Add per-application Docker image retention for rollback (#7504)

app/Actions/Server/CleanupDocker.php

@@ -13,7 +13,6 @@ class CleanupDocker
 
     public function handle(Server $server, bool $deleteUnusedVolumes = false, bool $deleteUnusedNetworks = false)
     {
-        $settings = instanceSettings();
         $realtimeImage = config('constants.coolify.realtime_image');
         $realtimeImageVersion = config('constants.coolify.realtime_version');
         $realtimeImageWithVersion = "$realtimeImage:$realtimeImageVersion";
@@ -26,9 +25,25 @@ class CleanupDocker
         $helperImageWithoutPrefix = 'coollabsio/coolify-helper';
         $helperImageWithoutPrefixVersion = "coollabsio/coolify-helper:$helperImageVersion";
 
+        $cleanupLog = [];
+
+        // Get all application image repositories to exclude from prune
+        $applications = $server->applications();
+        $applicationImageRepos = collect($applications)->map(function ($app) {
+            return $app->docker_registry_image_name ?? $app->uuid;
+        })->unique()->values();
+
+        // Clean up old application images while preserving N most recent for rollback
+        $applicationCleanupLog = $this->cleanupApplicationImages($server, $applications);
+        $cleanupLog = array_merge($cleanupLog, $applicationCleanupLog);
+
+        // Build image prune command that excludes application images
+        // This ensures we clean up non-Coolify images while preserving rollback images
+        $imagePruneCmd = $this->buildImagePruneCommand($applicationImageRepos);
+
         $commands = [
             'docker container prune -f --filter "label=coolify.managed=true" --filter "label!=coolify.proxy=true"',
-            'docker image prune -af --filter "label!=coolify.managed=true"',
+            $imagePruneCmd,
             'docker builder prune -af',
             "docker images --filter before=$helperImageWithVersion --filter reference=$helperImage | grep $helperImage | awk '{print $3}' | xargs -r docker rmi -f",
             "docker images --filter before=$realtimeImageWithVersion --filter reference=$realtimeImage | grep $realtimeImage | awk '{print $3}' | xargs -r docker rmi -f",
@@ -44,7 +59,6 @@ class CleanupDocker
             $commands[] = 'docker network prune -f';
         }
 
-        $cleanupLog = [];
         foreach ($commands as $command) {
             $commandOutput = instant_remote_process([$command], $server, false);
             if ($commandOutput !== null) {
@@ -57,4 +71,122 @@ class CleanupDocker
 
