Keeping your whole Docker stack safely up to date

说明与用途

自动化更新 Docker 堆栈的配方：固定版本、Diun 通知、Restic 备份和安全部署。

问题

Self‑hosted Docker stacks drift to vulnerable or incompatible versions when images are updated automatically or left unpinned, risking security and stability.

结果

A repeatable, controlled update process that eliminates accidental major upgrades, provides timely alerts, and safeguards against data loss.

工作流

• Pin every service to a fixed tag (major or exact) in compose.yaml
• Add a Diun service to watch the stack and notify on updates
• Label containers with diun.enable=true and diun.watch_repo=true
• Run Diun to inventory current images and set up notifications
• When Diun reports a new image, back up the stack with Restic
• Pull the new image and redeploy the stack
• Verify functionality and roll back if needed
• Schedule regular cleanup of unused images

证据

Pin every service to a fixed tag instead. Two sensible levels: Major tag or Exact version.

来源

Diun only watches containers you explicitly mark – so you don't get a flood about things that don't interest you.

来源