blocks|key|2724625|text|如果不运行docker+pull，您就不会知道您的容器落后了。然后你需要rebuild或recompose你的图像。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2724626|docker+pull+image:tag
docker-compose+-f+docker-compose.yml+-f+production.yml+up+-d+--build|code-block|syntax|javascript|2724627|这些命令可以与完成升级所需的任何其他内容一起放在脚本中，尽管合适的容器不需要任何额外的东西。|2724628|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.docker.com/engine/reference/commandline/pull/|1|https://docs.docker.com/engine/reference/commandline/build/|2|https://docs.docker.com/compose/reference/build/^0|5|B|0|10|7|1|18|9|2|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]|$A|10|B|11|1|12]|$A|13|B|14|1|15]]|C|$]]|$1|D|3|E|5|F|7|16|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|17|8|@]|9|@]|C|$]]|$1|K|3|-4|5|6|7|18|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]|S|$5|N|O|P|C|$Q|T]]|U|$5|N|O|P|C|$Q|V]]]]

You would not know your container is behind without running <a href="https://docs.docker.com/engine/reference/commandline/pull/" rel="noreferrer">docker pull</a>. Then you'd need to <a href="https://docs.docker.com/engine/reference/commandline/build/" rel="noreferrer">rebuild</a> or <a href="https://docs.docker.com/compose/reference/build/" rel="noreferrer">recompose</a> your image.

<pre><code>docker pull image:tag
docker-compose -f docker-compose.yml -f production.yml up -d --build
</code></pre>

The commands can be put in a script along with anything else necessary to complete the upgrade, although a proper container would not need anything additional.

blocks|key|2724678|text|我也遇到过同样的问题，我想通过一个每天调用unattended-upgrade的任务就可以简单地解决这个问题。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2724679|我的目的是让它作为一个自动和快速的解决方案，以确保生产容器的安全和更新，因为我可能需要一些时间来更新我的镜像，并使用最新的安全更新部署新的docker镜像。|2724680|还可以使用Github+hooks自动构建和部署映像|2724681|我已经创建了一个基本的docker+image，可以每天自动检查和安装安全更新(可以直接由docker+run+itech/docker-unattended-upgrade运行)。|2724682|我还遇到了另一个不同的approach来检查容器是否需要更新。|2724683|我的完整实现：|2724684|文档文件|BOLD|2724685|FROM+ubuntu:14.04+++

RUN+apt-get+update+\
&&+apt-get+install+-y+supervisor+unattended-upgrades+\
&&+rm+-rf+/var/lib/apt/lists/*

COPY+install+/install
RUN+chmod+755+install
RUN+/install

COPY+start+/start
RUN+chmod+755+/start|code-block|syntax|javascript|2724686|帮助器脚本|2724687|安装|2724688|#!/bin/bash
set+-e

cat+>+/etc/supervisor/conf.d/cron.conf+<<EOF
[program:cron]
priority=20
directory=/tmp
command=/usr/sbin/cron+-f
user=root
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/%25(program_name)s.log
stderr_logfile=/var/log/supervisor/%25(program_name)s.log
EOF

rm+-rf+/var/lib/apt/lists/*

ENTRYPOINT+["/start"]|2724689|开始|2724690|#!/bin/bash

set+-e

echo+"Adding+crontab+for+unattended-upgrade+..."
echo+"0+0+*+*+*+root+/usr/bin/unattended-upgrade"+>>+/etc/crontab

#+can+also+use+@daily+syntax+or+use+/etc/cron.daily

echo+"Starting+supervisord+..."
exec+/usr/bin/supervisord+-n+-c+/etc/supervisor/supervisord.conf|2724691|编辑|2724692|我开发了一个小工具docker-run，它作为docker容器运行，可以用来更新所有或选定的运行容器中的包，它也可以用来运行任何命令。|2724693|可以使用以下命令轻松进行测试：|2724694|docker+run+--rm+-v+/var/run/docker.sock:/tmp/docker.sock+itech/docker-run+exec|2724695|默认情况下，它将在所有运行的容器中执行date命令并显示结果。如果您传递update而不是exec，它将在所有运行的容器中执行apt-get+update，后跟apt-get+upgrade+-y|2724696|entityMap|0|LINK|mutability|MUTABLE|url|http://blog.docker.com/tag/automated-build/|1|https://registry.hub.docker.com/u/itech/docker-unattended-upgrade/|2|https://github.com/mafr/docker-update-check|3|https://github.com/iTech-Developer/docker-run^0|L|I|0|0|5|C|0|0|19|16|B|C|1|0|B|8|2|0|0|0|4|0|0|0|5|0|0|0|0|0|0|2|0|9|A|3|0|0|0|26|0|J|4|10|6|19|4|1R|E|28|I|0^^$0|@$1|2|3|4|5|6|7|1V|8|@$9|1W|A|1X|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1Y|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|1Z|8|@]|D|@$9|20|A|21|1|22]]|E|$]]|$1|J|3|K|5|6|7|23|8|@$9|24|A|25|B|C]]|D|@$9|26|A|27|1|28]]|E|$]]|$1|L|3|M|5|6|7|29|8|@]|D|@$9|2A|A|2B|1|2C]]|E|$]]|$1|N|3|O|5|6|7|2D|8|@]|D|@]|E|$]]|$1|P|3|Q|5|6|7|2E|8|@$9|2F|A|2G|B|R]]|D|@]|E|$]]|$1|S|3|T|5|U|7|2H|8|@]|D|@]|E|$V|W]]|$1|X|3|Y|5|6|7|2I|8|@$9|2J|A|2K|B|R]]|D|@]|E|$]]|$1|Z|3|10|5|6|7|2L|8|@]|D|@]|E|$]]|$1|11|3|12|5|U|7|2M|8|@]|D|@]|E|$V|W]]|$1|13|3|14|5|6|7|2N|8|@]|D|@]|E|$]]|$1|15|3|16|5|U|7|2O|8|@]|D|@]|E|$V|W]]|$1|17|3|18|5|6|7|2P|8|@$9|2Q|A|2R|B|R]]|D|@]|E|$]]|$1|19|3|1A|5|6|7|2S|8|@]|D|@$9|2T|A|2U|1|2V]]|E|$]]|$1|1B|3|1C|5|6|7|2W|8|@]|D|@]|E|$]]|$1|1D|3|1E|5|6|7|2X|8|@$9|2Y|A|2Z|B|C]]|D|@]|E|$]]|$1|1F|3|1G|5|6|7|30|8|@$9|31|A|32|B|C]|$9|33|A|34|B|C]|$9|35|A|36|B|C]|$9|37|A|38|B|C]|$9|39|A|3A|B|C]]|D|@]|E|$]]|$1|1H|3|-4|5|6|7|3B|8|@]|D|@]|E|$]]]|1I|$1J|$5|1K|1L|1M|E|$1N|1O]]|1P|$5|1K|1L|1M|E|$1N|1Q]]|1R|$5|1K|1L|1M|E|$1N|1S]]|1T|$5|1K|1L|1M|E|$1N|1U]]]]

I had the same issue and thought it can be simply solved by a cron job calling <code>unattended-upgrade</code> daily.

My intention is to have this as an automatic and quick solution to ensure that production container is secure and updated because it can take me sometime to update my images and deploy a new docker image with the latest security updates. 

It is also possible to automate the image build and deployment with <a href="http://blog.docker.com/tag/automated-build/" rel="noreferrer">Github hooks</a>

I've created a basic <a href="https://registry.hub.docker.com/u/itech/docker-unattended-upgrade/" rel="noreferrer">docker image</a> with that automatically checks and installs security updates daily (can run directly by <code>docker run itech/docker-unattended-upgrade</code> ). 

I also came across another different <a href="https://github.com/mafr/docker-update-check" rel="noreferrer">approach</a> to check if the container needs an update.

My complete implementation:

Dockerfile

<pre><code>FROM ubuntu:14.04 

RUN apt-get update \
&amp;&amp; apt-get install -y supervisor unattended-upgrades \
&amp;&amp; rm -rf /var/lib/apt/lists/*

COPY install /install
RUN chmod 755 install
RUN /install

COPY start /start
RUN chmod 755 /start
</code></pre>

Helper scripts

install

<pre><code>#!/bin/bash
set -e

cat &gt; /etc/supervisor/conf.d/cron.conf &lt;&lt;EOF
[program:cron]
priority=20
directory=/tmp
command=/usr/sbin/cron -f
user=root
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/%(program_name)s.log
stderr_logfile=/var/log/supervisor/%(program_name)s.log
EOF

rm -rf /var/lib/apt/lists/*

ENTRYPOINT ["/start"]
</code></pre>

start

<pre><code>#!/bin/bash

set -e

echo "Adding crontab for unattended-upgrade ..."
echo "0 0 * * * root /usr/bin/unattended-upgrade" &gt;&gt; /etc/crontab

# can also use @daily syntax or use /etc/cron.daily

echo "Starting supervisord ..."
exec /usr/bin/supervisord -n -c /etc/supervisor/supervisord.conf
</code></pre>

Edit

I developed a small tool <a href="https://github.com/iTech-Developer/docker-run" rel="noreferrer">docker-run</a> that runs as docker container and can be used to update packages inside all or selected running containers, it can also be used to run any arbitrary commands.

