The registry keeps the blobs pushed and not yet released in
Registry::staged (crates/knotless-serve/src/oci.rs). The only bound is
bounded() (about line 204): once the map holds MOST_KEPT (1024)
entries, it is emptied. Entries are never taken out one by one, not even
once their release is made. So the map fills over time, and at some
moment it is wiped all at once. That drops every pusher's staged blobs,
including those of pushes still under way.
How to see it
Over the server's life, after about 1024 blobs have been pushed across
all accounts, the next blob upload clears the map. A docker push that
uploaded its blobs just before that point fails at the manifest PUT,
because its blobs are no longer staged (staged() misses, and
by_digest has no release for them yet). Its blobs stay in the owner's
PDS, orphaned. One account can also wipe everyone's staged blobs on
purpose by uploading 1024 small blobs.
What you expected
Evict per entry rather than all at once. For example, drop a pusher's
staged blobs once their release is made, and evict by age or LRU, or cap
each account, so that one push never loses another's.
Where
knotless-serve's OCI registry, on main at b191acef. Found by the docs
audit.
chadtmiller.com/knotless
What happened
The registry keeps the blobs pushed and not yet released in
Registry::staged(crates/knotless-serve/src/oci.rs). The only bound isbounded()(about line 204): once the map holdsMOST_KEPT(1024) entries, it is emptied. Entries are never taken out one by one, not even once their release is made. So the map fills over time, and at some moment it is wiped all at once. That drops every pusher's staged blobs, including those of pushes still under way.How to see it
Over the server's life, after about 1024 blobs have been pushed across all accounts, the next blob upload clears the map. A
docker pushthat uploaded its blobs just before that point fails at the manifest PUT, because its blobs are no longer staged (staged()misses, andby_digesthas no release for them yet). Its blobs stay in the owner's PDS, orphaned. One account can also wipe everyone's staged blobs on purpose by uploading 1024 small blobs.What you expected
Evict per entry rather than all at once. For example, drop a pusher's staged blobs once their release is made, and evict by age or LRU, or cap each account, so that one push never loses another's.
Where
knotless-serve's OCI registry, on main at b191acef. Found by the docs audit.
🤖 Generated with Claude Code