In my setup images get deleted although they are still being referenced in a task definition. I dug a little deeper and it seems like images are not recognized as running, when they are directly referencing an image by digest and not by tag. So if one is using the format repositoryurl/image@sha256:digest it does never match and thus the image will be added to the images to delete list.

I created a change that will check if the task definition is referencing an image via digest and will also add those images to the list to keep. But I'm not sure if this is the best solution and maybe my setup with referencing the image via digest might be an anti pattern somehow.