DockerUpdateGuard

DockerUpdateGuard is a web application for tracking what is actually running in Docker, comparing it with registry metadata, and showing where updates, vulnerabilities, and shared base-image dependencies need attention.

It is designed for teams that want more than "a newer tag exists". The app keeps an inventory of observed images and runtime containers, correlates them with registry tags and digests, samples CPU, memory, and network usage, and keeps a scan history so update decisions can be reviewed instead of guessed.

What the application helps with

Discover configured Docker instances and the containers currently running on them
Detect whether a running container is up to date, behind a newer version, or needs manual review
Resolve alias tags such as latest to matching semantic version tags when they share the same digest
Track resource usage over time for Docker instances and runtime containers
Correlate runtime containers with observed images and shared base images
Refresh vulnerability data for images
Keep historical scan results for auditing and troubleshooting

Main UI areas

Dashboard: summary view of the current inventory
Observed Images: repositories and tags discovered from Docker Hub account data
Runtime Containers: live workload inventory with update and vulnerability state
Docker Instances: configured engines plus usage history
Shared Base Images: base-image reuse across observed images
Scan History: recent background activity and outcomes

Runtime requirements

DockerUpdateGuard expects:

A PostgreSQL database
Access to one or more Docker Engine endpoints
Optional Docker Hub credentials for authenticated registry access
Optional Portainer access per Docker instance
Optional OTLP endpoint for telemetry export
Optional Trivy server when Trivy-based vulnerability scanning is enabled

The application applies EF Core migrations automatically on startup.

Running the application

Local development

Use the solution file from the repository root:

dotnet restore DockerUpdateGuard.slnx
reihitsu-format ./
dotnet build DockerUpdateGuard.slnx -c Release --no-restore
dotnet test src\Tests\**\*.csproj -c Release --no-build --logger trx --collect:"XPlat Code Coverage"

Docker image

The container image listens on port 8080 by default.

Example for Linux with a local Docker socket:

docker run -d \
  --name dockerupdateguard \
  -p 8080:8080 \
  --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
  -v /path/to/appsettings.json:/app/appsettings.json:ro \
  networlddev/dockerupdateguard:latest

When DockerUpdateGuard runs inside a Linux container and should inspect the host Docker Engine through the Unix socket, two things must be in place:

/var/run/docker.sock must be mounted into the container
The corresponding Docker instance BaseUrl must be set to unix:///var/run/docker.sock in appsettings.json

Without both settings, the application cannot reach the host engine.

Configuration model

DockerUpdateGuard uses normal ASP.NET Core configuration binding and prefers configuration files for container deployments:

appsettings.json
appsettings.{Environment}.json
command-line arguments
secret stores supported by ASP.NET Core

For example:

JSON key: DockerUpdateGuard:Scanning:RuntimeImageUpdateScanIntervalMinutes

Configuration reference

Connection and host settings

Key	Default	Required	Description
`ConnectionStrings:DockerUpdateGuard`	none	Yes*	Named PostgreSQL connection string used when `DockerUpdateGuard:ConnectionString` is not set
`DockerUpdateGuard:ConnectionString`	none	Yes*	Inline PostgreSQL connection string
`DockerUpdateGuard:ConnectionStringName`	`DockerUpdateGuard`	No	Name of the `ConnectionStrings` entry to resolve
`DockerUpdateGuard:DisplayVersion`	assembly version	No	Version string shown in the UI footer; the Docker image sets this automatically

* At least one of DockerUpdateGuard:ConnectionString or ConnectionStrings:{ConnectionStringName} must be configured.