feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them
pihole/pihole (no tag) -> 2026.10.0 sha256:d3413471... lscr.io/linuxserver/jackett:latest -> v0.24.2865-ls7 sha256:4fcf3cc2... plexinc/pms-docker:latest -> 1.43.4.10903-e5521bd8c sha256:e0ab2739... Each tag was resolved against its registry and matched the pods' imageID, so the image is unchanged (the pod template string does change, so Flux rolls the three workloads). renovate.json5: regex versioning for jackett (-lsN) and plex (build-hex); jackett is looked up on ghcr.io via overridePackageName, because lscr.io is capped at dockerMaxPages=20 pages and jackett's 32k tags put the running one at #31,980 (dry run proposed nothing without it); jackett weekly (13 builds in 12 days); pihole deliberately unheld, year rollover = major. Stale "publishes only latest" prose fixed in renovate.json5 and three runbooks. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 5.5 committed
1 parent
ce849032d5
commit
183bca6897
11 files changed
+160
-20
No files matched your search
@@ -78,7 +78,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: jackett
|
||||
image: lscr.io/linuxserver/jackett:latest
|
||||
image: lscr.io/linuxserver/jackett:v0.24.2865-ls7
|
||||
ports:
|
||||
- containerPort: 9117
|
||||
volumeMounts:
|
||||
|
||||
@@ -62,7 +62,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: pihole
|
||||
image: pihole/pihole
|
||||
image: pihole/pihole:2026.10.0
|
||||
ports:
|
||||
- containerPort: 80
|
||||
env:
|
||||
|
||||
@@ -120,7 +120,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: plex
|
||||
image: plexinc/pms-docker:latest
|
||||
image: plexinc/pms-docker:1.43.4.10903-e5521bd8c
|
||||
ports:
|
||||
- containerPort: 32400
|
||||
env:
|
||||
|
||||
@@ -16,7 +16,7 @@
|
||||
name: jackett
|
||||
kind: container
|
||||
source:
|
||||
image: lscr.io/linuxserver/jackett:latest
|
||||
image: lscr.io/linuxserver/jackett:v0.24.2865-ls7
|
||||
exposure: internal # LAN-only web UI at jackett.${BASE_DOMAIN} (docs/13 row 4; R-DNS/R-NET)
|
||||
egress: vpn # indexer scraping via node PIA tunnel + kill-switch (docs/03; ADR-0015; R-NET-05/06)
|
||||
storage:
|
||||
@@ -70,7 +70,8 @@ auth:
|
||||
- ^/api/
|
||||
update:
|
||||
channel: stable # R-UPD-01
|
||||
range: ">=0.22.0" # stay on the Jackett 0.22.x stable line
|
||||
range: ">=0.22.0" # floor only, no ceiling (0.24.x runs as of 2026-10-30; Jackett has no
|
||||
# major line to hold back from, so renovate.json5 mirrors no cap)
|
||||
cadence: "0 4 * * *"
|
||||
autoRollbackOnFailedHealth: true # R-UPD-03
|
||||
observability:
|
||||
|
||||
+1
-1
@@ -5,7 +5,7 @@
|
||||
name: pihole
|
||||
kind: container
|
||||
source:
|
||||
image: pihole/pihole
|
||||
image: pihole/pihole:2026.10.0
|
||||
exposure: internal # LAN-only admin UI (docs/13 row 6; R-DNS/R-NET)
|
||||
egress: internet # normal WAN egress (docs/03; R-NET-05)
|
||||
storage:
|
||||
|
||||
+1
-1
@@ -12,7 +12,7 @@
|
||||
name: plex
|
||||
kind: container
|
||||
source:
