New out of date image indicators feature in 2.14.0 BE may be confusing.

[philclifford]

I like this new feature, but could not find documentation other than what is in the New Features section so had to guess the detailed intent and what it was trying to tell me (and what data it was using)
Bug description
Apparently shows red for any newer repository image regardless of tag. Some repositories may have "newer" (later, higher tag ... ) images that I would not regard as significant or appropriate to flag my running container as outdated. This might be beta/dev/test versions or it might be just a different tag (if I have pinned a version/tag for example)

Expected behaviour
I would expect to show red for only where a newer image existed for the running image's tag. For example if my container is running the locally-pulled haproxy:latest I would expect that to be green. If a newer image tagged latest exists on docker hub I'd expect a red flag, and if I've already pulled a local copy of haproxy:latest but am running an outdated version (which the pull will have untagged and probably shows with an ID pseudo-tag in the dashboard) I would expect that to be flagged amber, indicating I need to re-create/update without needing to pull.

I would expect the user documentation to explain (or link to a technical explanation of) the intended meaning of the new traffic lights/states, how they derive their state, what might be the recommended "path to green" in various scenarios (and maybe the UI could make the traffic light separately clickable (or carry it/the state through to the detail view when the column is clicked) leading to the appropriate step (e.g. re-create container with the pull toggle appropriately pre-set).

Of course this is all speculative guesswork tinged with my prejudices and habits so apologies if I'm completely misguided here.
Many thanks.

Steps to reproduce the issue:

pull and run haproxy:latest and haproxy:2.7-dev, haproxy:latest will be marked red, the dev one green.

Technical details:

• Portainer version: 2.14.0 BE
• Docker version (managed by Portainer): 20.10.17

Server: Docker Engine - Community
 Engine:
  Version:          20.10.17
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.17.11
  Git commit:       a89b842
  Built:            Mon Jun  6 23:01:15 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.6
  GitCommit:        10c12954828e7c7c9b6e0ea9b0c02b01407d3ae1
 runc:
  Version:          1.1.2
  GitCommit:        v1.1.2-0-ga916309
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

• Platform (windows/linux): linux (Ubuntu Mate 21.10)
• Command used to start Portainer : docker run -d -p 8000:8000 -p 9000:9000 -p 9443:9443 --name=portainer --restart=always --pull=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ee:latest
• Browser: chrome
• Use Case (delete as appropriate): Using Portainer at Home
• Have you reviewed our technical documentation and knowledge base? Yes and No

[jamescarppe]

We've just pushed an update to the documentation which is the first step towards clarifying how this works further, and I'm currently gathering some more technical background information on the functionality which I'll add as well once I have it. Essentially:

The circle next to the image name indicates whether the local image is up to date, with a green circle indicating it is up to date and a red circle indicating that there is a newer version of the image available at the remote registry. A grey circle indicates Portainer was unable to determine whether there is an update available for the image.

It is worth noting that image update notifications are currently not supported for private registries and private DockerHub accounts. This is due to be fixed in our next version.

[jamescarppe]

@philclifford

I've just been doing some testing and I'm not able to replicate what you've indicated with the haproxy images - if I deploy a haproxy:latest and a haproxy:2.7-dev container they both show as up to date for me.

In terms of how it all works:

• Portainer looks at the local digest of the image and compares it to the remote digest of the image. If the digests differ, then we assume a new version is available. This check is done on page refresh (with a bit of caching to not hamper performance).
• The new version is based on the image and tag, not just the image.
• If a local copy of the image and tag already exists but hasn't been deployed, the circle will display as grey and the image name will change to the hash. This is partially due to how Docker itself works (you'd see the same "hash as the image name" behavior when doing docker ps), but we're discussing ways that we might be able to make this more user-friendly in the future.

I'll be bringing this detail over into the documentation soon, but I wanted to reply to you directly here as well.

[philclifford]

I've just been doing some testing and I'm not able to replicate what you've indicated with the haproxy images - if I deploy a haproxy:latest and a haproxy:2.7-dev container they both show as up to date for me.

