Skip to content

Home

Jump to bottom
Will Luck edited this page Apr 13, 2026 · 8 revisions

Docker-Sentinel

A container update orchestrator with a web dashboard, written in Go. Monitors Docker containers for image updates, applies per-container update policies, takes pre-update snapshots, and rolls back automatically if a container fails health checks after updating.

Recent Highlights (v2.12.x)

  • Multi-instance Portainer support - one Sentinel instance can monitor containers across multiple Portainer servers
  • Engine ID deduplication - automatically detects and prevents duplicate scanning when the same Docker host is reachable via multiple Portainer endpoints
  • Enhanced cluster mode - SENTINEL_CLUSTER_ADVERTISE for multi-network TLS cert SANs, plus actionable CA mismatch guidance
  • Security hardening - webhook secrets moved to headers, OIDC nonce + PKCE, CSRF-protected logout
  • Maintenance windows - SENTINEL_MAINTENANCE_WINDOW restricts auto-updates to a specific time range

Update Lifecycle

  1. Scan running containers and check their update policies
  2. Check registries for new digests (mutable tags) or semver tags
  3. Queue updates (auto-policy proceeds immediately; manual-policy waits for approval)
  4. Snapshot the full container config, then pull the new image
  5. Update the container: stop, remove, recreate with identical config, start
  6. Validate after the grace period and rollback from the snapshot if unhealthy

Wiki Pages

Page Description
Installation Docker, Docker Compose, binary, and building from source
Configuration Reference All environment variables with defaults and descriptions
Docker Labels Per-container labels for policies, schedules, and constraints
Web UI Guide Dashboard, queue, container detail, images, and settings pages
REST API Reference HTTP endpoints for automation and integrations
Authentication and Security Password, WebAuthn/passkeys, OIDC/SSO, TOTP/2FA, and TLS
Notifications Gotify, Slack, Discord, Ntfy, Telegram, Pushover, Email, MQTT, Apprise, and webhooks
Cluster Mode Multi-host monitoring with server/agent topology and mTLS
Lifecycle Hooks Pre/post-update hooks and Docker-Guardian integration
Upgrade Guide Version-to-version upgrade notes and breaking changes
Troubleshooting Common issues, debug logging, and diagnostics

Links

Home

Getting Started

Using Sentinel

Multi-Host

Security

Reference

Clone this wiki locally