Image updates

2 min read

Image Update Detection

In production (STACK=prod), WITH_WUD=1 is the default and enables WUD. WUD watches running images and applies a hybrid policy: api and ui auto-pull + auto-recreate on new GHCR tags, while base services stay notify-only for operator review.

Setup Hybrid policy

WUD

watch engine

Hybrid

deploy policy

:3033

WUD dashboard

Hybrid policy

App images (api, ui): auto-deploy

WUD uses a Docker trigger for app containers. When GHCR publishes a newer image tag, WUD pulls and recreates those containers automatically.

Base images (postgres, valkey, traefik): notify-only

WUD reports updates, but does not recreate base services. You review release notes, schedule maintenance, then update manually.

Notifications are optional

Dashboard at :3033 always works. Discord and Slack notifications are enabled only when the corresponding env vars are set.

Setup

Optional notifications in compose/.env (Discord, Slack, or both):

WUD_DISCORD_WEBHOOK=https://discord.com/api/webhooks/...
WUD_SLACK_BOT_TOKEN=xoxb-...
WUD_SLACK_CHANNEL=docker-updates

Optional private GHCR auth:

WUD_GHCR_USERNAME=your-gh-username
WUD_GHCR_TOKEN=ghp_xxx

Optional schedule override:

WUD_SCHEDULE="0 */6 * * *"

Boot production stack:

Boot prod with WUD

$ STACK=prod ./scripts/compose-up.sh

ok  WUD started
ok  Dashboard at http://localhost:3033/

Operational flow

A push that touches apps/api or apps/ui publishes new GHCR image tags.
WUD detects tag movement on schedule.
App containers auto-pull + auto-recreate.
Base-image updates only generate notifications.

Manual base-image update

For Postgres, Valkey, and Traefik:

Read upstream release notes.
Take required backups.
Bump pinned tag(s) in infra compose files.
Pull and recreate the specific service.

Disable WUD

WITH_WUD=0 STACK=prod ./scripts/compose-up.sh

Source

infra/compose/docs/image-update-detection.md · WUD docs