Is Docker-Sentinel specifically protected from updates?

[wsw70]

These are the three views of the status of Docker-Sentinel, when there is a new version. Since the default action is "Auto", it is expected to be updated seamlessly. There is, however, a 🔒self setting which would suggest that it needs to be handled differently?

[Will-Luck]

Thanks for spotting this! Yes, Sentinel protects itself from automatic updates.

The 🔒self badge means the container has the sentinel.self=true label (set automatically in the official Docker image). When Sentinel detects an update for itself, it always queues it for manual approval, regardless of your default policy setting. It will never auto-apply an update to itself.

The reason for this is straightforward: if Sentinel updated itself mid-scan, it would stop running and potentially leave other containers in a half-updated state. Instead, when you're ready to update, you can trigger it from the dashboard and Sentinel handles the process using a temporary helper container that pulls the new image, stops the old container, and recreates it with the same config.

So the short answer: the update will sit in the queue until you explicitly approve it. Your other containers are unaffected.

[wsw70]

OK, clear. I tried to upgrade by pressing "Approve" but ...

[Will-Luck]

Thanks for catching this! You've found a genuine bug. The queue page shows a standard "Approve" button for Sentinel's own update, but the API blocks it because self-updates need to go through a different process (the helper container). The dashboard handles this correctly with a dedicated "Update Sentinel" button, but the queue page was missed.

As a workaround, go to the main dashboard and you'll see an "Update Sentinel" button in the status column for the Sentinel row. That one works correctly and will trigger the self-update via the helper container.

I've filed this as #58 and it'll be fixed in the next release.

I've also filed #59 for the safe auto-update mode I mentioned earlier, so Sentinel can optionally update itself automatically once it's confirmed idle (no scans running, no updates in progress).

[Will-Luck]

I've just thought of this: it would be possible to add a safe self-update mode where Sentinel updates itself automatically, but only when no other updates are actively running. That way there's no risk of it stopping mid-scan and leaving something half-updated.

The flow would be something like: detect self-update available, wait until the current scan/update cycle is fully idle, then trigger the helper container process to swap itself out.

Something like this would be a good way to allow auto updates without anything (hopefully :D) breaking. What do you think?

[Will-Luck]

v2.9.0 (releasing now) adds an auto self-update mode setting in Settings > General. When enabled, Sentinel will automatically update itself after each scan when no other updates are in progress. This replaces the need to manually approve self-updates from the queue page.

The self-update flow also now has a concurrent guard to prevent duplicate update attempts, and re-queues on failure.