[SOLVED] unable to delete image has dependent child images

In Docker environments, managing images is a routine task. At times, you might encounter an issue where you can't remove an image due to dependencies or running containers using it. The error message may look something like this: "Error response from daemon: conflict: unable to delete [image_id] (cannot be forced) - image has dependent child images" or "image is being used by running container [container_id]." This article provides a deep dive into this issue, exploring potential causes, debugging steps, and solutions to resolve it.

Understanding Docker Image Layers

Docker images are composed of layers, and each layer corresponds to a change in the file system from the previous layer. Each Docker layer is essentially a series of file system changes that can be grouped and stacked on top of each other to form the final image. Every time you create a Docker container, you're using these layered images.

When a Docker image is built from a Dockerfile, each instruction in the Dockerfile creates a new layer in the image. For instance, consider the following Dockerfile:

FROM ubuntu:latest
RUN apt-get update
RUN apt-get install -y python3

This Dockerfile will result in a Docker image with three layers:

1. The base layer is the Ubuntu image.
2. The second layer is the changes made to the base Ubuntu image when running apt-get update. This could include updated software packages or modified system settings.
3. The third layer is the result of installing Python3 on top of the second layer.

When Docker builds images, it uses a cache. If you change an instruction in the Dockerfile, Docker will need to rebuild that layer and any layers stacked above it, since the changes may affect those layers.

A critical concept here is that these image layers can be shared between Docker images. This is why Docker images can have parent-child relationships. If you have an image that uses another image as its base (i.e., it's built on top of another image), we can say the base image is the parent and the derived image is the child. This allows Docker to optimize storage by reusing layers between images.

When you try to delete a Docker image that has child images, Docker prevents it because the child images are dependent on the parent image's layers. Deleting the parent would leave the child image incomplete, so Docker does not allow this operation to protect the integrity of your images. Thus, you need to remove the dependent child images first before you can delete the parent image.

Understanding the error message - Error response from daemon: conflict: unable to delete XXXX (cannot be forced) - image has dependent child images.

When working with Docker images, it's important to understand that Docker has mechanisms in place to protect the integrity and dependencies of your images and containers. One such mechanism is the prevention of deletion for an image that is being used by a container or has dependent child images. This is where the error message comes into play:

Error response from daemon: conflict: unable to delete bc7d21c2120a (cannot be forced) - image has dependent child images.

Let's break down this message and its two main components:

1. unable to delete bc7d21c2120a (cannot be forced): This part of the message is telling you that Docker is not able to delete the specified image, even when using the -f or --force option. The force option (-f or --force) in Docker is designed to try to remove an image even if it has containers associated with it (either running or stopped). However, the force option cannot override the protection Docker has for images with child dependencies, hence the "cannot be forced" message. This ensures that no dependent child image gets 'orphaned' by losing access to necessary parent layers.
2. image has dependent child images: The second part of the error message is stating the reason why Docker cannot remove the image — it has child images that are dependent on it. As explained before, Docker images are built in layers, and these layers can be shared across multiple images to optimize storage and build times. If you try to delete a parent image (i.e., an image used as a base for another image), Docker prevents this operation because the child images depend on the parent's layers. Deleting the parent would leave the child images incomplete.

Why we get this error?

There are generally two main reasons why you might encounter the error message Error response from daemon: conflict: unable to delete bc7d21c2120a (cannot be forced) - image has dependent child images:

1. The image is being used by a running container: Docker will prevent the deletion of an image if it's currently being used by a running container. The reasoning here is quite straightforward: removing an image while it's being used could disrupt the running container and potentially lead to data loss or unexpected behavior. Even if you use the -f or --force option, Docker will still prevent the deletion if a running container is using the image.
2. The image has dependent child images: As mentioned earlier, Docker images are built in layers, and one image can serve as the base (or parent) for another image. These relationships create a dependency where the child image requires the layers of the parent image to function correctly. If Docker allowed the deletion of a parent image, it would break any child images that depend on it. Therefore, Docker prevents the deletion of any image that has dependent child images, even when using the --force option.

