atlas-iac/services/maintenance/node-ops/scripts/node_image_sweeper.sh

#!/bin/sh
set -eu

ONE_SHOT=${ONE_SHOT:-false}
SWEEP_INTERVAL_SEC=${SWEEP_INTERVAL_SEC:-21600}
HIGH_USAGE_PERCENT=${HIGH_USAGE_PERCENT:-70}
EMERGENCY_USAGE_PERCENT=${EMERGENCY_USAGE_PERCENT:-85}
LOG_RETENTION_DAYS=${LOG_RETENTION_DAYS:-7}
ORPHAN_POD_RETENTION_DAYS=${ORPHAN_POD_RETENTION_DAYS:-3}
JOURNAL_MAX_SIZE=${JOURNAL_MAX_SIZE:-200M}

sweep_once() {
  usage=$(df -P /host | awk 'NR==2 {gsub(/%/,"",$5); print $5}') || usage=""

  # crictl image metadata frequently omits createdAt on this cluster; prune by
  # runtime reachability whenever rootfs crosses pressure thresholds.
  if [ -n "${usage}" ] && [ "${usage}" -ge "${HIGH_USAGE_PERCENT}" ]; then
    chroot /host /bin/sh -c "crictl rmi --prune >/dev/null 2>&1 || true"
  fi

  # Kubelet owns active logs; retain every active UID, including quiet pods.
  python3 /scripts/node_pod_log_cleanup.py --host-root /host \
    --retention-days "${ORPHAN_POD_RETENTION_DAYS}"

  if [ -d /host/var/log.hdd/containers ]; then
    find /host/var/log.hdd/containers -xtype l -print -delete 2>/dev/null || true
  fi

  find /host/var/lib/rancher/k3s/agent/images -type f -name "*.tar" -mtime +7 -print -delete 2>/dev/null || true
  find /host/var/lib/rancher/k3s/agent/containerd -maxdepth 1 -type f -mtime +7 -print -delete 2>/dev/null || true

  if [ -n "${usage}" ] && [ "${usage}" -ge "${EMERGENCY_USAGE_PERCENT}" ]; then
    # Emergency pass for rootfs pressure on SD-backed nodes.
    chroot /host /bin/sh -c "crictl rmi --prune >/dev/null 2>&1 || true"
    chroot /host /bin/sh -c "journalctl --vacuum-size='${JOURNAL_MAX_SIZE}' >/dev/null 2>&1 || true"
    # Pod logs are handled only by the UID-aware check above.
    find /host/var/log -path /host/var/log/pods -prune -o -type f -name "*.gz" -mtime +"${LOG_RETENTION_DAYS}" -print -exec rm -f {} \; 2>/dev/null || true
    find /host/var/log.hdd -path /host/var/log.hdd/pods -prune -o -type f -name "*.gz" -mtime +"${LOG_RETENTION_DAYS}" -print -exec rm -f {} \; 2>/dev/null || true
    chroot /host /bin/sh -c "if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi"
  fi
}

sweep_once
touch /tmp/initial-sweep-complete

if [ "${ONE_SHOT}" = "true" ]; then
  exit 0
fi

while true; do
  sleep "${SWEEP_INTERVAL_SEC}"
  sweep_once
done