quay.io docker image not renovated

[geothechr]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab (renovatebot:39.160.1)

Please tell us more about your question or problem

Hello everyone!

I have a custom regex manager, in order to update docker image reference in a custom yaml file. The docker image is stored publicly in quay.io (quay.io/cilium/cilium).

As you can see in logs (attached):

1. we interact with our registry proxy, for checking new image versions in quay.io (and not directly to quay.io)
2. there is an error log: "Found no satisfying versions with 'docker' versioning", even though newer tags exist (i.e v1.16.5, v1.17.0)

Here comes the interesting part:

• if I try to change docker registry from quay.io to something else (i.e hub.docker.com), it will magically work and pull the new tags (renovated to v1.17.0 and correct sha hash)

Any ideas? Thanks!

Logs (if relevant)

Logs

The custom manager is the following:

"customManagers": [
      {
        "customType": "regex",
        "fileMatch": [
            "^file.yaml$"
        ],
        "matchStringsStrategy": "combination",
        "matchStrings": [
          "[\\s\\S]*- source:\\s*image:\\s*\"docker://(?<depName>[\\w\\-/\\.${}]+)\"",
          "[\\s\\S]*hash:\\s*\"(?<currentDigest>[\\w:]+)",
          "[\\s\\S]*tag:\\s*\"(?<currentValue>[\\w\\-\\.]+)\""
        ],
        "datasourceTemplate": "docker"
      }
    ]

The file.yaml (which renovate should update) has the following structure:

images:
  - source:
      image: "docker://PRIVATE-PROXY-REDACTED/quay.io/cilium/cilium"
      tag: "" #v1.16.4         <----- this line should be updated
      hash: "sha256:d55ec38938854133e06739b1af237932b9c4dd4e75e9b7b2ca3acc72540a44bf"     <----- this line should be updated
    destination:
      image: "docker://PRIVATE-REGISTRY-REDACTED/cilium/cilium"
      tag: "v1.16.4"       <----- this line should be updated

Logs from renovate-bot execution (debug):

DEBUG: getLabels(https://PRIVATE-PROXY-REDACTED/, quay.io/cilium/cilium, v1.14.19) (repository=REPOSITORY-REDACTED)
DEBUG: getManifestResponse(https://PRIVATE-PROXY-REDACTED/, quay.io/cilium/cilium, v1.14.19, get) (repository=REPOSITORY-REDACTED)
DEBUG: getManifestResponse(https://PRIVATE-PROXY-REDACTED/, quay.io/cilium/cilium, sha256:e699cd68bd44b3472a8ccd4ecec6355dfb630cd4f69c3f68d839d2c4c0ee3917, get) (repository=REPOSITORY-REDACTED)
DEBUG: found labels in manifest (repository=REPOSITORY-REDACTED)
       "labels": {"maintainer": "[email protected]"}
DEBUG: Found no satisfying versions with 'docker' versioning (repository=REPOSITORY-REDACTED)
DEBUG: getDigest(https://PRIVATE-PROXY-REDACTED/, quay.io/cilium/cilium, v1.16.4) (repository=REPOSITORY-REDACTED)
DEBUG: getManifestResponse(https://PRIVATE-PROXY-REDACTED/, quay.io/cilium/cilium, sha256:d55ec38938854133e06739b1af237932b9c4dd4e75e9b7b2ca3acc72540a44bf, head) (repository=REPOSITORY-REDACTED)
DEBUG: getManifestResponse(https://PRIVATE-PROXY-REDACTED/, quay.io/cilium/cilium, v1.16.4, head) (repository=REPOSITORY-REDACTED)

"regex": [
           {
             "deps": [
               {
                 "depName": "PRIVATE-PROXY-REDACTED/quay.io/cilium/cilium",
                 "currentValue": "v1.16.4",
                 "currentDigest": "sha256:d55ec38938854133e06739b1af237932b9c4dd4e75e9b7b2ca3acc72540a44bf",
                 "datasource": "docker",
                 "replaceString": "REDACTED",
                 "updates": [],
                 "packageName": "PRIVATE-PROXY-REDACTED/quay.io/cilium/cilium",
                 "versioning": "docker",
                 "warnings": [],
                 "registryUrl": "https://PRIVATE-PROXY-REDACTED/",
                 "lookupName": "quay.io/cilium/cilium",
                 "currentVersion": "v1.16.4",
                 "fixedVersion": "v1.16.4"
               }
             ],
             "matchStrings": [
               "[\\s\\S]*- source:\\s*image:\\s*\"docker://(?<depName>[\\w\\-/\\.${}]+)\"",
               "[\\s\\S]*hash:\\s*\"(?<currentDigest>[\\w:]+)",
               "[\\s\\S]*tag:\\s*\"(?<currentValue>[\\w\\-\\.]+)\""
             ],
             "matchStringsStrategy": "combination",
             "datasourceTemplate": "docker",
             "packageFile": "file.yaml"
           }
         ]
       }

[rarkins]

Your proxy probably does not return a full list of tags. They often are designed to only return the tags they have cached, so they are not suitable for using with Renovate.

[geothechr]

@rarkins thanks for your reply!

In this case, proxy has cached v1.16.5 and v1.16.6 (I pulled them through proxy manually, so they are also available there), but renovate does not update to any of those 2 tags.

Additionally, it works with proxy but with another public registry (PROXY-REDACTED/hub.docker.com/cilium/cilium).

At the same time, if I remove proxy and directly refer to quay.io/cilium/cilium, tag is renovated and updated to latest one.

I saw some issues with proxy & quay.io & renovate here, could it be somehow related?

[rarkins]

Maybe. Unfortunately this is pretty hard for us to guess without a reproduction to debug

[geothechr]

Yep, I agree, not easy to guess - I am not sure how I can help here (since registry proxy is company internal one).
I can say it is Artifactory JFrog proxy (JFrog Platform Enterprise Plus 7.98.10) - can it help somehow?

Or, what other information (or debug lines) could be useful from my side?

[github-actions[bot]]

Hi there,

The maintainers have labeled this discussion as a use case specific to "enterprise" users. Enterprise users typically self-host Renovate and have advanced requirements like custom certificates, HTTP proxies, private registries, air gapping, etc.

Such cases usually need a lot of back-and-forth to resolve, because the problem is related to the user's environment. Usually the user's environment can not be reproduced publicly, which means that maintainer debugging is not possible.

The maintainers decided their time is best spent on issues that help large numbers of users. This means enterprise-specific issues affecting one user (or a small number of users), are not a priority. If we can help you quickly, we will. But if you see this message, then a maintainer believes this is not a quick fix. The maintainers will not actively work on this issue, unless new information is found.

If you are an enterprise user, please consider the following options:

• Troubleshoot and contribute a fix yourself, or
• Hire a consultant to help you, or
• Consider an Enterprise support contract from Mend.io, or
• Wait for a community member to help you, if they have the same problem

If you choose to wait, then this discussion can remain open indefinitely. But please be patient, do not nudge or bump this discussion just to get attention.

Thanks, the Renovate team