kamal-image-retention 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: d0a48138263317ddaa8a5ca23da6beaeaf6a340b011024ca13943ca08837f29b
+  data.tar.gz: 846384090f8dfe614ec44c7e0fd792c2ecf1c63f6c7027e152fe421e7374b9c0
+SHA512:
+  metadata.gz: 755b66a99e784b76262ede4876b43bee45fba8d0351444c3fb79e863f98324d85d85bf107193b2947370da0ecfc2f12b131c39e27c06e03587f3de1d34c3e495
+  data.tar.gz: 6450c797086b934f67bb7f31ff8bca23d8513077df44aa6cf651c390c099f20bca947171ecf7dda8ebc46ac575574bd59068bb78a4d2f94cc82eccfa95075855

data/README.md

@@ -0,0 +1,111 @@
+# Kamal image retention
+
+Kamal prunes old containers and images on your application servers. A copy of each
+release can still take up disk space on the machine that built it and in your
+Docker registry. This gem cleans up those copies for one Kamal application at a
+time. Run it manually or from a hook after each deploy.
+
+## Installation
+
+Add the gem to the Gemfile you use to run Kamal. It requires Ruby 3.2 or newer
+and declares a dependency on Kamal `~> 2.12`.
+
+```ruby
+group :deploy, optional: true do
+  gem "kamal-image-retention", "~> 0.1.1", require: false
+end
+```
+
+On the machine where you run deployments, enable the group and install it:
+
+```sh
+bundle config set --local with deploy
+bundle install
+```
+
+The command needs local Docker access and SSH access to Docker on the app hosts.
+It reads the image name, registry, hosts and SSH settings from the same Kamal
+configuration you use to deploy.
+
+## Preview a cleanup
+
+From the application's Kamal directory, run:
+
+```sh
+bundle exec kamal-retain-images -d staging
+```
+
+Use your destination name, or omit `-d staging` if you deploy with just
+`config/deploy.yml`. Pass `-c FILE` if you keep the base config elsewhere.
+The preview counts eligible tags without removing images. Example output for
+an application with a supported registry:
+
+```text
+registry.example.com/team/app registry {"obsolete_tags":3}
+registry.example.com/team/app build machine {"obsolete_tags":2}
+```
+
+Here, three registry tags and two local tags are eligible for removal. To apply
+the cleanup to the same destination, run:
+
+```sh
+bundle exec kamal-retain-images -d staging --apply
+```
+
+## What gets kept
+
+The gem keeps the five newest distinct builds tagged with a full Git SHA, ordered
+by image creation time. To change the count, set Kamal's existing option in
+`config/deploy.yml` or a destination override:
+
+```yaml
+retain_containers: 8
+```
+
+Images with a named tag such as `stable` and images referenced by running or
+stopped containers on the build machine or the configured app hosts are also
+kept. For example, if `stable` points to the eighth-newest build and your limit
+is five, that build survives alongside the newest five. Shared registry layers
+stay available to the other repositories that use them.
+
+## Run after each deployment
+
+Add this block to your executable `.kamal/hooks/post-deploy` shell script.
+If you are creating the file, start it with `#!/bin/sh` and run
+`chmod +x .kamal/hooks/post-deploy` once.
+
+```sh
+case "${KAMAL_COMMAND:-}" in
+  deploy|redeploy)
+    bundle exec kamal-retain-images --apply
+    ;;
+esac
+```
+
+The hook inherits `KAMAL_DESTINATION` from Kamal. Each invocation runs once
+and exits. [Kamal hook documentation](https://kamal-deploy.org/docs/hooks/overview/)
+
+## Registry support
+
+Registry cleanup supports a Kamal-managed `kamal-docker-registry` container
+running Distribution v3 with a single Docker volume at `/var/lib/registry` and
+its default configuration. The registry can run locally on the build machine
+or on an app host selected for the deployment. With a hosted registry such as
+GHCR, the gem cleans up the build machine and leaves registry retention to the
+provider.
+
+When registry cleanup has work to do, pushes and pulls to **all repositories
+on that registry** pause during collection. A recent upload defers collection.
+If collection is interrupted, rerun with `--apply` from the same build machine
+and user account so the gem can read its recovery state.
+
+## Development
+
+```sh
+bundle install
+bundle exec ruby -Ilib test/retention_test.rb
+```
+
+## Author
+
+Built by [Anton Kopylov](https://www.kopylov.net).

