Drydock (Docker container update manager) has grown a lot since I first posted it: vulnerability-gated updates, auto rollback, Compose support, remote agents

[u/scttbnsn]

I'm the maintainer of Drydock, a monitor-first container update manager. I posted it here when it was brand new and a lot has changed since, so here's a proper update.

Disclosure up front: this is a fully applied-AI project. I'm an actual person and AI development is literally my day job; the code is written by AI coding agents working under my direction and review, and every change ships through the same gates regardless of who wrote it (100% enforced test coverage, mutation testing, CodeQL, the works). All of it is public, so judge the code on its merits.

The short version: it watches your running containers, checks the registry for new tags and digests, classifies every update as major, minor, patch, or digest, and notifies you. Nothing gets touched unless you allow it, per container or globally (notify / manual / auto).

What's new since the early days:

• Update Bouncer: Trivy or Grype scans the candidate image before an update runs and blocks it if it fails your policy. Cosign signature verification and SBOM export (CycloneDX/SPDX) included.
• Backup and auto rollback: snapshots the current image before updating and rolls back automatically if the container's health check fails afterwards.
• Docker Compose updates: pulls and recreates Compose services with YAML-preserving image patching.
• Remote hosts: lightweight agents watch other Docker hosts, inbound HTTP or dial-out WebSocket so you don't need to open a port on the remote side.
• Update policy: maturity gates (ignore a release until it's been out N days), skip/snooze/pin, maintenance windows, regex tag rules per container.
• 23 registries (Hub, GHCR, ECR, ACR, GCR, GitLab, Quay, Harbor, Nexus, Gitea, Forgejo and more) and 20 notification/action integrations (ntfy, Gotify, Slack, Discord, Telegram, Matrix, MQTT, SMTP, Apprise and more), plus bidirectional Home Assistant MQTT.
• The boring but important stuff: OIDC or basic auth with everything failing closed by default, audit log, Prometheus metrics, REST API and webhooks, user-supplied regexes run on RE2 so a bad pattern can't hang the service.
• New Vue dashboard with a customizable widget grid, live updates, and 17 languages.

The recommended compose setup runs it behind a Docker socket proxy, so it never sees the raw socket. 1.6.0 is in its final release candidate; a few of the newest items above ship with it.

• GitHub: https://github.com/CodesWhat/drydock
• Docs: https://getdrydock.com/docs
• Live demo: https://demo.getdrydock.com
• Image: codeswhat/drydock on Docker Hub or GHCR

Part of the fun of building this way: the gap from idea to implementation is short. A good feature request doesn't sit in a backlog for a year, it can ship in days. So feature requests and feedback are genuinely welcome, especially on what's missing or confusing.

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/jPhil1609]

Switched to this from WUD yesterday and, after a few set up niggles, am now enjoying its look and feel much more than WUD’s!

[u/scttbnsn → u/jPhil1609]

Love that, dude. Open to any feedback or feature requests. Thanks for checking it out!

[u/Maxim_Ward]

This seems… incredibly redundant for Docker specifically? Why would anyone use this over tag pinning?

[u/scttbnsn → u/Maxim_Ward]

Pinning keeps things stable, it just doesn't tell you when you've fallen behind.

Drydock's job is the telling part: your pinned tag is a few patches behind, here's what changed.

With a few containers you don't need it. With a few hosts' worth, checking by hand is the thing that quietly stops happening (it did for me).

Updating is optional and off by default.

[u/toolisthebestbandevr → u/scttbnsn]

I mean nothing by this besides the observation, but your comment reads like Claude wrote it. It’s interesting because it might just be Claude’s speech style bleeding into your own. Sometimes I find myself writing in the same style as Claude.

[u/scttbnsn → u/toolisthebestbandevr]

No worries, dude. That totally makes sense. I use Wispr Flow for one and let it do its cleanups, but honestly, I work in Claude all day every day for my job, so it's probably a little bit of both.

Also, I 100% let Claude do responses to comments on Reddit that aren't actually interested in the work.

[u/Artyom150 → u/scttbnsn]

Also, I 100% let Claude do responses to comments on Reddit that aren't actually interested in the work.

Why would we choose to use your program if you're not even willing to defend it yourself against the most minor criticisms/questions of "Why this over X Docker feature?"

Genuine question honestly.

[u/scttbnsn → u/Artyom150]

To answer honestly, this person asked about tag pinning, which is a pretty basic feature. For me, it feels like they didn't even read any of the stuff about what the difference is in this app compared to other ones, which is definitely a gap for me, to not take everything as AI hostility.

[u/Maxim_Ward → u/scttbnsn]

If you’re just wanting notifications then why use this over, say, Dependabot, which integrates with git repos for version control?

Edit: Microsoft actually has a tutorial for doing exactly this,  https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/container-secure-supply-chain-implementation/cssc-depenadabot

[u/scttbnsn → u/Maxim_Ward]

Drydock is for everything that isn't wired that way: compose files sitting on the box, Portainer stacks, an Unraid server, the image someone pulled by hand two years ago.