         return $cleanupLog;
     }
+
+    /**
+     * Build a docker image prune command that excludes application image repositories.
+     *
+     * Since docker image prune doesn't support excluding by repository name directly,
+     * we use a shell script approach to delete unused images while preserving application images.
+     */
+    private function buildImagePruneCommand($applicationImageRepos): string
+    {
+        // Step 1: Always prune dangling images (untagged)
+        $commands = ['docker image prune -f'];
+
+        if ($applicationImageRepos->isEmpty()) {
+            // No applications, add original prune command for all unused images
+            $commands[] = 'docker image prune -af --filter "label!=coolify.managed=true"';
+        } else {
+            // Build grep pattern to exclude application image repositories
+            $excludePatterns = $applicationImageRepos->map(function ($repo) {
+                // Escape special characters for grep extended regex (ERE)
+                // ERE special chars: . \ + * ? [ ^ ] $ ( ) { } |
+                return preg_replace('/([.\\\\+*?\[\]^$(){}|])/', '\\\\$1', $repo);
+            })->implode('|');
+
+            // Delete unused images that:
+            // - Are not application images (don't match app repos)
+            // - Don't have coolify.managed=true label
+            // Images in use by containers will fail silently with docker rmi
+            // Pattern matches both uuid:tag and uuid_servicename:tag (Docker Compose with build)
+            $commands[] = "docker images --format '{{.Repository}}:{{.Tag}}' | ".
+                "grep -v -E '^({$excludePatterns})[_:].+' | ".
+                "grep -v '<none>' | ".
+                "xargs -r -I {} sh -c 'docker inspect --format \"{{{{index .Config.Labels \\\"coolify.managed\\\"}}}}\" \"{}\" 2>/dev/null | grep -q true || docker rmi \"{}\" 2>/dev/null' || true";
+        }
+
+        return implode(' && ', $commands);
+    }
+
+    private function cleanupApplicationImages(Server $server, $applications = null): array
+    {
+        $cleanupLog = [];
+
+        if ($applications === null) {
+            $applications = $server->applications();
+        }
+
+        $disableRetention = $server->settings->disable_application_image_retention ?? false;
+
+        foreach ($applications as $application) {
+            $imagesToKeep = $disableRetention ? 0 : ($application->settings->docker_images_to_keep ?? 2);
+            $imageRepository = $application->docker_registry_image_name ?? $application->uuid;
+
+            // Get the currently running image tag
+            $currentTagCommand = "docker inspect --format='{{.Config.Image}}' {$application->uuid} 2>/dev/null | grep -oP '(?<=:)[^:]+$' || true";
+            $currentTag = instant_remote_process([$currentTagCommand], $server, false);
+            $currentTag = trim($currentTag ?? '');
+
+            // List all images for this application with their creation timestamps
+            // Use wildcard to match both uuid:tag and uuid_servicename:tag (Docker Compose with build)
+            $listCommand = "docker images --format '{{.Repository}}:{{.Tag}}#{{.CreatedAt}}' --filter reference='{$imageRepository}*' 2>/dev/null || true";
+            $output = instant_remote_process([$listCommand], $server, false);
+
+            if (empty($output)) {
+                continue;
+            }
+
+            $images = collect(explode("\n", trim($output)))
+                ->filter()
+                ->map(function ($line) {
+                    $parts = explode('#', $line);
+                    $imageRef = $parts[0] ?? '';
+                    $tagParts = explode(':', $imageRef);
+
+                    return [
+                        'repository' => $tagParts[0] ?? '',
+                        'tag' => $tagParts[1] ?? '',
+                        'created_at' => $parts[1] ?? '',
+                        'image_ref' => $imageRef,
+                    ];
+                })
+                ->filter(fn ($image) => ! empty($image['tag']));
+
+            // Separate images into categories
+            // PR images (pr-*) and build images (*-build) are excluded from retention
+            // Build images will be cleaned up by docker image prune -af
+            $prImages = $images->filter(fn ($image) => str_starts_with($image['tag'], 'pr-'));
+            $regularImages = $images->filter(fn ($image) => ! str_starts_with($image['tag'], 'pr-') && ! str_ends_with($image['tag'], '-build'));
+
+            // Always delete all PR images
+            foreach ($prImages as $image) {
+                $deleteCommand = "docker rmi {$image['image_ref']} 2>/dev/null || true";
+                $deleteOutput = instant_remote_process([$deleteCommand], $server, false);
+                $cleanupLog[] = [
+                    'command' => $deleteCommand,
+                    'output' => $deleteOutput ?? 'PR image removed or was in use',
+                ];
+            }
+
+            // Filter out current running image from regular images and sort by creation date
+            $sortedRegularImages = $regularImages
+                ->filter(fn ($image) => $image['tag'] !== $currentTag)
+                ->sortByDesc('created_at')
+                ->values();
+
+            // Keep only N images (imagesToKeep), delete the rest
+            $imagesToDelete = $sortedRegularImages->skip($imagesToKeep);
+
+            foreach ($imagesToDelete as $image) {
+                $deleteCommand = "docker rmi {$image['image_ref']} 2>/dev/null || true";
+                $deleteOutput = instant_remote_process([$deleteCommand], $server, false);
+                $cleanupLog[] = [
+                    'command' => $deleteCommand,
+                    'output' => $deleteOutput ?? 'Image removed or was in use',
+                ];
+            }
+        }
+
+        return $cleanupLog;
+    }
 }

app/Jobs/ApplicationDeploymentJob.php

@@ -620,7 +620,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 $this->application_deployment_queue->addLogEntry('Build secrets are configured. Ensure your docker-compose file includes build.secrets configuration for services that need them.');
             }
         } else {
-            $composeFile = $this->application->parse(pull_request_id: $this->pull_request_id, preview_id: data_get($this->preview, 'id'));
+            $composeFile = $this->application->parse(pull_request_id: $this->pull_request_id, preview_id: data_get($this->preview, 'id'), commit: $this->commit);
             // Always add .env file to services
             $services = collect(data_get($composeFile, 'services', []));
             $services = $services->map(function ($service, $name) {

app/Livewire/Project/Application/Rollback.php

@@ -4,6 +4,7 @@ namespace App\Livewire\Project\Application;
 
 use App\Models\Application;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Validate;
 use Livewire\Component;
 use Visus\Cuid2\Cuid2;
 
