w33ble/lagom
Watch
1
0
Fork
You've already forked lagom
 0
Code Issues 1 Pull requests Releases 4 Packages 1 Activity Actions
4 releases 4 tags
  • v1.0.0 f111f9e50b

    v1.0.0 Stable

    w33ble released this 2026-08-22 16:50:20 -06:00 | 41 commits to main since this release

    First release of lagom — a supply-chain-safe Docker image updater. It watches the digests of images running in your containers, records when each digest was first seen, and updates containers to newer digest-addressed images only after they've satisfied a minimum-age policy. Nothing is ever pulled by a mutable tag; updates are always addressed by digest.

    Features

    Digest tracking

    • lagom track inspects running containers (or the images config list) and records observed image digests with first-seen/last-seen timestamps in BoltDB ($LAGOM_CONFIG_PATH/state.db).
    • Registry inspection archives remote digest history per ref; history is retained for a 5x min-age window.

    Age-gated updates

    • lagom update advances each image to the newest observed digest that satisfies min_age_days, pulled by digest with up to max_pull_candidates fallbacks.
    • Eligibility is judged from when lagom first observed a digest, cross-referenced against the registry build date so a backdated timestamp cannot make an unpulled digest eligible early.
    • Historic-digest fallback keeps updates working when the remote tag is too new or unreachable.
    • --force bypasses the age gate; --debug emits a pull/retag/prune/recreate audit trail.

    Daemon mode

    • lagom daemon runs periodic track+update cycles, handling SIGHUP/SIGTERM/SIGINT gracefully.
    • Health endpoint on :8080 surfaces daemon errors for monitoring (bound to all interfaces so Docker health checks work).
    • Optional notifications via shoutrrr (ntfy, SMTP, webhook, etc.), with LAGOM_SERVER_NAME to identify the sender.

    Container recreation

    • --recreate recreates containers that were running an updated image; the lagom.no-recreate label opts individual containers out, and lagom.enable=false disables a container entirely.

    Configuration

    • YAML config with LAGOM_* environment variable overrides for every field; values are validated (minimums clamped to 1).

    Build & packaging

    • Version/commit/date injected at build time (git describe); Dockerfile for running in a container; cross-compiled dist binaries for linux/darwin on amd64/arm64.

    Docker image

    Downloads