ExcludeDockerImages masks end up in missing layers

[olwe0002]

this is the used config:

- name: Remove all docker images from docker-xyz-local older than 14 days
  rules:
    - rule: Repo
      name: docker-xyz-local
    - rule: DeleteDockerImagesOlderThan
      days: 14
    - rule: ExcludeDockerImages
      masks:
        - image/path/with:tag

I expected the image image/path/with:tag to be excluded from deletion, with all its layers. Is that an wrong assumption with this config?

list.manifest.json of this image (note the digest 877fe4031a674aebb3d006692366fb73badfc36e0d1756964b9d1a7db5b8b553):

{
    "schemaVersion": 2,
    "mediaType": "application/vnd.oci.image.index.v1+json",
    "manifests": [
        {
        "mediaType": "application/vnd.oci.image.manifest.v1+json",
        "digest": "sha256:a7660fa61e8845d998169dc6c6a2cf801284af6a055ea52b94aad540c68d8926",
        "size": 2199,
        "platform": {
            "architecture": "amd64",
            "os": "linux"
        }
        },
        {
        "mediaType": "application/vnd.oci.image.manifest.v1+json",
        "digest": "sha256:877fe4031a674aebb3d006692366fb73badfc36e0d1756964b9d1a7db5b8b553",
        "size": 566,
        "annotations": {
            "vnd.docker.reference.digest": "sha256:a7660fa61e8845d998169dc6c6a2cf801284af6a055ea52b94aad540c68d8926",
            "vnd.docker.reference.type": "attestation-manifest"
        },
        "platform": {
            "architecture": "unknown",
            "os": "unknown"
        }
        }
    ]
}

the output of the deletion shows the nmatch entry for the image, but also the deletion of its layer:

Add AQL Text - rule: Repo - Apply the policy to one repository.
Add AQL Text - rule: DeleteDockerImagesOlderThan - Removes Docker image older than ``days`` days
Add AQL Text - rule: ExcludeDockerImages - Exclude Docker images by name and tags.
********************************************************************************
Result AQL Query:

items.find(
...
{"path": {"$nmatch": "image/path/with/tag"}}


Found 1093 artifacts
Filter artifacts - rule: Repo - Apply the policy to one repository.
Filter artifacts - rule: DeleteDockerImagesOlderThan - Removes Docker image older than ``days`` days
Filter artifacts - rule: ExcludeDockerImages - Exclude Docker images by name and tags.
Found 1093 artifacts AFTER filtering

DESTROY MODE - delete 'docker-xyz-local/image/path/sha256%3A877fe4031a674aebb3d006692366fb73badfc36e0d1756964b9d1a7db5b8b553 - 1K'
...

After that, the image can't be pulled any more, as the layer is missing in Artifactory. This doesn't happen all the time, only for some images or single layers. How can I avoid this?

[olwe0002]

any update on this?

[allburov]

Likely you need to track that down in your environment, especially if it happens time to time.
Feel free to contribute the fix, we're happy to review that!

[felipecrs]

I have the exact same issue, and I could not get around it yet.