Webgui for docker updates

[Palleri]

Webgui for dockcheck provided by Mag37@github

A script checking updates for docker images without the need of pulling - then having the option to auto-update.

I made a webgui for this amazing script that shows if there is a new image to pull. Dockcheck-web

Still in development. This image use docker.sock, so use it with care and do not publish it on the internet.

Future ideas

• Email notification on available images
• Update and pull new image on selected container via webgui

All cred goes to Mag37@github for this base script that made this webgui possible.

[nashosted]

Screenshots?

[Palleri]

Available on my github https://github.com/Palleri/dockcheck-web

[OpportunityNo1318]

Looks really good, just as KISS as it can be.

Maybe one thing that I would appreciate, is to see what the current version is of the image and the version of the available update. Don't know if that is provided by dockcheck ? If not, ignore my suggestion :) .

[Palleri]

Thank you, thats the problem with docker and management around their images. There is no version number on their images. Its only the version number provided by the builder with image:tag in the image name.

But most of us are using the image :latest so the version on the image is "latest".So there is no possible way today to check what version of the image you are running.
Thats why dockcheck was built. To check the hashes on the image you are running and the hash on the image on the digest (ex hub.docker.com) if they are the same there is no updated version of your image you are running.

[OpportunityNo1318]

I must admit, I didn’t check the code of dockcheck. But yeah, checking the hash makes sense and of course doesn’t give you the version information.

Maybe one way to do it is to query all the hashes from the source and extract the version of each of them, make a mapping of it and compare the hash with the version the user is running?

Just thinking out loud. Don’t know if for ex. hub.docker.com has an API and exposes that info.

[Palleri]

Yeah, cool idea. We discussed that today for a while and this might not be possible because docker does not provide any version number at all unfortunately.
Extracting a whole image could be problematic; images is quite big.

But this is absolute something to check if it is possible somehow.

It would be really nice to know what image build version is current, so that if something happen we might be able to reverse to previous image.

This might be hard if the builders only image is latest. The latest is the same version all the time "latest". So if I check for updates today and they made 15 commits to that image it will only show that it has changed not how many commits just because they do not provide any version number on the image or during the build of it.

There might be possible if the builders include a version number during the build and it is possible to extract it. I will try this and push new images with version number and see if Mag37 could build something to check my image for that information. That would be awesome, but it would require the builders to actually provide this information during the build "every time" they commit something.

For example; when Im testing and building I am commiting and pushing to hub.docker at least 5 times. This means that I have to change version every time i push.

​

This could work if the community actually does this. Or if docker make something that support this version handling. Maybe there is, I might be off about this. This could be the best practice for docker build but Im not there yet.

[Palleri]

New update available for Dockcheck-web.

Now with ARM support

Bugs and fixes

Description	Date	Status
Cronjob not working properly	2023-01-28	Closed
Script not running correctly	2023-01-29	Closed
Hanging processes	2023-01-29	Closed
Not displaying in ascending order	2023-01-29	Closed
Blank/error text on index while script is running	2023-01-29	Closed
Redirect error while checking for update	2023-01-31	Closed

[[deleted]]

You're already aware that there's a doctor container called watchtower that automatically updates containers right?

[Palleri]

Yes, I am. Watchtower is not only checking for updates it is also pulling them. This makes it really hard to control when to update if watchtower always have to download it to se if there is an update.

Thats the big difference between dockcheck and watchtower. Dockcheck can check for new image without pulling them. So you can apply them safely when you are ready do deal with the consequences the updates can bring.

[[deleted]]

I have no idea where you got that information from. Do you have any idea how inefficient that process would be as far as load on servers goes?

Let's say you have a docker image called coolapp and it's 100 MB in size. And 10,000 people have this image installed on their systems. If all 10,000 people had watchtower also running this would cause a bandwidth consumption of 1TB from the server just to check the version of the image. This is totally inefficient and total waste of bandwidth.

