[Bug] self-update vs auto update (podman)?

[LeeNX]

What happened?
Self-update does not seem to be happening on my podman instances

Expected behavior
I was looking for a way to enable the self-update as the button in the webUI did not seem to be working, even thou I know I have the v1.50.0 on my host - both arm64/x64 hosts

Not sure why my traeifk labels are doing sh: docksentry.h.leenx.nz: not found

Going to bump them to v1.50.0 and monitor.

Logs

Telegram disabled (no BOT_TOKEN/CHAT_ID). Running headless.
Selfupdate helper started (docksentry_updater). Waiting for shutdown...
Shutting down...
History: patched selfupdate entry with new version v1.47.0
Scheduler started with schedule: 00 09 * * *
Web UI started on port 8080
Docksentry started.
Schedule: 00 09 * * *
Excluded: none
Auto selfupdate: OFF
Language: en
Telegram: OFF
Web UI: http://0.0.0.0:8080
Self-update recreate failed — helper output:
docksentry
sh: docksentry.h.leenx.nz: not found
invalid argument "RLIMIT_NOFILE=524288" for "--ulimit" flag: invalid ulimit type: RLIMIT_NOFILE

Usage:  docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

Run 'docker run --help' for more information
Selfupdate recreate failed — rolling back
docksentry

Telegram disabled (no BOT_TOKEN/CHAT_ID). Running headless.

Your setup

• Docksentry version: 1.47.0
• Podman version: 4.9.3 / 5.4.2
• OS: Ubuntu 24.04.4 / Debian 13.6
• Deployment: Podman Compose

[LeeNX]

I was trying to track down the options or possible the label to use to enable self-update, but got confused by the docs

Opt in to / out of auto-updates. =false keeps a container manual even with AUTO_UPDATE_ALL=true; =true opts it in without the per-container toggle

is this enabling self-update or would this be for all containers?

[amayer1983]

Your log has the whole story in it, and it's two separate things stacked on top of each other. Both fixed now — v1.51.0.

The one that actually bricked you is this line:

sh: docksentry.h.leenx.nz: not found

That's your Traefik router label. The rule value is Host(docksentry.h.leenx.nz) — with backticks. The self-update helper was building its docker run command and passing it through sh -c, and it quoted arguments with double quotes. Double quotes don't stop the shell from treating backticks as a command to run — so sh tried to execute docksentry.h.leenx.nz, failed, and the whole recreate fell over. Any container with a backtick (or a $) in a label or env value hit this, which means basically every Traefik user with the standard Host(...) syntax. v1.51.0 quotes properly now (single quotes, which the shell leaves completely alone).

The RLIMIT_NOFILE line right below it is the ulimit bug from #48 — I fixed that back in v1.47.4. It's still showing because you're stuck on v1.47.0, which brings me to the annoying part:

You can't self-update out of this, because self-update is the thing that's broken. Classic chicken-and-egg. So it needs one manual pull to break the loop. On each podman host:

podman rm -f docksentry_old 2>/dev/null   # clear any leftover from the failed rollbacks
podman-compose pull
podman-compose up -d

That lands you on v1.51.0, and from there /selfupdate (and the Web UI button) work normally again — both the backtick fix and the ulimit fix are in.

On your other question — the docs confusion is fair, the two "auto" things are genuinely different and the wording doesn't make that obvious:

• docksentry.auto (and AUTO_UPDATE_ALL) control auto-updating your other containers — should Docksentry pull+recreate them without you tapping "update".
• Self-update is Docksentry updating itself, and it's a separate switch: AUTO_SELFUPDATE=true for automatic, or the Web UI self-update button / /selfupdate for manual. There's no label for it.

So your instinct to reach for a label was reasonable, but self-update was never label-driven — and the reason the Web UI button "did nothing" was the same brick bug, not a missing setting. It should just work once you're on v1.51.0. Give it a go and let me know.

[LeeNX]

Thanks @amayer1983 , testing a change with my one host, changed the treafik backticks to single quote, see if that makes any difference.

For the self-update, I think the difference between self-update vs selfupdate defeated my quick search for a quick fix ( LOL ) . Might be worth adding the (self-update)on the end of the docs line inside the table, so search would find bothselfupdateandself-update``` for this option/explanation.