|
||||
image: plexinc/pms-docker:latest
|
||||
image: plexinc/pms-docker:1.43.4.10903-e5521bd8c
|
||||
# plexinc/pms-docker env. Rendered VERBATIM onto the app container by render.py (schema env list).
|
||||
env:
|
||||
# PLEX_UID/PLEX_GID: the image boots as root (s6 PID1), chowns /config to this uid/gid, then drops
|
||||
|
||||
@@ -0,0 +1,96 @@
|
||||
---
|
||||
date: 2026-10-30
|
||||
branch: feat/pin-pihole-jackett-plex
|
||||
title: Pin pihole, jackett and plex to the digests already running, and make Renovate able to follow them
|
||||
---
|
||||
|
||||
## What changed
|
||||
|
||||
- **`catalog/{pihole,jackett,plex}.yaml` `source.image`** pinned to the tag whose digest was
|
||||
already running, so the *image* does not change:
|
||||
- `pihole/pihole` (no tag) -> `pihole/pihole:2026.10.0`
|
||||
- `lscr.io/linuxserver/jackett:latest` -> `lscr.io/linuxserver/jackett:v0.24.2865-ls7`
|
||||
- `plexinc/pms-docker:latest` -> `plexinc/pms-docker:1.43.4.10903-e5521bd8c`
|
||||
- **`apps/wave-0/{pihole,jackett,plex}.yaml`** re-rendered (`render.py --all catalog -o apps
|
||||
--wave-layout --no-image-automation`, in the toolbox). The diff is exactly the three app-container
|
||||
`image:` lines; nothing else moved.
|
||||
- **`catalog/jackett.yaml`** `update.range` comment: "stay on the Jackett 0.22.x stable line" was
|
||||
false (0.24 runs, and `>=0.22.0` has no ceiling). Range unchanged; comment corrected.
|
||||
- **`renovate.json5`**, four packageRules plus a comment block:
|
||||
- jackett `versioning: regex:^v(major).(minor).(patch)-ls(build)$` (Renovate's linuxserver example).
|
||||
- jackett **`overridePackageName: ghcr.io/linuxserver/jackett`**: not in the brief, and needed.
|
||||
Renovate's docker datasource reads at most `dockerMaxPages` (20, a global-only option) tag
|
||||
pages from any host except a short list that includes ghcr.io (1000 pages). lscr.io is not on
|
||||
that list. Jackett has **32,093** tags, oldest first, ~1000 per page; the running tag is #31,980.
|
||||
Before this rule the dry run extracted jackett at `v0.24.2865-ls7` and **proposed nothing**,
|
||||
with no warning. The override changes only the lookup; the manifests keep `lscr.io/...`.
|
||||
Every jackett rule matches on `depName`, because the override rewrites `packageName`.
|
||||
- jackett `schedule: after 3am and before 6am on sunday`, i.e. weekly. Measured: 13 ls builds in
|
||||
12 days (ls7 built 2026-10-17, ls20 built 2026-10-29). Each is a `patch` and auto-merges, so on
|
||||
the daily window it would mean a PR, a gate run and a jackett restart (Recreate) every day.
|
||||
Weekly picks the newest tag, so it skips nothing. `catalog/jackett.yaml update.cadence` still
|
||||
says daily. That field fed the retired Flux image-automation, and the rule's description
|
||||
says the rule is now the cadence that takes effect.
|
||||
- plex `versioning: regex:^(major).(minor).(patch).(build)-[0-9a-f]+$`.
|
||||
- pihole: **no rule**, as the operator decided. CalVer parses under default docker versioning.
|
||||
Patches and minors auto-merge, and a year rollover is a major (dashboard approval). This is
|
||||
written in a comment.
|
||||
- Corrected the "WHAT RENOVATE STILL CANNOT FIX" comment. It listed these three as floating;
|
||||
they publish immutable version tags.
|
||||
- No `allowedVersions` mirror was added. None of the three catalog ranges has a ceiling
|
||||
(`>=2024.0.0`, `>=0.22.0`, `>=1.40.0`), so #86's mirror has nothing to encode for them.
|
||||
- **Runbooks:** `image-policy-stalled.md` no longer says jackett and pms-docker are
|
||||
`latest`-only. In `plex-quicksync.md`, "the floating-image caveat" became "the image-version
|
||||
caveat", because the deployment no longer runs `:latest` with an implicit `Always`, and the symptom
|
||||
is now "after a pms-docker bump". `plex-claim.md`'s two "running `:latest`" mentions are
|
||||
now in the past tense.
|
||||
|
||||
## What I verified
|
||||
|
||||
- **Live digests** (read-only `kubectl --context k3s-prod`, pod `.status.containerStatuses[].imageID`):
|
||||
pihole-0 and pihole-1 `sha256:d34134716fc3…`, jackett `sha256:4fcf3cc22dd3…`, plex
|
||||
`sha256:e0ab27395614…`.
