vibed-infra 0.4.0 → 0.5.0

package/README.md

@@ -71,6 +71,8 @@ wget -qO- .../dist/install-gateway.sh | bash
 | `INFRA_PROFILE` | `api`, `ui`, `nodes`, or `gateway` |
 | `INSTALL_DIR` | Target directory (default `.`) |
 
+Auto-update cron runs profile `update-*.sh`. Each update **prunes dangling Docker images** by default (`DOCKER_AUTO_PRUNE=1`). Set `DOCKER_PRUNE_UNUSED=1` to also drop unused tagged images older than `DOCKER_PRUNE_UNTIL` (default `72h`).
+
 ## Tests
 
 ```bash

package/lib/env.sh

@@ -222,3 +222,32 @@ chown_data_dir() {
   fi
   chmod 755 "$dir" 2>/dev/null || true
 }
+
+# Default on during auto-update. Set DOCKER_AUTO_PRUNE=0 to disable.
+docker_auto_prune_on() {
+  if [[ -n "${DOCKER_AUTO_PRUNE+x}" ]]; then
+    env_flag_on DOCKER_AUTO_PRUNE
+    return
+  fi
+  return 0
+}
+
+# Drop dangling images left after retagged pulls (e.g. :main). Optionally also
+# remove unused tagged images older than DOCKER_PRUNE_UNTIL when DOCKER_PRUNE_UNUSED=1.
+prune_docker_images() {
+  local log_dir="${1:-.}"
+  local role_label="${2:-infra}"
+  docker_auto_prune_on || return 0
+  if ! command -v docker >/dev/null 2>&1; then
+    return 0
+  fi
+  local summary
+  summary="$(docker image prune -f 2>/dev/null | awk '/Total reclaimed space/{print; found=1} END{if(!found) print "done"}' || echo done)"
+  log_update "$log_dir" "${role_label}: prune dangling images — ${summary}"
+  if env_flag_on DOCKER_PRUNE_UNUSED; then
+    local until="${DOCKER_PRUNE_UNTIL:-72h}"
+    summary="$(docker image prune -af --filter "until=${until}" 2>/dev/null \
+      | awk '/Total reclaimed space/{print; found=1} END{if(!found) print "done"}' || echo done)"
+    log_update "$log_dir" "${role_label}: prune unused images (until=${until}) — ${summary}"
+  fi
+}

package/lib/package.py

@@ -50,6 +50,9 @@ API_MEMORY_LIMIT=256m
 {au['flag']}=0
 {au['intervalEnv']}=30
 {au['stopTimeoutEnv']}=60
+DOCKER_AUTO_PRUNE=1
+DOCKER_PRUNE_UNUSED=0
+DOCKER_PRUNE_UNTIL=72h
 """
 
 
@@ -63,6 +66,9 @@ UI_MEMORY_LIMIT=32m
 {au['flag']}=0
 {au['intervalEnv']}=20
 {au['stopTimeoutEnv']}=30
+DOCKER_AUTO_PRUNE=1
+DOCKER_PRUNE_UNUSED=0
+DOCKER_PRUNE_UNTIL=72h
 """
 
 
@@ -81,6 +87,9 @@ WORKER_MEMORY_LIMIT=64m
 {au['flag']}=0
 {au['intervalEnv']}=30
 {au['stopTimeoutEnv']}=30
+DOCKER_AUTO_PRUNE=1
+DOCKER_PRUNE_UNUSED=0
+DOCKER_PRUNE_UNTIL=72h
 """
 
 
@@ -103,6 +112,9 @@ GATEWAY_MEMORY_LIMIT=64m
 {flag_lines}
 {au.get('intervalEnv', 'GATEWAY_AUTO_UPDATE_INTERVAL_MIN')}=20
 {au.get('stopTimeoutEnv', 'GATEWAY_STOP_TIMEOUT')}=30
+DOCKER_AUTO_PRUNE=1
+DOCKER_PRUNE_UNUSED=0
+DOCKER_PRUNE_UNTIL=72h
 """
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibed-infra",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Product-agnostic VPS packager: wget install, Docker Compose, TLS/nginx, auto-update",
   "license": "MIT",
   "repository": {

package/schema/packageconfig.md

@@ -73,4 +73,14 @@ config:          # opaque — written to dist/nodes-workers.yaml
 | `PACKAGECONFIG_URL` | defaults to `dist/packageconfig.yaml` |
 | `INFRA_PROFILE` | `api`, `ui`, `nodes`, or `gateway` |
 
+### Auto-update + image prune
+
+When `*_AUTO_UPDATE=1`, cron runs the profile `update-*.sh`. After each run it **prunes dangling Docker images** (old digests left when `:main` is retagged) so disk does not fill up.
+
+| Variable | Default | Meaning |
+|----------|---------|---------|
+| `DOCKER_AUTO_PRUNE` | `1` | Prune dangling images after auto-update |
+| `DOCKER_PRUNE_UNUSED` | `0` | Also prune unused tagged images older than `DOCKER_PRUNE_UNTIL` |
