c8d/prune: Fix images being deleted when they're still used with a different reference
- Fixes: https://github.com/moby/moby/issues/45732


**- What I did**
Fixed `image prune -a` deleting dangling images used by containers.

**- How I did it**
-  Exclude dangling tag of the images used by containers (this makes sure that if the original image was deleted we don't delete the dangling image)
-  Exclude images that are used by containers which were started by specifying an image ID instead of a specific name.

**- How to verify it**
```bash
$ make TEST_INTEGRATION_USE_SNAPSHOTTER=1 \
       DOCKER_GRAPHDRIVER=overlayfs \
       TEST_FILTER=TestPruneDontDeleteUsedDangling \
       test-integration
...
INFO: Testing against a local daemon
=== RUN   TestPruneDontDeleteUsedDangling
--- PASS: TestPruneDontDeleteUsedDangling (0.07s)
PASS

DONE 1 tests in 1.079s
```

**- Description for the changelog**
```release-notes
containerd integration: `docker image prune -a` no longer removes images still in use by running containers
```

**- A picture of a cute animal (not mandatory but encouraged)**


daemon/containerd/soft_delete.go
package containerd

import (
	"context"

	cerrdefs "github.com/containerd/containerd/errdefs"
	containerdimages "github.com/containerd/containerd/images"
	"github.com/docker/docker/errdefs"
	"github.com/opencontainers/go-digest"
	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
	"github.com/pkg/errors"
)

// softImageDelete deletes the image, making sure that there are other images
// that reference the content of the deleted image.
// If no other image exists, a dangling one is created.
func (i *ImageService) softImageDelete(ctx context.Context, img containerdimages.Image) error {
	is := i.client.ImageService()

	// If the image already exists, persist it as dangling image
	// but only if no other image has the same target.
	dgst := img.Target.Digest.String()
	imgs, err := is.List(ctx, "target.digest=="+dgst)
	if err != nil {
		return errdefs.System(errors.Wrapf(err, "failed to check if there are images targeting digest %s", dgst))
	}

	// From this point explicitly ignore the passed context
	// and don't allow to interrupt operation in the middle.

	// Create dangling image if this is the last image pointing to this target.
	if len(imgs) == 1 {
		danglingImage := img

		danglingImage.Name = danglingImageName(img.Target.Digest)
		delete(danglingImage.Labels, containerdimages.AnnotationImageName)
		delete(danglingImage.Labels, ocispec.AnnotationRefName)

		_, err = is.Create(context.Background(), danglingImage)

		// Error out in case we couldn't persist the old image.
		// If it already exists, then just continue.
		if err != nil && !cerrdefs.IsAlreadyExists(err) {
			return errdefs.System(errors.Wrapf(err, "failed to create a dangling image for the replaced image %s with digest %s",
				danglingImage.Name, danglingImage.Target.Digest.String()))
		}
	}

	// Free the target name.
	err = is.Delete(context.Background(), img.Name)
	if err != nil {
		if !cerrdefs.IsNotFound(err) {
			return errdefs.System(errors.Wrapf(err, "failed to delete image %s which existed a moment before", img.Name))
		}
	}

	return nil
}

func danglingImageName(digest digest.Digest) string {
	return "moby-dangling@" + digest.String()
}

func isDanglingImage(image containerdimages.Image) bool {
	return image.Name == danglingImageName(image.Target.Digest)
}

package containerd

import (
	"context"

	cerrdefs "github.com/containerd/containerd/errdefs"
	containerdimages "github.com/containerd/containerd/images"
	"github.com/docker/docker/errdefs"
	"github.com/opencontainers/go-digest"
	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
	"github.com/pkg/errors"
)

// softImageDelete deletes the image, making sure that there are other images
// that reference the content of the deleted image.
// If no other image exists, a dangling one is created.
func (i *ImageService) softImageDelete(ctx context.Context, img containerdimages.Image) error {
	is := i.client.ImageService()

	// If the image already exists, persist it as dangling image
	// but only if no other image has the same target.
	dgst := img.Target.Digest.String()
	imgs, err := is.List(ctx, "target.digest=="+dgst)
	if err != nil {
		return errdefs.System(errors.Wrapf(err, "failed to check if there are images targeting digest %s", dgst))
	}

	// From this point explicitly ignore the passed context
	// and don't allow to interrupt operation in the middle.

	// Create dangling image if this is the last image pointing to this target.
	if len(imgs) == 1 {
		err = i.ensureDanglingImage(context.Background(), img)

		// Error out in case we couldn't persist the old image.
		if err != nil {
			return errdefs.System(errors.Wrapf(err, "failed to create a dangling image for the replaced image %s with digest %s",
				img.Name, img.Target.Digest.String()))
		}
	}

	// Free the target name.
	err = is.Delete(context.Background(), img.Name)
	if err != nil {
		if !cerrdefs.IsNotFound(err) {
			return errdefs.System(errors.Wrapf(err, "failed to delete image %s which existed a moment before", img.Name))
		}
	}

	return nil
}

func (i *ImageService) ensureDanglingImage(ctx context.Context, from containerdimages.Image) error {
	danglingImage := from

	danglingImage.Labels = make(map[string]string)
	for k, v := range from.Labels {
		switch k {
		case containerdimages.AnnotationImageName, ocispec.AnnotationRefName:
			// Don't copy name labels.
		default:
			danglingImage.Labels[k] = v
		}
	}
	danglingImage.Name = danglingImageName(from.Target.Digest)

	_, err := i.client.ImageService().Create(context.Background(), danglingImage)
	// If it already exists, then just continue.
	if cerrdefs.IsAlreadyExists(err) {
		return nil
	}

	return err
}

func danglingImageName(digest digest.Digest) string {
	return "moby-dangling@" + digest.String()
}

func isDanglingImage(image containerdimages.Image) bool {
	return image.Name == danglingImageName(image.Target.Digest)
}

Thanks, good catch!