data/exe/kamal-retain-images

@@ -0,0 +1,5 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "kamal_image_retention"
+KamalImageRetention::CLI.run(ARGV)

data/lib/kamal_image_retention/cli.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module KamalImageRetention
+  module CLI
+    def self.run(argv)
+      destination = ENV["KAMAL_DESTINATION"].presence
+      config_file = "config/deploy.yml"
+      apply = false
+      OptionParser.new do |opts|
+        opts.banner = "Usage: bin/retain-images [-d destination] [-c config_file] [--apply]"
+        opts.on("-d DESTINATION") { |value| destination = value }
+        opts.on("-c FILE") { |value| config_file = value }
+        opts.on("--apply") { apply = true }
+      end.parse!(argv)
+      abort "Unexpected argument: #{argv.first}" unless argv.empty?
+
+      config = Kamal::Configuration.create_from(config_file: Pathname(config_file), destination: destination)
+      abort "Kamal service differs from hook" if ENV["KAMAL_SERVICE"].present? && ENV["KAMAL_SERVICE"] != config.service
+      selected = ENV.fetch("KAMAL_HOSTS", "").split(",")
+      abort "Hook hosts differ from configuration" unless (selected - config.all_hosts).empty?
+      deployed = selected.empty? ? config.app_hosts : config.app_hosts & selected
+      return if deployed.empty?
+
+      local = DockerHost.new
+      hosts = config.app_hosts.to_h { |host| [ host, DockerHost.new(host, config.ssh) ] }
+      endpoint = URI.parse("http://#{config.registry.server}") if config.registry.server.present?
+      registry_host = endpoint&.hostname unless config.registry.local?
+      state = Pathname(Dir.home).join(".cache", "docker-release-retention")
+      state.mkpath
+      state.join("coordinator.lock").open("a") do |lock|
+        lock.flock(File::LOCK_EX)
+        used = local.inventory(config.run_directory)
+        hosts.each_value { |h| h.open { used.merge(h.inventory(config.run_directory)) } }
+        if endpoint && (registry_host.nil? || deployed.include?(registry_host))
+          host = registry_host ? hosts.fetch(registry_host) : local
+          registry_state = state.join(Digest::SHA256.hexdigest(config.registry.server))
+          registry_state.mkpath
+          host.open do
+            retention = RegistryRetention.new(host, config.image, endpoint.port, registry_state)
+            summary = retention.clean(config.repository, config.retain_containers, used, apply, config.run_directory)
+            puts "#{config.repository} registry #{summary.to_json}"
+          end
+        end
+        old = Releases.clean_build(local, config.repository, config.retain_containers, used, apply)
+        puts "#{config.repository} build machine #{ { obsolete_tags: old }.to_json}"
+      end
+    end
+  end
+end