+| `DOCKER_PRUNE_UNTIL` | `72h` | Age filter for unused prune (`docker image prune -af --filter until=…`) |
+
 Legacy `packageconfig.yaml`-only products still work; new products use the four-file layout + `package.sh`.

package/skills/system-gateway/SKILL.md

@@ -35,7 +35,7 @@ sudo certbot certonly --standalone -d app.example.com
 
 Set `TLS_FULLCHAIN` / `TLS_PRIVKEY` in gateway `.env`, then `./start-gateway.sh` (reloads certs into the gateway volume).
 
-6. **Auto-update** — stagger cron: API :00, UI :15, workers :10, gateway :20 (infra defaults).
+6. **Auto-update** — stagger cron: API :00, UI :15, workers :10, gateway :20 (infra defaults). Update scripts prune dangling images afterward (`DOCKER_AUTO_PRUNE=1`).
 
 ## Dual-domain on one host
 

package/templates/generic/update-api.sh

@@ -28,12 +28,13 @@ run_api_update() {
   fi
   if ! container_needs_image "$name" "$image"; then
     log_update "$SCRIPT_DIR" "api: $name already on latest $image"
-    return 0
+  else
+    log_update "$SCRIPT_DIR" "api: updating $name"
+    graceful_stop "$name" "$stop_timeout"
+    PULL=0 "$SCRIPT_DIR/start-api.sh"
+    log_update "$SCRIPT_DIR" "api: $name updated"
   fi
-  log_update "$SCRIPT_DIR" "api: updating $name"
-  graceful_stop "$name" "$stop_timeout"
-  PULL=0 "$SCRIPT_DIR/start-api.sh"
-  log_update "$SCRIPT_DIR" "api: $name updated"
+  prune_docker_images "$SCRIPT_DIR" "api"
 }
 
 with_update_lock "$SCRIPT_DIR" "api" run_api_update

package/templates/generic/update-gateway.sh

@@ -30,12 +30,13 @@ run_gateway_update() {
   fi
   if ! container_needs_image "$name" "$image"; then
     log_update "$SCRIPT_DIR" "gateway: $name already on latest $image"
-    return 0
+  else
+    log_update "$SCRIPT_DIR" "gateway: updating $name"
+    graceful_stop "$name" "$stop_timeout"
+    PULL=0 "$SCRIPT_DIR/start-gateway.sh"
+    log_update "$SCRIPT_DIR" "gateway: $name updated"
   fi
-  log_update "$SCRIPT_DIR" "gateway: updating $name"
-  graceful_stop "$name" "$stop_timeout"
-  PULL=0 "$SCRIPT_DIR/start-gateway.sh"
-  log_update "$SCRIPT_DIR" "gateway: $name updated"
+  prune_docker_images "$SCRIPT_DIR" "gateway"
 }
 
 with_update_lock "$SCRIPT_DIR" "gateway" run_gateway_update

package/templates/generic/update-nodes.sh

@@ -27,11 +27,12 @@ run_nodes_update() {
   fi
   if ! container_needs_image "$name" "$image"; then
     log_update "$SCRIPT_DIR" "nodes: $name already on latest $image"
-    return 0
+  else
+    log_update "$SCRIPT_DIR" "nodes: updating via compose"
+    PULL=0 "$SCRIPT_DIR/start-nodes.sh"
+    log_update "$SCRIPT_DIR" "nodes: updated"
   fi
-  log_update "$SCRIPT_DIR" "nodes: updating via compose"
-  PULL=0 "$SCRIPT_DIR/start-nodes.sh"
-  log_update "$SCRIPT_DIR" "nodes: updated"
+  prune_docker_images "$SCRIPT_DIR" "nodes"
 }
 
 with_update_lock "$SCRIPT_DIR" "nodes" run_nodes_update

package/templates/generic/update-ui.sh

@@ -28,12 +28,13 @@ run_ui_update() {
   fi
   if ! container_needs_image "$name" "$image"; then
     log_update "$SCRIPT_DIR" "ui: $name already on latest $image"
-    return 0
+  else
+    log_update "$SCRIPT_DIR" "ui: updating $name"
+    graceful_stop "$name" "$stop_timeout"
+    PULL=0 "$SCRIPT_DIR/start-ui.sh"
+    log_update "$SCRIPT_DIR" "ui: $name updated"
   fi
-  log_update "$SCRIPT_DIR" "ui: updating $name"
-  graceful_stop "$name" "$stop_timeout"
-  PULL=0 "$SCRIPT_DIR/start-ui.sh"
-  log_update "$SCRIPT_DIR" "ui: $name updated"
+  prune_docker_images "$SCRIPT_DIR" "ui"
 }
 
 with_update_lock "$SCRIPT_DIR" "ui" run_ui_update