I was thinking that RLIMIT_NOFILE was breaking the update. I have to wait for CDN to catch-up to try out the v1.51.0.

I will close this in the next day or two, I am sure this has been fixed/addressed.

[amayer1983]

Good call on the search thing — done. The docs line now spells it both ways ("self-update / selfupdate") so a search for either hyphenation lands on it. It's in v1.52.0, which I just pushed (that release also has a couple of unrelated fixes an internal audit turned up, nothing you filed).

One heads-up on your Traefik experiment, though: changing the backticks to single quotes will probably upset Traefik itself. Its rule syntax specifically wants backticks — Host(docksentry.h.leenx.nz) — and single quotes aren't valid there, so Traefik may quietly refuse to route. Since v1.51.0 handles the backticks correctly on our side, you shouldn't need the workaround at all — keep the backticks and let the fix do its job. If you already flipped it and routing still works for you, great, but worth watching.

And yeah — RLIMIT_NOFILE was a real second problem, not a red herring; it would've failed the recreate too, just a line later. The backtick was simply the first thing to blow up. Both are fixed now (ulimit since v1.47.4, backticks since v1.51.0), so once the CDN catches up and you're on v1.51.0 or newer, /selfupdate should go clean.

No rush on closing — do it whenever you've seen it work on your end.

[LeeNX]

Nice to know about Traekfix, I don't remember seeing that when I was setting up, but easy enough to over look at spend hours trying to track down and fix.

I think I might have hit another podman corner case.

  → Up to date
  Checking: esp-config-designer (ghcr.io/sokolsok/esp-config-designer:edge)
  Local:  sha256:5a21ebe177f88fc788e99df..., sha256:60768522410d5cfe8218f87...
  Remote: sha256:5a21ebe177f88fc788e99df...
  → Up to date
Found 1 updates.
Selfupdate check: pulling ghcr.io/amayer1983/docksentry:latest (running sha256:e5f42a043e6b, created 2026-07-25)...
Selfupdate check: update found sha256:e5f42a043e6b -> sha256:1732e7118501 (2026-07-25 -> 2026-07-25) — starting selfupdate.
Selfupdate helper started (docksentry_updater). Waiting for shutdown...
Shutting down...
History: patched selfupdate entry with new version v1.50.0
Scheduler started with schedule: 00 09 * * *
Web UI started on port 8080
Docksentry started. (v1.50.0, debug OFF)
Schedule: 00 09 * * *
Excluded: none
Auto selfupdate: ON
Language: en
Telegram: OFF
Bot label: 🖥  cylon
Web UI: http://0.0.0.0:8080
Self-update recreate failed — helper output:
docksentry
sh: docksentry.c.leenx.nz: not found
docker: --pid: invalid PID mode

Run 'docker run --help' for more information
Selfupdate recreate failed — rolling back
docksentry

Telegram disabled (no BOT_TOKEN/CHAT_ID). Running headless.

This is my only host that is on v1.50.0 at the moment.

note

docker: --pid: invalid PID mode

[LeeNX]

I have rolled this host to revert the Treafik backtips change. I will keep an eye on this too.

[amayer1983]

Good catch — and thanks for closing #48. Your log has two things in it, one expected and one genuinely new:

• sh: docksentry.c.leenx.nz: not found — that's the Traefik backtick bug again, but expected here: this cylon host is still on v1.50.0, and the backtick fix only landed in v1.51.0. It'll be gone once this host is past that.
• docker: --pid: invalid PID mode — this one's new, and you found a real podman corner case. Podman reports a container's default PID (and UTS) namespace as "private", where Docker reports an empty string — and --pid private isn't a valid docker run value, so the recreate blew up. We were already skipping "private" for --ipc; PID and UTS had the same gap. Fixed in v1.53.0 (just released) — real values like host still carry through, only the bogus default is dropped.

Same chicken-and-egg as before: this host can't self-update out, because self-update is what's failing. One manual bump breaks the loop:

podman rm -f docksentry_old 2>/dev/null
podman-compose pull
podman-compose up -d

That lands it on v1.53.0 with all three podman fixes in (ulimit, backticks, and now the PID/UTS namespace), and /selfupdate should finally run clean on it.

And good call reverting the Traefik backtick edit — keep the backticks, v1.51.0+ handles them, and Traefik itself wants them that way anyway.