Update Alpine version in images with alpine variant

[mschoettle]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab (latest)

Please tell us more about your question or problem

We have a few dependencies to alpine-based images and we would like to receive updates for that part of the dependency as well.

For example:

• python:3.11.9-alpine3.19 --> python:3.11.9-alpine3.20
• node:2.14.0-alpine3.19 --> node:2.14.0-alpine3.20

I have seen a prior discussion in #22836 about this and tried what was tested there.

So right now I have tried the following:

"regexManagers": [
    {
      "description": "Manage Alpine OS versions in container image tags",
      "fileMatch": ["\\.gitlab-ci\\.yml$", "Dockerfile"],
      "matchStrings": [
        "(?:image:\\s+name:\\s*|image:\\s*|services:\\s+-\\s+|FROM\\s+)(?<depName>[\\S]+):(?<currentValue>[\\S]+)"
      ],
      "versioningTemplate": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
      "datasourceTemplate": "docker"
    }
  ],

Based on the dependency dashboard, the dependency is detected and listed under the additional regex entry. Unfortunately, the update does not work.

Based on the logs below, is the problem that the current version is still detected as the node version?

Logs (if relevant)

Logs

DEBUG: packageFiles with updates (repository=mschoettle/renovate-playground, baseBranch=main)
[...]
         "dockerfile": [
           {
             "deps": [
               {
                 "depName": "node",
                 "currentValue": "20.14.0-alpine3.19",
                 "replaceString": "node:20.14.0-alpine3.19",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "depType": "stage",
                 "updates": [],
                 "packageName": "node",
                 "versioning": "node",
                 "warnings": [],
                 "sourceUrl": "https://github.com/nodejs/node",
                 "registryUrl": "https://index.docker.io",
                 "lookupName": "library/node",
                 "currentVersion": "20.14.0",
                 "fixedVersion": "20.14.0"
               },
               {
                 "depName": "node",
                 "currentValue": "20.14.0-alpine3.19",
                 "replaceString": "node:20.14.0-alpine3.19",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "depType": "final",
                 "updates": [],
                 "packageName": "node",
                 "versioning": "node",
                 "warnings": [],
                 "sourceUrl": "https://github.com/nodejs/node",
                 "registryUrl": "https://index.docker.io",
                 "lookupName": "library/node",
                 "currentVersion": "20.14.0",
                 "fixedVersion": "20.14.0"
               }
             ],
             "packageFile": "Dockerfile"
           }
         ],
[...]
        "regex": [
           {
             "deps": [
               {
                 "depName": "node",
                 "currentValue": "20.14.0-alpine3.19",
                 "datasource": "docker",
                 "versioning": "node",
                 "replaceString": "image: node:20.14.0-alpine3.19",
                 "updates": [],
                 "packageName": "node",
                 "warnings": [],
                 "sourceUrl": "https://github.com/nodejs/node",
                 "registryUrl": "https://index.docker.io",
                 "lookupName": "library/node",
                 "currentVersion": "20.14.0",
                 "fixedVersion": "20.14.0"
               }
             ],
             "matchStrings": [
               "(?:image:\\s+name:\\s*|image:\\s*|services:\\s+-\\s+|FROM\\s+)(?<depName>[\\S]+):(?<currentValue>[\\S]+)"
             ],
             "datasourceTemplate": "docker",
             "versioningTemplate": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
             "packageFile": ".gitlab-ci.yml"
           },
           {
             "deps": [
               {
                 "depName": "node",
                 "currentValue": "20.14.0-alpine3.19",
                 "datasource": "docker",
                 "versioning": "node",
                 "replaceString": "FROM node:20.14.0-alpine3.19",
                 "updates": [],
                 "packageName": "node",
                 "warnings": [],
                 "sourceUrl": "https://github.com/nodejs/node",
                 "registryUrl": "https://index.docker.io",
                 "lookupName": "library/node",
                 "currentVersion": "20.14.0",
                 "fixedVersion": "20.14.0"
               },
               {
                 "depName": "node",
                 "currentValue": "20.14.0-alpine3.19",
                 "datasource": "docker",
                 "versioning": "node",
                 "replaceString": "FROM node:20.14.0-alpine3.19",
                 "updates": [],
                 "packageName": "node",
                 "warnings": [],
                 "sourceUrl": "https://github.com/nodejs/node",
                 "registryUrl": "https://index.docker.io",
                 "lookupName": "library/node",
                 "currentVersion": "20.14.0",
                 "fixedVersion": "20.14.0"
               }
             ],
             "matchStrings": [
               "(?:image:\\s+name:\\s*|image:\\s*|services:\\s+-\\s+|FROM\\s+)(?<depName>[\\S]+):(?<currentValue>[\\S]+)"
             ],
             "datasourceTemplate": "docker",
             "versioningTemplate": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
             "packageFile": "Dockerfile"
           }
         ]

/cc @aarongoldenthal

[HonkingGoose]

Issue #27012 mentions making Renovate smarter about tags like 24.0.7-dind-alpine3.18, maybe having that feature would help here as well?

