DockerUpdateGuard

Overview

DockerUpdateGuard keeps an overview of a Docker estate that has grown over time. It maintains an inventory of observed images and of the containers actually running, reconciles both against registry tags and digests, and answers the question that “a newer tag exists” leaves open: which update is worth doing now, and which one can wait?

The application stores its data in PostgreSQL, applying database migrations itself on startup. It talks to one or more Docker Engine endpoints, optionally through the local Unix socket, and can additionally use Docker Hub credentials and Portainer per instance. The interface is split into dashboard, observed images, runtime containers, Docker instances, shared base images and scan history.

Two behaviours set it apart from a simple update notifier. First, it resolves alias tags: if latest points at the same digest as a version tag, the concrete version is named. Second, it treats major upgrades conservatively. A new major line is only recommended once it has reached a minimum number of releases and a minimum age, and while the previous line is still maintained alongside it, the upgrade stays deferred.

Vulnerability data can come from Trivy in client mode or from Docker Scout. The published container image already ships the Trivy command line. Docker Hub requests work against a per-window request budget, so scheduled scans never exhaust the rate limits and manual scans remain possible.

Features

Installation

docker run -d \
  --name dockerupdateguard \
  -p 8080:8080 \
  --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
  -v /path/to/appsettings.json:/app/appsettings.json:ro \
  networlddev/dockerupdateguard:latestCopy

A PostgreSQL database is required; migrations run automatically on startup. When the Docker socket is mounted, the instance BaseUrl has to point at unix:///var/run/docker.sock.

Releases

All releases on GitHub ↗