data/lib/kamal_image_retention/docker_host.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module KamalImageRetention
+  class DockerHost
+    def initialize(host = nil, ssh = nil)
+      @host, @ssh = host, ssh
+    end
+
+    def open
+      return yield self unless @host
+      Net::SSH.start(@host, @ssh.user, **@ssh.options.except(:user)) do |session|
+        @session = session
+        yield self
+      ensure
+        @session = nil
+      end
+    end
+
+    def run(*args)
+      if @session
+        output = +""
+        errors = +""
+        status = {}
+        @session.exec!(args.shelljoin, status: status) do |_, stream, data|
+          (stream == :stdout ? output : errors) << data
+        end
+        success = status[:exit_code] == 0
+      else
+        env = ENV.to_h.slice("HOME", "PATH", "DOCKER_CONFIG", "DOCKER_CONTEXT", "DOCKER_HOST", "SSH_AUTH_SOCK")
+        output, errors, status = Open3.capture3(env, *args, unsetenv_others: true)
+        success = status.success?
+      end
+      raise "#{args.first} failed on #{@host || "local"}: #{errors.strip}" unless success
+      output.chomp
+    end
+
+    def docker(*args) = run("docker", *args)
+
+    def inspect_rows(kind, ids, format)
+      return [] if ids.empty?
+      docker(kind, "inspect", "-f", format, *ids.uniq).lines(chomp: true)
+    end
+
+    def check_deploy_lock(directory)
+      run("sh", "-ec", 'case "$1" in /*) dir=$1;; *) dir="$HOME/$1";; esac; for lock in "$dir"/lock-*; do [ ! -d "$lock" ] || exit 1; done', "sh", directory)
+    end
+
+    def inventory(directory)
+      check_deploy_lock(directory)
+      used = Set.new
+      ids = docker("ps", "-aq", "--no-trunc").split
+      rows = inspect_rows("container", ids, "{{.Image}} {{.Config.Image}}")
+      images = rows.map do |row|
+        digest, reference = row.split
+        used.merge([ digest, reference, reference.split("@").last ])
+        digest
+      end
+      inspect_rows("image", images, "{{.Id}} {{json .RepoDigests}}").each do |row|
+        digest, references = row.split(" ", 2)
+        used << digest
+        Array(JSON.parse(references)).each { |r| used << r.split("@").last }
+      end
+      used
+    end
+
+    def with_port(port)
+      return yield port unless @host
+      # The SSH event loop must continue servicing HTTP while the command session runs Docker.
+      Net::SSH.start(@host, @ssh.user, **@ssh.options.except(:user)) do |tunnel|
+        local_port = tunnel.forward.local(0, "127.0.0.1", port)
+        done = false
+        thread = Thread.new { tunnel.loop(0.1) { !done } }
+        begin
+          yield local_port
+        ensure
+          done = true
+          thread.join
+        end
+      end
+    end
+  end
+end

data/lib/kamal_image_retention/registry_api.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module KamalImageRetention
+  class RegistryAPI
+    ACCEPT = %w[application/vnd.oci.image.manifest.v1+json application/vnd.oci.image.index.v1+json
+                application/vnd.docker.distribution.manifest.v2+json application/vnd.docker.distribution.manifest.list.v2+json].join(", ")
+
+    def initialize(port)
+      @http = Net::HTTP.new("127.0.0.1", port, nil)
+      @http.open_timeout = 5
+      @http.read_timeout = 45
+    end
+
+    def open
+      attempts = 0
+      begin
+        @http.start
+        request("")
+      rescue IOError, SystemCallError, Net::HTTPBadResponse
+        @http.finish if @http.started?
+        raise if (attempts += 1) >= 30
+        sleep 0.2
+        retry
+      end
+      yield self
+    ensure
+      @http.finish if @http.started?
+    end
+
+    def request(path, method = "GET")
+      response = @http.send_request(method, "/v2/#{path}", nil, "Accept" => ACCEPT)
+      response.value
+      response.body
+    end
+
+    def content(path, digest)
+      body = request(path)
+      raise "Unexpected digest for #{path}" unless "sha256:#{Digest::SHA256.hexdigest(body)}" == digest
+      body
+    end
+  end
+end

