Add registry remove script

1 files changed, 315 insertions, 0 deletions

diff --git a/bin/remove_image_from_registry.sh b/bin/remove_image_from_registry.sh
new file mode 100755
index 0000000..d6e9fb1
--- /dev/null
+++ b/bin/remove_image_from_registry.sh
@@ -0,0 +1,315 @@
+#!/bin/bash
+
+IMAGE_ARG=""
+HOST=""
+IMAGE=""
+URI=""
+TAG=""
+USERNAME=""
+CREDENTIALS_STRING=""
+INSECURE=""
+RAW_URL=""
+RAW_HTTP_METHOD=""
+RAW_HTTP_HEADER=""
+TAG_ONLY=false
+
+function printUsage
+{
+    local RESULT=$1
+    if [ "$RESULT" == "" ]; then
+        RESULT=0
+    fi
+    cat << EOF
+
+Usage:
+ $ ./remove_image_from_registry.sh [OPTIONS] [IMAGE]
+
+IMAGE
+ Image name has the format registryhost:port/repository/imagename:version
+ For instance : mydockerregistry:5000/myrepo/zoombie:latest
+ Note that the version tag ("latest" in this example) is mandatory.
+ Please note that this script will delete the image from the repository, not only the tag; if the
+ image you are deleting have multiple tags ( for instance "1.0" and "latest" ), both tags will be
+ removed from the registry.
+ Docker registry does not support deleting only a tag ATM, ref https://github.com/docker/distribution/issues/2317
+ The option "--tag-only" tries to circumvent this by restoring other tags which also disappear from
+ the registry during the delete. However, this is not entirely safe:
+  - Do not delete multiple images concurrently.
+  - Do not run registry garbage collector while deleting images (this you should never do anyway....).
+  - Do not create new local tags for the image during the delete operation.
+
+REQUIREMENTS
+ The registry must run a v2 registry and have token based authentication enabled.
+ Deletion must be enabled on the registry server (REGISTRY_STORAGE_DELETE_ENABLED=true).
+ 
+NOTE
+  The blobs are actually not deleted from the registry server automatically after running this script.
+  In order to do that you must manually (for the time being) run the registry garbage collector.
+  See https://docs.docker.com/registry/garbage-collection/ for more info about this.
+
+OPTIONS
+ -h, --help
+        Print help
+ --insecure
+        Connect to a registry which has a self-signed SSL certificate
+ -p
+        Prompt for password
+ -u <username>
+        Use the given username when authenticating with the registry
+ --raw <url> <http-method> [http-header]
+        Send custom request to the registry. When using this argument, do not use the  [IMAGE] argument too.
+        Example:
+        ./remove_image_from_registry.sh \\
+             -u admin \\
+             --insecure \\
+             --raw \\
+             mydockerregistry:5000/v2/imagename/manifests/latest \\
+             GET \\
+             "Accept: application/vnd.docker.distribution.manifest.v2+json"
+ --tag-only
+        After deleting the image, try to recover all other tags which also pointed to the image
+
+ 
+Password may also be set using the environment variable REGISTRY_PASSWORD
+ $ export REGISTRY_PASSWORD=sesame
+
+EOF
+    exit $RESULT;
+}
+
+function validateImageName
+{
+    local IMAGE_NAME
+    IMAGE_NAME="$1"
+    if [[ "$IMAGE_NAME" == https://* ]]; then
+        echo "Image name or raw URL should not start with https://"
+        exit 1
+    fi
+    if [[ "$IMAGE_NAME" == http://* ]]; then
+        echo "Image name or raw URL should not start with http://"
+        echo "Anyway, registry must use SSL in order to make token based auth work"
+        exit 1
+    fi
+}
+
+function parseArguments
+{
+    while (( "$#" )); do
+        if [ "$1" = "-u" ]; then
+            shift
+            USERNAME=$1
+        elif [ "$1" = "-p" ]; then
+            echo -n "Password: "
+            read -s REGISTRY_PASSWORD
+            echo
+        elif [ "$1" = "--insecure" ]; then
+            INSECURE=" --insecure"
+        elif [ "$1" = "--help" ]; then
+            printUsage
+        elif [ "$1" = "-h" ]; then
