How to update docker images only on major version upgrades

[nebula-it]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

renovate/renovate:39@sha256:e693cb07853865ae129a56585b44999de212c7fe264718dce0de2137cca756ea

Please tell us more about your question or problem

Looking for a way to only upgrade docker images on major version bump, e.g in renovate's case:

image: renovate/renovate:39@sha256:e693cb07853865ae129a56585b44999de212c7fe264718dce0de2137cca756ea

should only get updated when the version 40 is out. However in this case, since the digest on 39 gets updated almost every day renovate bot creates PR for new digest. Is there a way to achieve that?

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[rarkins]

Do you definitely want to stay on an old digest? They will lock you into an outdated version (the 39 tag is ignored by docker if a digest is present). You're probably best to remove the digest and keep the tag.

[nebula-it]

Do you definitely want to stay on an old digest?

Not really, just dont want to update it every day. So I was hoping with the major version of Renovate I'll get the update ~ once a month.

the 39 tag is ignored by docker if a digest is present

Yeah that makes sense. I was hoping the Renovate image tag 39 stays same and when 40 is out Renovate will update the tag and digest to that one. However, On the Renovate side, It looks like using 39 gets updated to the latest subversion available under 39 which makes this tricky.

In the end, I just need to stay on latestish version but don't want to do the updates every day, it should be something like once a month. Is there is a way to achieve that?

[rarkins]

So you want to do this:

• manually edit the image definition to remove the digest and leave the 39 tag
• if renovate raised a PR to pin the digest again, it means you need to set pinDigests=false in renovate config

Then you won't get any updates until tag 40 is released

[nebula-it]

Is there a way to apply this pinDigests=false for a specific file i.e the renovate one? I use latest tag for few other items where I'd love to continue using the digest pinning.

[rarkins]

Yes, use packageRules

[nebula-it]

Perfect, that works as expected. Thank you both for your help 😄

If someone comes looking for the same, this is what worked:

  "packageRules": [
    {
      "matchFileNames": ["**/renovate/cronjob.yaml"],
      "pinDigests": false
    }
  ]