data/lib/kamal_image_retention/registry_retention.rb

@@ -0,0 +1,197 @@
+# frozen_string_literal: true
+
+module KamalImageRetention
+  class RegistryRetention
+    ROOT = "/var/lib/registry/docker/registry/v2/repositories"
+    DIGEST = /\Asha256:[0-9a-f]{64}\z/
+
+    def initialize(host, repository, port, state, container: "kamal-docker-registry")
+      @host, @repo, @port, @state, @container = host, repository, port, state, container
+      @helper = "#{container}-retention"
+      @marker = state.join("restore-registry")
+      @journal = state.join("pending-#{Digest::SHA256.hexdigest(repository)}.json")
+    end
+
+    def metadata(container)
+      script = <<~'SH'
+        cd "$1"
+        find . -path '*/_manifests/revisions/*/*/link'
+        find . -path '*/_manifests/tags/*/current/link' -exec sh -ec '
+          for path do printf "%s %s\n" "$path" "$(cat "$path")"; done' sh {} +
+      SH
+      data = {}
+      @host.docker("exec", container, "sh", "-ec", script, "sh", ROOT).each_line do |line|
+        path, digest = line.split
+        repo, link = path.delete_prefix("./").split("/_manifests/", 2)
+        item = data[repo] ||= { tags: {}, revisions: Set.new }
+        if digest
+          item[:tags][link.split("/").fetch(1)] = digest
+        else
+          _, algorithm, hex, = link.split("/")
+          item[:revisions] << "#{algorithm}:#{hex}"
+        end
+      end
+      data
+    end
+
+    def with_api(port, &block)
+      @host.with_port(port) { |local| RegistryAPI.new(local).open(&block) }
+    end
+
+    def graph(roots, children)
+      found = Set.new
+      pending = roots.to_a.dup
+      until pending.empty?
+        id = pending.pop
+        pending.concat(children.fetch(id)) if found.add?(id)
+      end
+      found
+    end
+
+    def plan(api, entry, count, used, reference, pending)
+      tags, revisions = entry.values_at(:tags, :revisions)
+      manifests = revisions.to_h { |id| [ id, JSON.parse(api.content("#{@repo}/manifests/#{id}", id)) ] }
+      children = manifests.transform_values do |m|
+        raise "Unsupported manifest" unless m.key?("config") || m.key?("manifests")
+        (m.fetch("manifests", []) + [ m["subject"] ].compact).map { |c| c.fetch("digest") }
+      end
+      dates = {}
+      created = lambda do |id|
+        dates[id] ||= begin
+          m = manifests.fetch(id)
+          if m["config"]
+            cfg = m["config"].fetch("digest")
+            Time.iso8601(JSON.parse(api.content("#{@repo}/blobs/#{cfg}", cfg)).fetch("created"))
+          else
+            m.fetch("manifests").reject { |c| c.dig("platform", "architecture") == "unknown" }
+              .map { |c| created.call(c.fetch("digest")) }.max || raise("Missing image creation time")
+          end
+        end
+      end
+      pins = manifests.keys.select { |id| used.include?(id) || used.include?(manifests[id].dig("config", "digest")) }.to_set
+      keep = Releases.protected_tags(tags, count, used, reference, &created)
+      tags.each_value { |id| keep << id if graph([ id ], children).intersect?(pins) }
+      candidates = graph((tags.values.to_set - keep) | (pending & revisions), children)
+      live = graph((revisions - candidates) | keep | pins, children)
+      obsolete = (candidates - live).sort_by { |id| -graph([ id ], children).size }
+      blobs = obsolete.to_set
+      obsolete.each do |id|
+        m = manifests.fetch(id)
+        (m.fetch("layers", []) + [ m["config"] ].compact).each { |blob| blobs << blob.fetch("digest") }
+      end
+      [ obsolete, blobs ]
+    end
+
+    def verify(api, metadata)
+      metadata.each do |repo, entry|
+        blobs = Set.new
+        entry[:revisions].each do |id|
+          m = JSON.parse(api.content("#{repo}/manifests/#{id}", id))
+          (m.fetch("manifests", []) + [ m["subject"] ].compact).each do |child|
+            raise "Missing manifest in #{repo}" unless entry[:revisions].include?(child.fetch("digest"))
+          end
+          (m.fetch("layers", []) + [ m["config"] ].compact).each { |b| blobs << b.fetch("digest") }
+        end
+        blobs.each { |id| api.request("#{repo}/blobs/#{id}", "HEAD") }
+        entry[:tags].each { |tag, id| api.content("#{repo}/manifests/#{tag}", id) }
+      end
+    end
+
+    def uploads?(container)
+      !@host.docker("exec", container, "sh", "-ec", 'find "$1" -mmin -15 -path "*/_uploads/*" | head -1', "sh", ROOT).empty?
+    end
+
+    def sweep(image, candidates)
+      args = [ "run", "--rm", "--pull=never", "--network=none", "--volumes-from" ]
+      report = @host.docker(*args, "#{@container}:ro", "-e", "REGISTRY_LOG_LEVEL=error", "--entrypoint", "/bin/registry",
+        image, "garbage-collect", "--dry-run", "/etc/distribution/config.yml")
+      raise "Unexpected Distribution GC report" unless report.match?(/\d+ blobs marked, \d+ blobs and \d+ manifests eligible for deletion/)
+      eligible = report.scan(/^blob eligible for deletion: (sha256:\h{64})$/).flatten.to_set
+      links = report.scan(/^layer link eligible for deletion: #{Regexp.escape(@repo)}\/(sha256:\h{64})$/).flatten.to_set
+      foreign = @host.docker(*args, "#{@container}:ro", "--entrypoint", "sh", image, "-ec",
+        'cd "$1" && find . -path "./$2/_layers" -prune -o -path "*/_layers/sha256/*/link" -print', "sh", ROOT, @repo)
+      shared = foreign.lines.map { |line| "sha256:#{line.split("/")[-2]}" }.to_set
+      paths = []
+      candidates.each do |id|
+        raise "Invalid digest" unless id.match?(DIGEST)
+        hex = id.delete_prefix("sha256:")
+        paths << "repositories/#{@repo}/_layers/sha256/#{hex}/link" if links.include?(id)
+        paths << "blobs/sha256/#{hex[0, 2]}/#{hex}/data" if eligible.include?(id) && !shared.include?(id)
+      end
+      paths.each_slice(100) do |batch|
+        @host.docker(*args, @container, "--entrypoint", "sh", image, "-ec",
+          'cd /var/lib/registry/docker/registry/v2 && rm -f "$@"', "sh", *batch)
+      end
+    end
+
+    def write_state(path, value)
+      tmp = path.sub_ext(".tmp")
+      tmp.write(JSON.generate(value))
+      tmp.rename(path)
+    end
+
+    def recover
+      return unless @marker.exist?
+      id, helper = JSON.parse(@marker.read)
+      raise "Registry identity changed" unless @host.docker("inspect", "-f", "{{.Id}}", @container) == id
+      existing = @host.docker("ps", "-aq", "--no-trunc", "--filter", "id=#{helper}")
+      @host.docker("rm", "-f", helper) unless existing.empty?
+      @host.docker("start", id)
+      @marker.delete
+    end
+
+    def clean(reference, count, used, apply, directory)
+      recover if apply
+      ports = JSON.parse(@host.docker("inspect", "-f", "{{json .NetworkSettings.Ports}}", @container))
+      bound = Array(ports["5000/tcp"]).any? { |p| p["HostPort"] == @port.to_s && %w[127.0.0.1 0.0.0.0].include?(p["HostIp"]) }
+      raise "Unexpected registry port binding" unless bound
+      initial = metadata(@container)
+      entry = initial.fetch(@repo, { tags: {}, revisions: Set.new })
+      pending = @journal.exist? ? JSON.parse(@journal.read) : { "revisions" => [], "blobs" => [] }
+      obsolete, candidates = with_api(@port) { |api| plan(api, entry, count, used, reference, pending.fetch("revisions").to_set) }
+      summary = { obsolete_tags: entry[:tags].count { |_, id| obsolete.include?(id) } }
+      return summary unless apply && (obsolete.any? || @journal.exist?)
+      return summary.merge(deferred: "active upload") if uploads?(@container)
+
+      id, image, mounts, env = @host.docker("inspect", "-f",
+        '{{.Id}} {{.Image}} {{json .Mounts}}{{println}}{{json .Config.Env}}', @container).match(/\A(\S+) (\S+) (.+)\n(.+)\z/).captures
+      mount, *others = JSON.parse(mounts)
+      raise "Unexpected registry storage" unless others.empty? && mount&.values_at("Type", "Destination") == [ "volume", "/var/lib/registry" ]
+      raise "Custom registry configuration" if JSON.parse(env).any? { |v| v.start_with?("REGISTRY_") }
+      raise "Expected Distribution v3" unless @host.docker("exec", id, "registry", "--version").match?(%r{distribution/v3 3\.})
+      before = @host.docker("exec", id, "du", "-sk", "/var/lib/registry").split.first.to_i
+      helper = @host.docker("create", "--name", @helper, "--volumes-from", id, "-p", "127.0.0.1::5000", "--pull=never", image)
+      begin
+        write_state(@marker, [ id, helper ])
+      rescue StandardError
+        @host.docker("rm", helper)
+        raise
+      end
+      begin
+        @host.docker("stop", id)
+        @host.docker("start", helper)
+        port = Integer(@host.docker("port", helper, "5000/tcp").rpartition(":").last)
+        @host.check_deploy_lock(directory)
+        return summary.merge(deferred: "registry changed during scan") if uploads?(helper) || metadata(helper) != initial
+        candidates.merge(pending.fetch("blobs"))
+        write_state(@journal, revisions: obsolete, blobs: candidates.to_a)
+        with_api(port) do |api|
+          obsolete.each { |digest| api.request("#{@repo}/manifests/#{digest}", "DELETE") }
+          entry[:tags].delete_if { |_, digest| obsolete.include?(digest) }
+          entry[:revisions].subtract(obsolete)
+          raise "Unexpected revision changes" unless metadata(helper) == initial
+          verify(api, initial)
+        end
+        @host.docker("stop", helper)
+        sweep(image, candidates)
+      ensure
+        recover
+      end
+      raise "Unexpected revisions after collection" unless metadata(@container) == initial
+      with_api(@port) { |api| verify(api, initial) }
+      @journal.delete
+      after = @host.docker("exec", id, "du", "-sk", "/var/lib/registry").split.first.to_i
+      summary.merge(freed_bytes: (before - after) * 1024, retained_tags: entry[:tags].size)
+    end
+  end
+end