These situations create a conflict, hence the term "conflict" used in the error message. Understanding these scenarios is the first step towards resolving the issue

Possible Solutions

Method 1: Stopping and removing the container using the image before deleting the image

In this approach, when you find that a Docker image cannot be deleted because it is in use by a running container, you can follow these steps to solve the issue:

~]# docker rmi be14e51caaee -f
Error response from daemon: conflict: unable to delete be14e51caaee (cannot be forced) - image is being used by running container ed0f6d3aabef

The following steps were used to resolve this issue:

Identify the running container that is using the image. Use the following command:

docker ps -a | grep ed0f6d3aabef

After finding the running container, stop it using the command:

docker stop ed0f6d3aabef

Once the container is stopped successfully, remove it with the following command:

docker rm ed0f6d3aabef

With the container now removed, you can now run the image deletion command again, and this time it should successfully delete the image:

~]# docker rmi be14e51caaee -f
Untagged: demo-registry:5500/diag:deep-3352-0
Untagged: demo-registry:5500/diag@sha256:580ec473a3a09d73d5db5d7014d458830f452116a247d408be95603ad1723d07
Deleted: sha256:be14e51caaee1085f08a72b45de33d2bf80659b605f9757c5e10ca7bf24740f1
Deleted: sha256:388912c62f33c226152c4cbca42be3284fe80fa2257fa2847d75c95fa6317c6b

Method 2: Directly force removing the image using the repository and tag

In the second approach, when you try to delete an image, but the operation fails because the image has dependent child images, you can remove the image directly by using the repository and tag:

Make an initial attempt to delete the image:

docker rmi 421e15fbff51 -f
Error response from daemon: conflict: unable to delete 421e15fbff51 (cannot be forced) - image has dependent child images

If this attempt fails due to the existence of dependent child images, you can remove the image by using its repository and tag, and coupling this with the force removal flag:

# docker rmi demo-registry:5500/rtdb:deep-3352-0 -f
Untagged: bcmt-registry:5000/rtdb:deep-3352-0 
Untagged: bcmt-registry:5000/rtdb@sha256:51e09210f718ff3482a18743a37098a1e30a36212a43241326108058d20361e6

Method-3: Identify and delete the dependent child images

Here is another situation where I was getting the same error:

# docker rmi bc7d21c2120a -f
Error response from daemon: conflict: unable to delete bc7d21c2120a (cannot be forced) - image has dependent child images

Docker doesn't allow you to forcefully delete a parent image, even using the -f option, if there are child images depending on it. The proper course of action is to delete the child images first.

Docker inspect provides more information about an image or a container, including its parent.

docker inspect --format='{{.Id}} {{.Parent}}' $(docker images --filter since=bc7d21c2120a -q)

In the output, check the Parent field to see if the id bc7d21c2120a is listed. The images with bc7d21c2120a as the parent are the dependent child images.

Sample Output

# docker inspect --format='{{.Id}} {{.Parent}}' $(docker images --filter since=bc7d21c2120a -q)
sha256:d14435bf48b3a3df3bd7191d8e3a1dbd08dc2faf891437bf05142185e4943b5e sha256:dac2ed75a9f434b6747abd5f808c8f83f48f93bb7d71fcf2771a6e83fd071ffd
sha256:9616156553c0e7e5b4503ba9cbecedc5e6fa8e290c9a00d1ea0ee3e2237a42fd 
sha256:9616156553c0e7e5b4503ba9cbecedc5e6fa8e290c9a00d1ea0ee3e2237a42fd 
sha256:d2b6c1fa30d16312718dd8dc57b0558e916ec4308be876e3c132225ce781b715 
sha256:d2b6c1fa30d16312718dd8dc57b0558e916ec4308be876e3c132225ce781b715 
sha256:acca7e60d58336fd6f19a5460660d199c03d6477add0343aadb4fbc5d59f9d2b 
sha256:acca7e60d58336fd6f19a5460660d199c03d6477add0343aadb4fbc5d59f9d2b 
sha256:b73cead6c07a71b06833959342e64409f9f5dad85ccf77acd89edff4abf6981d 
sha256:b73cead6c07a71b06833959342e64409f9f5dad85ccf77acd89edff4abf6981d 
sha256:6aae71fcecb477d05a41c2ed8aca3685617725d8ad2206580e7bc6f58e261324 
sha256:6aae71fcecb477d05a41c2ed8aca3685617725d8ad2206580e7bc6f58e261324 
sha256:3eb7985b4b740a743b26708c05b063e5eea3920e1033e3242ff849ba0bdc6920 
sha256:3eb7985b4b740a743b26708c05b063e5eea3920e1033e3242ff849ba0bdc6920 
sha256:a8e239aa506772db92340d556032855413e4ae90100d1b767ce50d6de1bfc9b0 
....