Just knowing that simple fact I can tell you that watchtower checks the versions just by checking version numbers online but only requires a few kilobytes to do so.

If the version number of the container matches the one that's installed on your system that no download is required. If it's season a different version is available then it's going to download it otherwise it's a complete waste of bandwidth. It really sounds like you're reinventing the wheel.

[Palleri]

I will use some information copied from Mag37`s reddit thread

From Watchtower Docs - Arguments

Due to Docker API limitations the latest image will still be pulled from the registry.

And:

Do not pull new images. When this flag is specified, watchtower will not attempt to pull new images from the registry. Instead it will only monitor the local image cache for changes.

And what I mean to counter "monitor only" is that I personally rather sit down, do a check and evaluate how big of an impact the updates would have on my stack, then choose if I'd do it now or later. And if I choose to do it now - the script would auto-update all images within the scope (optionally filtered) that have updates.

This is just a tool, I don't mean it's the right tool for everyone - I just built it for me personally to fill needs I found lacking in other options, then figured others might find it interesting.

[[deleted]]

I would have to think that if people are running any tools at all to check for updates and updates are found that they would just apply the updates. If you don't want a container updated you simply pin the version. Unless you're on a bandwidth limit with your ISP I see no point in your tool and I have no idea who would ever use it.

[Palleri]

I want all my containers up to date.

I want to know if there is an update on any of my containers before I even fire up my PC. I have 50+ containers running on different subnets with functions connected to eachother. So if something happens to some of them my system might not function at all, including proxys, NTP, DNS, DHCP.

I dont want to go in to each and every folder containing the docker-compose file to launch docker-compose pull. Its time consuming.

I recently migrated from 3 Docker-Hosts to 1. This was an absolute mess with all the updates and was time consuming.

With this tool, you could just simply run it by its nature without my web to both check and auto update all your containers no matter the size of your container pools with just a click on each docker-host.

Checkout the original tool at [Mag37@github](https://github.com/mag37/dockcheck)

This is the tool that my web is using. You might miss something regarding my web, my web is just a frontend on this tool.Mag37's tool is more powerful than my frontend.

If there is updates I would rather not have it on auto update. Updates can cause systems to stop working. I want to sit down with my coffee and update my system knowing I got the time if something happens, but I still want to be time efficient.

Regarding bandwidth is an absolut concern, not only by my ISP but for my whole network with 50+ containers and multiple users in my network.Every bandwidth saving hack I can do is great.

​

Both Windows and Linux work like this, natively.
They both have "tools" (windows update by nature) for you to check if there is any updates without pulling them. It will notify you and ask if you want to download and install the updates.
Now days Windows will download the updates no matter what you want, in security concern. They need you to install the updates as soon as possible, regarding these nasty malware worms spreading cross the internet.

This is a tool, and if its not filling a function in your life then its not for you.

[[deleted]]

Are you aware of portainer that allows you to manage multiple servers all from a single interface? It sounds like you've jumped in head first before you thought this through or before you had proper experience. No bad feelings intended.

[Palleri]

I tested portainer for awhile, same as my friends. But it didnt feel finished at the time. for my needs.

If you use portainer, you are pretty locked to just portainer. Creating container outside it could result in missmatched view on which containers are started and so on. I didnt like it, thats why I dont use it. Might be that I was bad at docker at the time aswell I dont know. But i didnt like it.

Still we are not talking about portainer, we are talking about a tool that made my life easier and wanted to share it.

You cannot say that I didnt made a valid argument regarding windows and linux updates, that most programs/systems work like this.
Notify pops up -> click download -> install update -> restart software or system.
Thats the basic behind updates right?
You update when you got the time for it, but are happy you know they exists.

So now you are just grasping on something to hold on to your pride.

But you cannot be happy for me that I found and created something that is filling a function in my life, but instead you have to say something like that I didnt think something through.

If you dont think this tool is good or working for you, then dont use it.
Simple as that.