Can be easily tested with the following command:

<code>docker run --rm -v /var/run/docker.sock:/tmp/docker.sock itech/docker-run exec</code>

which by default will execute <code>date</code> command in all running containers and display the results. If you pass <code>update</code> instead of <code>exec</code> it will execute <code>apt-get update</code> followed by <code>apt-get upgrade -y</code> in all running containers

blocks|key|2937042|text|我们使用一个脚本来检查正在运行的容器是否使用最新的镜像启动。我们还使用upstart+init脚本来启动docker镜像。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2937043|#!/usr/bin/env+bash
set+-e
BASE_IMAGE="registry"
REGISTRY="registry.hub.docker.com"
IMAGE="$REGISTRY/$BASE_IMAGE"
CID=$(docker+ps+%7C+grep+$IMAGE+%7C+awk+'{print+$1}')
docker+pull+$IMAGE

for+im+in+$CID
do
++++LATEST=`docker+inspect+--format+"{{.Id}}"+$IMAGE`
++++RUNNING=`docker+inspect+--format+"{{.Image}}"+$im`
++++NAME=`docker+inspect+--format+'{{.Name}}'+$im+%7C+sed+"s/\///g"`
++++echo+"Latest:"+$LATEST
++++echo+"Running:"+$RUNNING
++++if+[+"$RUNNING"+!=+"$LATEST"+];then
++++++++echo+"upgrading+$NAME"
++++++++stop+docker-$NAME
++++++++docker+rm+-f+$NAME
++++++++start+docker-$NAME
++++else
++++++++echo+"$NAME+up+to+date"
++++fi
done|code-block|syntax|javascript|2937044|init看起来像|2937045|docker+run+-t+-i+--name+$NAME+$im+/bin/bash|2937046|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

We use a script which checks if a running container is started with the latest image. We also use upstart init scripts for starting the docker image.

<pre><code>#!/usr/bin/env bash
set -e
BASE_IMAGE="registry"
REGISTRY="registry.hub.docker.com"
IMAGE="$REGISTRY/$BASE_IMAGE"
CID=$(docker ps | grep $IMAGE | awk '{print $1}')
docker pull $IMAGE

for im in $CID
do
 LATEST=`docker inspect --format "{{.Id}}" $IMAGE`
 RUNNING=`docker inspect --format "{{.Image}}" $im`
 NAME=`docker inspect --format '{{.Name}}' $im | sed "s/\///g"`
 echo "Latest:" $LATEST
 echo "Running:" $RUNNING
 if [ "$RUNNING" != "$LATEST" ];then
 echo "upgrading $NAME"
 stop docker-$NAME
 docker rm -f $NAME
 start docker-$NAME
 else
 echo "$NAME up to date"
 fi
done
</code></pre>

And init looks like 

<pre><code>docker run -t -i --name $NAME $im /bin/bash
</code></pre>

blocks|key|2724790|text|我的答案是：的前提|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|2724791|2724792|Containers是使用标签运行的。|ordered-list-item|2724793|相同的标签可以指向不同的镜像UUID，因为我们喜欢/感觉到appropriate.|2724794|Updates对镜像所做的操作可以提交到新的镜像层|2724795|2724796|方法|2724797|2724798|首先使用安全补丁程序更新脚本构建所有容器|2724799|为以下内容构建自动化过程|2724800|使用安全补丁程序脚本将现有映像运行到新容器，同时将映像更改为|unordered-list-item|2724801|现有标记->，然后逐个重新启动容器<|2724802|>H123新版本标记->将少数容器替换为新标记->验证->将所有容器移至新标记|2724803|2724804|2724805|​|2724806|2724807|此外，可以升级基本映像/可以定期构建具有完整新基本映像的容器，因为维护人员觉得有必要|2724808|优势|2724809|2724810|在创建新的安全修补映像时，我们将保留旧版本的映像，因此，如有必要，我们可以回滚到以前运行的映像|2724811|我们保留了坞站缓存，因此网络传输更少(仅更改的层上线)|2724812|升级过程可以在转移到prod|2724813|之前在暂存中进行验证这可以是一个受控过程，因此只有在必要/被认为重要时才可以推送安全修补程序。|2724814|2724815|entityMap^0|7|2|0|0|0|J|0|0|15|0|0|P|0|0|0|2|0|0|0|K|0|0|C|1|0|U|2|0|I|2|0|13|1|0|0|0|1|0|0|1|0|0|16|0|0|2|0|0|0|1B|0|0|R|0|0|E|0|0|1B|0|0^^$0|@$1|2|3|4|5|6|7|1N|8|@$9|1O|A|1P|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|1Q|8|@]|D|@]|E|$]]|$1|G|3|H|5|I|7|1R|8|@$9|1S|A|1T|B|C]]|D|@]|E|$]]|$1|J|3|K|5|I|7|1U|8|@$9|1V|A|1W|B|C]]|D|@]|E|$]]|$1|L|3|M|5|I|7|1X|8|@$9|1Y|A|1Z|B|C]]|D|@]|E|$]]|$1|N|3|-4|5|6|7|20|8|@]|D|@]|E|$]]|$1|O|3|P|5|6|7|21|8|@$9|22|A|23|B|C]]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|24|8|@]|D|@]|E|$]]|$1|R|3|S|5|I|7|25|8|@$9|26|A|27|B|C]]|D|@]|E|$]]|$1|T|3|U|5|I|7|28|8|@$9|29|A|2A|B|C]]|D|@]|E|$]]|$1|V|3|W|5|X|7|2B|8|@$9|2C|A|2D|B|C]]|D|@]|E|$]]|$1|Y|3|Z|5|X|7|2E|8|@$9|2F|A|2G|B|C]]|D|@]|E|$]]|$1|10|3|11|5|6|7|2H|8|@$9|2I|A|2J|B|C]]|D|@]|E|$]]|$1|12|3|-4|5|6|7|2K|8|@]|D|@]|E|$]]|$1|13|3|-4|5|6|7|2L|8|@]|D|@]|E|$]]|$1|14|3|15|5|6|7|2M|8|@$9|2N|A|2O|B|C]]|D|@]|E|$]]|$1|16|3|15|5|6|7|2P|8|@$9|2Q|A|2R|B|C]]|D|@]|E|$]]|$1|17|3|18|5|6|7|2S|8|@$9|2T|A|2U|B|C]]|D|@]|E|$]]|$1|19|3|1A|5|6|7|2V|8|@$9|2W|A|2X|B|C]]|D|@]|E|$]]|$1|1B|3|-4|5|6|7|2Y|8|@]|D|@]|E|$]]|$1|1C|3|1D|5|I|7|2Z|8|@$9|30|A|31|B|C]]|D|@]|E|$]]|$1|1E|3|1F|5|I|7|32|8|@$9|33|A|34|B|C]]|D|@]|E|$]]|$1|1G|3|1H|5|I|7|35|8|@$9|36|A|37|B|C]]|D|@]|E|$]]|$1|1I|3|1J|5|I|7|38|8|@$9|39|A|3A|B|C]]|D|@]|E|$]]|$1|1K|3|-4|5|6|7|3B|8|@]|D|@]|E|$]]|$1|1L|3|-4|5|6|7|3C|8|@]|D|@]|E|$]]]|1M|$]]

Premise to my answer:

<ol>
<li>Containers are run with tags.</li>
<li>The same tag can be pointed to different image UUID as we please/ feel appropriate.</li>
<li>Updates done to an image can be committed to a new image layer</li>
</ol>

Approach

<ol>
<li>Build all the containers in the first place with a security-patch update script</li>
<li>Build an automated process for the following

<ul>
<li>Run an existing image to new container with security patch script as the command</li>
<li>Commit changes to the image as

<ul>
<li>existing tag -> followed by restarting the containers one by one</li>
<li>new version tag -> replace few containers with new tag -> validate -> move all containers to new tag</li>
</ul></li>
</ul></li>
</ol>

Additionally, the base image can be upgraded/ the container with a complete new base image can be built at regular intervals, as the maintainer feels necessary

Advantages

<ol>
<li>We are preserving the old version of the image while creating the new security patched image, hence we can rollback to previous running image if necessary</li>
<li>We are preserving the docker cache, hence less network transfer (only the changed layer gets on the wire)</li>
<li>The upgrade process can be validated in staging before moving to prod</li>
<li>This can be a controlled process, hence the security patches only when necessary/ deemed important can be pushed.</li>
</ol>

blocks|key|2937135|text|另一种方法是假设您的基础映像非常快地落后(这很可能发生)，并定期(例如，每周)强制您的应用程序的另一个映像构建，然后如果它发生了变化，则重新部署它。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2937136|据我所知，像官方Debian或Java这样的流行基础镜像会更新它们的标签来应对安全修复，所以标签不是一成不变的(如果你想要更强的保证，你需要使用参考图片：@digest，在最近的Docker版本中可用)。因此，如果您要使用docker+build+--pull构建映像，那么您的应用程序应该获得您所引用的最新和最好的基础映像标记。|offset|length|style|CODE|2937137|由于可变标记可能会令人困惑，因此每次执行此操作时，最好递增应用程序的版本号，以便至少在您这方面是干净的。|2937138|因此，我不确定前面答案中建议的脚本是否能完成工作，因为它不会重建应用程序的映像-它只是更新基本映像标记，然后重新启动容器，但新的容器仍然引用旧的基本映像哈希。|2937139|我不主张在容器中运行cron类型的作业(或任何其他进程，除非确实必要)，因为这与每个容器只运行一个进程的原则背道而驰(关于为什么这样做更好，有各种不同的争论，所以我在这里不再赘述)。|2937140|entityMap^0|0|33|J|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@$D|R|E|S|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|T|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|U|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|V|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|O|$]]

Another approach could be to assume that your base image gets behind quite quickly (and that's very likely to happen), and force another image build of your application periodically (e.g. every week) and then re-deploy it if it has changed.

