Summary
Immutable artifacts cached by the pull-through proxy are never reclaimed. After nora mirror rpm/deb (which bulk-fetches an entire upstream — potentially tens of GB) the cache grows until an operator prunes storage by hand.
Surfaced while reviewing #864 (rpm/deb pull-through proxy + offline mirror), now merged as 26d3f9f.
Details
Proxy downloads cache packages via spawn_cache_immutable, which writes only the payload — no metadata sidecar. As a result:
- Retention groups versions from the
.nora-meta/*.json sidecars (collect_sidecar_versions), so it never sees proxy-cached packages — keep_last / age policies don't apply to them.
- GC lists
rpm/, deb/ (and gems/ conan/ nuget/ ansible/ terraform/) under uncovered — it reports that data exists but never reclaims it (orphan-graph GC only; no size/LRU eviction).
Impact
An operator who mirrors a large distro repo, or runs a long-lived proxy under load, sees storage grow with no built-in bound. On Kubernetes a PVC must be pre-sized for the full mirror; there is no eviction to fall back on.
Proposed
- Size/LRU-bounded proxy-cache eviction: walk
{format}/{repo}/ by mtime/last-access, evict oldest until under a configured byte cap (proxy_cache_max_bytes?).
- Or: write a lightweight proxy sidecar so existing retention age-policies apply to cached packages too.
- Interim: document as a known limitation in COMPAT.md and expose a storage-size alert recipe.
Not a regression
#864 follows the existing proxy-cache model exactly; this is a pre-existing class-wide gap (all proxy formats) surfaced by adding first-class bulk mirroring for rpm/deb.
Summary
Immutable artifacts cached by the pull-through proxy are never reclaimed. After
nora mirror rpm/deb(which bulk-fetches an entire upstream — potentially tens of GB) the cache grows until an operator prunes storage by hand.Surfaced while reviewing #864 (rpm/deb pull-through proxy + offline mirror), now merged as
26d3f9f.Details
Proxy downloads cache packages via
spawn_cache_immutable, which writes only the payload — no metadata sidecar. As a result:.nora-meta/*.jsonsidecars (collect_sidecar_versions), so it never sees proxy-cached packages —keep_last/ age policies don't apply to them.rpm/,deb/(andgems/ conan/ nuget/ ansible/ terraform/) underuncovered— it reports that data exists but never reclaims it (orphan-graph GC only; no size/LRU eviction).Impact
An operator who mirrors a large distro repo, or runs a long-lived proxy under load, sees storage grow with no built-in bound. On Kubernetes a PVC must be pre-sized for the full mirror; there is no eviction to fall back on.
Proposed
{format}/{repo}/by mtime/last-access, evict oldest until under a configured byte cap (proxy_cache_max_bytes?).Not a regression
#864 follows the existing proxy-cache model exactly; this is a pre-existing class-wide gap (all proxy formats) surfaced by adding first-class bulk mirroring for rpm/deb.