@@ -19,9 +20,30 @@ class Rollback extends Component
 
     public array $parameters;
 
+    #[Validate(['integer', 'min:0', 'max:100'])]
+    public int $dockerImagesToKeep = 2;
+
+    public bool $serverRetentionDisabled = false;
+
     public function mount()
     {
         $this->parameters = get_route_parameters();
+        $this->dockerImagesToKeep = $this->application->settings->docker_images_to_keep ?? 2;
+        $server = $this->application->destination->server;
+        $this->serverRetentionDisabled = $server->settings->disable_application_image_retention ?? false;
+    }
+
+    public function saveSettings()
+    {
+        try {
+            $this->authorize('update', $this->application);
+            $this->validate();
+            $this->application->settings->docker_images_to_keep = $this->dockerImagesToKeep;
+            $this->application->settings->save();
+            $this->dispatch('success', 'Settings saved.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function rollbackImage($commit)
@@ -66,14 +88,12 @@ class Rollback extends Component
                     return str($item)->contains($image);
                 })->map(function ($item) {
                     $item = str($item)->explode('#');
-                    if ($item[1] === $this->current) {
-                        // $is_current = true;
-                    }
+                    $is_current = $item[1] === $this->current;
 
                     return [
                         'tag' => $item[1],
                         'created_at' => $item[2],
-                        'is_current' => $is_current ?? null,
+                        'is_current' => $is_current,
                     ];
                 })->toArray();
             }

app/Livewire/Server/DockerCleanup.php

@@ -31,6 +31,9 @@ class DockerCleanup extends Component
     #[Validate('boolean')]
     public bool $deleteUnusedNetworks = false;
 
+    #[Validate('boolean')]
+    public bool $disableApplicationImageRetention = false;
+
     public function mount(string $server_uuid)
     {
         try {
@@ -52,6 +55,7 @@ class DockerCleanup extends Component
             $this->server->settings->docker_cleanup_threshold = $this->dockerCleanupThreshold;
             $this->server->settings->delete_unused_volumes = $this->deleteUnusedVolumes;
             $this->server->settings->delete_unused_networks = $this->deleteUnusedNetworks;
+            $this->server->settings->disable_application_image_retention = $this->disableApplicationImageRetention;
             $this->server->settings->save();
         } else {
             $this->forceDockerCleanup = $this->server->settings->force_docker_cleanup;
@@ -59,6 +63,7 @@ class DockerCleanup extends Component
             $this->dockerCleanupThreshold = $this->server->settings->docker_cleanup_threshold;
             $this->deleteUnusedVolumes = $this->server->settings->delete_unused_volumes;
             $this->deleteUnusedNetworks = $this->server->settings->delete_unused_networks;
+            $this->disableApplicationImageRetention = $this->server->settings->disable_application_image_retention;
         }
     }
 

app/Models/Application.php

@@ -1500,10 +1500,10 @@ class Application extends BaseModel
         instant_remote_process($commands, $this->destination->server, false);
     }
 
-    public function parse(int $pull_request_id = 0, ?int $preview_id = null)
+    public function parse(int $pull_request_id = 0, ?int $preview_id = null, ?string $commit = null)
     {
         if ((int) $this->compose_parsing_version >= 3) {
-            return applicationParser($this, $pull_request_id, $preview_id);
+            return applicationParser($this, $pull_request_id, $preview_id, $commit);
         } elseif ($this->docker_compose_raw) {
             return parseDockerComposeFile(resource: $this, isNew: false, pull_request_id: $pull_request_id, preview_id: $preview_id);
         } else {

app/Models/ApplicationSetting.php

@@ -25,6 +25,7 @@ class ApplicationSetting extends Model
         'is_git_submodules_enabled' => 'boolean',
         'is_git_lfs_enabled' => 'boolean',
         'is_git_shallow_clone_enabled' => 'boolean',
+        'docker_images_to_keep' => 'integer',
     ];
 
     protected $guarded = [];

app/Models/ServerSetting.php

@@ -61,6 +61,7 @@ class ServerSetting extends Model
         'is_reachable' => 'boolean',
         'is_usable' => 'boolean',
         'is_terminal_enabled' => 'boolean',
+        'disable_application_image_retention' => 'boolean',
     ];
 
     protected static function booted()