Keeping your whole Docker stack safely up to date

Описание и применение

Автоматизированный рецепт обновления Docker‑стека: закрепление версий, уведомления Diun, резервное копирование Restic и безопасный развертывание.

Задача

Self‑hosted Docker stacks drift to vulnerable or incompatible versions when images are updated automatically or left unpinned, risking security and stability.

Результат

A repeatable, controlled update process that eliminates accidental major upgrades, provides timely alerts, and safeguards against data loss.

Рабочий процесс

• Pin every service to a fixed tag (major or exact) in compose.yaml
• Add a Diun service to watch the stack and notify on updates
• Label containers with diun.enable=true and diun.watch_repo=true
• Run Diun to inventory current images and set up notifications
• When Diun reports a new image, back up the stack with Restic
• Pull the new image and redeploy the stack
• Verify functionality and roll back if needed
• Schedule regular cleanup of unused images

Доказательства

Pin every service to a fixed tag instead. Two sensible levels: Major tag or Exact version.

Источник

Diun only watches containers you explicitly mark – so you don't get a flood about things that don't interest you.

Источник