As far as I can tell, popular base images like the official Debian or Java update their tags to cater for security fixes, so tags are not immutable (if you want a stronger guarantee of that you need to use the reference [image:@digest], available in more recent Docker versions). Therefore, if you were to build your image with <code>docker build --pull</code>, then your application should get the latest and greatest of the base image tag you're referencing.

Since mutable tags can be confusing, it's best to increment the version number of your application every time you do this so that at least on your side things are cleaner.

So I'm not sure that the script suggested in one of the previous answers does the job, since it doesn't rebuild you application's image - it just updates the base image tag and then it restarts the container, but the new container still references the old base image hash.

I wouldn't advocate for running cron-type jobs in containers (or any other processes, unless really necessary) as this goes against the mantra of running only one process per container (there are various arguments about why this is better, so I'm not going to go into it here).

blocks|key|2724861|text|我不会深入讨论您是否希望在生产环境中进行无人参与更新的整个问题(我不这么认为)。我只是把它留在这里作为参考，以防任何人发现它有用。在终端中使用以下命令将所有docker镜像更新为最新版本：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2724862|#+docker+images+%7C+awk+'(NR>1)+&&+($2!~/none/)+{print+$1":"$2}'+%7C+xargs+-L1+docker+pull|offset|length|style|CODE|2724863|entityMap^0|0|0|2E|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@$D|L|E|M|F|G]]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

I'm not going into the whole question of whether or not you want unattended updates in production (I think not). I'm just leaving this here for reference in case anybody finds it useful. Update all your docker images to the latest version with the following command in your terminal:

<code># docker images | awk '(NR&gt;1) &amp;&amp; ($2!~/none/) {print $1":"$2}' | xargs -L1 docker pull</code>

blocks|key|148836|text|一种“docker方式”是使用docker+hub+automated+builds。当重建上游容器时，Repository+Links功能将重建您的容器，并且Webhooks功能将向您发送通知。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|148837|看起来webhooks仅限于HTTP+POST调用。你需要设置一个服务来捕获他们，或者使用其中一个帖子来发送电子邮件。|148838|我还没有研究过它，但是新的Docker+Universal+Control+Plane可能会有一个检测更新容器和重新部署的功能。|148839|entityMap|0|LINK|mutability|MUTABLE|url|https://hub.docker.com/|1|https://docs.docker.com/docker-hub/builds/|2|https://docs.docker.com/docker-hub/builds/#repository-links|3|https://docs.docker.com/docker-hub/webhooks/|4|https://www.docker.com/products/docker-universal-control-plane^0|F|A|0|Q|G|1|1G|G|2|28|8|3|0|0|D|U|4|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@$A|Y|B|Z|1|10]|$A|11|B|12|1|13]|$A|14|B|15|1|16]|$A|17|B|18|1|19]]|C|$]]|$1|D|3|E|5|6|7|1A|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|1B|8|@]|9|@$A|1C|B|1D|1|1E]]|C|$]]|$1|H|3|-4|5|6|7|1F|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]|P|$5|K|L|M|C|$N|Q]]|R|$5|K|L|M|C|$N|S]]|T|$5|K|L|M|C|$N|U]]|V|$5|K|L|M|C|$N|W]]]]

A 'docker way' would be to use <a href="https://hub.docker.com" rel="noreferrer">docker hub</a> <a href="https://docs.docker.com/docker-hub/builds/" rel="noreferrer">automated builds</a>. The <a href="https://docs.docker.com/docker-hub/builds/#repository-links" rel="noreferrer">Repository Links</a> feature will rebuild your container when an upstream container is rebuilt, and the <a href="https://docs.docker.com/docker-hub/webhooks/" rel="noreferrer">Webhooks</a> feature will send you a notification. 

It looks like the webhooks are limited to HTTP POST calls. You'd need to set up a service to catch them, or maybe use one of the POST to email services out there.

I haven't looked into it, but the new <a href="https://www.docker.com/products/docker-universal-control-plane" rel="noreferrer">Docker Universal Control Plane</a> might have a feature for detecting updated containers and re-deploying.

blocks|key|2724918|text|Docker镜像的依赖管理是一个真正的问题。我是一个团队的成员，该团队构建了一个名为MicroBadger的工具，通过监控容器图像和检查元数据来帮助实现这一点。它的一个功能是让你设置一个通知网络钩子，当你感兴趣的图像(例如基础图像)发生变化时调用它。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2724919|entityMap|0|LINK|mutability|MUTABLE|url|http://microbadger.com/^0|16|B|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Dependency management for Docker images is a real problem. I'm part of a team that built a tool, <a href="http://microbadger.com" rel="noreferrer">MicroBadger</a>, to help with this by monitoring container images and inspecting metadata. One of its features is to let you set up a notification webhook that gets called when an image you're interested in (e.g. a base image) changes.

blocks|key|148873|text|您可以使用Watchtower监视实例化容器的镜像的更新，并自动拉取更新并使用更新后的镜像重启容器。然而，这并没有解决当它所基于的上游图像发生变化时重新构建您自己的自定义图像的问题。您可以将其视为一个由两部分组成的问题：(1)知道上游映像何时更新，以及(2)执行实际的映像重建。(1)可以相当容易地解决，但(2)在很大程度上取决于您本地的构建环境/实践，因此创建一个通用的解决方案可能要困难得多。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|148874|如果你能够使用Docker+Hub的automated+builds，那么使用repository+links功能就可以相对干净地解决整个问题，该功能允许您在链接的存储库(可能是上游存储库)更新时自动触发重建。您还可以将webhook配置为在发生自动构建时通知您。如果你想收到电子邮件或短信通知，你可以将webhook连接到IFTTT+Maker。我发现IFTTT的用户界面有点让人困惑，但是你可以配置Docker+webhook来发布到https://maker.ifttt.com/trigger/docker\_xyz\_image\_built/with/key/your\_key。|style|CODE|148875|如果您需要在本地构建，您至少可以通过在Docker+Hub中创建一个链接到您感兴趣的存储库的虚拟存储库来解决上行镜像更新时收到通知的问题。虚拟回购的唯一目的是在它被重建时触发一个webhook+(这意味着它的一个链接的回购被更新了)。如果你能收到这个网络钩子，你甚至可以用它来触发你这边的重建。|148876|entityMap|0|LINK|mutability|MUTABLE|url|https://hub.docker.com/r/containrrr/watchtower/|1|https://docs.docker.com/docker-hub/builds/|2|https://docs.docker.com/docker-hub/builds/#repository-links|3|https://docs.docker.com/docker-hub/webhooks/|4|https://ifttt.com/maker|5|https://maker.ifttt.com/trigger/%2560docker_xyz_image_built%2560/with/key/%2560your_key%2560^0|5|A|0|0|6Z|P|7Y|9|I|G|1|13|G|2|32|7|3|4I|B|4|63|24|5|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@$A|12|B|13|1|14]]|C|$]]|$1|D|3|E|5|6|7|15|8|@$A|16|B|17|F|G]|$A|18|B|19|F|G]]|9|@$A|1A|B|1B|1|1C]|$A|1D|B|1E|1|1F]|$A|1G|B|1H|1|1I]|$A|1J|B|1K|1|1L]|$A|1M|B|1N|1|1O]]|C|$]]|$1|H|3|I|5|6|7|1P|8|@]|9|@]|C|$]]|$1|J|3|-4|5|6|7|1Q|8|@]|9|@]|C|$]]]|K|$L|$5|M|N|O|C|$P|Q]]|R|$5|M|N|O|C|$P|S]]|T|$5|M|N|O|C|$P|U]]|V|$5|M|N|O|C|$P|W]]|X|$5|M|N|O|C|$P|Y]]|Z|$5|M|N|O|C|$P|10]]]]

You can use <a href="https://hub.docker.com/r/containrrr/watchtower/" rel="nofollow noreferrer">Watchtower</a> to watch for updates to the image a container is instantiated from and automatically pull the update and restart the container using the updated image. However, that doesn't solve the problem of rebuilding your own custom images when there's a change to the upstream image it's based on. You could view this as a two-part problem: (1) knowing when an upstream image has been updated, and (2) doing the actual image rebuild. (1) can be solved fairly easily, but (2) depends a lot on your local build environment/practices, so it's probably much harder to create a generalized solution for that.
If you're able to use Docker Hub's <a href="https://docs.docker.com/docker-hub/builds/" rel="nofollow noreferrer">automated builds</a>, the whole problem can be solved relatively cleanly using the <a href="https://docs.docker.com/docker-hub/builds/#repository-links" rel="nofollow noreferrer">repository links</a> feature, which lets you trigger a rebuild automatically when a linked repository (probably an upstream one) is updated. You can also configure a <a href="https://docs.docker.com/docker-hub/webhooks/" rel="nofollow noreferrer">webhook</a> to notify you when an automated build occurs. If you want an email or SMS notification, you could connect the webhook to <a href="https://ifttt.com/maker" rel="nofollow noreferrer">IFTTT Maker</a>. I found the IFTTT user interface to be kind of confusing, but you would configure the Docker webhook to post to <a href="https://maker.ifttt.com/trigger/%60docker_xyz_image_built%60/with/key/%60your_key%60" rel="nofollow noreferrer">https://maker.ifttt.com/trigger/`docker_xyz_image_built`/with/key/`your_key`</a>.
If you need to build locally, you can at least solve the problem of getting notifications when an upstream image is updated by creating a dummy repo in Docker Hub linked to your repo(s) of interest. The sole purpose of the dummy repo would be to trigger a webhook when it gets rebuilt (which implies one of its linked repos was updated). If you're able to receive this webhook, you could even use that to trigger a rebuild on your side.

