From a26a77dd0a87d9abe4a1cc4c9ecabd81c7437444 Mon Sep 17 00:00:00 2001 From: Logan Cusano Date: Mon, 26 Oct 2026 01:14:45 -0400 Subject: [PATCH] drb-update: prune BuildKit cache and stale images after every update (#41) node-002's root disk hit 100% (39.5 GB build cache + 16 GB unused images) and the node silently stopped recording for 17 days: BUILD=1 runs `docker compose build` on every update and nothing ever pruned the cache; the existing prunes only drop dangling images and old src- pins. After `up -d`: `builder prune -af --filter until=72h` and `image prune -af --filter until=168h`. Neither touches anything a running container uses; the age filters keep the next build's cache warm. Disk-free reporting to the portal (the other half of #41) is not in this change. Co-Authored-By: Claude Opus 5.5 --- drb-edge-node/tests/test_host_updater.py | 11 +++++++++++ scripts/drb-update.sh | 8 ++++++++ 2 files changed, 19 insertions(+) diff --git a/drb-edge-node/tests/test_host_updater.py b/drb-edge-node/tests/test_host_updater.py index 73b92bc..ddb33f2 100644 --- a/drb-edge-node/tests/test_host_updater.py +++ b/drb-edge-node/tests/test_host_updater.py @@ -151,6 +151,17 @@ def test_mqtt_sentinel_triggers_update_and_is_consumed(env): assert "evil" not in calls and "rm -rf" not in calls +def test_update_prunes_build_cache_and_stale_images_after_up(env): + # node-26#41: the build cache was never pruned and filled node-002's disk. + (env["stub"] / "response").write_text(json.dumps({"update_requested_at": "2026-10-04T12:00:00+00:00"})) + assert _run(env).returncode == 0 + lines = _calls(env).splitlines() + up = next(i for i, ln in enumerate(lines) if ln.startswith("docker compose up -d")) + builder = next(i for i, ln in enumerate(lines) if ln.startswith("docker builder prune -af --filter until=")) + images = next(i for i, ln in enumerate(lines) if ln.startswith("docker image prune -af --filter until=")) + assert up < builder and up < images # only after the new containers are running + + def test_c2_response_is_never_used_as_a_ref_or_command(env): (env["stub"] / "response").write_text(json.dumps({"update_requested_at": "$(touch /tmp/pwned); main"})) r = _run(env) diff --git a/scripts/drb-update.sh b/scripts/drb-update.sh index 0d9219d..6ee7e01 100644 --- a/scripts/drb-update.sh +++ b/scripts/drb-update.sh @@ -225,6 +225,14 @@ do_update() { done || true fi docker image prune -f >/dev/null 2>&1 || true + + # node-26#41: neither of the above ever freed BuildKit cache or untagged- + # but-unused images, so a BUILD=1 node grew ~40 GB of build cache plus + # 16 GB of stale images until the root disk hit 100% and recording silently + # stopped (node-002, 17 days). Both prunes skip anything a container uses; + # the age filters keep the cache warm for the next build. + docker builder prune -af --filter until=72h >/dev/null 2>&1 || true + docker image prune -af --filter until=168h >/dev/null 2>&1 || true } main "$@" -- 2.54.0