Automatically update your running Docker containers to the latest available image.

The de-facto standard for docker update automation

Forked from the original at https://github.com/pyouroboros/ouroboros/

Overview

Ouroboros will monitor (all or specified) running docker containers and update them to the (latest or tagged) available image in the remote registry. The updated container uses the same tag and parameters that were used when the container was first created such as volume/bind mounts, docker network connections, environment variables, restart policies, entrypoints, commands, etc.

• Push your image to your registry and simply wait your defined interval for ouroboros to find the new image and redeploy your container autonomously.
• Notify you via many platforms courtesy of Apprise
• Serve metrics for trend monitoring (Currently: Prometheus/Influxdb)
• Limit your server ssh access
• ssh -i key server.domainname "docker pull ... && docker run ..." is for scrubs
• docker-compose pull && docker-compose up -d is for fancier scrubs

Getting Started

More detailed usage and configuration can be found on the wiki.

Docker

Ouroboros is deployed via docker image like so:

docker run -d --name ouroboros \
  -v /var/run/docker.sock:/var/run/docker.sock \
  ghcr.io/styliteag/ouroboros

This image is compatible with amd64, arm64, and arm/v7 CPU architectures

or via docker-compose:

Official Example

Private registries / multiple logins

Ouroboros resolves registry credentials per registry, the same way docker login does. The recommended setup is mounting a docker config.json with one entry per registry:

docker run -d --name ouroboros \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/.docker/config.json:/root/.docker/config.json:ro \
  ghcr.io/styliteag/ouroboros

{
    "auths": {
        "ghcr.io": {"auth": "<base64 user:token>"},
        "https://index.docker.io/v1/": {"auth": "<base64 user:pass>"},
        "my.private.registry": {"auth": "<base64 user:pass>"}
    }
}

This works for standalone containers, swarm services and dry-run checks. Registries without an entry (e.g. public Docker Hub images) are pulled anonymously.

Alternatively, for a single registry, set REPO_USER, REPO_PASS and REPO_REGISTRY (default docker.io). The credentials are only sent to that one registry; both mechanisms can be combined.

Minimum image age

To avoid updating to a freshly published (possibly broken) image, set MIN_IMAGE_AGE. New images younger than this are deferred until a later cycle. Values are plain seconds or durations with s/m/h/d/w suffixes (combinable: 1d 8h, 8h30m):

MIN_IMAGE_AGE=1d                 # only update to images >= 1 day old
MIN_IMAGE_AGE_ONLY="web1 web2"   # optional whitelist: gate only these (container/service names)
MIN_IMAGE_AGE_IGNORE="critical"  # optional blacklist: never gate these (container/service names)

Per container/service override via label (takes precedence, 0 disables):

labels:
  - com.ouroboros.min_image_age=1w

Note: not enforced in --dry-run mode (registry metadata carries no creation timestamp).

Examples

Per-command and scenario examples can be found in the wiki

Contributing

All contributions are welcome! Contributing guidelines are in the works