Keeping your whole Docker stack safely up to date

Description and use

Automated recipe for updating a Docker stack: pinning versions, Diun notifications, Restic backups, and safe deployment.

Problem

Self‑hosted Docker stacks drift to vulnerable or incompatible versions when images are updated automatically or left unpinned, risking security and stability.

Outcome

A repeatable, controlled update process that eliminates accidental major upgrades, provides timely alerts, and safeguards against data loss.

Workflow

• Pin every service to a fixed tag (major or exact) in compose.yaml
• Add a Diun service to watch the stack and notify on updates
• Label containers with diun.enable=true and diun.watch_repo=true
• Run Diun to inventory current images and set up notifications
• When Diun reports a new image, back up the stack with Restic
• Pull the new image and redeploy the stack
• Verify functionality and roll back if needed
• Schedule regular cleanup of unused images

Evidence

Pin every service to a fixed tag instead. Two sensible levels: Major tag or Exact version.

Source

Diun only watches containers you explicitly mark – so you don't get a flood about things that don't interest you.

Source