|
||||
- **Each chosen tag resolves to the same digest** (anonymous registry HEAD, OCI index + manifest-list
|
||||
Accept): `pihole/pihole:2026.10.0` = `sha256:d34134716fc3…`; `ghcr.io/linuxserver/jackett:v0.24.2865-ls7`
|
||||
= `sha256:4fcf3cc22dd3…`; `plexinc/pms-docker:1.43.4.10903-e5521bd8c` = `sha256:e0ab27395614…`.
|
||||
(For contrast, `pms-docker:latest` is now `sha256:6d778d41…` and `jackett:latest` `sha256:ee6ae915…`.
|
||||
The pods would have drifted on their next restart.)
|
||||
- `renovate-config-validator` (ghcr.io/renovatebot/renovate:44.167.0) reports "Config validated
|
||||
successfully". The only warning is the existing `docker` block migration.
|
||||
- **Renovate dry run** (`RENOVATE_PLATFORM=local`, `--dry-run=full`, 44.167.0, anonymous, includePaths
|
||||
limited to the six files). It extracted all three from both `catalog/` (custom regex) and
|
||||
`apps/wave-0/` (kubernetes) under the same depName, so each lands in one branch:
|
||||
- plex `1.43.4.10903-e5521bd8c` -> `1.43.5.11079-b3b13e506` (patch, `renovate/plexinc-pms-docker-1.x`)
|
||||
- jackett `v0.24.2865-ls7` -> `v0.24.2961-ls20` (patch, `renovate/lscr.io-linuxserver-jackett-0.x`).
|
||||
This needs the ghcr override; without it there was no proposal.
|
||||
- pihole `2026.10.0` -> none. That is correct, because 2026.10.0 is the newest numbered tag on Docker Hub.
|
||||
- **Automerge, schedule and dashboard flags** come from Renovate's own `applyPackageRules`
|
||||
(datasource-merge, then update-type-merge, the same order as `flatten.js`), run on the resolved
|
||||
config. The local platform does not run the branch worker:
|
||||
- plex patch: automerge **true**, daily window.
|
||||
- jackett patch: automerge **true**, schedule **sunday** window.
|
||||
- pihole (synthetic updates) `2026.10.1` patch and `2026.11.0` minor: automerge **true**. `2027.01.0`
|
||||
major: automerge **false**, `dependencyDashboardApproval` **true**, +needs-review/breaking.
|
||||
- **Versioning filters** (Renovate's versioning module): the jackett regex rejects `latest`, bare
|
||||
`0.24.2961`, `amd64-…` and `development-…`. The plex regex rejects `latest`, `public`, `beta`,
|
||||
`plexpass` and `…-amd64`/`…-arm64`. Docker versioning ranks `2026.09.0 < 2026.10.0`.
|
||||
- Touched paths (`catalog/`, `apps/`, `renovate.json5`, `runbooks/`, `decisions/`) are not in
|
||||
`infra/gitea/approval-policy.json` `sensitive_paths`.
|
||||
|
||||
## What I did NOT verify
|
||||
|
||||
- **That the merge is restart-free. It is not.** The pod-template `image` string changes, so Flux
|
||||
rolls all three: plex and jackett are `Recreate`, so each has a brief outage, and pihole is a
|
||||
2-replica StatefulSet that rolls one pod at a time. The digest is identical, so the image's
|
||||
behaviour should not change, but the kubelet resolves the new tag name and may pull it. The
|
||||
rollout itself was not observed.
|
||||
- The implicit `imagePullPolicy` moves from `Always` (`:latest` or no tag) to `IfNotPresent`. This is
|
||||
intended, and was not observed live.
|
||||
- A real (non-dry) Renovate run against Gitea, and whether the Sunday window actually opens a jackett
|
||||
PR. The schedule was only evaluated, not exercised.
|
||||
- Other `lscr.io/linuxserver/*` images (radarr, sonarr, qbittorrent) may hit the same 20-page
|
||||
truncation once their tag counts grow. Not measured here, and not changed.
|
||||
- Plex not self-updating on a version tag was checked only against the running pod (read-only
|
||||
`kubectl exec cat`). `/etc/cont-init.d/50-plex-update` does `exit 0` when `version` from
|
||||
`/version.txt` equals the installed `plexmediaserver` package. Both are
|
||||
`1.43.4.10903-e5521bd8c`. I did not boot a pod on a *new* tag to watch that short-circuit.