+            printUsage
+        elif [ "$1" = "--raw" ]; then
+            shift
+            RAW_URL="$1"
+            validateImageName "$1"
+            shift
+            RAW_HTTP_METHOD="$1"
+            shift
+            RAW_HTTP_HEADER="$1"
+        elif [ "$1" = "--tag-only" ]; then
+            TAG_ONLY=true
+        else
+            # If first param is a dash, we have an invalid argumwent
+            if [ ${1:0:1} == "-" ]; then
+                echo "Error: Unknown parameter : $1"
+                exit 1
+            fi
+            if [ "$IMAGE_ARG" != "" ]; then
+                echo "Error: You may only provide IMAGE name once"
+                exit 1
+            fi
+            validateImageName "$1"
+            IMAGE_ARG="$1"
+            HOST=`echo $IMAGE_ARG|cut -f 1 -d "/"`
+            IMAGE=`echo $IMAGE_ARG|cut -f 2- -d "/"|cut -f 1 -d ":"`
+            TAG=`echo $IMAGE_ARG|cut -f 2- -d "/"|cut -f 2 -d ":"`
+        fi
+        shift
+    done
+
+    if [ "$IMAGE_ARG" = "" ] && [ "$RAW_URL" = "" ]; then
+        echo "Error: You need to provide image name"
+        printUsage 1
+    fi
+
+    if [ "$USERNAME" != "" ]; then
+        CREDENTIALS_STRING=" --user ${USERNAME}:${REGISTRY_PASSWORD}"
+    fi
+}
+
+# $1 is URL
+# $2 is HTTP METHOD (default GET)
+# $2 is additional header ( optional )
+function sendRegistryRequest
+{
+    local URL
+    local WWW_AUTH_HEADER
+    local TOKEN
+    local TOKEN_RESP
+    local REALM
+    local SERVICE
+    local SCOPE
+    local CUSTOM_HEADER
+    local HTTP_METHOD
+    local CURL_HTTP_METHOD_OPTION
+    local CURL_ARG
+    local RESULT
+    
+    URL="$1"
+
+    CURL_HTTP_METHOD_OPTION="-X"
+    if [ "$2" != "" ]; then
+        HTTP_METHOD="$2"
+    else
+        HTTP_METHOD="GET"
+    fi
+    
+    # If HTTP_METHOD == "HEAD", we'll need to use -I option instead
+    if [ $HTTP_METHOD = "HEAD" ]; then
+        CURL_HTTP_METHOD_OPTION="-I"
+        HTTP_METHOD=""
+    fi
+
+    if [ "$3" != "" ]; then
+        CUSTOM_HEADER="$3"
+    else
+        CUSTOM_HEADER=""
+    fi
+    WWW_AUTH_HEADER=`curl -sS -i $INSECURE $CURL_HTTP_METHOD_OPTION $HTTP_METHOD -H "Content-Type: application/json" ${URL} |grep Www-Authenticate|sed 's|.*realm="\(.*\)",service="\(.*\)",scope="\(.*\)".*|\1,\2,\3|'`
+
+    REALM=`echo $WWW_AUTH_HEADER|cut -f 1 -d ","`
+    SERVICE=`echo $WWW_AUTH_HEADER|cut -f 2 -d ","`
+    SCOPE=`echo $WWW_AUTH_HEADER|cut -f 3 -d ","`
+
+    TOKEN=`curl -f -sS $INSECURE -G --data-urlencode "service=${SERVICE}" --data-urlencode "scope=${SCOPE}" "${REALM}" -K- <<< $CREDENTIALS_STRING|jq .token|cut -f 2 -d "\""`
+    RESULT=$?
+    if [ $RESULT -ne 0 ] || [ "$TOKEN" == "" ]; then
+        # Run command again (without -f arg) and output message to std err 
+        >&2 echo Auth server responded:
+        >&2 curl -sS $INSECURE -G --data-urlencode "service=${SERVICE}" --data-urlencode "scope=${SCOPE}" "${REALM}" -K- <<< $CREDENTIALS_STRING
+        if [ $RESULT -eq 0 ]; then
+            RESULT=42
+        fi
+        exit $RESULT
+    fi
+
+    # We only use -f parameter if we are doing a ordinary delete request
+    # If we are doing raw request, we output both request and response ( including headers )
+    if [ "$RAW_URL" = "" ]; then
+        CURL_ARG="-f "
+    else
+        CURL_ARG="-v "
+    fi
+    if [ "$CUSTOM_HEADER" == "" ]; then
+        curl $CURL_ARG -sS $INSECURE $CURL_HTTP_METHOD_OPTION $HTTP_METHOD -H "Authorization: Bearer $TOKEN" "${URL}"
+        RESULT=$?
+        if [ $RESULT -ne 0 ]; then
+        # Run command again (without -f arg) and output message to std err 
+            >&2 curl -sS $INSECURE $CURL_HTTP_METHOD_OPTION $HTTP_METHOD -H "Authorization: Bearer $TOKEN" "${URL}"
+            exit $RESULT
+        fi
+    else
+        curl $CURL_ARG -i -sS $INSECURE $CURL_HTTP_METHOD_OPTION $HTTP_METHOD -H "$CUSTOM_HEADER" -H "Authorization: Bearer $TOKEN" "${URL}"
+        RESULT=$?
