so-docker-prune error

[tsmullins]

We are having an issue with a sensor filling up disk space with error messages from Zeek crashes. While troubleshooting, we ran "sudo salt 'wispa' state.highstate" on the manager and noticed this error. The other images are at 2.3.52 and the problem sensor is at 2.3.40. Anyone know to force this removal?

Thanks,
Shane

     ID: prune_images
Function: cmd.run
    Name: so-docker-prune
  Result: False
 Comment: Command "so-docker-prune" run
 Started: 14:04:43.599761
Duration: 491.661 ms
 Changes:   
          ----------
          pid:
              14949
          retcode:
              1
          stderr:
              Traceback (most recent call last):
                File "/usr/lib/python3/dist-packages/docker/api/client.py", line 220, in _raise_for_status
                  response.raise_for_status()
                File "/usr/lib/python3/dist-packages/requests/models.py", line 935, in raise_for_status
                  raise HTTPError(http_error_msg, response=self)
              requests.exceptions.HTTPError: 409 Client Error: Conflict for url: http+docker://localunixsocket/v1.30/images/so-manager-cliffbar:5000/security-onion-solutions/so-zeek:2.3.40?force=False&noprune=False
              
              During handling of the above exception, another exception occurred:
              
              Traceback (most recent call last):
                File "/usr/sbin/so-docker-prune", line 89, in <module>
                  main(args.quiet)
                File "/usr/sbin/so-docker-prune", line 75, in main
                  client.images.remove(tag)
                File "/usr/lib/python3/dist-packages/docker/models/images.py", line 284, in remove
                  self.client.api.remove_image(*args, **kwargs)
                File "/usr/lib/python3/dist-packages/docker/utils/decorators.py", line 19, in wrapped
                  return f(self, resource_id, *args, **kwargs)
                File "/usr/lib/python3/dist-packages/docker/api/image.py", line 481, in remove_image
                  return self._result(res, True)
                File "/usr/lib/python3/dist-packages/docker/api/client.py", line 226, in _result
                  self._raise_for_status(response)
                File "/usr/lib/python3/dist-packages/docker/api/client.py", line 222, in _raise_for_status
                  raise create_api_error_from_http_exception(e)
                File "/usr/lib/python3/dist-packages/docker/errors.py", line 31, in create_api_error_from_http_exception
                  raise cls(e, response=response, explanation=explanation)
              docker.errors.APIError: 409 Client Error: Conflict ("conflict: unable to remove repository reference "so-manager-cliffbar:5000/security-onion-solutions/so-zeek:2.3.40" (must force) - container e5e8e1d75e45 is using its referenced image c4e5d27f1d63")
          stdout:
              Removing image so-manager-cliffbar:5000/security-onion-solutions/so-zeek:2.3.40

[tsmullins]

Update,

We removed the old image on the sensor with:

docker rmi -f c4e5d27f1d63

Then forced a highstate on the manager and this fixed the problem.

Shane

[TOoSmOotH]

This will be addressed in 2.3.60 as well.