WhatsNewDock
Self-hosted Docker container update monitor that shows changelogs before updates.
Ficha actualizada 22 sept 2026, 23:55 · upstream 22 sept 2026, 23:30 · release v0.1.3
Qué es WhatsNewDock
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
WhatsNewDock is a self-hosted Docker container update monitor with a focus on changelog tracking. It watches every container across your Docker hosts, tells you when a newer image is available, and — crucially — shows you what actually changed by aggregating release notes from multiple sources including GitHub Releases, GitLab Releases, Gitea/Forgejo releases, and registry tag listings. A single, sleek web UI gives you a unified view of all servers, stacks, and containers with one-click image updates.
The tool provides update detection that compares each container's current tag against upstream releases to report how many versions you are behind. It aggregates release notes from various sources: GitHub Releases (including ghcr.io images and those labeled org.opencontainers.image.source), GitLab Releases on registry.gitlab.com, Gitea/Forgejo releases for self-hosted instances, and Docker Hub or other registry tag listings as a fallback when no changelog is available.
A history feature lets you browse the last N releases (default 5, configurable) so you can see the full changelog of each skipped version. The interface supports one-click image updates using only the Docker Engine API with live progress and automatic rollback if replacement fails to start. It offers both agent-based and agentless deployment modes — either deploying an agent on every server or directly connecting via a remote Docker API endpoint.
The application uses an embedded SQLite database for all data, requiring no external databases. Authentication supports local username/password accounts plus optional OIDC integration with PocketID or other providers, featuring admin and viewer roles. It is hardened against common attacks including memory-safe Go backend code, non-root distroless images, signed session cookies, CSRF protection, and no use of the Docker CLI or shell commands.
Architecture-wise, WhatsNewDock runs a web server that serves the UI/API while optionally monitoring local Docker hosts through a socket-proxy. The proxy holds the Docker socket read-only and exposes only the restricted API the application needs. Agent mode snapshots a host and reports it to the server, which then ex
- Track which Docker images you are behind on across multiple servers
- Monitor container health by checking if newer versions exist for each image
- Automatically pull and update containers when new release notes are available
- Compare version history of your applications to identify breaking changes
- Set up automated deployment pipelines that trigger on specific changelogs
- Audit which images have been updated without manual intervention
- Single web UI aggregates changelogs from GitHub, GitLab, Gitea/Forgejo, and registry tag listings into one dashboard
- One-click image updates using only the Docker Engine API with automatic rollback on failure
- Supports both agent-based deployment (agentless) and direct endpoint connections to remote Docker hosts
- SQLite database stores all data locally without requiring external databases or cloud storage
- Built-in support for Docker Swarm with task-level grouping and service updates via the socket-proxy
- Hardened security features including memory-safe Go backend, non-root distroless images, signed session cookies, CSRF protection, and no Docker CLI usage
- Only monitors GitHub Releases for this repository; does not scan other private repositories or registries unless you add them manually
- Updates require write access to containers and images on the monitored host — must be granted via socket-proxy permissions
- Self-updates only offer newer tags from the same repository; they cannot pull arbitrary new versions without a registry digest reference
- Agent mode requires each remote host to have Docker installed with the required API endpoints exposed
- Direct endpoint updates are limited to hosts on the same LAN or via VPN, and require TLS for non-local connections
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Deploy WhatsNewDock using Docker Compose: run `docker compose up -d` which starts the server and a socket-proxy container. The proxy exposes only the restricted API needed by the app. For agent deployment, create servers in the UI, copy tokens from the dashboard, then run agents with the provided token and link to the socket-proxy via environment variables or a shared network. Direct endpoints require TLS certificates for remote hosts. Self-updates are enabled by default every 24 hours; set `WND_SELF_UPDATE_IMAGE` if you need to pin an exact version. For production, consider using Quadlet deployment for systemd-based management with rootless and rootful options available in the deploy/quadlet directory.
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.