Let Renovate keep your Docker images up to date

A while back I wrote about Any docker images to be updated? on my private blog, where I was looking for a way to find out when the public Docker images I rely on have a new version.

These days I don't do it manually any more. I let Renovate do it for me.

I like this approach for the following reasons

• I don't have to remember to check
• I get a pull request, so I can see what changes before I merge it
• my CI runs on the pull request, so I know if something breaks

What is Renovate?

Renovate is an Open Source tool that scans your repository for dependencies, and creates pull requests when there are newer versions. It supports a lot of ecosystems, but in this post I only care about Docker.

It understands Dockerfile, docker-compose.yml and also GitLab CI and GitHub Actions files, so most of the places where I reference an image are covered.

Prerequisites

• A repository with a Dockerfile or a docker compose file
• Images with a specific tag, not just latest

The last point is important. If you are using latest, Renovate has nothing to compare against, so pin your images to a version.

services:
  registry:
    image: registry:3.0.0
    restart: always

Set up Renovate

You can either install the Renovate GitHub App, or self-host it. I'll not walk you through the app installation, but you can find it in the documentation.

Silent or interactive

When you install the Mend Renovate app, it can run in two modes. In Interactive mode, Renovate creates an onboarding pull request and opens PRs for updates automatically.

In Silent mode, Renovate still scans your repository, but it doesn't create any pull requests. The updates it finds are listed as Pending Approval in the Mend interface, and you have to approve them manually.

When Renovate is enabled on your repository, in interactive-mode, it will create an onboarding pull request with a renovate.json. The simplest version looks like this

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"]
}

Merge that, and you are ready to go.

Make it a little quieter

By default, you will get one pull request per update. That can be a lot, so I group the minor and patch updates.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchManagers": ["docker-compose", "dockerfile"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "docker minor and patch updates"
    }
  ]
}

Major updates still get their own pull request, as those are the ones I want to look at more carefully.

Conclusion

Keeping images up to date is not the most exciting task, but it is an important one. With Renovate I get a nudge when something needs attention, and the rest of the time I don't have to think about it.

Have fun with your updated images.