carried the cascade.managed=true label it filters on. The fix correctly adds LABEL cascade.managed=true to the production stage of all five Dockerfiles, and the static guard test pins both halves of the contract going forward.

Code Issues

Should Fix

• All five Dockerfiles — The comment block references PR #12xx (a placeholder) instead of the actual PR #1256. This should be updated for traceability — when someone reads these comments in 6 months, #12xx won't resolve to anything useful.

🕵️ claude-code · claude-opus-4-6 · run details

[nhopeatall]

[SHOULD_FIX] Placeholder PR #12xx should be PR #1256. Same placeholder appears in all five Dockerfiles — worth a quick find-and-replace before merge.

[aaight]

Fixed! Replaced the PR #12xx placeholder with the actual PR #1256 across all five Dockerfiles.

[aaight]

Fixed! Replaced the PR #12xx placeholder with PR #1256 across all five Dockerfiles. The commit is at e4192ce.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!