+        if [ $RESULT -ne 0 ]; then
+        # Run command again (without -f arg) and output message to std err 
+            >&2 curl -i -sS $INSECURE $CURL_HTTP_METHOD_OPTION $HTTP_METHOD -H "$CUSTOM_HEADER" -H "Authorization: Bearer $TOKEN" "${URL}"
+            exit $RESULT
+        fi
+    fi
+}
+
+function getTags
+{
+    TAGS=`sendRegistryRequest https://${HOST}/v2/${IMAGE}/tags/list GET |jq --compact-output .tags`
+    RESULT=$?
+    if [ "$TAGS" == "" ] || [ $RESULT -ne 0 ]; then
+        exit $RESULT
+    fi
+    # imagenames and tags cannot contain special characters or space. So let's just remove that JSON syntax
+    TAGS=${TAGS//\"}
+    TAGS=${TAGS//\[}
+    TAGS=${TAGS//\]}
+    TAGS=${TAGS//,/ }
+}
+
+# $1 is the tag you want to take backup of
+# $2 is tag name used for backup (backup tag)
+function backupLocalImage
+{
+    # If the tag we are going to delete exists locally we need to take a backup of that
+    # then download the image from registry ( remote and local image may not match even though they have the same name )
+    if [ `docker images --format "{{.Repository}}:{{.Tag}}" ${HOST}/${IMAGE}:$1| wc -l` -eq 1 ]; then
+        BACKUP_TAKEN="true"
+        docker tag ${HOST}/${IMAGE}:$1 ${HOST}/${IMAGE}:$2
+        docker rmi ${HOST}/${IMAGE}:$1
+    fi
+}
+
+# $1 is the tag you want to restore to
+# $2 is the tag name used when taking the backup (backup tag)
+function restoreBackup
+{
+    if [ `docker images --format "{{.Repository}}:{{.Tag}}" ${HOST}/${IMAGE}:$2| wc -l` -eq 1 ]; then
+#        docker rmi ${HOST}/${IMAGE}:$1
+        docker tag ${HOST}/${IMAGE}:$2 ${HOST}/${IMAGE}:$1
+        docker rmi ${HOST}/${IMAGE}:$2
+    fi
+}
+
+parseArguments "$@"
+
+if [ "$RAW_URL" = "" ]; then
+    if [ "$TAG_ONLY" = "true" ]; then
+        getTags
+        backupLocalImage $TAG remove_image_from_registry1
+        docker pull ${HOST}/${IMAGE}:${TAG}
+    fi
+    SHA_REQ=`sendRegistryRequest https://${HOST}/v2/${IMAGE}/manifests/${TAG} GET "Accept: application/vnd.docker.distribution.manifest.v2+json"`
+    RESULT=$?
+    if [ "$SHA_REQ" == "" ] || [ $RESULT -ne 0 ]; then
+        docker rmi ${HOST}/${IMAGE}:${TAG}
+        restoreBackup $TAG remove_image_from_registry1
+        exit $RESULT
+    fi
+
+    SHA=$(echo "$SHA_REQ"|grep "Docker-Content-Digest:"|cut -f 2- -d ":"|tr -d '[:space:]')
+    sendRegistryRequest https://${HOST}/v2/${IMAGE}/manifests/${SHA} DELETE
+    if [ "$TAG_ONLY" = "true" ]; then
+        OLDTAGS="$TAGS"
+        getTags
+        TAGSPIPE="|${TAGS// /|}|"
+
+        for i in $OLDTAGS; do
+            # Clearly, we expect TAG to be gone
+            # We don't want to restore that one
+            if [ "$i" = "$TAG" ]; then
+                continue
+            fi
+
+            if [[ $TAGSPIPE != *"|$i|"* ]]; then
+                echo This tag needs to be restored : ${HOST}/${IMAGE}:${i}
+                backupLocalImage $i remove_image_from_registry2
+                docker tag ${HOST}/${IMAGE}:${TAG} ${HOST}/${IMAGE}:${i}
+                docker push ${HOST}/${IMAGE}:${i}
+                docker rmi ${HOST}/${IMAGE}:${i}
+                restoreBackup $i remove_image_from_registry2
+            fi
+        done
+        docker rmi ${HOST}/${IMAGE}:${TAG}
+        restoreBackup $TAG remove_image_from_registry1
+    fi
+else
+    sendRegistryRequest "https://${RAW_URL}" "${RAW_HTTP_METHOD}" "${RAW_HTTP_HEADER}"
+fi
+