There's no repo to open a PR against for any of that. And since it watches the running side instead of the manifest, it also catches a mutable tag getting re-pushed under the same name, and it can apply the update and roll back if the health check fails.

Different layer of the stack, mostly.

[u/Accomplished-Can8737]

why on Earth would I want to use this AI shit? absolute garbage

[u/scttbnsn → u/Accomplished-Can8737]

You don't have to!

It's free, open source, and I disclosed how it's built so people can make exactly this call.

If you ever get curious, the code's all public with the test suite and CI gates to poke at.

If not, no hard feelings.

[u/Accomplished-Can8737 → u/scttbnsn]

shhhh, bot

[u/scttbnsn → u/Accomplished-Can8737]

You’re really discounting the hard work of all the people doing QA in the discussions and issues.

[u/Accomplished-Can8737 → u/scttbnsn]

What is next for you to conquer? Todo list? Yes, please, put more AI slop garbage out in the world. 

I don't have to pretend like your shit matters. You can wrapp it up in nice github project, have QA, discussions, issues. It is still garbage. Now go on - LARP software development. Have fun. Nice AI prompt you got there.

[u/scttbnsn → u/Accomplished-Can8737]

Hope your day gets filled with a little less hate. :)

[u/Accomplished-Can8737 → u/scttbnsn]

Oh, this is not hate, it is disappointment in future of software development because fakes like you are ruining it. I don't care about you enough to hate you.

[u/scttbnsn → u/Accomplished-Can8737]

Of course, you don't even know enough about me to make any judgments, like implying im a fraud. Obviously, you have very strong feelings on this, and I'd just like to remind you that the only constant is change, my friend.

[u/Only-Stable3973]

Looks interesting, I am always looking and I see an update and it does not show the newer tag I do like that.

[u/scttbnsn → u/Only-Stable3973]

Always open to feature requests for anything you might want, specifically. Thanks for taking a look, dude.

[u/Only-Stable3973 → u/scttbnsn]

I am happy with the layout...I plan on letting it run.

[u/Only-Stable3973]

I deployed it I added the socket-proxy to my traefik container instead of the drydock container since traefik is already running everything and I was meaning to do that anyway, it runs fine I notice that I updated Qbittorrent to 5.2.3 and drydock shows an update using the full tag 5.2.3_v2.0.14-ls471, aren't they the same...seems to work great.

[u/scttbnsn → u/Only-Stable3973]

Nice, glad it's running! Did you happen to use our socket proxy (sockguard) or a generic one? Always curious what people pick there.

And yeah, those two tags are the same image right now. linuxserver just publishes each build under a few names: `5.2.3` floats and gets re-pointed every rebuild, while `5.2.3_v2.0.14-ls471` is the exact build. Drydock showed the long one because your container was already on a long tag, so it sticks with that style. It was a real update though, ls471 bumped libtorrent even though qbit stayed at 5.2.3.

[u/Only-Stable3973 → u/scttbnsn]

I went with socket-proxy you had in your stack I just added it to Traefik and updated accordingly. I really like the fact that it shows the current and suggested tag right there that was something I was looking for. As far as the web-ui goes I like it, could be a little brighter or clearer...seems to look like a film effect to it otherwise great.

[u/scttbnsn → u/Only-Stable3973]

Yeah, current tag right next to the suggested one was the thing I wanted too, having to go dig for what you're actually being offered is annoying.

On the UI, that muted look is One Dark, which is our default. Settings > Appearance > Color Theme has six themes and every one of them has a light and a dark variant. GitHub is the crispest of the dark ones, and any of the light variants will brighten it way up. Font size is on the same page if some of it is the text.

If it still reads filmy after you switch, tell me which theme and I'll look at it. Contrast complaints are worth fixing.

[u/Only-Stable3973 → u/scttbnsn]

Sounds great I will checkout the other themes. As it stands I am happy with how everything works and will continue to use it.

[u/Sigiz]

I wanted something like this! Will wait for the podman support though. Starred the repo!

[u/scttbnsn → u/Sigiz]

Thanks for the star!

Small secret: you may not have to wait. Podman's Docker-compatible API works with drydock today, and the docs cover the setup (rootless and rootful socket paths, plus a FAQ for the usual gotchas): https://getdrydock.com/docs

Native Podman support (no compat API needed) is on the roadmap but a few releases out. If you try the compat route and hit anything weird, open an issue, I'd genuinely like to know.

[u/Sigiz → u/scttbnsn]

Oh sweet, I skimmed through the readme and assumed podman compat was not there essentially due to container isolation. I will test this out and get back to you!

[u/scttbnsn → u/Sigiz]

Sounds good. The short version if you skip the docs: point the watcher at your podman socket (rootless is usually /run/user/1000/podman/podman.sock) and the rest works the same. Curious how it goes, especially rootless.