Be able to force deletion on immutable tags

[flbla]

As a user I would like to use immutable tags to avoid the same tag to be push on a existing one.
But I would also like to be able to force deletion of an existing immutable tag.
A similar feature exist on Artifactory.

[MatthewJohn]

I'm interested in this - from a security standpoint, the tags should be immutable (from the point of, they should be protected from being overriden). But deleting old artifacts is useful (the immutability pattern isn't complex enough to know "what is the latest or in-use version).
From this point, perhaps being able to have purging patterns that don't just delete the image, but also stop it from being used (perhaps being replaced with a dummy image). This would protect from old versions being exploited by a malicious upload after deletion, but also mean disk space can be saved.

Otherwise, the "only" way I can see is:

• Disable retention rule schedules
• Create a job (using some other tooling) to:
  • De-activate immutibility rule
  • Manually run retention rule
  • Re-activate immutibility rule
• This would need to run per project

The unfortunate side-affect of this is that, during this, immutibility would be completely disabled, meaning that malicious users could replace any tags during this period. The only way around this would be to have some "maintenance window" where all write access is disabled whilst the immutibility rules are disabled.
The other issue is that deleted tags could be re-uploaded at any time with malicious payloads. But, during this process the tag could be replaced with a dummy image - but then the process needs to be aware of the tags that are being removed by the retention rule, which adds even more complexity.

If this task isn't prioritised, I might think about creating a job with rules to attempt to achieve this and see how it looks

[eloo-abi]

Hi there,
just found this discussions as we are also looking for exactly the feature.
in our case its a scenario like this

we need to make sure tags are immutable for a specific time e.g. 3 years..
after this 3 years we want to remove the images to not get a mess in future.

so we would need some kind of mix of retention and immutability in this time