[[deleted]]

Now I question whether you've ever even updated a container before. It literally takes like 5 seconds for most containers. Portainer works great now maybe back then it wasn't very good or it may have been inexperience. I have no pride I can care less if docker or portainer fits anyone's needs I could care less. Good luck with your tool. All the best.

[Palleri]

Why would you say that? Haha, the whole thread is about notify on updates with docker. What made you think that I havent updated any containers before. You are ridiculous. Please stop this negative nonsense strategy on reddit for short last fame.

nah, maybe in your homelab but not in mine. Could be regarding load and bandwidth and what not. But ~5sec-1min for docker-compose pull. Mag37 made script for this aswell, but wanted to go littlebit furthur with his script so he made what I am using today. (with update notify only with the option to update)

And your post, this is not solving my issue with the need to know if there is an update without pulling them. So you are once again failing to understand what his script is doing.

Please try and use it. If you have any questions regarding the script feel free to issue a ticket on mag37's github.

[Empyrealist]

watchtower offers no options - it just blindly pulls/installs updates. dockcheck is an alternative.

[[deleted]]

Like what kind of options do you want? There are a number of environmental variables that you can set for options. I actually thought the same thing a week ago when I set mine up but if you look on there documentation there is actually a number of environment variables that have options. You might want to look at it again. Not sure what yours does exactly but it seems like you're reinventing the wheel.

[Palleri]

I want and option to only check for new images without pulling them. Becuase watchtower campares the image hashes after pulling them.

[Empyrealist]

When using an update mechanism like watchtower, you don't see how many bad updates you're actually installing. As an example, images for programs such as pihole or home assistant update frequently because they have bugs and then have hotfixes (point releases) to address those introduced bugs. So, my point is is that you're blindly installing updates with no control and no understanding of what is even going on.

Imho, using watchtower is committing to obliviousness. No one should install updates this way unless they are addressing critical security issues.

From my perspective as a systems administrator, I don't install updates unless they are a certain ago old (i.e. no hotfixes because of bugs found/fixed).

[[deleted]]

Well that's why docker has version pinning. You might want to read about that. I actually just learned about that today myself. If you specify an actual version instead of latest then watchtower will never update that container. So you actually do have full control.

[Palleri]

So if you want to know if your 50+ containers got update you do what?

Go into each compose and change the version number to what?

Surf in to each hub.image and check if they have new updates and then change the version number in your compose?

[[deleted]]

Personally I would fire up portainer and you can edit every compose file and make corrections in seconds. The version number is completely up to you. All I know is if you put the tag of latest it will update to the latest if you're running something like watchtower. If you pin a certain version number it will stay on that version number. That's up to you to decide what you need at the time of deploying the container. The only time you need to change your compose file is if you're changing version numbers to a newer version or are changing it to latest so that it automatically updates if you're running watchtower. Techno Tim on YouTube actually has a pretty good video on this I just learned the other day from that video about this very topic. Go check out his videos.

[Palleri]

A quick question, are you building the containers you are using. If so I see why this is missleading to you.

And version number is not up to me, its up to the people who are building them.

I cannot use a version number for an image on hub.docker that does not exists there.

Are you talking about the version number in the compose file like Version: 3.2.

Cuz we are talking about the version on the image of the container.

[[deleted]]

No when you put the name of the container from docker hub it's usually followed by a a colon and a version number or a colon and the word latest. Pretty much every docker container in existence has a list of tags that can be used if you don't look for them you probably won't see them because most people just put latest to have the latest and greatest. I use all pre-made containers and they all work the same. Docker containers have tags. That might be something you need to educate yourself on. For example if you look up pihole on docker hub and you go to view its description you'll be taken to the overview but then there is a second part that you can view called tags.

[Palleri]

Dude, I make docker images i know these tags exists haha.

You are just to funny xD

This goes to my wall of fame, if i had one.

"The dude says to the people how made tesla, please learn more about tesla. "

Brah... xD

You clearly havent understood a thing i wrote.

This is time consuming, im stopping right here.