[mschoettle]

Thanks for the reference. Based on my understanding I think it would help as well. At least I think it should be able to handle these cases.

[aarongoldenthal]

The preset that I use is here, and it recently triggered Alpine 3.20 updates, so I dug in a little since it was working for me. I didn't have any Node examples specifically, so I included the one above, plus a python and go example that this had worked for.

It looks like the versioning for the node docker dependency is being overridden by config:recommended (which I assume is being used). It includes workarounds:all, which includes workarounds:nodeDockerVersioning. This includes a packageRules that sets "versioning": "node".

Just to confirm, I ran with config:recommended and you can see the go and python images are as expected, but the node versioning is being reset:

{
    "deps": [
        {
            "depName": "golang",
            "currentValue": "1.22.3-alpine3.19",
            "datasource": "docker",
            "versioning": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
            "replaceString": "image: golang:1.22.3-alpine3.19",
            "updates": [
                {
                    "bucket": "non-major",
                    "newVersion": "1.22.3-alpine3.20",
                    "newValue": "1.22.3-alpine3.20",
                    "newMajor": 3,
                    "newMinor": 20,
                    "newPatch": 0,
                    "updateType": "minor",
                    "branchName": "renovate/golang-3.x"
                }
            ],
            "packageName": "golang",
            "warnings": [],
            "registryUrl": "https://index.docker.io",
            "lookupName": "library/golang",
            "currentVersion": "1.22.3-alpine3.19",
            "isSingleVersion": true,
            "fixedVersion": "1.22.3-alpine3.19"
        },
        {
            "depName": "python",
            "currentValue": "3.12.3-alpine3.19",
            "datasource": "docker",
            "versioning": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
            "replaceString": "image: python:3.12.3-alpine3.19",
            "updates": [
                {
                    "bucket": "non-major",
                    "newVersion": "3.12.3-alpine3.20",
                    "newValue": "3.12.3-alpine3.20",
                    "newMajor": 3,
                    "newMinor": 20,
                    "newPatch": 0,
                    "updateType": "minor",
                    "branchName": "renovate/python-3.x"
                }
            ],
            "packageName": "python",
            "warnings": [],
            "registryUrl": "https://index.docker.io",
            "lookupName": "library/python",
            "currentVersion": "3.12.3-alpine3.19",
            "isSingleVersion": true,
            "fixedVersion": "3.12.3-alpine3.19"
        },
        {
            "depName": "node",
            "currentValue": "20.14.0-alpine3.19",
            "datasource": "docker",
            "versioning": "node",
            "replaceString": "image: node:20.14.0-alpine3.19",
            "updates": [],
            "packageName": "node",
            "warnings": [],
            "sourceUrl": "https://github.com/nodejs/node",
            "registryUrl": "https://index.docker.io",
            "lookupName": "library/node",
            "currentVersion": "20.14.0",
            "fixedVersion": "20.14.0"
        }
    ],

Without it, everything is as expected:

