skopeo delete: Remove a Tag or Digest From a Registry
skopeo delete removes an image reference from a registry that supports the delete API, without a local daemon.
Cleaning up throwaway CI tags keeps a registry from filling up. skopeo delete removes a specific tag or digest remotely, provided the registry allows deletes.
What it does
skopeo delete issues a registry delete request for the named image reference. Most registries delete by digest at the API level; deleting by tag removes that tag pointer. Whether the underlying blobs are reclaimed depends on the registry running garbage collection.
Common usage
# delete a tag
skopeo delete docker://ghcr.io/acme/app:pr-123
# delete a specific digest
skopeo delete docker://ghcr.io/acme/app@sha256:abc...
# with credentials
skopeo delete --creds "$USER:$PASS" docker://registry.example.com/app:oldOptions
| Flag | What it does |
|---|---|
| --creds user:pass | Registry credentials |
| --tls-verify=false | Skip TLS verification (insecure registry) |
| --authfile <path> | Path to a non-default auth file |
In CI
Delete short-lived tags (per-PR or per-commit images) at the end of a job so ephemeral builds do not accumulate. Note that Docker Hub does not support the registry delete API, so this works against registries like GHCR, Harbor, Quay, or a self-hosted registry:2 started with REGISTRY_STORAGE_DELETE_ENABLED=true.
Common errors in CI
"Error deleting image ... 405 Method Not Allowed" or "manifest delete is not allowed" means the registry does not have delete enabled; enable it or delete via the registry API/UI. "unauthorized: authentication required" needs --creds. Deleting by tag on some registries errors "reference not a digest"; resolve the tag to a digest first with skopeo inspect.