create container and rmi its image causes rmi failure

[djdongjin]

Description

As titled, after create and rmi(1) its image, any follwoup rmi(2) command will fail. The exact unexpected behavior can be 1 of the 2 and I'm not sure which one we should fix:

1. rmi(1) shouldn't be able to remove an image if a container is created/running using that image.
2. rmi(2) should skip the container (i.e. when getting used images) if its image is already removed.

Steps to reproduce the issue

snd = sudo nerdctl

# a container is created using `alpine`
$ snd ps -a
CONTAINER ID    IMAGE                              COMMAND      CREATED          STATUS     PORTS    NAMES
d8cf1159f0ed    docker.io/library/alpine:latest    "/bin/sh"    5 minutes ago    Created             alpine-d8cf1
$ snd images -a
REPOSITORY    TAG       IMAGE ID        CREATED          PLATFORM       SIZE        BLOB SIZE
alpine        latest    f271e74b17ce    6 minutes ago    linux/amd64    7.0 MiB     3.2 MiB
ubuntu        latest    9a0bdde4188b    6 minutes ago    linux/amd64    80.8 MiB    28.2 MiB

# rmi alpine succeeds and container still in `Created` state
$ snd rmi -f alpine
Untagged: docker.io/library/alpine:latest@sha256:f271e74b17ced29b915d351685fd4644785c6d1559dd1f2d4189a5e851ef753a
Deleted: sha256:8e012198eea15b2554b07014081c85fec4967a1b9cc4b65bd9a4bce3ae1c0c88
$ snd images -a
REPOSITORY    TAG       IMAGE ID        CREATED          PLATFORM       SIZE        BLOB SIZE
ubuntu        latest    9a0bdde4188b    6 minutes ago    linux/amd64    80.8 MiB    28.2 MiB
$ snd ps -a
CONTAINER ID    IMAGE                              COMMAND      CREATED          STATUS     PORTS    NAMES
d8cf1159f0ed    docker.io/library/alpine:latest    "/bin/sh"    6 minutes ago    Created             alpine-d8cf1

# any follow-up rmi will fail now
$ snd rmi -f ubuntu
FATA[0000] failed to get image docker.io/library/alpine:latest for container: image "docker.io/library/alpine:latest": not found

Describe the results you received and expected

Depending on which unexpected behaviors we should fix

for (1): the 1st rmi should fail to remove alpine.
for (2): the 2nd rmi should skip the alpine not exist when getting used images.

What version of nerdctl are you using?

main

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

No response

[suyanhanx]

2. rmi(2) should skip the container (i.e. when getting used images) if its image is already removed.

I took a look at how docker behaves. (2) is the right behavior.