at-container-registry/scanner/internal/scan/sweep.go

package scan

import (
	"errors"
	"io/fs"
	"log/slog"
	"os"
	"path/filepath"
	"strings"
	"time"
)

// The three directory shapes a scan leaves directly under the configured tmp
// dir. Everything created here is per-job and disposable:
//
//	scan-*            buildOCILayout's downloaded OCI layout
//	syft-scan-*       stereoscope's extraction root (syftTempDirName)
//	syft-cataloger-*  Syft's own cataloging scratch, created inside itself
//
// Only these are ever swept. The Grype database lives beside the tmp dir at
// <parent>/vulndb and go-getter unpacks its downloads into a grype-dl
// directory underneath it; both are state the scanner needs and neither
// matches a prefix here.
const (
	scanDirPrefix = "scan-"
	// syftTempDirName is the root prefix handed to stereoscope's
	// TempDirGenerator in syft.go, which appends "-" and a random suffix.
	syftTempDirName = "syft-scan"
	// syftCatalogerPrefix is Syft's, not ours: it opens its own generator
	// during cataloging. Named here because the sweep is the only thing that
	// reclaims one after a crash.
	syftCatalogerPrefix = "syft-cataloger-"
)

// sweepPrefixes is the full set, defined once so the creators above and the
// sweeper below cannot drift apart.
var sweepPrefixes = []string{scanDirPrefix, syftTempDirName + "-", syftCatalogerPrefix}

// sweepTmpDir removes scan leftovers older than maxAge from tmpDir.
//
// The per-job error paths already clean up after themselves; what they cannot
// do is clean up after a process that dies mid-scan. A restart — a deploy
// included — permanently orphans whatever was in flight, and on seamark-hold
// that reached 8.8 GB on a 20 GB disk before scans started failing with "no
// space left on device". Nothing else ever reclaims these, so startup does.
//
// Only direct children matching sweepPrefixes are considered, and only
// directories: the tmp dir is shared with state the scanner needs. maxAge is
// what makes this safe to run while another scanner shares the directory —
// its in-flight scan-* dir is minutes old, not hours. A maxAge of zero or less
// disables the sweep entirely rather than removing a peer's live work.
//
// Nothing here is fatal. Every failure is logged and the sweep moves on, so a
// permission problem in the tmp dir cannot stop the scanner from starting.
func sweepTmpDir(tmpDir string, maxAge time.Duration) {
	if tmpDir == "" || maxAge <= 0 {
		return
	}

	entries, err := os.ReadDir(tmpDir)
	if err != nil {
		// A tmp dir that does not exist yet is the normal first-boot state,
		// not something to warn about.
		if !errors.Is(err, fs.ErrNotExist) {
			slog.Warn("Failed to sweep scanner tmp dir", "dir", tmpDir, "error", err)
		}
		return
	}

	cutoff := time.Now().Add(-maxAge)
	var removed int
	var reclaimed int64
	for _, entry := range entries {
		if !entry.IsDir() || !sweepable(entry.Name()) {
			continue
		}
		info, err := entry.Info()
		if err != nil {
			slog.Warn("Failed to stat stale scan directory", "name", entry.Name(), "error", err)
			continue
		}
		if info.ModTime().After(cutoff) {
			continue
		}

		// Measured before the removal, because afterwards there is nothing
		// left to measure. Best effort: a directory that cannot be walked is
		// still worth removing, it just goes unaccounted for.
		path := filepath.Join(tmpDir, entry.Name())
		size := dirSize(path)
		if err := os.RemoveAll(path); err != nil {
			slog.Warn("Failed to remove stale scan directory", "dir", path, "error", err)
			continue
		}
		removed++
		reclaimed += size
	}

	slog.Info("Swept scanner tmp dir",
		"dir", tmpDir,
		"removed", removed,
		"bytes", reclaimed,
		"older_than", maxAge)
}

// sweepable reports whether a directory name is one of ours.
func sweepable(name string) bool {
	for _, prefix := range sweepPrefixes {
		if strings.HasPrefix(name, prefix) {
			return true
		}
	}
	return false
}

// dirSize sums the file sizes under path, ignoring anything it cannot read.
// It exists only to put a number in the sweep's log line.
func dirSize(path string) int64 {
	var total int64
	_ = filepath.WalkDir(path, func(_ string, d fs.DirEntry, err error) error {
		if err != nil || d.IsDir() {
			return nil //nolint:nilerr // an unreadable subtree is skipped, not fatal
		}
		if info, err := d.Info(); err == nil {
			total += info.Size()
		}
		return nil
	})
	return total
}