Autoupdating Dockerfiles with newer dependencies

[matrixik]

I found today: https://www.dependencies.io

It could update Dockerfile-s with newer version of public images from Docker Hub. It also could update straight from git tags and more. https://www.dependencies.io/examples/ https://www.dependencies.io/docs/

Free for open source.

Not sure how helpful could it be in our case.

[timothyb89]

That seems to solve a fairly similar problem as our own pr-bot: https://github.com/monasca/pr-bot. We don't see it much in monasca-docker (yet...) but it's been pushing updates to monasca-helm for a while now.

Some thoughts comparing the two. dependencies.io:

• has a nice workflow for tracking public 3rd party docker images
• supports docker
• supports several other package managers... node, ruby, python
• checks once per week for open-source projects
• does not support helm (specifically docker -> helm or helm -> helm) dependencies

On the other hand, our bot:

• triggers ~instantly on merge / publish (for our own repos)
• supports helm charts
• can be self hosted / used privately
• does not yet support docker -> docker updates (soon™)

I think the update frequency is a big factor. Weekly updates for 3rd party dependencies is alright, but it doesn't help with e.g. updates between parent/child images. If I update monasca/agent-base I'd like a pull request to monasca/agent-collector and monasca/agent-forwarder ... well, preferably right away, and definitely not a week (or even a day) later.

Given our bot is still fairly immature, I'm not sure what would be best to do right now. Eventually I'd like the pr-bot to do everything dependencies.io can (and then some), but there might be some utility to enabling it in the mean time?