Updating
Image tags
The bunker and the dashboard share one version and are released together. Each image is published with several tags.
| Tag | Points at |
|---|---|
latest | The newest release. |
<version>, such as 0.1.0 | That release. |
<major>.<minor>, such as 0.1 | The newest patch of that release line. |
edge | Trunk: the latest merged code, not a reviewed release. |
master | The same image as edge. |
sha-<short> | One specific commit. |
Trunk builds are also tagged with their own version, such as 0.1.1-3.
latest only moves forward, to the highest stable release. There is no :0 style tag for a major version.
Use edge only to try what has merged but not been released.
Weekly rebuilds
Every Monday, the newest release and trunk are rebuilt on fresh base images. Each rebuild runs the same tests and vulnerability scan before it is published.
A rebuilt release keeps its version and its code. Only the image digest changes. This brings base-image security fixes to what you run within a week, without a new release.
If you pin an image by digest, you will not get these fixes.
Choosing a tag
compose.yaml pins an exact version for both images, such as 0.1.0. Upgrading is then a deliberate change to that file.
Always use the same tag for both images.
How to update
- Edit the two
image:lines incompose.yamlto the new version, for both the bunker and the frontend. - Pull the new images:
podman pull ghcr.io/diogel-io/bancwr-diogel-backend:0.1.0 podman pull ghcr.io/diogel-io/bancwr-diogel-frontend:0.1.0 - Recreate the containers:
podman compose down podman compose up -d
Replace 0.1.0 with the version you are updating to.
Your data is kept in the ./data directory, so it survives the update.
To pick up a weekly rebuild of the version you already run, pull the same tag again and recreate the containers.
Checking the running version
After updating, check that both parts run the new version.
- In the dashboard: the sidebar footer shows the bunker and frontend versions. It warns Bunker and frontend versions differ if they do not match.
- The dashboard container:
curl -s http://localhost:3001/api/version - The bunker container: its first log line carries its version, such as
Bancwr Diogel 0.1.0 starting....
If the versions differ, the two containers were not updated together. Check both image: lines in compose.yaml.
Updating from an early build
Both containers run as user ID 65532, not root. If you ran an early build of the bunker as root, its ./data directory belongs to root, and the bunker can no longer write its database. Hand it over once, before starting the new image.
With rootless Podman:
podman unshare chown -R 65532:65532 ./data
With Docker:
sudo chown -R 65532:65532 ./data
Early builds used the roles admin and viewer. At startup the bunker changes them to administrator and user. If the same key was registered twice, the older registration is kept, and the log names both.