bluesky-social / ozone

web interface for labeling content in atproto / Bluesky
https://atproto.com
Other
218 stars 15 forks source link

Watchtower configuration is risky for hosts running more than just ozone #103

Open Bossett opened 2 months ago

Bossett commented 2 months ago

See https://github.com/bluesky-social/pds/issues/49 - ozone is better configured (only updates where labelled), but still does not limit scope to bluesky-only containers.

Instead of straight enable, all bluesky and bluesky-provided watchtower containers in the compose should be defined with:

labels:
      - "com.centurylinklabs.watchtower.scope=bluesky-social-ozone" # (e.g.)

Also note that multiple instances with conflicting configuration and no scopes will break - as-is, it will not be clear which watchtower instance is updating which containers (i.e. which configuration will load) when running both the PDS and Ozone on the same docker host, and it's possible that the PDS instance runs which ignores the label setting.