Sort by uploaded date when creation date is old

.github/workflows/test.yml

@@ -0,0 +1,34 @@
+name: 'test'
+
+on:
+  push:
+    branches:
+    - 'main'
+    tags:
+    - '*'
+  pull_request:
+    branches:
+    - 'main'
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: 'ubuntu-latest'
+
+    steps:
+    - uses: 'actions/checkout@v3'
+
+    - uses: 'actions/setup-go@v3'
+      with:
+        go-version: '1.18'
+
+    - uses: 'actions/cache@v3'
+      with:
+        path: |-
+          ~/.cache/go-build
+          ~/go/pkg/mod
+        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+        restore-keys: |-
+          ${{ runner.os }}-go-
+
+    - run: 'make test'

Makefile

@@ -18,3 +18,12 @@ docker-push:
 		--config ./cloudbuild/cloudbuild.yaml \
 		.
 .PHONY: docker-push
+
+test:
+	@go test \
+		-count=1 \
+		-race \
+		-shuffle=on \
+		-timeout=10m \
+		./...
+.PHONY: test

README.md

@@ -183,8 +183,24 @@ The payload is expected to be JSON with the following fields:
   the duration will not be deleted. If unspecified, the default is no grace
   period (all untagged image refs are deleted).
 
-- `keep` - If an integer is provided, it will always keep that minimum number
-  of images. Note that it will not consider images inside the `grace` duration.
+- `keep` - If an integer is provided, it will always keep that minimum number of
+  images. Note that it will not consider images inside the `grace` duration. GCR
+  Cleaner attempts to keep the most recently created images, but there are some
+  caveats. Some community tooling sets container creation time to a date back in
+  1980, which breaks the default sorting algorithm. As such, GCR Cleaner uses
+  the following sorting algorithm for container images:
+
+    - If either of the containers were created before Docker even existed, it
+      sorts by the date the container was uploaded to the registry.
+
+    - If two containers were created at the same timestamp, it sorts by the date
+      the container was uploaded to the registry.
+
+    - In all other situations, it sorts by the timestamp the container was
+      created.
+
+  This algorithm exists to preserve ordering for containers that are moved
+  between registries.
 
 - `tag_filter_any` - If specified, any image with at **least one tag** that
   matches this given regular expression will be deleted. The image will be

pkg/gcrcleaner/cleaner.go

@@ -31,6 +31,16 @@ import (
 	gcrremote "github.com/google/go-containerregistry/pkg/v1/remote"
 )
 
+// dockerExistence is date of the first release of Docker[1] (then dotCloud) and
+// marks the first possible date in which Docker containers could feasibly have
+// been created. We need this because some tools set the container's CreatedDate
+// to a very old value[2] and thus sorting by creation date fails.
+//
+// [1]: https://en.wikipedia.org/wiki/Docker_(software)
+//
+// [2]: https://buildpacks.io/docs/features/reproducibility/
+var dockerExistence = time.Date(2013, time.March, 20, 0, 0, 0, 0, time.UTC)
+
 // Cleaner is a gcr cleaner.
 type Cleaner struct {
 	auther      gcrauthn.Authenticator
@@ -78,9 +88,22 @@ func (c *Cleaner) Clean(ctx context.Context, repo string, since time.Time, keep
 		manifests = append(manifests, &manifest{repo, k, m})
 	}
 
-	// Sort manifest by Created from the most recent to the least
+	// Sort manifests. If either of the containers were created before Docker even
+	// existed, we fall back to the upload date. This can happen with some
+	// community build tools. If two containers were created at the same time, we
+	// fall back to the upload date. Otherwise, we sort by the container creation
+	// date.
 	sort.Slice(manifests, func(i, j int) bool {
-		return manifests[j].Info.Created.Before(manifests[i].Info.Created)
+		jCreated, jUploaded := manifests[j].Info.Created, manifests[j].Info.Uploaded
+		iCreated, iUploaded := manifests[i].Info.Created, manifests[i].Info.Uploaded
+
+		// If either container has a CreateTime that predates Docker's existence, or
+		// the contains have the same creation time, fallback to the uploaded time.
+		if jCreated.Before(dockerExistence) || iCreated.Before(dockerExistence) || jCreated.Equal(iCreated) {
+			return jUploaded.Before(iUploaded)
+		}
+
+		return jCreated.Before(iCreated)
 	})
 
 	// Generate an ordered map