data/lib/kamal_image_retention/releases.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module KamalImageRetention
+  module Releases
+    COMMIT = /\A(?:[a-f0-9]{40}|[a-f0-9]{64})\z/
+
+    def self.protected_tags(tags, count, used, repository)
+      commits = tags.select { |tag, _| tag.match?(COMMIT) }.values.uniq
+      keep = commits.sort_by { |id| [ yield(id), id ] }.last(count).to_set
+      tags.each do |tag, id|
+        keep << id if !tag.match?(COMMIT) || used.include?(id) || used.include?("#{repository}:#{tag}")
+      end
+      keep
+    end
+
+    def self.clean_build(host, repository, count, used, apply)
+      ids = host.docker("image", "ls", "-aq", "--no-trunc", "--filter", "reference=#{repository}:*").split
+      tags, dates = {}, {}
+      host.inspect_rows("image", ids, "{{.Id}} {{.Created}} {{json .RepoTags}}").each do |row|
+        id, date, aliases = row.split(" ", 3)
+        dates[id] = Time.iso8601(date)
+        Array(JSON.parse(aliases)).each do |ref|
+          repo, _, tag = ref.rpartition(":")
+          tags[tag] = id if repo == repository
+        end
+      end
+      keep = protected_tags(tags, count, used, repository) { |id| dates.fetch(id) }
+      old = tags.reject { |_, id| keep.include?(id) }
+      if apply
+        old.each do |tag, id|
+          ref = "#{repository}:#{tag}"
+          host.docker("image", "rm", ref) if host.docker("image", "inspect", "-f", "{{.Id}}", ref) == id
+        end
+      end
+      old.size
+    end
+  end
+end

