Does minimumReleaseAge apply to Docker digests?

[paulzakin]

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

Based on my experimentation - it does not seem to.

For example: PostgreSQL 17.6 on DockerHub released a new digest for the same tag yesterday (9/23) postgres:17.6@sha256:0f4f20021a065d114083d1b95d9fb89ad847cbc4c3cc9238417815c7df42350f - and even with a minimumReleaseAge of 7 days - Renovate wanted to bump it up from postgres:17.6@sha256:6e1474849477e0e976e6318229cdef4f9e66dbb3ad26324d558c25614ced641c

More broadly, it would be helpful to update the documentation if possible to list the formats that minimumReleaseAge does and does and does not support. Currently, the docs just say this.

The datasource that Renovate uses must have a release timestamp for the minimumReleaseAge config option to work. Some datasources may have a release timestamp, but in a format Renovate does not support. In those cases a feature request needs to be implemented.

Thank you very much!

Logs (if relevant)

Here is the config, if it helps

  "extends": [
    "config:recommended",
    "docker:enableMajor",
    "docker:pinDigests",
    "helpers:pinGitHubActionDigests"
  ],
  "configMigration": true,
  "minimumReleaseAge": "7 days",
  "packageRules": [
    {
      "groupName": "Renovate",
      "groupSlug": "renovate",
      "matchDatasources": [
        "asdf",
        "docker-compose",
        "dockerfile",
        "github-actions",
        "pyenv"
      ],
      "matchUpdateTypes": [
        "bump",
        "digest",
        "lockFileMaintenance",
        "major",
        "minor",
        "patch",
        "pin",
        "pinDigest",
        "replacement",
        "rollback"
      ]
    }
  ],
}```

[jamietanna]

More broadly, it would be helpful to update the documentation if possible to list the formats that minimumReleaseAge does and does and does not support. Currently, the docs just say [...]

@paulzakin I've raised #38655 for slightly more information in the docs about this - thoughts?

[paulzakin]

Yeah, that looks great!

[jamietanna]

In terms of whether Docker digest support this 🧵

[paulzakin]

Works for me!

[jamietanna]

Based on my experimentation - it does not seem to.

For example: PostgreSQL 17.6 on DockerHub released a new digest for the same tag yesterday (9/23) postgres:17.6@sha256:0f4f20021a065d114083d1b95d9fb89ad847cbc4c3cc9238417815c7df42350f - and even with a minimumReleaseAge of 7 days - Renovate wanted to bump it up from postgres:17.6@sha256:6e1474849477e0e976e6318229cdef4f9e66dbb3ad26324d558c25614ced641c

I agree that it looks like we don't provide a releaseTimestamp for a given Docker digest.

Given the current behaviour of minimumReleaseAge to treat no releaseTimestamp as indication of a version being stable - which can be tweaked as of #38363 - this is why you got a PR.

For instance, we can see:

DEBUG: packageFiles with updates (repository=local)
       "config": {
         "dockerfile": [
           {
             "deps": [
               {
                 "depName": "postgres",
                 "packageName": "postgres",
                 "currentValue": "17.6",
                 "currentDigest": "sha256:0f4f20021a065d114083d1b95d9fb89ad847cbc4c3cc9238417815c7df42350f",
                 "replaceString": "postgres:17.6@sha256:0f4f20021a065d114083d1b95d9fb89ad847cbc4c3cc9238417815c7df42350f",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "depType": "final",
                 "updates": [
                   {
                     "bucket": "v18",
                     "newVersion": "18.0",
                     "newValue": "18.0",
                     "newDigest": "sha256:073e7c8b84e2197f94c8083634640ab37105effe1bc853ca4d5fbece3219b0e8",
                     "releaseTimestamp": "2025-10-01T20:17:52.074Z",
                     "newVersionAgeInDays": 14,
                     "newMajor": 18,
                     "newMinor": 0,
                     "newPatch": null,
                     "updateType": "major",
                     "isBreaking": true,
                     "libYears": 0.000003061009639776763,
                     "branchName": "renovate/postgres-18.x"
                   },
                   {
                     "updateType": "digest",
                     "newValue": "17.6",
                     "newDigest": "sha256:e6a4209d1a4893f2df3bdcde58f8926c3c929c4d51df90990ed1b36d83c1382a",
                     "branchName": "renovate/postgres-17.6"
                   }
                 ],
                 "versioning": "docker",
                 "warnings": [],
                 "registryUrl": "https://index.docker.io",
                 "lookupName": "library/postgres",
                 "currentVersion": "17.6",
                 "currentVersionTimestamp": "2025-10-01T20:16:15.542Z",
                 "currentVersionAgeInDays": 14,
                 "isSingleVersion": true,
                 "fixedVersion": "17.6"
               }
             ],
             "packageFile": "Dockerfile"
           }
         ],

Via

FROM postgres:17.6@sha256:0f4f20021a065d114083d1b95d9fb89ad847cbc4c3cc9238417815c7df42350f

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:best-practices"
  ]
}

The date that a Docker digest was created is available as metadata is available in the API, but it's a little more awkward to get to:

Details

# Co-authored-by: GPT-4.1 (GitHub Copilot)

REPO="library/postgres"
DIGEST="sha256:0f4f20021a065d114083d1b95d9fb89ad847cbc4c3cc9238417815c7df42350f"

# 1. Get Docker Hub token
TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:${REPO}:pull" | jq -r .token)

# 2. Get manifest list for the digest
MANIFEST_LIST=$(curl -s -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://registry-1.docker.io/v2/${REPO}/manifests/${DIGEST}")

# 3. Extract the digest for linux/amd64
ARCH_DIGEST=$(echo "$MANIFEST_LIST" | jq -r '.manifests[] | select(.platform.architecture=="amd64" and .platform.os=="linux") | .digest')
echo $ARCH_DIGEST

if [ -z "$ARCH_DIGEST" ]; then
  echo "No linux/amd64 manifest found."
  exit 1
fi

# 4. Fetch the platform-specific manifest
MANIFEST=$(curl -s -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
  "https://registry-1.docker.io/v2/${REPO}/manifests/${ARCH_DIGEST}")
echo $MANIFEST

# 5. Extract config digest
CONFIG_DIGEST=$(echo "$MANIFEST" | jq -r .config.digest)
echo "$CONFIG_DIGEST"

if [ -z "$CONFIG_DIGEST" ]; then
  echo "No config digest found."
  exit 1
fi

# 6. Fetch config blob and extract 'created'
CREATED=$(curl -s -L -H "Authorization: Bearer $TOKEN" \
  "https://registry-1.docker.io/v2/${REPO}/blobs/${CONFIG_DIGEST}" | jq .created )

echo "Image created at: $CREATED"

So this looks like a bug/feature (I could argue either way)

[jamietanna]

I've raised #38656 to track implementation

[jamietanna]

In the meantime, I've raised #38658 to improve our docs to clarify this (this will then appear on https://docs.renovatebot.com/modules/datasource/docker/)

[paulzakin]

Awesome, thank you so much!