diff --git a/articles/container-registry/container-registry-auto-purge.md b/articles/container-registry/container-registry-auto-purge.md index 4696019c6..b19a922da 100644 --- a/articles/container-registry/container-registry-auto-purge.md +++ b/articles/container-registry/container-registry-auto-purge.md @@ -6,7 +6,7 @@ ms.service: azure-container-registry ms.custom: devx-track-azurecli author: KumudD ms.author: kumud -ms.date: 02/26/2026 +ms.date: 07/08/2026 # Customer intent: As a developer, I want to efficiently purge old or unnecessary images from my container registry, so that I can maintain an organized and optimally performing storage environment. --- @@ -34,7 +34,7 @@ To delete single image tags or manifests by using Azure CLI commands, see [Delet The `acr purge` command deletes images by tag in a repository. It deletes all images that match a name filter and are older than a specified duration. By default, the command deletes only tag references, not the underlying [manifests](container-registry-concepts.md#manifest) and layer data. The command has an option to also delete manifests. > [!NOTE] -> `acr purge` doesn't delete an image tag or repository if the `write-enabled` attribute is set to `false`. For more information, see [Lock a container image in an Azure container registry](container-registry-image-lock.md). +> By default, `acr purge` doesn't delete an image tag or manifest if the `write-enabled` or `delete-enabled` attribute is set to `false`. To also purge these locked artifacts, use the `--include-locked` parameter, which unlocks each matching tag or manifest before deleting it. For more information, see [Lock a container image in an Azure container registry](container-registry-image-lock.md). `acr purge` is designed to run as a container command in an [ACR Task](container-registry-tasks-overview.md). It automatically authenticates with the registry where the task runs and performs actions there. The task examples in this article use the `acr purge` command [alias](container-registry-tasks-reference-yaml.md#aliases) instead of a fully qualified container image command. @@ -59,6 +59,10 @@ At a minimum, specify the following options when you run `acr purge`: * `--keep` - Specifies the latest number of to-be-deleted tags per repository that are retained. The latest tags are determined by the last modified time of the tag for each repository matched by the provided `--filter` options. * `--concurrency` - Specifies a number of purge tasks to process concurrently. * `--untagged-only` - Deletes only untagged manifests (dangling manifests that have no tags) without deleting any tags first. Unlike the standard `acr purge` flow, which requires `--filter` and `--ago`, this flag makes those parameters optional. Without `--filter`, it scans all repositories. You can combine it with `--ago` to filter by age and `--keep` to preserve a number of recent untagged manifests. +* `--include-locked` - Purges tags and manifests even when they're locked (that is, their `write-enabled` or `delete-enabled` attributes are set to `false`). For each matching locked artifact, `acr purge` first unlocks it by setting both attributes back to `true`, then deletes it. Without this flag, locked tags and manifests are skipped. This parameter is available beginning with `mcr.microsoft.com/acr/acr-cli:0.17`. For more information about locking, see [Lock a container image in an Azure container registry](container-registry-image-lock.md). + +> [!CAUTION] +> `--include-locked` overrides the deletion protection provided by [locking](container-registry-image-lock.md) and applies to every artifact matching your `--filter` and `--ago` selection. Deleted data is **unrecoverable**. Run with `--dry-run` first to confirm what will be removed. For information about additional parameters, run `acr purge --help`. diff --git a/articles/container-registry/container-registry-image-lock.md b/articles/container-registry/container-registry-image-lock.md index 62dcb3f8a..0da8cbb1a 100644 --- a/articles/container-registry/container-registry-image-lock.md +++ b/articles/container-registry/container-registry-image-lock.md @@ -6,7 +6,7 @@ ms.custom: devx-track-azurecli author: KumudD ms.author: kumud ms.service: azure-container-registry -ms.date: 10/31/2023 +ms.date: 07/08/2026 # Customer intent: As a developer, I want to lock container images in a registry so that they cannot be deleted or overwritten, ensuring the integrity of production deployments. --- @@ -198,6 +198,9 @@ az acr repository update \ --delete-enabled true --write-enabled true ``` +> [!NOTE] +> If it has sufficient permissions, the `acr purge` command can unlock locked artifacts automatically. When run with the `--include-locked` parameter, it resets `delete-enabled` and `write-enabled` to `true` on each matching locked tag or manifest before deleting it. For more information, see [Automatically purge images from an Azure container registry](container-registry-auto-purge.md). + ## Next steps In this article, you learned about using the [az acr repository update][az-acr-repository-update] command to prevent deletion or updating of image versions in a repository. To set additional attributes, see the [az acr repository update][az-acr-repository-update] command reference.