data/lib/kamal_image_retention.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "kamal"
+require "digest"
+require "fileutils"
+require "json"
+require "net/http"
+require "open3"
+require "optparse"
+require "set"
+require "shellwords"
+require "time"
+
+require_relative "kamal_image_retention/docker_host"
+require_relative "kamal_image_retention/releases"
+require_relative "kamal_image_retention/registry_api"
+require_relative "kamal_image_retention/registry_retention"
+require_relative "kamal_image_retention/cli"

metadata

@@ -0,0 +1,63 @@
+--- !ruby/object:Gem::Specification
+name: kamal-image-retention
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+platform: ruby
+authors:
+- Anton Kopylov
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: kamal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.12'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.12'
+executables:
+- kamal-retain-images
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- exe/kamal-retain-images
+- lib/kamal_image_retention.rb
+- lib/kamal_image_retention/cli.rb
+- lib/kamal_image_retention/docker_host.rb
+- lib/kamal_image_retention/registry_api.rb
+- lib/kamal_image_retention/registry_retention.rb
+- lib/kamal_image_retention/releases.rb
+homepage: https://github.com/tonic20/kamal-image-retention
+licenses:
+- Nonstandard
+metadata:
+  allowed_push_host: https://rubygems.org
+  source_code_uri: https://github.com/tonic20/kamal-image-retention
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Retain recent Kamal builds on the build machine and in a private Distribution
+  registry
+test_files: []