{
    "deps": [
        {
            "depName": "node",
            "currentValue": "20.14.0-alpine3.19",
            "datasource": "docker",
            "versioning": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
            "replaceString": "FROM node:20.14.0-alpine3.19",
            "updates": [
                {
                    "bucket": "non-major",
                    "newVersion": "20.14.0-alpine3.20",
                    "newValue": "20.14.0-alpine3.20",
                    "newMajor": 3,
                    "newMinor": 20,
                    "newPatch": 0,
                    "updateType": "minor",
                    "branchName": "renovate/node-3.x"
                }
            ],
            "packageName": "node",
            "warnings": [],
            "sourceUrl": "https://github.com/nodejs/node",
            "registryUrl": "https://index.docker.io",
            "lookupName": "library/node",
            "currentVersion": "20.14.0-alpine3.19",
            "isSingleVersion": true,
            "fixedVersion": "20.14.0-alpine3.19"
        },
        {
            "depName": "golang",
            "currentValue": "1.22.3-alpine3.19",
            "datasource": "docker",
            "versioning": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
            "replaceString": "FROM golang:1.22.3-alpine3.19",
            "updates": [
                {
                    "bucket": "non-major",
                    "newVersion": "1.22.3-alpine3.20",
                    "newValue": "1.22.3-alpine3.20",
                    "newMajor": 3,
                    "newMinor": 20,
                    "newPatch": 0,
                    "updateType": "minor",
                    "branchName": "renovate/golang-3.x"
                }
            ],
            "packageName": "golang",
            "warnings": [],
            "registryUrl": "https://index.docker.io",
            "lookupName": "library/golang",
            "currentVersion": "1.22.3-alpine3.19",
            "isSingleVersion": true,
            "fixedVersion": "1.22.3-alpine3.19"
        },
        {
            "depName": "python",
            "currentValue": "3.12.3-alpine3.19",
            "datasource": "docker",
            "versioning": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
            "replaceString": "FROM python:3.12.3-alpine3.19",
            "updates": [
                {
                    "bucket": "non-major",
                    "newVersion": "3.12.3-alpine3.20",
                    "newValue": "3.12.3-alpine3.20",
                    "newMajor": 3,
                    "newMinor": 20,
                    "newPatch": 0,
                    "updateType": "minor",
                    "branchName": "renovate/python-3.x"
                }
            ],
            "packageName": "python",
            "warnings": [],
            "registryUrl": "https://index.docker.io",
            "lookupName": "library/python",
            "currentVersion": "3.12.3-alpine3.19",
            "isSingleVersion": true,
            "fixedVersion": "3.12.3-alpine3.19"
        }
    ],
    "matchStrings": [
        "FROM\\s+(?<depName>[\\S]+?):(?<currentValue>[^@\\s]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?"
    ],
    "datasourceTemplate": "docker",
    "versioningTemplate": "regex:^(?<compatibility>[\\S]*\\d+\\.\\d+(?:\\.\\d+)?(?:[\\S]*)?-alpine-?)(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<patch>\\d+))?$",
    "packageFile": "Dockerfile"
},

And in my reproduction you can see there are merge requests for all (except the python update to Alpine 3.20, which is a collision problem as detailed here).

I guess you can use something like "ignorePresets": ["workarounds:nodeDockerVersioning"], although I'm not sure of the case that drove this and all the implications. That is what I currently have set in the reproduction.

[mschoettle]

Thanks a lot for all this! Great find with the workaround preset. I believe that it is used to enable node versioning to add LTS-awareness. Removing it means that it is possible to receive updates for non-LTS (odd) versions (currently v21) and also non-active LTS versions (v22). Updates for v21 are created if multiple major versions are separated.

I tried it out and it works (with the additional limitation about missing LTS-awareness). I wonder if there is a way to keep node versioning somehow. I suspect it might require a change to the way node versioning is handled.

[aarongoldenthal]

I wonder if you could setup another custom manager for the node version case. Then there are two custom managers and not the custom manager and a package rule interfering with each other.

[HonkingGoose]

I tried it out and it works (with the additional limitation about missing LTS-awareness). I wonder if there is a way to keep node versioning somehow. I suspect it might require a change to the way node versioning is handled.

This issue is about adding "LTS awareness" to Renovate's datasources:

• LTS awareness #27632

I wonder if you could setup another custom manager for the node version case. Then there are two custom managers and not the custom manager and a package rule interfering with each other.

Hmm, with two managers you as user can accidentally pick the wrong manager, and then get confused. In general I lean towards having one way to do things.

As I understand issue #27632 above: having LTS awareness in the datasource will make Renovate do the right thing by default. Or at least the right thing for most users.

[aarongoldenthal]

The challenge here is it's a set of rules trying to force Renovate to manage container image tags like node:20.14.0-alpine3.19 as two dependencies - a Node version and an Alpine version. I definitely agree with node versioning as it is, and it should be applicable when managing the Node part of this, but not the Alpine part.

So, this worked for me - ignore the original Node preset that's applicable to all, but add it back limiting the managers it's applicable to. Since regex isn't in the list, it isn't applied to the regexManager above. Note this is very specific to an example with dockerfile and gitlabci managers, so that might have to be changed.

{
  ...regex manager for alpine...
  "ignorePresets": ["workarounds:nodeDockerVersioning"],
  "packageRules": [
    {
      "matchDatasources": ["docker"],
      "matchDepNames": ["node"],
      "matchManagers": ["dockerfile", "gitlabci"],
      "versionCompatibility": "^(?<version>[^-]+)(?<compatibility>-.*)?$",
      "versioning": "node"
    }
  ]
}

[mschoettle]

Awesome, it works! I had tried something similar but missed the matchManagers part. Thanks a lot!

[mschoettle]

Follow-up: I put this into a preset and it only worked once I put the "ignorePresets": ... into the project's renovate config directly. Not sure if this is intended.

[HonkingGoose]

... I put this into a preset and it only worked once I put the "ignorePresets": ... into the project's Renovate config directly. Not sure if this is intended.

Maybe you're hitting some kind of order of operations problem? As far as I understand there's a specific order in which Renovate loads presets. I think the local repository config always "wins" in the end...