Docker CI Jobs Need Cleanup Contracts
CI cleanup is usually treated as housekeeping. In a busy Docker pipeline, that is the wrong mental model. A container, temporary database, test inbox, or cloud runner left behind can change the next build, inflate costs, and make an incident harder to explain. I started treating cleanup as part of the job's reliability contract. The job must say what it owns, how long the ownership lasts, and…
Docker CI jobs require a more structured approach to cleanup tasks to ensure reliability and cost control. Leaving behind temporary resources like containers, databases, or cloud services can negatively impact subsequent builds, increase expenses, and complicate incident investigations. Treating cleanup as an integral part of a job's reliability contract can help maintain a clearer pipeline, especially when builds are interrupted mid-deployment.
To implement a Docker CI cleanup contract, every resource must be assigned a unique run ID and owner. This approach makes it easier to identify and remove resources during cleanup. Define ownership for all ephemeral resources, including Docker containers, networks, volumes, build cache entries, temporary databases, cloud security groups, log groups, and runners.
For each resource, record four fields: Owner (workflow and run ID), Expiry (maximum useful lifetime), Reaper (command for removal), and Evidence (log line, metric, or API result confirming the action).
During the cleanup process, preserve the original test or build exit code to maintain consistency. Use a trap to run the cleanup function when the job exits, is interrupted, or times out. Avoid using generic search strings for identifying temporary resources; instead, use run ID-specific labels. Implement an external reaper to remove resources older than a safe threshold, especially in case of runner disappearances.
Include structured logs with the run ID, resource type, ID, action, and result to improve trust in the cleanup process. Emit searchable evidence with a stable run ID and ensure sensitive test data is expired separately from container cleanup. Although achieving perfect cleanup is challenging due to distributed jobs and odd failures, the goal is bounded failure – operators should know what resources a job owned, how long they remain, and which process handles removal.
Following this cleanup contract can transform Docker CI from an unreliable process into a more predictable and manageable operation.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.