Docker Image & Volume Governance: How to Safely Clean Up Unowned Assets in Core-Banking Integrations

Core-banking systems rely on Docker for containerized microservices, CI/CD pipelines, and integration layers. However, unowned Docker images and volumes—especially those in production or staging environments—pose significant risks: compliance violations, operational instability, and security vulnerabilities. Without proper governance, these assets can accumulate indefinitely, leading to bloated registries, failed deployments, and audit failures.

This guide provides a step-by-step approach to identifying, auditing, and safely remediating unowned Docker images and volumes in core-banking environments. We’ll focus on governed archival-first recovery, ensuring compliance while minimizing disruption to critical systems.

Why Unowned Docker Assets Are a Problem in Core-Banking

Core-banking systems demand traceability, reproducibility, and auditability. When Docker images and volumes lack ownership documentation, they introduce:

• Compliance Risks: Regulators (e.g., Basel III, GDPR, or local financial authorities) require clear lineage and access controls for production assets. Unowned images may violate Basel III or GDPR requirements.
• Operational Instability: Orphaned volumes can consume disk space, while unused images may prevent rollbacks or cause deployment conflicts.
• Security Vulnerabilities: Stale images may contain unpatched CVEs or misconfigured permissions, exposing the system to exploits.
• Cost Inefficiency: Unused images and volumes inflate storage costs and slow down CI/CD pipelines.

Step 1: Inventory and Audit Unowned Assets

Before remediation, you need a complete inventory of Docker assets with ownership metadata. Here’s how to approach it:

1.1 Scan for Unowned Images

Use Docker’s CLI and scripting to identify images without explicit ownership tags or labels:

docker images --format "{{.Repository}}:{{.Tag}} | {{.ID}} | {{.Size}}"


To filter for unowned images (e.g., no `com.x-itm/owner` label):

docker inspect --format='{{json .Config.Labels}}' | jq '.com.x-itm/owner // ""'

For large registries, automate this with a script (e.g., Python + `docker SDK`):

import docker

client = docker.from_env()
for image in client.images.list(all=True):
labels = client.images.get(image.id).attrs['Config']['Labels']
if 'com.x-itm/owner' not in labels:
print(f"Unowned image: {image.tags}")


1.2 Audit Volumes for Orphaned Data

Volumes tied to stopped containers or unused services may persist indefinitely. Use:

docker volume ls


To find volumes with no attached containers:

docker volume inspect --format='{{json .Mounts}}' | jq '.[] | select(.Destination == "")'

1.3 Correlate with CI/CD and Deployment Logs

Cross-reference Docker assets with:

• CI/CD pipelines (Jenkins, GitLab CI, ArgoCD)
• Deployment manifests (Kubernetes `PodSpec`, Docker Compose)
• Audit logs (e.g., Splunk, ELK Stack)

Tools like Trivy or Defense in Depth can help identify assets not referenced in recent deployments.

Step 2: Classify Assets for Governed Recovery

Not all unowned assets are equal. Categorize them into:

• Critical: Used in production or staging (e.g., `core-banking-service:1.2.0`). Do not delete.
• Stale but Safe: No longer in use but patched (e.g., `legacy-auth:0.1.0`). Archive.
• High-Risk: Unpatched or misconfigured (e.g., images with `root` user). Remediate or delete.
• Trivial: Test images, dev snapshots (e.g., `test-app:dev`). Delete.

2.1 Use Labels for Ownership Tracking

Tag images with metadata during build:

docker build --label "com.x-itm/owner=core-banking-team" --label "com.x-itm/purpose=integration" -t core-banking-service:1.2.0 .


For volumes, document ownership in Kubernetes annotations or a central registry (e.g., Kubernetes Annotations).

2.2 Automate Classification with Policies

Define rules in your CI/CD pipeline (e.g., GitLab CI, ArgoCD) to:

• Reject images without `com.x-itm/owner`.
• Archive images older than 6 months without recent deployments.
• Block volumes without access controls.

Example GitLab CI policy:

rules:
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
variables:
DOCKER_IMAGE_LABELS: "com.x-itm/owner=dev-team"


Step 3: Governed Archival-First Recovery

3.1 Archive Stale but Safe Assets

For images/volumes no longer in use but compliant:

# Archive to a read-only registry
docker tag core-banking-service:0.9.0 registry.example.com/archives/core-banking-service:0.9.0
docker push registry.example.com/archives/core-banking-service:0.9.0


Use tools like immutable tags to prevent accidental overwrites.

3.2 Remediate High-Risk Assets

For unpatched or misconfigured images:

• Scan for CVEs using Snyk or Grype.
• Rebuild with fixes and re-tag with ownership labels.
• Rotate secrets (e.g., API keys, DB credentials) in volumes.

3.3 Delete Trivial Assets

For test/dev images or unused volumes:

# Delete local images
docker rmi -f

# Delete volumes
docker volume rm


Step 4: Enforce Ongoing Governance

4.1 Integrate with CI/CD

Add Docker governance checks to your pipeline:

• Prevent pushes without `com.x-itm/owner`.
• Auto-archive images not deployed in 6 months.
• Fail builds for volumes without access controls.

4.2 Use Policy-as-Code

Tools like Open Policy Agent (OPA) or KubeWarden can enforce Docker governance rules at runtime.

4.3 Monitor with Observability

Track Docker asset usage with:

• Prometheus metrics for image/volume creation/deletion.
• Logs from Docker Engine or Kubernetes Audit Logs.
• Custom dashboards (e.g., Grafana) for ownership trends.

Step 5: Validate and Document

5.1 Conduct a Post-Remediation Audit

Verify:

• No critical services were disrupted.
• All high-risk assets were remediated.
• Ownership labels are consistent.

5.2 Update Compliance Documentation

Update your System Design Document (SDD) or Risk Assessment to reflect:

• New ownership policies.
• Archival procedures.
• Remediation steps for high-risk assets.

When to Seek Expert Help

If your core-banking environment has:

• Hundreds of unowned images/volumes across multiple clusters.
• Complex interdependencies between services (e.g., shared volumes).
• Regulatory deadlines for cleanup (e.g., Basel III audit).
• A need for enterprise-scale governance beyond manual scripts.

A governed engineering approach—combining automated discovery, policy enforcement, and remediation—can streamline the process while minimizing risk. X-ITM’s Enterprise Platform provides the tools and expertise to:

• Automate asset classification and remediation.
• Integrate with your existing CI/CD and observability stacks.
• Ensure compliance with financial regulations.
• Reduce operational overhead with governed workflows.

For core-banking systems, governed Docker recovery isn’t just about cleanup—it’s about operational resilience and regulatory confidence.