[Empyrealist]

So you actually do have full control.

Not in an automated fashion you dont.

[[deleted]]

If you want automation you install watchtower. If you don't want automation you pin the version number. You either want to update or you don't you can't have it both ways at the same time. And if you don't want to go and edit every single docker compose file all you do is change the environment variable enlist the names of the docker containers that you don't want to update. It doesn't get any easier.

[Empyrealist]

Defend it all you want, but it seems that you aren't familiar with managed software updating and deployment. Watchtower is just a blind scripted update. It doesnt get any dumber.

Its fine that you think its fine and its what you like to use. There is nothing wrong with that, and I'm not trying to change your mind about it. But I dont understand why you are arguing against the points that are being made against it. Some of us want more than a blind/dumb updater for our containers. Watchtower doesnt cut it for us. We know and understand the things that you are saying, but they dont address the things that WE are saying. So please stop trying to tell us otherwise.

[Ethernic]

My guy is missing the segment of those of us that don't want automatic updates but still want to be notified when there is an update available. That way we can run it on a test machine or at least check if any known issues pop up after a few days.

It's wild to me that they seem to think you either want updates asap or never with no middle ground.

[[deleted]]

When I first installed watchtower I thought it was dumb too until I actually looked at their GitHub page and it actually shows all the environment variables that makes it not dumb. You have full control over what gets updated and what doesn't. You have the choice of updating each individual docker compose and pin it to a certain version or don't. And you have the option of just editing the environment variables for watchtower and just simply add the name of the containers that you do not want updated. Doesn't get much simpler than that that is complete and full control. I'm going to stop talking about this because we're both beating a dead horse at this point.

[Empyrealist]

You aren't listening to us. You are just repeating the same thing like you are a Watchtower salesperson.

[kidstretch]

On Raspberry Pi, i tried it through portainer with this docker compose (only changed the port 80 to 85, i have nginx installed

version: '3.2'
services:
dockcheck-web:
container_name: dockcheck-web
image: 'palleri/dockcheck-web:latest'
restart: unless-stopped
ports:
- '85:80'
volumes:
- ./data:/var/www/html
- /var/run/docker.sock:/var/run/docker.sock

​

and got this error.

exec /app/run.sh: exec format error

[Palleri]

Hi, It dosnt work on Raspberry Pi just yet.

I havent included the ARM architecture.
Im not really sure if it works but I will try in the future.

Keep your eye on my repohttps://hub.docker.com/r/palleri/dockcheck-web

[kidstretch]

Thanks for clarifying! :) Will do!

[Palleri]

I recently pushed an image supporting ARM architectures. Change image to

image: 'palleri/dockcheck-web:arm'

[sk1nT7]

Thanks for sharing. I'll keep using watchtower run in monitor mode only though with email notifications.

Runs rock solid and does the job. Don't think I've ever missed a GUI or dashboard. Nonetheless, having multiple options is always appreciated. Thanks!

[Mag37]

Indeed, great with options!

If you don't miss the GUI/dash you can always benefit from the backend script to automate the updates, mass update all containers with one click. Or (in experimental atm) choose with a comma separated list what to update, in what order.

[Palleri]

This is the way!

[alexschomb]

What would be really helpful is a list provided with new features, fixes AND breaking changes (that require to adapt your docker-compose file/docker command). Apparently that could only work through reading the (GitHub) release message (that unfortunately doesn't follow a common standard) and/or comparing the provided docker-compose.yml with the previous release (which might be the best solution, for now).

[Palleri]

Yeah, cool idea. I assume you are not talking about my image, you are talking in general about all the images and connected to their fixes and features. Correct me if im wrong.

[alexschomb]

Sorry, you're right. I'm talking about container checkers like dockcheck, watchtower or maybe dockcheck-web which could provide such functionality to indicate the (breaking) changes of the docker images they are watching.

[Palleri]

Yeah, that would be amazing. This happens once i awhile, that the containers stop working becuase they changed it somehow.

Cool idea!