blocks|key|145042|text|这里有很多答案，但没有一个适合我的需求。我想要一个真正的答案来回答发问者的第一个问题。如何知道hub.docker.com上的映像何时更新？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|145043|下面的脚本可以每天运行。在第一次运行时，它从集线器注册表中获取标记和更新日期的基线，并将其保存在本地。从那时起，它每次运行时都会检查注册表中的新标记和更新日期。由于每次存在新映像时都会发生变化，因此它会告诉我们基本映像是否发生了更改。下面是脚本：|145044|#!/bin/bash

DATAPATH='/data/docker/updater/data'

if+[+!+-d+"${DATAPATH}"+];+then
++++++++mkdir+"${DATAPATH}";
fi
IMAGES=$(docker+ps+--format+"{{.Image}}")
for+IMAGE+in+$IMAGES;+do
++++++++ORIGIMAGE=${IMAGE}
++++++++if+[[+"$IMAGE"+!=+*\/*+]];+then
++++++++++++++++IMAGE=library/${IMAGE}
++++++++fi
++++++++IMAGE=${IMAGE%25%25:*}
++++++++echo+"Checking+${IMAGE}"
++++++++PARSED=${IMAGE//\//.}
++++++++if+[+!+-f+"${DATAPATH}/${PARSED}"+];+then
++++++++++++++++#+File+doesn't+exist+yet,+make+baseline
++++++++++++++++echo+"Setting+baseline+for+${IMAGE}"
++++++++++++++++curl+-s+"https://registry.hub.docker.com/v2/repositories/${IMAGE}/tags/"+>+"${DATAPATH}/${PARSED}"
++++++++else
++++++++++++++++#+File+does+exist,+do+a+compare
++++++++++++++++NEW=$(curl+-s+"https://registry.hub.docker.com/v2/repositories/${IMAGE}/tags/")
++++++++++++++++OLD=$(cat+"${DATAPATH}/${PARSED}")
++++++++++++++++if+[[+"${VAR1}"+==+"${VAR2}"+]];+then
++++++++++++++++++++++++echo+"Image+${IMAGE}+is+up+to+date";
++++++++++++++++else
++++++++++++++++++++++++echo+${NEW}+>+"${DATAPATH}/${PARSED}"
++++++++++++++++++++++++echo+"Image+${IMAGE}+needs+to+be+updated";
++++++++++++++++++++++++H=`hostname`
++++++++++++++++++++++++ssh+-i+/data/keys/<KEYFILE>+<USER>@<REMOTEHOST>.com+"{+echo+\"MAIL+FROM:+root@${H}\";+echo+\"RCPT+TO:+<USER>@<EMAILHOST>.com\";+echo+\"DATA\";+echo+\"Subject:+${H}+-+${IMAGE}+needs+update\";+echo+\"\";+echo+-e+\"\n${IMAGE}+needs+update.\n\ndocker+pull+${ORIGIMAGE}\";+echo+\"\";+echo+\".\";+echo+\"quit\";+sleep+1;+}+%7C+telnet+<SMTPHOST>+25"
++++++++++++++++fi

++++++++fi
done;|code-block|syntax|javascript|145045|您需要更改顶部的DATAPATH变量，并更改末尾的电子邮件通知命令以满足您的需要。对我来说，我将其SSH到我的SMTP所在的另一个网络上的服务器。但是您也可以很容易地使用mail命令。|offset|length|style|CODE|145046|现在，您还需要检查容器本身内部是否有更新的包。这实际上可能比在容器工作时进行“拉”更有效。下面是实现这一点的脚本：|145047|#!/bin/bash


function+needsUpdates()+{
++++++++RESULT=$(docker+exec+${1}+bash+-c+'+\
++++++++++++++++if+[[+-f+/etc/apt/sources.list+]];+then+\
++++++++++++++++grep+security+/etc/apt/sources.list+>+/tmp/security.list;+\
++++++++++++++++apt-get+update+>+/dev/null;+\
++++++++++++++++apt-get+upgrade+-oDir::Etc::Sourcelist=/tmp/security.list+-s;+\
++++++++++++++++fi;+\
++++++++++++++++')
++++++++RESULT=$(echo+$RESULT)
++++++++GOODRESULT="Reading+package+lists...+Building+dependency+tree...+Reading+state+information...+Calculating+upgrade...+0+upgraded,+0+newly+installed,+0+to+remove+and+0+not+upgraded."
++++++++if+[[+"${RESULT}"+!=+""+]]+&&+[[+"${RESULT}"+!=+"${GOODRESULT}"+]];+then
++++++++++++++++return+0
++++++++else
++++++++++++++++return+1
++++++++fi
}

function+sendEmail()+{
++++++++echo+"Container+${1}+needs+security+updates";
++++++++H=`hostname`
++++++++ssh+-i+/data/keys/<KEYFILE>+<USRER>@<REMOTEHOST>.com+"{+echo+\"MAIL+FROM:+root@${H}\";+echo+\"RCPT+TO:+<USER>@<EMAILHOST>.com\";+echo+\"DATA\";+echo+\"Subject:+${H}+-+${1}+container+needs+security+update\";+echo+\"\";+echo+-e+\"\n${1}+container+needs+update.\n\n\";+echo+-e+\"docker+exec+${1}+bash+-c+'grep+security+/etc/apt/sources.list+>+/tmp/security.list;+apt-get+update+>+/dev/null;+apt-get+upgrade+-oDir::Etc::Sourcelist=/tmp/security.list+-s'\n\n\";+echo+\"Remove+the+-s+to+run+the+update\";+echo+\"\";+echo+\".\";+echo+\"quit\";+sleep+1;+}+%7C+telnet+<SMTPHOST>+25"
}

CONTAINERS=$(docker+ps+--format+"{{.Names}}")
for+CONTAINER+in+$CONTAINERS;+do
++++++++echo+"Checking+${CONTAINER}"
++++++++if+needsUpdates+$CONTAINER;+then
++++++++++++++++sendEmail+$CONTAINER
++++++++fi
done|145048|entityMap^0|0|0|0|8|8|2D|4|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|X|8|@$K|Y|L|Z|M|N]|$K|10|L|11|M|N]]|9|@]|A|$]]|$1|O|3|P|5|6|7|12|8|@]|9|@]|A|$]]|$1|Q|3|R|5|F|7|13|8|@]|9|@]|A|$G|H]]|$1|S|3|-4|5|6|7|14|8|@]|9|@]|A|$]]]|T|$]]

There are a lot of answers here, but none of them suited my needs. I wanted an actual answer to the asker's #1 question. How do I know when an image is updated on hub.docker.com?

The below script can be run daily. On first run, it gets a baseline of the tags and update dates from the HUB registry and saves them locally. From then out, every time it is run it checks the registry for new tags and update dates. Since this changes every time a new image exists, it tells us if the base image has changed. Here is the script:

<pre><code>#!/bin/bash

DATAPATH='/data/docker/updater/data'

if [ ! -d "${DATAPATH}" ]; then
 mkdir "${DATAPATH}";
fi
IMAGES=$(docker ps --format "{{.Image}}")
for IMAGE in $IMAGES; do
 ORIGIMAGE=${IMAGE}
 if [[ "$IMAGE" != *\/* ]]; then
 IMAGE=library/${IMAGE}
 fi
 IMAGE=${IMAGE%%:*}
 echo "Checking ${IMAGE}"
 PARSED=${IMAGE//\//.}
 if [ ! -f "${DATAPATH}/${PARSED}" ]; then
 # File doesn't exist yet, make baseline
 echo "Setting baseline for ${IMAGE}"
 curl -s "https://registry.hub.docker.com/v2/repositories/${IMAGE}/tags/" &gt; "${DATAPATH}/${PARSED}"
 else
 # File does exist, do a compare
 NEW=$(curl -s "https://registry.hub.docker.com/v2/repositories/${IMAGE}/tags/")
 OLD=$(cat "${DATAPATH}/${PARSED}")
 if [[ "${VAR1}" == "${VAR2}" ]]; then
 echo "Image ${IMAGE} is up to date";
 else
 echo ${NEW} &gt; "${DATAPATH}/${PARSED}"
 echo "Image ${IMAGE} needs to be updated";
 H=`hostname`
 ssh -i /data/keys/&lt;KEYFILE&gt; &lt;USER&gt;@&lt;REMOTEHOST&gt;.com "{ echo \"MAIL FROM: root@${H}\"; echo \"RCPT TO: &lt;USER&gt;@&lt;EMAILHOST&gt;.com\"; echo \"DATA\"; echo \"Subject: ${H} - ${IMAGE} needs update\"; echo \"\"; echo -e \"\n${IMAGE} needs update.\n\ndocker pull ${ORIGIMAGE}\"; echo \"\"; echo \".\"; echo \"quit\"; sleep 1; } | telnet &lt;SMTPHOST&gt; 25"
 fi

 fi
done;
</code></pre>

You will want to alter the <code>DATAPATH</code> variable at the top, and alter the email notification command at the end to suit your needs. For me, I have it SSH into a server on another network where my SMTP is located. But you could easily use the <code>mail</code> command, too.

