Docker Support

Since clients can access manifests by their digest value, many docker users want to keep old manifests and blobs in their repository even when there is no longer an active tag referencing them. Deploying a manifest by its digest ID is a best practice as it allows the deployer to know with confidence exactly what is deployed.

Note that the "tag" attribute of a Manifest is a piece of data baked into the manifest itself. It is completely valid for there to be many manifests in a docker repository that all have the same "tag" value in their json data. Of course only one of them will be returned by the registry API's "tags" endpoint, and presumably that would be the newest one.

https://docs.docker.com/registry/spec/api/#/listing-image-tags

In order to allow pulp users to control which manifest is the "active" one returned by the registry API for a given tag name, pulp has the Tag unit type. During a sync, if the remote API has a new manifest referenced from a given tag name, pulp will update the corresponding Tag unit. This allows a point-in-time snapshot of a repository to be promoted by copying a Tag, Manifest, and associated Blob units to a new repo. In the future, if another copy is made and the source repo's Tag unit references a different manifest, that will overwrite the one in the destination repo.

Given all of that, I do not think this issue describes a bug. There are at least two opportunities for improvement though:

• Better document how Tags are intended to be used. I was surprised to see that we don't have much currently.
• An enhancement would be to add an importer option to purge non-tagged content during sync, possibly keeping some number of the newest non-tagged manifests. But this should be an optional behavior that is not the default; when uncertain about whether a user wants pulp to keep a piece of content, pulp should default to keeping it.