Updating apk add and apt install definitions in Dockerfiles with Renovate
If you're writing Dockerfiles that install packages using system package managers, such as apk or apt, you might be pinning your versions of packages, to make sure that you have more reproducible builds, or if you're on a rolling release distribution like Wolfi and Chainguard Images, you want to make sure you only get package versions you want.
When these system package manager versions are pinned, it can then be a little cumbersome to keep them updated in an automated fashion, as most tools don't have a way to automagically parse your files and propose updates. So you're probably one one of two camps - "I'll get my AI agent to go and update it for me" or "we'll not update anything until things break".
I've previously had this managed - at least for apk add updates - by using a Custom Regex Manager with Renovate to keep them updated, which required you break the install command over multiple lines:
# ...
RUN apk upgrade --no-cache && \
apk add --no-cache \
bash=5.2.37-r2 \
py3-pip \
python3 \
rsyslog=8.2412.0-r1 \
runit=2.2.0
ENV APP_HOST=0.0.0.0
ENV app_port=5000
ENV SNAPP_PORT 5000
This isn't that much of a problem - as it also improves readability - but you generally want the tools to work around you, not vice versa.
As of earlier this morning, we've shipped inbuilt support in Renovate, so if you have a Dockerfile with apk add, or an apt install (or apt-get install) like below, you'll be able to receive package updates for them 🎉
For instance, with the following Dockerfile:
# SPDX-License-Identifier: AGPL-3.0-only
# Via https://docs.renovatebot.com/modules/manager/dockerfile/#run-apt-install-support
FROM debian:trixie
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
# newlines for readability only
curl=8.14.1-2 \
git=1:2.47.3-0+deb13u1 \
&& rm -rf /var/lib/apt/lists/*
Renovate will detect that you have a package pin for curl and git, and if there are updates available, will propose them.
Right now, we don't currently auto-detect the distribution you're using and auto-wire the registry URL to look up packages with, so in the meantime you'll need to explicitly tell Renovate how to do that, for instance :
{
"packageRules": [
{
"matchFileNames": ["Dockerfile.wolfi"],
"matchDatasources": ["apk"],
"registryUrls": ["https://packages.wolfi.dev/os?arch=x86_64"]
},
{
"matchFileNames": ["Dockerfile.local"],
"matchDatasources": ["deb"],
"registryUrls": [
"https://deb.debian.org/debian?suite=trixie&components=main,contrib,non-free&binaryArch=amd64"
]
}
]
}
My hope is that early next week, my PR to derive this information will land, so you won't even need to configure anything - it'll ✨ just work ✨
This is something I've wanted for at least over a year, and we've had user requests for this for - at a quick check - over 5 years! So I'm really glad we've got this over the line, and I'm looking forward to hearing feedback about this.
We're also very open to other system package managers - feel free to raise a "Suggest an Idea" Discussion if there are others you'd like added.
You can see more details in the docs:
(If this post looks familiar, it might be because this blog post replaces [a post I wrote last year], because renovate now supports this functionality natively, as of Renovate 44.100.0 🎉)
(There are some subsequent fixes, so I'd recommend using 44.103.0 as the earliest version to test with)
