After converting my servers into docker setups, I was in need to update the images/containers regularly for security reasons. Baffled I found, that there is no standard update method to make sure that everything is up-to-date.
The ephemeral setup allows you to throw away your containers and images and recreate them with the latest version. As easy as this sounds, you figure that there are some loopholes in the setup.
First we need to understand, there are 3 types of images that we need to keep up-to-date
- Images from the docker hub, that just get pulled and are used as they are with some configs
- Images from the docker hub, that get pulled and then are only used as base for own dockerfiles
- The images created out of own dockerfiles
Ridiculously all three of them need to be updated to make sure everything is up-to-date (e.g., a new build won’t get the latest base image update) and additionally we have to care for cleanup.
I found some solutions in the net to automatically update docker, the so far best version by binfalse.de (Automatically update Docker images). But this leaves out my own dockerfiles with a build and some minor steps, pruning, etc. So I am only using the dupdate script out of the Handy Docker Tools to incorporate in a little script.
So what is the solution
WARNING: This just updates images. If your setup needs additional update steps, you need to plan these in. Otherwise you risk breaking your setup.
You need multiple steps to completely update.
First, I use dupdate to update all docker images coming from a hub, covering the ones I use directly and as base for builds.
This will give an error for the images you created out of your own dockerfiles, but update all via pull from docker hub.
Second, I update the images of my own dockerfiles by rebuilding all via docker-compose (If you use docker without docker-compose, you just have to to this for each dockerfile)
/usr/local/bin/docker-compose -f docker-compose.yml build
This will use the newly pulled base images in their build, hence create the latest version for your dockerfile.
Now the images are all updated and we only need to restart the containers.
Addition for cleaning up
However you end up with a lot of images tagged or named <none>. These are your old images, which are now cluttering the hard drive.
The ones only tagged with <none> are the ones you updated from docker hub, the ones with name and tag <none> are the ones you build.
You will need to do a image prune to get rid of them and free up space.
/usr/bin/docker image prune -a --force
Warning: This will erase all older images. If you need them as a safety precaution, skip this step.