|
||||
@@ -325,6 +325,37 @@
|
||||
{ "matchPackageNames": ["lscr.io/linuxserver/radarr"], "allowedVersions": "<6.0.0" },
|
||||
{ "matchPackageNames": ["lscr.io/linuxserver/sonarr"], "allowedVersions": "<5.0.0" },
|
||||
{ "matchPackageNames": ["semaphoreui/semaphore"], "allowedVersions": "<3.0.0" },
|
||||
// ADDED 2026-10-30 — pihole, jackett and plex, PINNED to the digests that were already running
|
||||
// (catalog/{pihole,jackett,plex}.yaml; each tag was resolved against the registry and matched the
|
||||
// pods' imageID, so the pin changed nothing at runtime). None of the three catalog `update.range`
|
||||
// values has a ceiling (pihole >=2024.0.0, jackett >=0.22.0, plex >=1.40.0), so the
|
||||
// allowedVersions mirror above needs no entry for them.
|
||||
//
|
||||
// pihole/pihole needs NO rule: its CalVer tags (YYYY.MM.N, e.g. 2026.10.0) parse under the
|
||||
// default `docker` versioning. Patches and minors (2026.10.0 -> 2026.10.1 / 2026.11.0) therefore
|
||||
// AUTO-MERGE on a green gate under rule 1 — the operator's explicit choice, not an oversight; do
|
||||
// not add a hold here. A YEAR ROLLOVER (2026.x -> 2027.x) is a MAJOR, so it waits for a tick on
|
||||
// the Dependency Dashboard (rule below) and is never auto-merged.
|
||||
{
|
||||
"description": "ADDED 2026-10-30. LinuxServer tags: `vX.Y.Z-lsN` is the IMMUTABLE build tag (bare `X.Y.Z` and `latest` are re-pushed for every ls rebuild). Docker versioning would treat `-ls7` as a compatibility suffix and only ever compare tags with the SAME suffix, so it would never move. This is Renovate's own regex-versioning example for linuxserver images: the ls build number becomes the `build` component, so an ls rebuild of the same Jackett is an update too. The `^v` and `$` anchors exclude `latest`, `development`, the bare mutable `X.Y.Z` tags and the arch-prefixed (`amd64-v...`) tags.",
|
||||
"matchDepNames": ["lscr.io/linuxserver/jackett"],
|
||||
"versioning": "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<build>\\d+)$"
|
||||
},
|
||||
{
|
||||
"description": "ADDED 2026-10-30. LOOK JACKETT UP ON ghcr.io, NOT lscr.io. lscr.io is LinuxServer's redirector in front of ghcr.io/linuxserver (same manifests: v0.24.2865-ls7 is sha256:4fcf3cc2... on both). Renovate's docker datasource fetches up to 1000 pages of tags from ghcr.io but only `dockerMaxPages` (default 20, a GLOBAL-only option) from any other host (lib/modules/datasource/docker/index.js getTags). Jackett has 32,093 tags at ~1000 per page (measured 2026-10-30), oldest first; the running tag is #31,980, so a lookup via lscr.io never sees it or anything newer and silently proposes NOTHING (measured in a dry run before this rule). overridePackageName changes only the lookup; the file keeps `lscr.io/...`, so the deployed image string does not change. Matched by depName because packageName is what this rule rewrites.",
|
||||
"matchDepNames": ["lscr.io/linuxserver/jackett"],
|
||||
"overridePackageName": "ghcr.io/linuxserver/jackett"
|
||||
},
|
||||
{
|
||||
"description": "ADDED 2026-10-30. Jackett publishes ~daily (13 ls builds in 12 days, measured 2026-10-30) and every one is a `patch` under the regex above, i.e. auto-mergeable. Left on the global daily window that is a PR, a gate run and a jackett pod restart EVERY DAY for an indexer proxy whose individual builds nobody needs promptly. WEEKLY instead: Renovate proposes only the newest tag when the window opens, so nothing is skipped, it is just batched. The window is still inside the global 03:00-06:00 local one that .gitea/workflows/renovate.yaml's 08:15 UTC cron lands in. NOTE: catalog/jackett.yaml `update.cadence` still says daily (`0 4 * * *`); that field drove Flux image-automation, which is retired, and this rule is the effective cadence now.",
|
||||
