jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(hardening): move watchtower to the maintained nicholas-fedor fork #140

Merged
jfraeys merged 1 commit from jfraeys/fix/watchtower-maintained-fork into main 2026-10-13 19:45:56 -04:00
Conversation 0 Commits 1 Files changed 2 +5 -5
jfraeys commented 2026-10-13 19:35:52 -04:00
Owner
Copy link

containrrr/watchtower is archived (1.7.1 is its last release) and failed the 2026-10-13 trivy report on 5 CRITICAL findings.

  • Both instances (auto, notify) now use ghcr.io/nicholas-fedor/watchtower:1.23.1.
  • trivy on services: 0 CRITICAL.
  • All flags used by the compose template exist in the fork (--label-enable, --scope, --cleanup, --interval, --monitor-only, --notification-url).
  • Functional check on services: a one-shot --run-once --monitor-only --label-enable --scope notify against the real socket scanned 6 containers, failed=0, updated=0.
  • docs/tool-versions.yml source and pin regex updated.

The com.centurylinklabs.watchtower.* labels on other services are unchanged (the fork reads them).

🤖 Generated with Claude Code

containrrr/watchtower is archived (1.7.1 is its last release) and failed the 2026-10-13 trivy report on 5 CRITICAL findings. - Both instances (auto, notify) now use ghcr.io/nicholas-fedor/watchtower:1.23.1. - trivy on services: 0 CRITICAL. - All flags used by the compose template exist in the fork (--label-enable, --scope, --cleanup, --interval, --monitor-only, --notification-url). - Functional check on services: a one-shot `--run-once --monitor-only --label-enable --scope notify` against the real socket scanned 6 containers, failed=0, updated=0. - `docs/tool-versions.yml` source and pin regex updated. The com.centurylinklabs.watchtower.* labels on other services are unchanged (the fork reads them). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(hardening): move watchtower to the maintained nicholas-fedor fork
All checks were successful
Lint / lint (pull_request) Successful in 2m12s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
aadfbfe5eb
 
containrrr/watchtower is archived (1.7.1 is its last release) and the trivy
report fails it on 5 CRITICAL findings. The fork's 1.23.1 reports 0 CRITICAL,
has every flag both instances use, and a one-shot --monitor-only run with
--label-enable --scope notify on services scanned 6 containers, 0 failed.
The com.centurylinklabs.watchtower.* labels on other services are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!140
No description provided.