Retire legacy Docker leftovers on the Synology NAS

[kelchm]

Context

Athena runs 10 containers under DSM Container Manager. Exactly one of them — netbootxyz-nas — is current, sanctioned, digest-pinned, and bound to a specific interface. The other nine are residue from migrations and benchmarks that already completed.

Live inventory, 2026-08-23:

Container	State	Image	Ports
netbootxyz-nas-netbootxyz-1	Up 4 days (healthy)	netbootxyz:0.7.6-nbxyz24 (digest-pinned)	10.32.20.5:{69/udp,3000,8080}
vss	Exited (0) 15h	visionect-server-v3:7.6.5	—
pdb	Up 6 weeks	postgres:latest	5432 (internal)
visionect-redis-1	Up 6 weeks	redis	6379 (internal)
newsprint-app	Up 6 weeks	kelchm/newsprint:latest	0.0.0.0:8090
dockerge-dockge-1	Up 6 weeks (healthy)	louislam/dockge:1	0.0.0.0:55001
iperf3-{a,b,c}	Exited (1) 4 months	networkstatic/iperf3:latest	—
nginx-test-nginx-1	Exited (0) 4 months	nginx:latest	—

docker system df: images 4.516 GB total with 2.052 GB (45%) reclaimable; /volume1/docker/dockerge is 2.1 GB.

Every leftover uses a mutable :latest tag, and newsprint-app and dockge bind 0.0.0.0 — every NAS interface on every VLAN — where netbootxyz correctly binds 10.32.20.5 only.

The retention gate — do not skip

docs/runbooks/visionect-migration.md requires keeping the stopped VSS, PostgreSQL, Redis, anonymous volumes, and final dump through at least 2026-08-30 and one successful restore drill. They are the rollback target for the 2026-08-23 cutover.

All seven anonymous Docker volumes belong to this group — six to vss, one to visionect-redis-1. docker volume prune before the gate passes destroys the rollback path. docker system df reports them as active with 0 B reclaimable, which is correct and must not be read as "safe to clear."

Work

Phase 1 — independent of the gate

• Remove iperf3-{a,b,c} and the iperf3-test project (storage-benchmark residue; docs/storage-benchmarks.md holds the results)
• Remove nginx-test-nginx-1 and the nginx-test project
• Repoint or delete the stale VSS session on http://vss.home.kelch.io:8090, per the cutover runbook's post-cutover list
• Stop and remove newsprint-app. Broadsheet has served broadsheet.home.kelch.io in-cluster for 48 days; the cutover runbook records that the migration deliberately did not preserve port 8090

Phase 2 — after 2026-08-30 and a successful restore drill

• Confirm the restore drill passed and record it in the migration runbook
• Remove vss, pdb, visionect-redis-1, the visionect project, and their seven anonymous volumes
• Remove the final migration dump under /volume1/docker/dockerge/visionect/migration/

Phase 3 — Dockge

• With the above gone, Dockge manages nothing: its only stacks are iperf3-test, newsprint, nginx-test, and visionect. Remove dockerge-dockge-1 and /volume1/docker/dockerge/
• Close the 0.0.0.0:55001 exposure with it

Phase 4 — images

• Prune the three dangling kelchm/newsprint images and the now-unreferenced :latest tags
• Do not prune the dangling ghcr.io/netbootxyz/netbootxyz entry. It shows as <none> because digest-pinned pulls are stored untagged, and it is the image the running container uses

Acceptance criteria

• docker ps -a on Athena lists only netbootxyz-nas-netbootxyz-1
• /volume1/docker/ contains only netbootxyz/
• No container publishes a port on 0.0.0.0
• The Visionect rollback path was retired deliberately, after a recorded successful restore drill — not by cleanup
• docs/runbooks/visionect-migration.md records the rollback-retirement date its post-cutover section asks for

Related

• Plan Git-managed Synology Compose deployments #379 — the Git-driven deployment plane for whatever remains on the NAS
• feat: commit the live netboot.xyz Compose project and GLKVM console helpers #417 — commits the netbootxyz Compose project, the one workload that survives this cleanup