Now, you also want to check for updated packages inside the containers themselves. This is actually probably more effective than doing a "pull" once your containers are working. Here's the script to pull that off:

<pre><code>#!/bin/bash


function needsUpdates() {
 RESULT=$(docker exec ${1} bash -c ' \
 if [[ -f /etc/apt/sources.list ]]; then \
 grep security /etc/apt/sources.list &gt; /tmp/security.list; \
 apt-get update &gt; /dev/null; \
 apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list -s; \
 fi; \
 ')
 RESULT=$(echo $RESULT)
 GOODRESULT="Reading package lists... Building dependency tree... Reading state information... Calculating upgrade... 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."
 if [[ "${RESULT}" != "" ]] &amp;&amp; [[ "${RESULT}" != "${GOODRESULT}" ]]; then
 return 0
 else
 return 1
 fi
}

function sendEmail() {
 echo "Container ${1} needs security updates";
 H=`hostname`
 ssh -i /data/keys/&lt;KEYFILE&gt; &lt;USRER&gt;@&lt;REMOTEHOST&gt;.com "{ echo \"MAIL FROM: root@${H}\"; echo \"RCPT TO: &lt;USER&gt;@&lt;EMAILHOST&gt;.com\"; echo \"DATA\"; echo \"Subject: ${H} - ${1} container needs security update\"; echo \"\"; echo -e \"\n${1} container needs update.\n\n\"; echo -e \"docker exec ${1} bash -c 'grep security /etc/apt/sources.list &gt; /tmp/security.list; apt-get update &gt; /dev/null; apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list -s'\n\n\"; echo \"Remove the -s to run the update\"; echo \"\"; echo \".\"; echo \"quit\"; sleep 1; } | telnet &lt;SMTPHOST&gt; 25"
}

CONTAINERS=$(docker ps --format "{{.Names}}")
for CONTAINER in $CONTAINERS; do
 echo "Checking ${CONTAINER}"
 if needsUpdates $CONTAINER; then
 sendEmail $CONTAINER
 fi
done
</code></pre>

blocks|key|147373|text|其中一种方法是通过您的CI/CD系统进行驱动。一旦您的父映像构建完成，就可以使用该父映像来扫描git+repos中的映像。如果找到了，你就会发送一个拉请求，以跳转到新版本的图像。如果所有测试都通过，则拉取请求将被合并，您将拥有一个基于更新的父映像的新的子映像。可以在这里找到采用此方法的工具的示例：https://engineering.salesforce.com/open-sourcing-dockerfile-image-update-6400121c1a75。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|147374|如果您不能控制您的父映像，就像您依赖于官方ubuntu映像时的情况一样，您可以编写一些工具来检测父映像标记或校验和中的更改(不是同一件事，标记是可变的)，并相应地调用子映像构建。|style|CODE|147375|entityMap|0|LINK|mutability|MUTABLE|url|https://engineering.salesforce.com/open-sourcing-dockerfile-image-update-6400121c1a75^0|45|2D|0|0|L|6|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@$A|U|B|V|F|G]]|9|@]|C|$]]|$1|H|3|-4|5|6|7|W|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]]]

One of the ways to do it is to drive this through your CI/CD systems. Once your parent image is built, have something that scans your git repos for images using that parent. If found, you'd then send a pull request to bump to new versions of the image. The pull request, if all tests pass, would be merged and you'd have a new child image based on updated parent. An example of a tool that takes this approach can be found here: <a href="https://engineering.salesforce.com/open-sourcing-dockerfile-image-update-6400121c1a75" rel="nofollow noreferrer">https://engineering.salesforce.com/open-sourcing-dockerfile-image-update-6400121c1a75</a> .

If you don't control your parent image, as would be the case if you are depending on the official <code>ubuntu</code> image, you can write some tooling that detects changes in the parent image tag or checksum(not the same thing, tags are mutable) and invoke children image builds accordingly.

blocks|key|147377|text|上面的答案也是正确的|type|unstyled|depth|inlineStyleRanges|entityRanges|data|147378|有两种方法|147379|147380|blockquote|147381|147382|147383|每隔一分钟使用webhooks|ordered-list-item|147384|运行脚本，以获取最新的docker映像|147385|147386|我只是在分享脚本，可能会对你有帮助！您可以将其与cronjob一起使用，我在OSX上尝试得很成功|147387|#!/bin/bash
##You+can+use+below+commented+line+for+setting+cron+tab+for+running+cron+job+and+to+store+its+O/P+in+one+.txt+file++
#*+*+*+*+*+/usr/bin/sudo+-u+admin+-i+bash+-c+/Users/Swapnil/Documents/checkimg.sh+>+/Users/Swapnil/Documents/cron_output.log+2>&1
#+Example+for+the+Docker+Hub+V2+API
#+Returns+all+images+and+tags+associated+with+a+Docker+Hub+organization+account.
#+Requires+'jq':+https://stedolan.github.io/jq/

#+set+username,+password,+and+organization
#+Filepath+where+your+docker-compose+file+is+present
FILEPATH="/Users/Swapnil/Documents/lamp-alpine"
#+Your+Docker+hub+user+name
UNAME="ur+username"
#+Your+Docker+hub+user+password
UPASS="ur+pwd"
#+e.g+organisation_name/image_name:image_tag
ORG="ur+org+name"
IMGNAME="ur+img+name"
IMGTAG="ur+img+tag"
#+Container+name
CONTNAME="ur+container+name"
#+Expected+built+mins
BUILDMINS="5"
#Generally+cronjob+frequency
CHECKTIME="5"
NETWORKNAME="${IMGNAME}_private-network"
#After+Image+pulling,+need+to+bring+up+all+docker+services?
DO_DOCKER_COMPOSE_UP=true
#+-------
echo+"Eecuting+Script+@+date+and+time+in+YmdHMS:+$(date+%2B%25Y%25m%25d%25H%25M%25S)"
set+-e
PIDFILE=/Users/Swapnil/Documents/$IMGNAME/forever.pid
if+[+-f+$PIDFILE+]
then
++PID=$(cat+$PIDFILE)
++ps+-p+$PID+>+/dev/null+2>&1
++if+[+$?+-eq+0+]
++then
++++echo+"Process+already+running"
++++exit+1
++else
++++##+Process+not+found+assume+not+running
++++echo+$$
++++echo+$$+>+$PIDFILE
++++if+[+$?+-ne+0+]
++++then
++++++echo+"Could+not+create+PID+file"
++++++exit+1
++++fi
++fi
else
++echo+$$+>+$PIDFILE
++if+[+$?+-ne+0+]
++then
++++echo+"Could+not+create+PID+file"
++++exit+1
++fi
fi

#+Check+Docker+is+running+or+not;+If+not+runing+then+exit
if+docker+info%7Cgrep+Containers+;+then
++++echo+"Docker+is+running"
else
++++echo+"Docker+is+not+running"
++++rm+$PIDFILE
++++exit+1
fi

#+Check+Container+is+running+or+not;+and+set+variable
CONT_INFO=$(docker+ps+-f+"name=$CONTNAME"+--format+"{{.Names}}")
if+[+"$CONT_INFO"+=+"$CONTNAME"+];+then
++++echo+"Container+is+running"
++++IS_CONTAINER_RUNNING=true
else
++++echo+"Container+is+not+running"
++++IS_CONTAINER_RUNNING=false
fi


#+get+token
echo+"Retrieving+token+..."
TOKEN=$(curl+-s+-H+"Content-Type:+application/json"+-X+POST+-d+'{"username":+"'${UNAME}'",+"password":+"'${UPASS}'"}'+https://hub.docker.com/v2/users/login/+%7C+jq+-r+.token)

#+get+list+of+repositories
echo+"Retrieving+repository+list+..."
REPO_LIST=$(curl+-s+-H+"Authorization:+JWT+${TOKEN}"+https://hub.docker.com/v2/repositories/${ORG}/?page_size=100+%7C+jq+-r+'.results%7C.[]%7C.name')

#+output+images+&+tags
echo+"Images+and+tags+for+organization:+${ORG}"
echo
for+i+in+${REPO_LIST}
do
++echo+"${i}:"
++#+tags
++IMAGE_TAGS=$(curl+-s+-H+"Authorization:+JWT+${TOKEN}"+https://hub.docker.com/v2/repositories/${ORG}/${i}/tags/?page_size=100+%7C+jq+-r+'.results%7C.[]%7C.name')
++for+j+in+${IMAGE_TAGS}
++do
++++echo+"++-+${j}"
++done
++#echo
done

#+Check+Perticular+image+is+the+latest+or+not
#imm=$(curl+-s+-H+"Authorization:+JWT+${TOKEN}"+https://hub.docker.com/v2/repositories/${ORG}/${IMGNAME}/tags/?page_size=100)
echo+"-----------------"
echo+"Last+built+date+details+about+Image+${IMGNAME}+:+${IMGTAG}+for+organization:+${ORG}"
IMAGE_UPDATED_DATE=$(curl+-s+-H+"Authorization:+JWT+${TOKEN}"+https://hub.docker.com/v2/repositories/${ORG}/${IMGNAME}/tags/?page_size=100+%7C+jq+-r+'.results%7C.[]%7Cselect(.name+%7C+contains("'${IMGTAG}'")).last_updated')
echo+"On+Docker+Hub+IMAGE_UPDATED_DATE---$IMAGE_UPDATED_DATE"
echo+"-----------------"

