This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(259.20000000000005, 68%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Team,
As far as I know AKS now use containerd in the backend. There are lot of stale images showing in the container environment of our AKS nodes.
Is there any reliable and production ready procedure to remove those stale and vulnerable images.
Kindly suggest. Thank you
Kind Regards,
Tanul
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 35%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Hello @Tanul , any update on below?
Hello @Tanul ,
Welcome to Microsoft QnA.
I had a quick word with the AKS product team on this query of yours.
We have a preview feature available just for this ask, check it out here - https://learn.microsoft.com/en-us/azure/aks/image-cleaner?tabs=azure-cli
This feature has been specifically designed to address this pain point.
Although it is in preview, it should work if you follow the steps, else if you want to wait for it to be GA, you need to manually clean up the images until ImageCleaner becomes GA, or implement the Open Source project yourself: https://github.com/Azure/eraser
However, please note that the open source project will not be supported by AKS and only via the project's GitHub issues page.
Thank you. Let me know if you have any additional questions!
-------------
If you find the above information useful, please "Accept as Answer" and "Upvote".
@srbhatta-MSFT , Thank you so much. But do we really need this.. We just checked that garbage colletion is the automatic process by kubelet
And these are the values set in AKS
--image-gc-high-threshold=85
--image-gc-low-threshold=80
I think kubelet will auto delete on its own.. Am I correct??
Disk usage above the configured HighThresholdPercent value triggers garbage collection, which deletes images in order based on the last time they were used, starting with the oldest first. The kubelet deletes images until disk usage reaches the LowThresholdPercent value
Hi @Tanul , garbage collection is used to clean images that have occupy a large disk space, and could potentially exceed resource limits or the overall available memory of worker nodes.
Whereas, ImageCleaner is used to clean stale images that might contain vulnerabilities which may pose a security concern.
Hope that clears your query!
Kubelet will auto-delete the large container images depending on the threshold value that you have set, but it is different from the stale images that you are talking about here.
Here's the docs for your reference:
https://learn.microsoft.com/en-us/azure/aks/faq#what-is-the-size-limit-on-a-container-image-in-aks
https://kubernetes.io/docs/concepts/architecture/garbage-collection/#containers-images
image-cleaner
Hope this resolves your query? :)
@srbhatta-MSFT
As its presented in this announcement in kubecon, can we consider image cleaner project production ready. Can we deploy it in prod environment as it is still in preview mode.
Hi @Tanul , as you can see it is mentioned that it is in preview, which implies that it is not yet production ready or GA.
Apply what's automated in this tool manually should work, but just so we are clear this feature is specifically for this pain point, therefore it is the way forward.
If you are still not sure, then you will have to wait till the feature become GA. Or, if you want to discuss about this feature with somebody from the AKS support team, I can also help you raise a support request just so that you get all the clarity. Do let me know if that will help you further.
@srbhatta-MSFT , Hey is it possible to run this image cleaner without running this command. I don't have subscription level access.
az feature register