Curious...

phil@home:~$ docker image inspect haproxy:latest
[
    {
        "Id": "sha256:73db7e0cd7cf3d2b4ef5c72ec88d2247f86874e71bd31078aca8cb5e9c348a43",
        "RepoTags": [
            "haproxy:latest"
        ],

phil@home:~$ docker pull haproxy@sha256:b9cf7aacc36beb88fe227792f1a914fad8e850b04c46f8793bf76068a98a0498
docker.io/library/haproxy@sha256:b9cf7aacc36beb88fe227792f1a914fad8e850b04c46f8793bf76068a98a0498: Pulling from library/haproxy
Digest: sha256:b9cf7aacc36beb88fe227792f1a914fad8e850b04c46f8793bf76068a98a0498
Status: Downloaded newer image for haproxy@sha256:b9cf7aacc36beb88fe227792f1a914fad8e850b04c46f8793bf76068a98a0498
docker.io/library/haproxy@sha256:b9cf7aacc36beb88fe227792f1a914fad8e850b04c46f8793bf76068a98a0498
phil@home:~$ docker image list haproxy
REPOSITORY   TAG       IMAGE ID       CREATED      SIZE
haproxy      2.7-dev   5bc8d3a5ae09   2 days ago   106MB
haproxy      latest    73db7e0cd7cf   6 days ago   102MB
(base) phil@daytripper:~$ docker pull haproxy:latest
latest: Pulling from library/haproxy
Digest: sha256:c0c9ce3a829469382c4bc3f5e464e716f4362fb9df95ba7890f0de2d75e5e402
Status: Image is up to date for haproxy:latest
docker.io/library/haproxy:latest

and yet the running one shows red and portainer sees it as
haproxy:latest@sha256:73db7e0cd7cf3d2b4ef5c72ec88d2247f86874e71bd31078aca8cb5e9c348a43
which aligns (at this moment) with docker hub

Image ID: sha256:73db7e0cd7cf3d2b4ef5c72ec88d2247f86874e71bd31078aca8cb5e9c348a43
Created: 2022-06-23T03:18:05.39175577Z
Virtual Size: ~ 101.81 Mb
(total size of all layers on-disk)
Arch: linux/amd64

Yes I stopped , removed, re-pulled and recreated (via docker-compose)...
I'm confused and also baffled as to why I'm not seeing what you are seeing.

[philclifford]

@jamescarppe
Thanks for the clear and full response. And for anticipating and fulfilling everything I could wish for in this feature.

I'll be bringing this detail over into the documentation soon, but I wanted to reply to you directly here as well.
Thanks, much appreciated.

If you feel it worth pursuing why I'm still "seeing red" and want any more info from my end I'll gladly oblige if I can. If you prefer to close this as "can't repro" ("user/environmental anomaly" 🤔 ) I'd be fine with that too, though maybe leaving this open for a while in case it isn't "just me" would be best.
Thanks again.

[jamescarppe]

@philclifford

If you do a docker image inspect haproxy:latest and look for the RepoDigests section, what do you have in there? I only have the one digest, and I suspect you might have two (especially if you've had previous versions of that image locally), with the first one being an older digest.

We currently only compare the first local digest with the remote - if this happens to be an older digest compared to the remote repo then it might explain why you're receiving a false "out of date" notification. We're discussing internally as to how we should handle multiple digests in this feature.

[philclifford]

I do indeed have two. Afk at the moment, but I remember clearly noticing two on inspection. I'd guess not too difficult to match "any one", but no doubt it is more tricky. Hope you find a neat solution. update: I actually have 3 now for haproxy:latest ``` "RepoDigests": [ "haproxy@sha256:b9cf7aacc36beb88fe227792f1a914fad8e850b04c46f8793bf76068a98a0498", "haproxy@sha256:bc68ce87bd98293aabcbc8148e5ca2fa87cf9034c8414e2ec221faf6597670cb", "haproxy@sha256:c0c9ce3a829469382c4bc3f5e464e716f4362fb9df95ba7890f0de2d75e5e402" ], ```

[jamescarppe]

A quick update here: I've opened an internal issue around the multiple digests issue, and we'll be working towards a fix for it.