IMAGE_CREATED_DATE=$(docker+image+inspect+${ORG}/${IMGNAME}:${IMGTAG}+%7C+jq+-r+'.[]%7C.Created')
echo+"Locally+IMAGE_CREATED_DATE---$IMAGE_CREATED_DATE"

updatedDate=$(date+-jf+'%25Y-%25m-%25dT%25H:%25M'+"${IMAGE_UPDATED_DATE:0:16}"+%2B%25Y%25m%25d%25H%25M%25S)+
createdDate=$(date+-jf+'%25Y-%25m-%25dT%25H:%25M'+"${IMAGE_CREATED_DATE:0:16}"+%2B%25Y%25m%25d%25H%25M%25S)
currentDate=$(date+%2B%25Y%25m%25d%25H%25M%25S)

start_date=$(date+-jf+"%25Y%25m%25d%25H%25M%25S"+"$currentDate"+"%2B%25s")
end_date=$(date+-jf+"%25Y%25m%25d%25H%25M%25S"+"$updatedDate"+"%2B%25s")
updiffMins=$((+($start_date+-+$end_date)+/+(60)+))
if+[[+"$updiffMins"+-lt+$(($CHECKTIME%2B1))+]];+then
++++++++if+[+!+-d+"${FILEPATH}"+];+then
++++++++++++mkdir+"${FILEPATH}";
++++++++fi
++++++++cd+"${FILEPATH}"
++++++++pwd
++++++++echo+"updatedDate---$updatedDate"+>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"createdDate---$createdDate"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"currentDate---$currentDate"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"Found+after+regular+checking+time+->+Docker+hub's+latest+updated+image+is+new;+Diff+${updiffMins}+mins"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"Script+is+checking+for+latest+updates+after+every+${CHECKTIME}+mins"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"Fetching+all+new"
++++++++echo+"---------------------------"
++++++++if+$IS_CONTAINER_RUNNING+;+then
++++++++++++echo+"Container+is+running"+++++++++
++++++++else
++++++++++++docker-compose+down
++++++++++++echo+"Container+stopped+and+removed;+Network+removed"+>>+"ScriptOutput_${currentDate}.txt"
++++++++fi
++++++++echo+"Image_Created_Date=$currentDate"+>+".env"
++++++++echo+"ORG=$ORG"+>>+".env"
++++++++echo+"IMGNAME=$IMGNAME"+>>+".env"
++++++++echo+"IMGTAG=$IMGTAG"+>>+".env"
++++++++echo+"CONTNAME=$CONTNAME"+>>+".env"
++++++++echo+"NETWORKNAME=$NETWORKNAME"+>>+".env"
++++++++docker-compose+build+--no-cache
++++++++echo+"Docker+Compose+built"+>>+"ScriptOutput_${currentDate}.txt"
++++++++if+$DO_DOCKER_COMPOSE_UP+;+then
++++++++++++docker-compose+up+-d
++++++++++++echo+"Docker+services+are+up+now,+checked+in"+>>+"ScriptOutput_${currentDate}.txt"++
++++++++else
++++++++++++echo+"Docker+services+are+down,+checked+in"+>>+"ScriptOutput_${currentDate}.txt"
++++++++fi
elif+[[+"$updatedDate"+-gt+"$createdDate"+]];+then+
++++echo+"Updated+is+latest"
++++start_date=$(date+-jf+"%25Y%25m%25d%25H%25M%25S"+"$updatedDate"+"%2B%25s")
++++end_date=$(date+-jf+"%25Y%25m%25d%25H%25M%25S"+"$createdDate"+"%2B%25s")
++++diffMins=$((+($start_date+-+$end_date)+/+(60)+))
++++if+[[+"$BUILDMINS"+-lt+"$diffMins"+]];+then
++++++++if+[+!+-d+"${FILEPATH}"+];+then
++++++++++++mkdir+"${FILEPATH}";
++++++++fi
++++++++cd+"${FILEPATH}"
++++++++pwd
++++++++echo+"updatedDate---$updatedDate"+>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"createdDate---$createdDate"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"currentDate---$currentDate"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"Found+after+comparing+times+->+Docker+hub's+latest+updated+image+is+new;+Diff+${diffMins}+mins"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"Actual+image+built+time+is+less+i.e.+${diffMins}+mins+than+MAX+expexted+BUILD+TIME+i.e.+${BUILDMINS}+mins"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"Fetching+all+new"+>>+"ScriptOutput_${currentDate}.txt"
++++++++echo+"-----------------------------"
++++++++if+$IS_CONTAINER_RUNNING+;+then
++++++++++++echo+"Container+is+running"+++++++++
++++++++else
++++++++++++docker-compose+down
++++++++++++echo+"Container+stopped+and+removed;+Network+removed"+>>+"ScriptOutput_${currentDate}.txt"
++++++++fi
++++++++echo+"Image_Created_Date=$currentDate"+>+".env"
++++++++echo+"ORG=$ORG"+>>+".env"
++++++++echo+"IMGNAME=$IMGNAME"+>>+".env"
++++++++echo+"IMGTAG=$IMGTAG"+>>+".env"
++++++++echo+"CONTNAME=$CONTNAME"+>>+".env"
++++++++echo+"NETWORKNAME=$NETWORKNAME"+>>+".env"
++++++++docker-compose+build+--no-cache
++++++++echo+"Docker+Compose+built"+>>+"ScriptOutput_${currentDate}.txt"
++++++++if+$DO_DOCKER_COMPOSE_UP+;+then
++++++++++++docker-compose+up+-d
++++++++++++echo+"Docker+services+are+up+now"+>>+"ScriptOutput_${currentDate}.txt"++
++++++++else
++++++++++++echo+"Docker+services+are+down"+>>+"ScriptOutput_${currentDate}.txt"
++++++++fi
++++elif+[[+"$BUILDMINS"+-gt+"$diffMins"+]];+then
++++++++echo+"Docker+hub's+latest+updated+image+is+NOT+new;+Diff+${diffMins}+mins"
++++++++echo+"Docker+images+not+fetched"
++++else
++++++++echo+"Docker+hub's+latest+updated+image+is+NOT+new;+Diff+${diffMins}+mins"
++++++++echo+"Docker+images+not+fetched"
++++fi
elif+[[+"$createdDate"+-gt+"$updatedDate"+]];+then+
++++echo+"Created+is+latest"
++++start_date=$(date+-jf+"%25Y%25m%25d%25H%25M%25S"+"$createdDate"+"%2B%25s")
++++end_date=$(date+-jf+"%25Y%25m%25d%25H%25M%25S"+"$updatedDate"+"%2B%25s")
++++echo+"Docker+hub+has+older+docker+image+than+local;+Older+than+$((+($start_date+-+$end_date)+/+(60)+))mins"
fi
echo+
echo+"------------end---------------"
rm+$PIDFILE|code-block|syntax|javascript|147388|这是我的docker-compose文件|147389|version:++"3.2"
services:
++lamp-alpine:
++++build:
++++++context:+.
++++container_name:+"${CONTNAME}"
++++image:+"${ORG}/${IMGNAME}:${IMGTAG}"
++++ports:
++++++-+"127.0.0.1:80:80"
++++networks:
++++++-+private-network+

networks:
++private-network:
++++driver:+bridge|147390|entityMap^0|0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|12|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|13|8|@]|9|@]|A|$]]|$1|E|3|-4|5|F|7|14|8|@]|9|@]|A|$]]|$1|G|3|-4|5|6|7|15|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|16|8|@]|9|@]|A|$]]|$1|I|3|J|5|K|7|17|8|@]|9|@]|A|$]]|$1|L|3|M|5|K|7|18|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|19|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1A|8|@]|9|@]|A|$]]|$1|Q|3|R|5|S|7|1B|8|@]|9|@]|A|$T|U]]|$1|V|3|W|5|6|7|1C|8|@]|9|@]|A|$]]|$1|X|3|Y|5|S|7|1D|8|@]|9|@]|A|$T|U]]|$1|Z|3|-4|5|6|7|1E|8|@]|9|@]|A|$]]]|10|$]]

Above Answers are also correct

There are two Approach 

<blockquote>
 <ol>
 <li>Use webhooks</li>
 <li>Run script for every specific minute to get fresh pull of docker images</li>
 </ol>
</blockquote>

I am just sharing script may be it will helpful for you!
You can use it with cronjob, I tried succesfully on OSX

<pre><code>#!/bin/bash
##You can use below commented line for setting cron tab for running cron job and to store its O/P in one .txt file 
#* * * * * /usr/bin/sudo -u admin -i bash -c /Users/Swapnil/Documents/checkimg.sh &gt; /Users/Swapnil/Documents/cron_output.log 2&gt;&amp;1
# Example for the Docker Hub V2 API
# Returns all images and tags associated with a Docker Hub organization account.
# Requires 'jq': https://stedolan.github.io/jq/

