Registries generally protect the per platform manifests while the multi-arch index that points to them still exists. Amazon ECR says an image referenced by a manifest list cannot be expired without the list going first. Plan retention around the index tag, and expect children to follow when it goes.
Definitions
A multi-arch image is published as an image index, also called a manifest list. The index holds a list of entries, one per platform such as amd64 and arm64, each pointing to a platform manifest by digest. When you pull by tag, the client reads the index and picks the entry for its platform.
Why children look untagged
Only the index carries the tag. The platform manifests are reached by digest and usually have no tag of their own. In a repository listing they can appear as untagged images. That is the source of a common scare: an untagged cleanup rule seems to threaten the images behind your tag.
What the registries say
- ECR: if an image is referenced by a manifest list, it cannot be expired or archived without the manifest list being deleted or archived first.
- Artifact Registry: cleanup policies for Docker images do not delete images referenced by a parent manifest. If the parent is deleted, related images are deleted the next time the policy runs.
- Azure: its untagged manifest retention covers Docker manifest media types including manifest lists, but it states that OCI media types such as the OCI image index are not supported by that feature, and points to the purge command for them.
The practical reading: the index is the thing to manage. Write rules against the index tags and let children follow.
Pitfalls
| Pitfall | What to do |
|---|---|
| Counting images by listing entries, so one release looks like three | Count by index tag, not by manifest |
| A rule that matches children by age before the parent is eligible | Rely on the registry's protection, and confirm with the preview |
| Cleanup tools with different media type support | Test with a multi-arch image before trusting a tool |
| Retagging only one platform manifest | Retag the index instead |
Scanning follows the same logic
Each platform manifest can have different packages and different findings. If your retention keeps the index, keep in mind that scans should cover every platform you ship. See scan multi-arch images, every platform and multi-arch image index digest, which one to pin.
A test worth running
- Push a small multi-arch image with one tag.
- Run your retention preview with an untagged rule.
- Confirm the platform manifests are not listed for removal.
- Repeat after letting a rule expire the index, and confirm children go too.
Quick check
Are the platform manifests of a tagged index really untagged?
They often show as untagged in listings, yet they are referenced by the index. Registries documented here protect them while the index exists.
Should I pin the index or a platform digest?
Usually the index digest, so each platform pulls the right image. See the linked post on pinning.
Sources
- Amazon ECR lifecycle policies
- Artifact Registry cleanup policies
- Azure Container Registry retention for untagged manifests
Last reviewed: 19 October 2026.
