GCR does not allow image deletion by digest when tag exists

[Luzifer]

Given there is an image in GCR having a manifest referenced by a digest and a tag pointing to that manifest reg rm gcr.io/project/image:tag directly tries to delete the underlying manifest instead of removing tag and afterwards digest.

This is not supported by GCR (see below for details) though this stands against the Docker API documentation. This also causes issues when multiple tags are pointing to one manifest: All of them have to be cleaned before the manifest can be removed.

---

$ curl -siu "$(jq -r '.auths."gcr.io".auth' ~/.docker/config.json | base64 -d)" -X DELETE https://gcr.io/v2/someproject/myimage/manifests/sha256:629783167add7484d006cd4ced67ffb91d4437e1ae0123032affbdf05955d47a
HTTP/2 400
docker-distribution-api-version: registry/2.0
content-type: application/json
date: Sun, 09 Sep 2018 12:25:04 GMT
server: Docker Registry
cache-control: private
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
accept-ranges: none
vary: Accept-Encoding

{"errors":[{"code":"GOOGLE_MANIFEST_DANGLING_TAG","message":"Manifest is still referenced by tag: cdd65fd"}]}

$ curl -siu "$(jq -r '.auths."gcr.io".auth' ~/.docker/config.json | base64 -d)" -X DELETE https://gcr.io/v2/someproject/myimage/manifests/cdd65fd
HTTP/2 202
docker-distribution-api-version: registry/2.0
content-type: application/json
date: Sun, 09 Sep 2018 12:26:11 GMT
server: Docker Registry
cache-control: private
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
accept-ranges: none
vary: Accept-Encoding

{"errors":[]}

$ curl -siu "$(jq -r '.auths."gcr.io".auth' ~/.docker/config.json | base64 -d)" -X DELETE https://gcr.io/v2/someproject/myimage/manifests/sha256:629783167add7484d006cd4ced67ffb91d4437e1ae0123032affbdf05955d47a
HTTP/2 202
docker-distribution-api-version: registry/2.0
content-type: application/json
date: Sun, 09 Sep 2018 12:26:37 GMT
server: Docker Registry
cache-control: private
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
accept-ranges: none
vary: Accept-Encoding

{"errors":[]}