Docker cleanup

One policy over every host, since servers are shared across teams. A sweep is allow-listed: it never prunes containers, volumes or networks, so a stopped app, its data and its network survive. A manual sweep ignores the exclusion list.

Policy

dockerCleanupPolicy

Instance admin only. Returns DockerCleanupPolicy.

The instance-wide Docker cleanup policy. Never null: an instance that has never configured cleanup reads as the defaults - enabled, daily, every scope.

query {
  dockerCleanupPolicy {
    enabled
    schedule
    scopes
  }
}

updateDockerCleanupPolicy

Instance admin only. Returns DockerCleanupPolicy.

Save the instance-wide cleanup policy. The cron is rejected (not repaired) when it does not parse - an unparseable schedule is a cleanup that silently never runs while the UI says it is enabled. The numeric bounds are clamped instead: there is no dangerous value of 'keep N images', only an unhelpful one.

mutation {
  updateDockerCleanupPolicy(
    input: { enabled: true, schedule: "0 4 * * *", minAgeHours: 24, keepImagesPerApp: 3, scopes: [dangling_images, build_cache] }
  ) {
    enabled
    schedule
    scopes
  }
}

setServerCleanupExcluded

Instance admin only. Returns DockerCleanupPolicy.

Include ONE server in the scheduled sweep, or leave it out, without touching any other host's membership. This is what a server's own Cleanup tab writes: sending the whole exclusion list from a per-host page would rewrite every other host from a stale snapshot. Manual runDockerCleanupNow ignores the list either way.

mutation {
  setServerCleanupExcluded(excluded: true, serverId: "srv_9f1c2ab7d3e4f5a6") {
    enabled
    schedule
    scopes
  }
}

Sweeps

runDockerCleanupNow

Instance admin only. Returns DockerCleanupRun.

START a sweep of this server now, with the policy's scopes - whether or not the schedule is enabled, and ignoring the exclusion list (which only governs the scheduled sweep). Returns IMMEDIATELY with the running run: the host keeps working in the background, so the caller never waits on a docker rmi sweep and closing the page cannot cancel it. Follow it on the dockerCleanupRuns subscription (or re-read the query); whatever the host fails at (unreachable, unprovisioned, an agent too old) lands on that run as failed with the reason. Only pre-flight problems error here: unknown server, nothing selected to reclaim, or a sweep already running on this host. Allow-listed: it never prunes containers, volumes or networks, so a stopped app, its data and its network survive.

mutation {
  runDockerCleanupNow(serverId: "srv_9f1c2ab7d3e4f5a6") {
    id
    status
    reclaimedBytes
    trigger
  }
}

dockerCleanupRuns

Instance admin only. Returns [DockerCleanupRun!].

Cleanup history, newest first. Not team-scoped: servers are the one shared cross-team resource, so a run belongs to a host.

query {
  dockerCleanupRuns(limit: 10) {
    id
    serverName
    status
    reclaimedBytes
  }
}

dockerCleanupRuns

Instance admin only. Returns [DockerCleanupRun!].

Emits the whole cleanup history whenever it changes - a sweep started, finished, or was pruned. Fires once immediately with the current snapshot. Instance-wide: there is no per-server stream, because there is one policy and one shared fleet.

query {
  dockerCleanupRuns(limit: 10) {
    id
    serverName
    status
    reclaimedBytes
  }
}

See also