Remove blocked packages
Use the cleanup service to remove stored versions that a named revocation rule denies. Its command is ecluse dredger.
On this page
Prepare the policy and targets#
Add the deny to the intended policy and make sure it applies at revocation. Update the proxy and mirror workers before removing stored copies.
The mirror repository and private cache each need independent maintenance credentials and consent. Keep the first-party publication repository separate.
For PyPI, cleanup requires CodeArtifact. Generic PyPI registries can still support reads and writes, but do not provide this maintenance capability.
Preview the result#
Run the configured image with:
Container arguments
dredger --dry-run --onceThe preview observes both target inventories and reports what policy selects. It needs no deletion consent and does not delete or write a walk cursor.
Review target-specific results and incomplete scans. Exit 0 means the preview completed, not that deletion is authorised.
Enable deletion deliberately#
For CodeArtifact, set ecluse-dredger-consent=true on each maintained repository. For Verdaccio, configure permitDeletion: true separately for each supported target.
The cleanup role must not be able to grant itself consent. Give it only the inventory, read, and deletion permissions needed for those targets.
Review the deletion cap, then run dredger --once for one cycle or dredger continuously. Run only one instance per store.
Verify each serving copy#
Check the mirror and private-cache results independently. A successful mirror deletion does not prove the cached copy is gone.
After older writes settle, inspect inventories and repeat authorised reads with fresh client state. A permission failure is not proof of absence.
Client caches and already-installed packages remain outside this operation.
If the deletion cap stops the service#
Reaching the cap halts cleanup for the process's lifetime. Liveness stays healthy and readiness reports the halt.
Investigate the policy and advisory generation before restarting or increasing the cap. An automatic restart would reset the deletion budget.
Read the revocation rulesDecisive denies, protected names, retained copies, and rollout order. Read the complete cleanup referenceCycle budgets, full walks, consent, backend limits, and recovery.