liveBook · Manning

Podman auto-update

As explained in Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more

podman auto-update is a Podman command and feature that detects changed container images in a registry and recreates the associated containers.

Podman auto-update detects a changed container image in a registry, pulls it, and recreates the associated container without manual intervention. It suits distributed, edge, and IoT workloads where images may contain new features or vulnerability fixes. section 7.3.4

Enable updates by creating the container with the io.containers.autoupdate=registry label and generating its systemd unit with podman generate systemd --new. Reload and start the unit, then run podman auto-update to check the registry. section 7.3.4

Table 7.6 Auto-update modes (view table figure)

io.containers.autoupdate

Description

registry

Podman connects to the container registry and checks if a different image than the one used to create the container is available; if there is one, Podman will update the container.

local

Podman connects to the container registry but compares local images to the one the container was created with; if they are different, Podman updates the container.

Compare registry and local update policies: registry compares against the image available in the container registry, while local compares registry state with local images. section 7.3.4

Reliable rollback depends on systemd notification. A containerized service receives NOTIFY_SOCKET through the unit; if it fails to report readiness within the limit, Podman removes the replacement, restores the original image, and recreates the previous container. section 7.4 section 7.5

How Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more covers it

How deep it goes
Explains labels, generated systemd units, update policies, readiness checks, and rollback, but not registry implementation internals.
Examples
Uses a labeled myapp container, a generated myapp-new.service unit, registry image replacement, and podman auto-update output.
What it assumes
Assumes familiarity with containers and images while defining the required Podman label, generated systemd unit, registry policy, and readiness notification.
What you can do after
Operate/configure unattended updates with Podman and systemd, including readiness-based rollback after failed replacements.
How it connects
Connects container images and registries with systemd, sd_notify, service lifecycle management, and rollback.
Cover of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more
liveBookmanning.com
Read Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more. The section links point to the parts of the book it draws on.