"matchDepNames": ["lscr.io/linuxserver/jackett"],
|
||||
"schedule": ["after 3am and before 6am on sunday"]
|
||||
},
|
||||
{
|
||||
"description": "ADDED 2026-10-30. Plex tags are `<major>.<minor>.<patch>.<build>-<commit hex>` (e.g. 1.43.4.10903-e5521bd8c). Docker versioning reads `-e5521bd8c` as a compatibility suffix that differs on EVERY release, so it would never find a successor. The trailing `$` excludes the per-arch variants and the floating `latest`/`public`/`beta`/`plexpass` tags. A version tag does NOT self-update inside the container: cont-init 50-plex-update exits early when /version.txt matches the installed package, so what is pinned is what runs.",
|
||||
"matchPackageNames": ["plexinc/pms-docker"],
|
||||
"versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)-[0-9a-f]+$"
|
||||
},
|
||||
{
|
||||
"description": "ADDED 2026-10-30. A CNPG Postgres MAJOR is a migration (new cluster + import), not an image bump; the dry run proposed 16.4 -> 18.6. Minors stay (and are blast-radius, above).",
|
||||
"matchPackageNames": ["ghcr.io/cloudnative-pg/postgresql"],
|
||||
@@ -379,6 +410,10 @@
|
||||
// ARE maintained (the first dry run proposed 35-apache and 29-dind; the suffix is kept).
|
||||
// CORRECTED 2026-10-30: quay.io/keycloak/keycloak was never a running reference — the operator
|
||||
// picks the server image — and the Keycloak version is now tracked via the operator URLs.
|
||||
// CORRECTED 2026-10-30 (feat/pin-pihole-jackett-plex): pms-docker, jackett and pihole are now
|
||||
// PINNED (1.43.4.10903-e5521bd8c, v0.24.2865-ls7, 2026.10.0 — the digests that were running) and
|
||||
// maintained via the versioning rules above. None of the three publishes "only latest": all three
|
||||
// publish immutable version tags, they were simply never referenced.
|
||||
// Separately, the HelmRelease minor-locking ranges (9 of 12, e.g. `>=88.0.0 <89.0.0` on
|
||||
// kube-prometheus-stack): THIS FILE USED TO SAY they cap Renovate at patches. They do not —
|
||||
// Renovate WIDENS the range (runs 353/354). The `range-widen` rule above keeps that a reviewed
|
||||
|
||||
@@ -112,10 +112,12 @@ A private repository with no `secretRef`, or an expired token. The message names
|
||||
### 4. The policy's range matches nothing
|
||||
`ImagePolicy` semver ranges come from each ServiceDefinition's `update.range` (for example
|
||||
`">=2024.0.0"` for pihole, `">=24.0.0"` for keycloak). A range that no published tag satisfies — or a
|
||||
repository that publishes only `latest` (this platform has `lscr.io/linuxserver/jackett:latest` and
|
||||
`plexinc/pms-docker:latest`) — leaves the policy with nothing to select. Remediation: fix the range in
|
||||
`catalog/<service>.yaml` and re-render; a `latest`-only image cannot participate in automation at all
|
||||
and should not carry a policy.
|
||||
repository that publishes only `latest` — leaves the policy with nothing to select. Remediation: fix
|
||||
the range in `catalog/<service>.yaml` and re-render; a `latest`-only image cannot participate in
|
||||
automation at all and should not carry a policy. (CORRECTED 2026-10-30: this page used to name
|
||||
`lscr.io/linuxserver/jackett` and `plexinc/pms-docker` as `latest`-only. Neither is — both publish
|
||||
immutable version tags (`v0.24.2865-ls7`, `1.43.4.10903-e5521bd8c`) — they were merely *deployed* as
|
||||
`:latest`. Both are now pinned to those tags and maintained by Renovate, not by an ImagePolicy.)
|
||||
|
||||
### 5. Egress is blocked for that namespace
|
||||
Default-deny everywhere (R-NET-01) means outbound registry access is an explicit allow. Cross-read
|
||||
|
||||
@@ -21,7 +21,8 @@ which is why this page exists: the loop is scripted and the reconcile is **force
|
||||
waited for. Measured end to end on 2026-09-29: **~2m45s**.
