[ihavespoons]

The problem

Each update pulls a new tag of every Sibyl service image, and Podman keeps the old tags. On the test host, podman system df reports 179 images, with 42.37 GB reclaimable.

The change

• /usr/libexec/sibyl/image-prune reads /usr/share/sibyl/image-tag from every bootc deployment: booted, rollback and staged. It keeps the ghcr.io/diffsec/sibyl-* images with those tags and their backend variants, such as -hip and -vulkan. A rollback therefore needs no download.
• It removes every other ghcr.io/diffsec/sibyl-* tag, then runs podman image prune, which removes only untagged images that no container uses. It does not touch other images, such as those of the stacks that Arcane runs.
• Podman refuses to remove an image that a container uses. The script logs such an image and keeps it.
• If it finds no valid deployment tag, it removes nothing.
• --dry-run lists what it would remove and changes nothing.
• sibyl-image-prune.timer runs it 15 minutes after boot and then daily, at idle I/O priority.
• The update guide and the design overview describe it.

Verification

• internal/hostctl/prune_test.go runs the script with a fake podman. It tests the kept tags and variants, a tag that only starts with a kept tag (sha-newer), an image in use, other repositories, no deployment, a bad tag file and the dry run. Removing the variant match fails the test.
• On the test host, --dry-run keeps sha-18c6914 and sha-0e719a2 and lists 133 tags. It removed nothing, because a training run is in progress there.
• The arm64 image builds with the timer enabled, and bootc container lint passes 14 checks. go vet, go test -race, golangci-lint (0 issues) and shellcheck pass.

🤖 Generated with Claude Code