feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them #94

2026-10-31T15:38:24Z

gitea-admin commented

2026-10-31 15:38:24 +00:00

Pins three floating images to the exact digests already running. Renovate can now maintain them.

image	was	now	live digest = tag digest
pihole	`pihole/pihole` (no tag)	`pihole/pihole:2026.10.0`	`sha256:d34134716fc3…` (both replicas)
jackett	`lscr.io/linuxserver/jackett:latest`	`…:v0.24.2865-ls7`	`sha256:4fcf3cc22dd3…`
plex	`plexinc/pms-docker:latest`	`…:1.43.4.10903-e5521bd8c`	`sha256:e0ab27395614…`

Each digest was read from the pod's imageID and matched against an anonymous registry HEAD. latest has already moved for plex (6d778d41…) and for jackett (ee6ae915…), so a restart would have changed versions with no commit.

The image is unchanged, but the merge is not restart-free. The pod-template image string changes, so Flux rolls plex and jackett (Recreate, which means a brief outage) and pihole (a 2-replica StatefulSet, one pod at a time).

Renovate

jackett and plex get regex versioning. pihole needs no rule: CalVer auto-merges patches and minors, as the operator chose, and a year rollover counts as a major, which needs dashboard approval.
jackett is looked up on ghcr.io (overridePackageName). On lscr.io Renovate reads only dockerMaxPages=20 tag pages, but jackett has 32,093 tags and the running one is #31,980. Without the override the dry run proposed nothing and gave no warning.
jackett is weekly (Sunday window): 13 ls builds in 12 days, each one an auto-merge patch.
No allowedVersions mirror is needed. None of the three catalog ranges has a ceiling.

Dry run (44.167.0, local platform). Flags come from Renovate's own applyPackageRules:

plex 1.43.4.10903-e5521bd8c -> 1.43.5.11079-b3b13e506: patch, automerge true, daily window
jackett v0.24.2865-ls7 -> v0.24.2961-ls20: patch, automerge true, Sunday window
pihole: no update (2026.10.0 is the newest). With synthetic updates, patch and minor get automerge true; 2027.x gets automerge false and dashboard approval

The stale "publishes only latest" prose is fixed in renovate.json5 and in three runbooks.

Gate

Toolbox ci/gate.sh returned rc 3. The only stage that did not run was gitea-settings. spec-immutability, approval-policy, decisions-log, lint, l0, render-golden and l1 were green. L2/L3 is not run. No touched path is in approval-policy.json sensitive_paths.

Handoff: decisions/2026-10-30-pin-pihole-jackett-plex.md.

🤖 Generated with Claude Code

Pins three floating images to the **exact digests already running**. Renovate can now maintain them. | image | was | now | live digest = tag digest | |---|---|---|---| | pihole | `pihole/pihole` (no tag) | `pihole/pihole:2026.10.0` | `sha256:d34134716fc3…` (both replicas) | | jackett | `lscr.io/linuxserver/jackett:latest` | `…:v0.24.2865-ls7` | `sha256:4fcf3cc22dd3…` | | plex | `plexinc/pms-docker:latest` | `…:1.43.4.10903-e5521bd8c` | `sha256:e0ab27395614…` | Each digest was read from the pod's `imageID` and matched against an anonymous registry HEAD. `latest` has already moved for plex (`6d778d41…`) and for jackett (`ee6ae915…`), so a restart would have changed versions with no commit. **The image is unchanged, but the merge is not restart-free.** The pod-template `image` string changes, so Flux rolls plex and jackett (Recreate, which means a brief outage) and pihole (a 2-replica StatefulSet, one pod at a time). ### Renovate - jackett and plex get regex versioning. pihole needs no rule: CalVer auto-merges patches and minors, as the operator chose, and a year rollover counts as a major, which needs dashboard approval. - **jackett is looked up on ghcr.io** (`overridePackageName`). On lscr.io Renovate reads only `dockerMaxPages`=20 tag pages, but jackett has 32,093 tags and the running one is #31,980. Without the override the dry run proposed **nothing** and gave no warning. - jackett is weekly (Sunday window): 13 ls builds in 12 days, each one an auto-merge patch. - No `allowedVersions` mirror is needed. None of the three catalog ranges has a ceiling. Dry run (44.167.0, local platform). Flags come from Renovate's own `applyPackageRules`: - plex `1.43.4.10903-e5521bd8c` -> `1.43.5.11079-b3b13e506`: patch, automerge **true**, daily window - jackett `v0.24.2865-ls7` -> `v0.24.2961-ls20`: patch, automerge **true**, Sunday window - pihole: no update (2026.10.0 is the newest). With synthetic updates, patch and minor get automerge true; `2027.x` gets automerge false and dashboard approval The stale "publishes only `latest`" prose is fixed in `renovate.json5` and in three runbooks. ### Gate Toolbox `ci/gate.sh` returned **rc 3**. The only stage that did not run was `gitea-settings`. spec-immutability, approval-policy, decisions-log, lint, l0, render-golden and l1 were green. L2/L3 is not run. No touched path is in `approval-policy.json` `sensitive_paths`. Handoff: `decisions/2026-10-30-pin-pihole-jackett-plex.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-10-31 15:38:24 +00:00

feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them

gate / gate (pull_request) Successful in 2m57s

Details

gate / conformance (pull_request) Has been skipped

Details

183bca6897

pihole/pihole (no tag)               -> 2026.10.0               sha256:d3413471...
lscr.io/linuxserver/jackett:latest   -> v0.24.2865-ls7          sha256:4fcf3cc2...
plexinc/pms-docker:latest            -> 1.43.4.10903-e5521bd8c  sha256:e0ab2739...

Each tag was resolved against its registry and matched the pods' imageID, so the image is
unchanged (the pod template string does change, so Flux rolls the three workloads).

renovate.json5: regex versioning for jackett (-lsN) and plex (build-hex); jackett is looked
up on ghcr.io via overridePackageName, because lscr.io is capped at dockerMaxPages=20 pages
and jackett's 32k tags put the running one at #31,980 (dry run proposed nothing without it);
jackett weekly (13 builds in 12 days); pihole deliberately unheld, year rollover = major.
Stale "publishes only latest" prose fixed in renovate.json5 and three runbooks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jakman85 merged commit f0760d1024 into main

2026-10-31 15:45:17 +00:00

jakman85 referenced this issue from a commit

2026-10-31 15:45:20 +00:00

Merge pull request 'feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them' (#94) from feat/pin-pihole-jackett-plex into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#94