Skip to main content

Overview

Keep every container on your Docker host current, and get the previous container back automatically when an update breaks.

What Is This?

Outpost is a self-hosted container updater for a single Docker host. On a schedule you choose, it checks each container's registry for a newer image and recreates the container on that image with the same settings, volumes, and networks.

If the new container stops or reports unhealthy, Outpost puts the old one back. It ships as one small image that needs nothing but access to the Docker socket.

Why Use Outpost?

  1. Restores the previous container when an update fails so a broken image doesn't leave your service down overnight.
  2. Carries over volumes, including anonymous ones, and every network attachment so your data and connectivity survive the swap.
  3. Asks the registry before downloading anything so containers that are already current cost almost nothing to check.
  4. Lets you choose what gets updated with labels, or just be told about new images, so cautious services stay under your control.
  5. Runs its updater process as a regular user rather than root so the process itself holds no root privileges. Access to the Docker socket is still equivalent to root on the host, so Outpost needs the same trust as any tool you give that socket.

Key Capabilities

  • Automatic rollback — A replacement that stops, turns unhealthy, or never settles is removed and the previous container is started again.
  • Safe recreation — Environment, labels, ports, restart policy, volumes, and networks are kept, while defaults from the old image are dropped so the new image's defaults apply.
  • Digest-first checks — Outpost compares the registry's digest with the running image before pulling.
  • Label control — Update everything unless labeled off, or only what is labeled on, and mark single containers as monitor-only.
  • Dependency order — Compose depends_on services are updated before the services that need them.
  • Self-updates — Outpost updates its own container too, last in each check, and puts the old one back if the new image fails.
  • Notifications — Get alerts in ntfy, Telegram, Discord, Slack, email, and six other services when containers are updated, new images are found, or an update fails.
  • Web dashboard — See every container, the next check, and the last 50 checks in your browser, and start a check with one click. Sign in with a password, an authenticator app, or a passkey.
  • HTTP API and metrics — Start a check, read the latest results, and scrape Prometheus metrics with access tokens that each do only what you allow.

How It Works

Each cycle goes through your containers one at a time and records a result for each in a report. The report feeds notifications, the dashboard, the status endpoint, and the metrics endpoint.

info

Outpost manages one Docker host through its local socket. Docker Swarm services, Kubernetes, and fleets of remote hosts are out of scope.

What You Will Need

  • A Docker host — Any Linux machine running Docker Engine, such as a NAS, mini PC, or VPS, on amd64 or arm64.
  • Access to the Docker socket — Mounted into the Outpost container, usually /var/run/docker.sock.
  • Containers started from tagged images — Such as nginx:1.27 or ghcr.io/org/app:latest, so there is a tag to follow.

Project Status

Released multi-platform images are available from Docker Hub and the GitHub Container Registry. You can also build the current working copy from source with the repository's compose.yml, as shown in the Quick Start.

Next Steps

Start with the Quick Start