Prune after update frees nothing with Docker's containerd image store (old images aren't dangling) #315

Environment: dockcheck v0.8.3, Docker 29.9.2 (fresh install, so the containerd image store is the default: docker info shows driver-type io.containerd.snapshotter.v1), compose stacks on :latest tags.

Steps: run dockcheck.sh, update a few containers, answer y to "Would you like to prune all dangling images?".

Expected: the replaced images are removed and their space reclaimed.

Actual:

Deleted Images:
untagged: sha256:46bf76e0…
untagged: sha256:516fd964…
Total reclaimed space: 0B

The old images are still there and not dangling:

$ docker images | grep '<none>'
sentriz/gonic       <none>  516fd9645614  4 months ago  637MB
standardnotes/web   <none>  46bf76e09592  9 days ago    205MB
$ docker images -f dangling=true      # empty

Cause: with the containerd image store, a replaced image keeps a repo@sha256:<digest> name after the tag moves to the new image. So it isn't dangling, and docker image prune -f only removes a temporary alias. dockcheck already removes that name (docker rmi "$ContRepoDigests", around line 690), but only in -b mode. The classic overlay2 store doesn't do this, which is probably why it hasn't come up yet: upgraded installs keep the old store.

Possible fix: remove the old RepoDigests reference after a successful pull in non-backup mode too. Or record the old image IDs before pulling and docker rmi them after the containers are recreated, ignoring any still in use.

Workaround: use -b N, or run docker image prune -a afterwards.