Updating oci-container images?

Help
1

I recently migrated a bunch of docker services onto NixOS as declarative oci-containers (podman backend). Everything works well, and podman pulled the latest images for each one on the first startup.

Now it’s been a couple weeks, and I know some of those images have updates. Is there a way to get all of them to update again? The NixOS configuration specifies the “latest” tag for each, but a nixos-rebuild doesn’t do anything here.

Do I need to deal directly with podman and update each image individually? Or is there a way to get all containers to rebuild on the latest images again?

1 Like
2

I’m pretty new to Nix, but I migrated my ansible playbooks and a couple of scripts for managing/updating my containers for everything but the setup of the service in the NixOS configuration.

You could probably setup a simple systemd service to podman pull each image and restart periodically using Nix if you’re not too concerned about automatically updating latest containers. I prefer a bit more control to prevent inadvertent breakage due to an update…

3

Thanks! This is what I ended up doing, creating a systemd service/timer to periodically pull the latest image for each container.

My confusion came from the fact that I was able to specify the creation of the containers via virtualisation.oci-containers in the NixOS config, but couldn’t update them from the same source. But, in the end, pulling new images and restarting the services isn’t a big deal.

4

@nairou I don’t suppose you’d have that systemd service definition handy would you?

5

Sure. I ended up breaking it out as a script I could run manually if I want to, and then a service to run that.

Script:

update-containers = pkgs.writeShellScriptBin "update-containers" ''
	SUDO=""
	if [[ $(id -u) -ne 0 ]]; then
		SUDO="sudo"
	fi

    images=$($SUDO ${pkgs.podman}/bin/podman ps -a --format="{{.Image}}" | sort -u)

    for image in $images
    do
      $SUDO ${pkgs.podman}/bin/podman pull $image
    done
'';

Systemd timer/service definitions:

systemd.timers = {
  # ...
  updatecontainers = {
    timerConfig = {
      Unit = "updatecontainers.service";
      OnCalendar = "Mon 02:00";
    };
    wantedBy = [ "timers.target" ];
  };
  # ...
};

systemd.services = {
  # ...
  updatecontainers = {
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "update-containers";
    };
  };
  # ...
};
6 Likes
6

What if I want to do the opposite, and pin a specific container image? You know, for reproducibility.

Is that the default behavior? Why can’t I specify a hash in the config?

7

Consider quadlet (and specifically quadlet-nix) in this case. With quadlet-nix, you get quadlet (an excellent systemd integration for podman) to manage the container plus you can declare the components to make it work. Which includes “pinning” (or rather, declarting) the version of the container.

1 Like
8

How do I put the script in my configuration?