From 114cb3f8d1bff6a60c57868a00fed3b0ed7a3ec3 Mon Sep 17 00:00:00 2001 From: Steve Munini Date: Thu, 30 Jul 2026 13:50:33 -0700 Subject: [PATCH] ci: correct the docker-host-gc rationale to match the host MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment justified the anonymous-only volume filter as protecting named volumes that exist today. Verified on the host: there are none — every volume is anonymous, so the narrow filter and `prune -af` would behave identically right now. The filter is still the right choice, but as defence in depth rather than as a fix for live exposure. Say so, so the next reader does not go looking for the named volume this was supposedly protecting. --- .github/actions/docker-host-gc/action.yml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/actions/docker-host-gc/action.yml b/.github/actions/docker-host-gc/action.yml index 80b03ca6f..4558acbbe 100644 --- a/.github/actions/docker-host-gc/action.yml +++ b/.github/actions/docker-host-gc/action.yml @@ -44,10 +44,17 @@ runs: - name: Remove orphaned anonymous volumes shell: bash run: | - # Deliberately NOT `docker volume prune -af`. This host also runs - # long-lived services, and `-a` includes *named* volumes — so a prune - # racing a service redeploy, at the moment its named volume is briefly - # unreferenced, would delete that service's data. There is no undo. + # Deliberately NOT `docker volume prune -af`. `-a` includes *named* + # volumes, so a prune racing a service redeploy — at the moment that + # service's named volume is briefly unreferenced — would delete its + # data, with no undo. + # + # Verified 2026-07-30: the host currently has *no* named volumes at all, + # so today the two forms would behave identically. The narrower filter + # is defence in depth, not a response to something already at risk: the + # host does run long-lived services alongside CI, and the day one of + # them gains a named volume, that must not silently turn a routine + # sweep into data loss. # # Anonymous volumes (the only kind testcontainers leaks) are named with # a 64-char hex string; named volumes never match that shape. Matching