[FAFDK]

Have the same issue. Is this why I get false 'out-of-date' notifications?

"Id": "sha256:c964652246a632c0fdc9fb5f47a30fda3932ffe134c2b1be653ad9a7a62de7c8", "RepoTags": [ "ghost:latest" ], "RepoDigests": [ "ghost@sha256:03975265161984245714eb3b441f1120649117a020626f02b8f679021eb95bf2", "ghost@sha256:c2483a9d9d96267d84fb2f88d84c34c60fe7c6b0d5889dec6215501b2935ed44" ],

[veeroohre]

Although issue #7371 is closed, I still have the problem mentioned here in version 2.16.2.

Any updates?

[jamescarppe]

We made some changes around this in 2.17.0 - are you able to test and confirm whether this version resolved your issues?

[philclifford]

We made some changes around this in 2.17.0 - are you able to test and confirm whether this version resolved your issues?

I'm no longer seeing red when up-to-date, but I don't have any images with multiple digests at the moment, thus I can't really test or confirm. Hopefully @veeroohre can.

[veeroohre]

Hi I can confirm it is fixed now (at least for me). No more red dots on my alpine/arm containers. Thank you for fixing! Am Fr., 17. Feb. 2023 um 04:40 Uhr schrieb Phil Clifford < ***@***.***>:

…

We made some changes around this in 2.17.0 - are you able to test and confirm whether this version resolved your issues? I'm no longer seeing red when up-to-date, but I don't have any images with multiple digests at the moment, thus I can't really test or confirm. Hopefully @veeroohre <https://github.com/veeroohre> can. — Reply to this email directly, view it on GitHub <#7148 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACDMBOCFUJZ7JRYD5RACQNTWX3XJDANCNFSM52D6WC3A> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[philclifford]

Thanks indeed!

[philclifford]

@jamescarppe it looks like it is not "completely fixed":

Today I spotted haproxy still showing red after updating via docker-compose. I checked for two digests and have:

 "RepoDigests": [
            "haproxy@sha256:1e70fc55d4ef104eb2c3e590b8be1445c8a5ac6c42dddcffcb9599683a763c94",
            "haproxy@sha256:d84e73186148c503bf6c9a509e438075ced1521982c9b4fa27137637ab235f84"
        ],

This is with EE 2.17.1 - just updating because portainer is also red, one moment ...

Using default tag: latest
latest: Pulling from portainer/portainer-ee
772227786281: Already exists 
96fd13befc87: Already exists 
c853cc68f7bc: Pull complete 
Digest: sha256:ed20d871670c080cf334e85ba99da3eb4544013e17300b19718013870a97c23a
Status: Downloaded newer image for portainer/portainer-ee:latest
docker.io/portainer/portainer-ee:latest
portainer
portainer
latest: Pulling from portainer/portainer-ee
Digest: sha256:ed20d871670c080cf334e85ba99da3eb4544013e17300b19718013870a97c23a
Status: Image is up to date for portainer/portainer-ee:latest
a864794b2c65cc3a50e53d8a23c3d11457536f8fe008db7fa8bb8b9771282135

So removing and re-creating portainer has cleared the red indicator for both haproxy and portainer-ee (still 2.17.1) (Sorry I didn't grab docker image inspect of portainer before my pull and re-create! - it currently only shows one RepoDigest for portainer/portainer-ee though)

[EHRETic]

Hi there,

Today I noticed that a bunch of my containers were running an outdated version when indicator icon was green on all.
I've most of my apps running 2 instances, a test one with "latest" tag and another with named version to avoid any update issue.

I'm running Portainer 2.18.4 and I'm pretty sure this was running fine with 2.18.3.

I don't think anything in my environnement could "mislead" the versioning but the only thing I remember changing is going from the anonymous Docker registry to a "signed-up" one (also Docker.io)

Is there anything I can check on my end to see if it's related to the upgrade or the registry change? maybe something else?

Thanks in advance & kind regards
Franck

PS: I hope this is the right thread for it... just let me know if I need to move my post 😉