In the output, you can see each image ID followed by its parent image ID. If an image ID is not followed by a parent image ID, it means that this image does not have a parent, it is a base image.

This indicates that the image with the ID sha256:d14435bf48b3a3df3bd7191d8e3a1dbd08dc2faf891437bf05142185e4943b5e was built on top of the image with the ID sha256:dac2ed75a9f434b6747abd5f808c8f83f48f93bb7d71fcf2771a6e83fd071ffd, making the latter image the parent of the former.

Before you remove this child image, ensure that it isn't in use by a running container or another image. If it isn't, you can remove it with the following command:

# docker rmi sha256:d14435bf48b3a3df3bd7191d8e3a1dbd08dc2faf891437bf05142185e4943b5e
Error response from daemon: conflict: unable to delete d14435bf48b3 (cannot be forced) - image is being used by running container 98b235701b72

The error message indicates that the image we are trying to remove is being used by a running container with the ID 98b235701b72. We cannot remove an image if it is being used by a running container.

If we want to remove this image, we need to stop and remove the container that's using it first. We can do so with the following commands:

docker stop 98b235701b72
docker rm 98b235701b72

Once the container is stopped and removed, we should be able to remove the image:

docker rmi sha256:d14435bf48b3a3df3bd7191d8e3a1dbd08dc2faf891437bf05142185e4943b5e

But I am still not able to delete my original image

# docker rmi bc7d21c2120a -f
Error response from daemon: conflict: unable to delete bc7d21c2120a (cannot be forced) - image has dependent child images

It seems there are still some dependent child images for the bc7d21c2120a image which are preventing you from deleting it. These images must be deleted before the parent image can be deleted.

However, finding the child images can be tricky, especially if there are many images in your Docker environment. Unfortunately, Docker doesn't provide a direct command to find child images of a given parent.

You can use this command to find potential dependent images:

docker images --filter since=bc7d21c2120a -q

This command lists all images that were created after the specified image (bc7d21c2120a), and potentially, these are the ones which could be dependent on it.

To delete these images, you can use the script I mentioned in the previous response:

for img in $(docker images --filter since=bc7d21c2120a -q)
do
  docker rmi $img -f
done

After running this script, try deleting bc7d21c2120a again

# docker rmi bc7d21c2120a -f
Untagged: demo-registry:5500/rtdb@sha256:8ba0758eedc1006f4f5fbb5adc6e179a34667434d648e3aadc310c7534943c40
Deleted: sha256:bc7d21c2120a75be68cd1079fef91521ef0172b5bb0d69fe15a2122eefc3a81e
Deleted: sha256:a024e0224eca7c1d34aa9a4ac0d9620519e243baeef7e10346c8b67a9ce5cb6d

Method-4: Cleanup all dangling images

In this method, you can use Docker's built-in prune commands to remove unused or dangling resources, which includes images, containers, volumes, and networks.

Removing Dangling Images

Firstly, you can remove all dangling images, which are not associated with a container, by running the command:

docker image prune

This will prompt you for a confirmation before proceeding. To skip the confirmation, you can add the -f or --force flag:

docker image prune -f

If you wish to remove all images not associated with a container, you can add the -a flag:

docker image prune -a

But be careful with this command as it removes all images not currently in use.

Removing Unused Data

To remove not only images but also stopped containers, networks not used by at least one container, and all build cache, you can use the docker system prune command:

docker system prune

Again, this will prompt you for confirmation. To force the command without a confirmation prompt, you can use the -f or --force flag:

docker system prune -f

Summary

In this article, we delved into the issue of Docker image dependencies and the problems that can arise when trying to manage and delete Docker images. A clear understanding of these dependencies is crucial to effectively handling Docker images and avoiding potential conflicts.

The error message "Error response from daemon: conflict: unable to delete (cannot be forced) - image has dependent child images" is an important signal that reminds us of the significance of image dependencies in Docker. It is typically triggered when an image is being used by a running container or when the image has child images.

We outlined four methods to resolve this issue:

1. The first method involved identifying and stopping the running container that is utilizing the image before deleting the image.
2. In the second method, we focused on deleting a Docker image with dependent child images by removing the repository reference forcefully.
3. The third method described the use of a script to force delete all images created after a specified image.
4. Finally, in the fourth method, we introduced Docker's built-in prune commands as an effective way to remove unused or dangling resources, including images, containers, volumes, and networks.