Question: why microk8s.ctr shows additional container images tagged by hash

[mshlain]

Hi!
Every time we load a container image into our cluster, or even on 'clean' cluster with only default images, there are additional entries that are tagged by hash:

zadmin@lima-default:~$ /snap/bin/microk8s.ctr image ls | awk '{print $1}'
REF
docker.io/calico/cni:v3.25.1
docker.io/calico/cni@sha256:9a2c99f0314053aa11e971bd5d72e17951767bf5c6ff1fd9c38c4582d7cb8a0a
docker.io/calico/node:v3.25.1
docker.io/calico/node@sha256:0cd00e83d06b3af8cd712ad2c310be07b240235ad7ca1397e04eb14d20dcc20f
docker.io/cdkbot/hostpath-provisioner:1.4.2
docker.io/cdkbot/hostpath-provisioner@sha256:b8e7be62e9c072adc52ca7e0ff4cffd3687cc39e98171b07884c456104e3fc5c
docker.io/coredns/coredns:1.10.1
docker.io/coredns/coredns@sha256:a0ead06651cf580044aeb0a0feba63591858fb2e43ade8c9dea45a6a89ae7e5e
registry.k8s.io/metrics-server/metrics-server:v0.6.3
registry.k8s.io/metrics-server/metrics-server@sha256:c60778fa1c44d0c5a0c4530ebe83f9243ee6fc02f4c3dc59226c201931350b10
registry.k8s.io/pause:3.7
registry.k8s.io/pause@sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c
sha256:273313a9d5b2b8472d56ce902dfd7b3050d19b150490216cb853c70906c9d61b
sha256:7da6d0c65048c800463b51e8c3dba5a8456ff9b9c05b34c6f038cf9f78098c00
sha256:8e22bf689cda7eb34081c7bed8d3c97fac366b3d9b60c829a6719249f4684cd8
sha256:950d5738db8bc62ff67fcdca15150c6c6e5c2ffb964b57b4cfed25d5b73fa7e1
sha256:97e04611ad43405a2e5863ae17c6f1bc9181bdefdaa78627c432ef754a4eb108
sha256:d314245e1354d8887517f9ac13afd9a925953c5a9a0c35cc2284d08f86cbbd4b
sha256:e5a475a0380575fb5df454b2e32bdec93e1ec0094d8a61e895b41567cb884550

Please excuse my ignorance, i could not find any good answer on what are the entries like:

docker.io/calico/cni@sha256:9a2c99f0314053aa11e971bd5d72e17951767bf5c6ff1fd9c38c4582d7cb8a0a

or even

sha256:e5a475a0380575fb5df454b2e32bdec93e1ec0094d8a61e895b41567cb884550

do they take additional disk space?
is it safe to delete them?

Thanks in advance

[neoaggelos]

Hi @mshlain

These entries are created by containerd, and are using the image hash as the tag. They do not take any extra space (if you drop the awk, you'll see the same digest hash and size.

They are safe to ignore, and if you remove them containerd will probably re-create them. An easy oneliner is to ignore them with microk8s ctr image ls | grep -v 'sha256:'