|
||||
|
||||
**An expired or wrong token does not break anything.** Verified against the image's own first-run
|
||||
script (and the copy inside `plexinc/pms-docker:latest`): a failed exchange gets a 403 with an empty
|
||||
script (and the copy inside the image then running as `plexinc/pms-docker:latest`; pinned to a version
|
||||
tag since 2026-10-30): a failed exchange gets a 403 with an empty
|
||||
body, `curl`'s status is never checked, the token `sed` yields empty, the `if` does not fire, there is
|
||||
no `else` and no `exit 1`, and the script (no `set -e`) exits 0. The pod comes up **unclaimed and
|
||||
serving**. So a burnt token costs you one more attempt, not an outage — and the repo deliberately
|
||||
@@ -186,4 +187,5 @@ When the claim does not take, in order of how often it is the answer here:
|
||||
Source of truth: `runbooks/plex-claim.md`. Index: `/runbooks/`
|
||||
Upstream behaviour cited here is from `plexinc/pms-docker` branch `master`,
|
||||
`root/etc/cont-init.d/40-plex-first-run` (s6-overlay v2), cross-checked against the same file inside
|
||||
the running `plexinc/pms-docker:latest` image.
|
||||
the image that was running at the time as `plexinc/pms-docker:latest` (the deployment has been pinned
|
||||
to a version tag, `catalog/plex.yaml` `source.image`, since 2026-10-30).
|
||||
@@ -371,8 +371,8 @@ verify".)
|
||||
2026-10-01, so this means a node changed — a rebuild, a BIOS reset, or a driver regression.
|
||||
**Fix the node.**
|
||||
|
||||
4. **The image changed under you.** See "The floating-image caveat". A `:latest` pull can remove the
|
||||
mechanism this feature leans on with no commit in this repo.
|
||||
4. **The image changed under you.** See "The image-version caveat". A pms-docker version bump (a
|
||||
Renovate PR, possibly auto-merged) can remove the mechanism this feature leans on.
|
||||
|
||||
5. **The session was never transcoding.** Direct Play / Direct Stream never reaches the transcoder,
|
||||
so no `hardware transcoding:` line is written for it at all. An *absent* line is this, not a
|
||||
@@ -446,17 +446,21 @@ revert you):
|
||||
Re-adding the field later is the same edit in reverse. Nothing about the Plex-side toggle or the
|
||||
`/config` PVC is affected either way — do **not** delete the PVC as part of this.
|
||||
|
||||
## The floating-image caveat
|
||||
## The image-version caveat
|
||||
|
||||
Everything this page states about the image's behaviour — the `cont-init.d` hook that adds the app
|
||||
user to the device's group, the absence of `PLEX_PREFERENCE*`, the six `setPref` keys, the
|
||||
`HardwareAcceleratedCodecs` string — was read from digest **`sha256:e0ab27395614…`**
|
||||
(`plexmediaserver 1.43.4.10903`).
|
||||
|
||||
The deployment runs **`plexinc/pms-docker:latest` with `imagePullPolicy: Always`**. A silent pull can
|
||||
therefore change the behaviour this feature depends on **with no commit in this repo**, while the
|
||||
manifest still looks identical. Symptom to watch for: hardware transcoding that worked and quietly
|
||||
stopped, with no git change to point at.
|
||||
**Since 2026-10-30 that digest is pinned:** `catalog/plex.yaml` names
|
||||
`plexinc/pms-docker:1.43.4.10903-e5521bd8c`, which resolved to exactly `sha256:e0ab27395614…` on
|
||||
Docker Hub. Before that the deployment ran the floating `:latest` (implicitly `imagePullPolicy:
|
||||
Always`), and a silent pull could change this behaviour with no commit in the repo. That is no longer
|
||||
the failure mode: the image now changes only through a **Renovate PR** bumping that tag (patch/minor
|
||||
ones auto-merge on a green gate, and the gate does not exercise QuickSync). So the symptom to watch
|
||||
for is hardware transcoding that quietly stopped **after a `chore(deps)` pms-docker bump** — check
|
||||
`git log -- catalog/plex.yaml` first.
|
||||
|
||||
```
|
||||
infra/devcontainer/dev.sh run bash -c \
|
||||
|
||||
Reference in new issue
Block a user