# set username, password, and organization
# Filepath where your docker-compose file is present
FILEPATH="/Users/Swapnil/Documents/lamp-alpine"
# Your Docker hub user name
UNAME="ur username"
# Your Docker hub user password
UPASS="ur pwd"
# e.g organisation_name/image_name:image_tag
ORG="ur org name"
IMGNAME="ur img name"
IMGTAG="ur img tag"
# Container name
CONTNAME="ur container name"
# Expected built mins
BUILDMINS="5"
#Generally cronjob frequency
CHECKTIME="5"
NETWORKNAME="${IMGNAME}_private-network"
#After Image pulling, need to bring up all docker services?
DO_DOCKER_COMPOSE_UP=true
# -------
echo "Eecuting Script @ date and time in YmdHMS: $(date +%Y%m%d%H%M%S)"
set -e
PIDFILE=/Users/Swapnil/Documents/$IMGNAME/forever.pid
if [ -f $PIDFILE ]
then
 PID=$(cat $PIDFILE)
 ps -p $PID &gt; /dev/null 2&gt;&amp;1
 if [ $? -eq 0 ]
 then
 echo "Process already running"
 exit 1
 else
 ## Process not found assume not running
 echo $$
 echo $$ &gt; $PIDFILE
 if [ $? -ne 0 ]
 then
 echo "Could not create PID file"
 exit 1
 fi
 fi
else
 echo $$ &gt; $PIDFILE
 if [ $? -ne 0 ]
 then
 echo "Could not create PID file"
 exit 1
 fi
fi

# Check Docker is running or not; If not runing then exit
if docker info|grep Containers ; then
 echo "Docker is running"
else
 echo "Docker is not running"
 rm $PIDFILE
 exit 1
fi

# Check Container is running or not; and set variable
CONT_INFO=$(docker ps -f "name=$CONTNAME" --format "{{.Names}}")
if [ "$CONT_INFO" = "$CONTNAME" ]; then
 echo "Container is running"
 IS_CONTAINER_RUNNING=true
else
 echo "Container is not running"
 IS_CONTAINER_RUNNING=false
fi


# get token
echo "Retrieving token ..."
TOKEN=$(curl -s -H "Content-Type: application/json" -X POST -d '{"username": "'${UNAME}'", "password": "'${UPASS}'"}' https://hub.docker.com/v2/users/login/ | jq -r .token)

# get list of repositories
echo "Retrieving repository list ..."
REPO_LIST=$(curl -s -H "Authorization: JWT ${TOKEN}" https://hub.docker.com/v2/repositories/${ORG}/?page_size=100 | jq -r '.results|.[]|.name')

# output images &amp; tags
echo "Images and tags for organization: ${ORG}"
echo
for i in ${REPO_LIST}
do
 echo "${i}:"
 # tags
 IMAGE_TAGS=$(curl -s -H "Authorization: JWT ${TOKEN}" https://hub.docker.com/v2/repositories/${ORG}/${i}/tags/?page_size=100 | jq -r '.results|.[]|.name')
 for j in ${IMAGE_TAGS}
 do
 echo " - ${j}"
 done
 #echo
done

# Check Perticular image is the latest or not
#imm=$(curl -s -H "Authorization: JWT ${TOKEN}" https://hub.docker.com/v2/repositories/${ORG}/${IMGNAME}/tags/?page_size=100)
echo "-----------------"
echo "Last built date details about Image ${IMGNAME} : ${IMGTAG} for organization: ${ORG}"
IMAGE_UPDATED_DATE=$(curl -s -H "Authorization: JWT ${TOKEN}" https://hub.docker.com/v2/repositories/${ORG}/${IMGNAME}/tags/?page_size=100 | jq -r '.results|.[]|select(.name | contains("'${IMGTAG}'")).last_updated')
echo "On Docker Hub IMAGE_UPDATED_DATE---$IMAGE_UPDATED_DATE"
echo "-----------------"

IMAGE_CREATED_DATE=$(docker image inspect ${ORG}/${IMGNAME}:${IMGTAG} | jq -r '.[]|.Created')
echo "Locally IMAGE_CREATED_DATE---$IMAGE_CREATED_DATE"

updatedDate=$(date -jf '%Y-%m-%dT%H:%M' "${IMAGE_UPDATED_DATE:0:16}" +%Y%m%d%H%M%S) 
createdDate=$(date -jf '%Y-%m-%dT%H:%M' "${IMAGE_CREATED_DATE:0:16}" +%Y%m%d%H%M%S)
currentDate=$(date +%Y%m%d%H%M%S)

start_date=$(date -jf "%Y%m%d%H%M%S" "$currentDate" "+%s")
end_date=$(date -jf "%Y%m%d%H%M%S" "$updatedDate" "+%s")
updiffMins=$(( ($start_date - $end_date) / (60) ))
if [[ "$updiffMins" -lt $(($CHECKTIME+1)) ]]; then
 if [ ! -d "${FILEPATH}" ]; then
 mkdir "${FILEPATH}";
 fi
 cd "${FILEPATH}"
 pwd
 echo "updatedDate---$updatedDate" &gt; "ScriptOutput_${currentDate}.txt"
 echo "createdDate---$createdDate" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "currentDate---$currentDate" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "Found after regular checking time -&gt; Docker hub's latest updated image is new; Diff ${updiffMins} mins" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "Script is checking for latest updates after every ${CHECKTIME} mins" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "Fetching all new"
 echo "---------------------------"
 if $IS_CONTAINER_RUNNING ; then
 echo "Container is running" 
 else
 docker-compose down
 echo "Container stopped and removed; Network removed" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 fi
 echo "Image_Created_Date=$currentDate" &gt; ".env"
 echo "ORG=$ORG" &gt;&gt; ".env"
 echo "IMGNAME=$IMGNAME" &gt;&gt; ".env"
 echo "IMGTAG=$IMGTAG" &gt;&gt; ".env"
 echo "CONTNAME=$CONTNAME" &gt;&gt; ".env"
 echo "NETWORKNAME=$NETWORKNAME" &gt;&gt; ".env"
 docker-compose build --no-cache
 echo "Docker Compose built" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 if $DO_DOCKER_COMPOSE_UP ; then
 docker-compose up -d
 echo "Docker services are up now, checked in" &gt;&gt; "ScriptOutput_${currentDate}.txt" 
 else
 echo "Docker services are down, checked in" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 fi
elif [[ "$updatedDate" -gt "$createdDate" ]]; then 
 echo "Updated is latest"
 start_date=$(date -jf "%Y%m%d%H%M%S" "$updatedDate" "+%s")
 end_date=$(date -jf "%Y%m%d%H%M%S" "$createdDate" "+%s")
 diffMins=$(( ($start_date - $end_date) / (60) ))
 if [[ "$BUILDMINS" -lt "$diffMins" ]]; then
 if [ ! -d "${FILEPATH}" ]; then
 mkdir "${FILEPATH}";
 fi
 cd "${FILEPATH}"
 pwd
 echo "updatedDate---$updatedDate" &gt; "ScriptOutput_${currentDate}.txt"
 echo "createdDate---$createdDate" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "currentDate---$currentDate" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "Found after comparing times -&gt; Docker hub's latest updated image is new; Diff ${diffMins} mins" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "Actual image built time is less i.e. ${diffMins} mins than MAX expexted BUILD TIME i.e. ${BUILDMINS} mins" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "Fetching all new" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 echo "-----------------------------"
 if $IS_CONTAINER_RUNNING ; then
 echo "Container is running" 
 else
 docker-compose down
 echo "Container stopped and removed; Network removed" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 fi
 echo "Image_Created_Date=$currentDate" &gt; ".env"
 echo "ORG=$ORG" &gt;&gt; ".env"
 echo "IMGNAME=$IMGNAME" &gt;&gt; ".env"
 echo "IMGTAG=$IMGTAG" &gt;&gt; ".env"
 echo "CONTNAME=$CONTNAME" &gt;&gt; ".env"
 echo "NETWORKNAME=$NETWORKNAME" &gt;&gt; ".env"
 docker-compose build --no-cache
 echo "Docker Compose built" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 if $DO_DOCKER_COMPOSE_UP ; then
 docker-compose up -d
 echo "Docker services are up now" &gt;&gt; "ScriptOutput_${currentDate}.txt" 
 else
 echo "Docker services are down" &gt;&gt; "ScriptOutput_${currentDate}.txt"
 fi
 elif [[ "$BUILDMINS" -gt "$diffMins" ]]; then
 echo "Docker hub's latest updated image is NOT new; Diff ${diffMins} mins"
 echo "Docker images not fetched"
 else
 echo "Docker hub's latest updated image is NOT new; Diff ${diffMins} mins"
 echo "Docker images not fetched"
 fi
elif [[ "$createdDate" -gt "$updatedDate" ]]; then 
 echo "Created is latest"
 start_date=$(date -jf "%Y%m%d%H%M%S" "$createdDate" "+%s")
 end_date=$(date -jf "%Y%m%d%H%M%S" "$updatedDate" "+%s")
 echo "Docker hub has older docker image than local; Older than $(( ($start_date - $end_date) / (60) ))mins"
fi
echo 
echo "------------end---------------"
rm $PIDFILE
</code></pre>

Here is my docker-compose file

<pre><code>version: "3.2"
services:
 lamp-alpine:
 build:
 context: .
 container_name: "${CONTNAME}"
 image: "${ORG}/${IMGNAME}:${IMGTAG}"
 ports:
 - "127.0.0.1:80:80"
 networks:
 - private-network 

networks:
 private-network:
 driver: bridge
</code></pre>

blocks|key|146306|text|一个简单而伟大的解决方案是shepherd|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|146307|entityMap|0|LINK|mutability|MUTABLE|url|https://hub.docker.com/r/mazzolino/shepherd/^0|D|8|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

