deploy: build: images never rebuilt on FROM or Dockerfile changes #288

New issue

Closed

opened 2026-09-19 22:43:59 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-09-19 22:43:59 -04:00

Owner

just deploy runs up -d --force-recreate and keys on */compose.yml changes only. A build: image is never rebuilt by it: a Renovate bump of a FROM digest, or an edit to a Dockerfile, its requirements.txt or copied sources, changes nothing live until someone runs a build by hand. Four images are affected — _helper/config-renderer (five init containers), dagu/tools, media/metadata, _helper/knock (two long-running services).

The image scan (#287) shows the cost: dagu-tools carries a fixable HIGH in its Alpine layer and metadata carried 3 fixable CRITICAL / 42 HIGH across its Debian and Python layers, none of which a merge can currently fix.

Wanted: deploy.py treats a change under a service's build context (Dockerfile and everything it copies) as a change to that stack and recreates it with --build; a FROM digest bump alone must be enough to trigger it, since that is what Renovate produces. Rebuilds should not run for stacks with no build context change.

`just deploy` runs `up -d --force-recreate` and keys on `*/compose.yml` changes only. A `build:` image is never rebuilt by it: a Renovate bump of a `FROM` digest, or an edit to a Dockerfile, its requirements.txt or copied sources, changes nothing live until someone runs a build by hand. Four images are affected — `_helper/config-renderer` (five init containers), `dagu/tools`, `media/metadata`, `_helper/knock` (two long-running services). The image scan (#287) shows the cost: dagu-tools carries a fixable HIGH in its Alpine layer and metadata carried 3 fixable CRITICAL / 42 HIGH across its Debian and Python layers, none of which a merge can currently fix. Wanted: `deploy.py` treats a change under a service's build context (Dockerfile and everything it copies) as a change to that stack and recreates it with `--build`; a `FROM` digest bump alone must be enough to trigger it, since that is what Renovate produces. Rebuilds should not run for stacks with no build context change.

mysticalsoap added the

bug

label

2026-09-19 22:43:59 -04:00

mysticalsoap referenced this issue from a pull request that will close it,

2026-09-19 22:48:11 -04:00

deploy: rebuild build: images when their inputs change #290

mysticalsoap closed this issue

2026-09-19 23:17:10 -04:00