Set a retention policy that deletes images you will not deploy, keep a short list of approved images for production, and block pulls of anything outside it. Every old image is something that could be deployed by mistake and something you must scan, explain and defend.
Why stale images are a risk
A registry accumulates images with every build. Old ones carry vulnerabilities that were unknown when they were built. They can still be pulled by anyone with access, by digest or by an old tag, and a rollback script or a forgotten manifest may do exactly that. The longer the list, the more noise in your scan results.
Decide what to keep
| Image class | Suggested retention |
|---|---|
| Currently deployed digests | Keep while deployed |
| Last few releases for rollback | Keep, within a defined window |
| Release images needed for support or audit | Keep with a documented period |
| Feature branch and pull request builds | Delete after merge or a short time |
| Untagged or dangling images | Delete unless referenced by digest |
| Images with a known critical issue and a fixed replacement | Mark deprecated, then delete after migration |
Pick the periods that fit your support commitments. Do not copy someone else's numbers.
Cleanup steps
- List images and when each was last pulled and pushed.
- Cross-check with the digests running in the cluster, so you never delete something live.
- Apply retention rules by repository and by tag pattern.
- Remember that deleting a tag does not delete the content if other tags or digest references remain. Run the registry's garbage collection or equivalent.
- Check for attached SBOMs and signatures, and decide whether they follow the image.
- Alert before deletion, and keep a log of what was removed.
Control who can push and pull
Retention only helps if people cannot reintroduce old content. Limit push rights to build systems, and restrict pulls in production to approved repositories. Our post on registry hardening covers access.
Use deprecation before deletion
For widely used internal images, mark a version deprecated, tell consumers, set a date, and watch pull counts fall before deleting. Surprising a team with a vanished image creates pressure to restore it.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how findings change over time on a component that nobody touches.
Quick check
Does deleting a tag free the image?
Not always. Other tags or digest references can keep the content, and storage is usually reclaimed by garbage collection.
Can I delete an image that rollback might need?
Keep the last few releases within your rollback window. Delete older ones.
Safeguard keeps dependency and SBOM inventories and applies policies; try the free scan.
Last reviewed: 19 October 2026.