A simple and great solution is <a href="https://hub.docker.com/r/mazzolino/shepherd/" rel="nofollow noreferrer">shepherd</a>

blocks|key|148958|text|更新:使用Dependabot+-+https://dependabot.com/docker/|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|148959|BLUF:找到用于监视容器更改的正确插入点是一个挑战。如果DockerHub能解决这个问题，那就太好了。(已经提到了存储库链接，但请注意在DockerHub上设置它们时-“每当Docker+Hub上的基础映像更新时，都会触发此存储库中的构建。仅适用于非官方映像。”)|148960|当我自己尝试解决这个问题时，我看到了一些关于webhooks的建议，所以我想详细介绍一下我使用过的几个解决方案。|148961|148962|使用microbadger.com跟踪容器中的更改，并使用其通知webhook功能来触发操作。我使用zapier.com+(但您可以使用任何可定制的webhook服务)进行设置，以便在我的github存储库中创建一个新问题，该存储库使用Alpine作为基础镜像。|ordered-list-item|148963|148964|-+Pros:+You+can+review+the+changes+reported+by+microbadger+in+github+before+taking+action.
-+Cons:+Microbadger+doesn't+let+you+track+a+specific+tag.++Looks+like+it+only+tracks+'latest'.|code-block|syntax|javascript|148965|​|148966|148967|跟踪git提交到上游容器的RSS+feed。例如。https://github.com/gliderlabs/docker-alpine/commits/rootfs/library-3.8/x86_64。我使用zapier.com监控这个提要，并在任何时候提交一些东西时触发在Travis-CI中自动构建我的容器。这有点极端，但您可以更改触发器以执行其他操作，如在git存储库中打开问题以进行手动intervention.|148968|148969|-+Pros:+Closer+to+an+automated+pipline.++The+Travis-CI+build+just+checks+to+see+if+your+container+has+issues+with+whatever+was+committed+to+the+base+image+repository.++It's+up+to+you+if+your+CI+service+takes+any+further+action.
-+Cons:+Tracking+the+commit+feed+isn't+perfect.++Lots+of+things+get+committed+to+the+repository+that+don't+affect+the+build+of+the+base+image.++Doesn't+take+in+to+account+any+issues+with+frequency/number+of+commits+and+any+API+throttling.|148970|148971|entityMap|0|LINK|mutability|MUTABLE|url|https://dependabot.com/docker/|1|https://github.com/gliderlabs/docker-alpine/commits/rootfs/library-3.8/x86_64^0|I|U|0|0|0|0|0|0|0|0|0|0|P|25|1|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1A|8|@]|9|@$A|1B|B|1C|1|1D]]|C|$]]|$1|D|3|E|5|6|7|1E|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|1F|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|1G|8|@]|9|@]|C|$]]|$1|I|3|J|5|K|7|1H|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|1I|8|@]|9|@]|C|$]]|$1|M|3|N|5|O|7|1J|8|@]|9|@]|C|$P|Q]]|$1|R|3|S|5|6|7|1K|8|@]|9|@]|C|$]]|$1|T|3|-4|5|6|7|1L|8|@]|9|@]|C|$]]|$1|U|3|V|5|K|7|1M|8|@]|9|@$A|1N|B|1O|1|1P]]|C|$]]|$1|W|3|-4|5|6|7|1Q|8|@]|9|@]|C|$]]|$1|X|3|Y|5|O|7|1R|8|@]|9|@]|C|$P|Q]]|$1|Z|3|S|5|6|7|1S|8|@]|9|@]|C|$]]|$1|10|3|-4|5|6|7|1T|8|@]|9|@]|C|$]]]|11|$12|$5|13|14|15|C|$16|17]]|18|$5|13|14|15|C|$16|19]]]]

UPDATE: Use Dependabot - <a href="https://dependabot.com/docker/" rel="nofollow noreferrer">https://dependabot.com/docker/</a>

BLUF: finding the right insertion point for monitoring changes to a container is the challenge. It would be great if DockerHub would solve this. (Repository Links have been mentioned but note when setting them up on DockerHub - "Trigger a build in this repository whenever the base image is updated on Docker Hub. Only works for non-official images.")

While trying to solve this myself I saw several recommendations for webhooks so I wanted to elaborate on a couple of solutions I have used.

<ol>
<li>Use microbadger.com to track changes in a container and use it's
notification webhook feature to trigger an action. I set this up
with zapier.com (but you can use any customizable webhook service)
to create a new issue in my github repository that uses Alpine as a
base image.

<ul>
<li>Pros: You can review the changes reported by microbadger in github before taking action.</li>
<li>Cons: Microbadger doesn't let you track a specific tag. Looks like it only tracks 'latest'.</li>
</ul></li>
<li>Track the RSS feed for git commits to an upstream container. ex. <a href="https://github.com/gliderlabs/docker-alpine/commits/rootfs/library-3.8/x86_64" rel="nofollow noreferrer">https://github.com/gliderlabs/docker-alpine/commits/rootfs/library-3.8/x86_64</a>. I used zapier.com to monitor this feed and to trigger an automatic build of my container in Travis-CI anytime something is committed. This is a little extreme but you can change the trigger to do other things like open an issue in your git repository for manual intervention.

<ul>
<li>Pros: Closer to an automated pipline. The Travis-CI build just checks to see if your container has issues with whatever was committed to the base image repository. It's up to you if your CI service takes any further action.</li>
<li>Cons: Tracking the commit feed isn't perfect. Lots of things get committed to the repository that don't affect the build of the base image. Doesn't take in to account any issues with frequency/number of commits and any API throttling.</li>
</ul></li>
</ol>

blocks|key|147438|text|你有没有试过这个：https://github.com/v2tec/watchtower。这是一个运行在docker容器中的简单工具，监视其他容器，如果它们的基础映像发生变化，它会拉出并重新部署。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|147439|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/v2tec/watchtower^0|9|Z|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

have you tried this: <a href="https://github.com/v2tec/watchtower" rel="nofollow noreferrer">https://github.com/v2tec/watchtower</a>.
it's a simple tool running in docker container watching other containers, if their base image changed, it will pull and redeploy.

blocks|key|147450|text|这里的|type|unstyled|depth|inlineStyleRanges|entityRanges|data|147451|是自动更新docker容器的最简单方法|blockquote|147452|147453|147454|通过$+crontab+-e上传作业|offset|length|style|CODE|147455|0+*+*+*+*+sh+~/.docker/cron.sh|code-block|syntax|javascript|147456|使用文件cron.sh创建目录~/.docker|147457|#!/bin/sh
if+grep+-Fqe+"Image+is+up+to+date"+<<+EOF
`docker+pull+ubuntu:latest`
EOF
then
++++echo+"no+update,+just+do+cleaning"
++++docker+system+prune+--force
else
++++echo+"newest+exist,+recompose!"
++++cd+/path/to/your/compose/file
++++docker-compose+down+--volumes
++++docker-compose+up+-d
fi|147458|entityMap^0|0|0|0|0|2|C|0|0|4|7|F|9|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|Y|8|@]|9|@]|A|$]]|$1|E|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|10|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|11|8|@$I|12|J|13|K|L]]|9|@]|A|$]]|$1|M|3|N|5|O|7|14|8|@]|9|@]|A|$P|Q]]|$1|R|3|S|5|6|7|15|8|@$I|16|J|17|K|L]|$I|18|J|19|K|L]]|9|@]|A|$]]|$1|T|3|U|5|O|7|1A|8|@]|9|@]|A|$P|Q]]|$1|V|3|-4|5|6|7|1B|8|@]|9|@]|A|$]]]|W|$]]

<blockquote>
 Here is a simplest way to update docker container automatically
</blockquote>

Put the job via <code>$ crontab -e</code>:

<pre><code>0 * * * * sh ~/.docker/cron.sh
</code></pre>

Create dir <code>~/.docker</code> with file <code>cron.sh</code>:

<pre><code>#!/bin/sh
if grep -Fqe "Image is up to date" &lt;&lt; EOF
`docker pull ubuntu:latest`
EOF
then
 echo "no update, just do cleaning"
 docker system prune --force
else
 echo "newest exist, recompose!"
 cd /path/to/your/compose/file
 docker-compose down --volumes
 docker-compose up -d
fi
</code></pre>

Say I have a trivial container based on the <code>ubuntu:latest</code>. Now there is a security update and <code>ubuntu:latest</code> is updated in the docker repo .

<ol>
<li>How would I know my local image and its containers are running behind? </li>
<li>Is there some best practice for automatically updating local images and containers to follow the docker repo updates, which in practice would give you the same niceties of having unattended-upgrades running on a conventional ubuntu-machine</li>
</ol>

How to automatically update your docker containers, if base-images are updated

安全补丁

服务器

短信

容器

Docker

Debian

Java

假设我有一个基于ubuntu:latest的普通容器。现在有了安全更新，并且在docker存储库中更新了ubuntu:latest。我如何知道本地映像及其容器正在运行？是否有一些最佳实践可用于自动更新本地映像和容器以跟踪docker存储库更新，这实际上将为您提供与在传统docker上运行无人值守升级相同的好处

问如果基本镜像被更新，如何自动更新docker容器
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如果基本镜像被更新，如何自动更新docker容器EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如果基本镜像被更新，如何自动更新docker容器
EN