How can I update the latest image that my docker service/stack uses?

Question

In the .yml definition, I'm always pulling the latest image of my service.

When I push a new image to the registry and I want to update the image that the service in my stack uses. I don't see any --pull flag, and the documentation for docker service update doesn't explicitly mentions this.

How can I re-deploy using the recently pushed latest image?

Liris

First suggestion would be not to use :latest. Honestly, the more I use Docker, the more problems I see which are caused by the use of this tag. – Tacit

We don't have a robust CI setup yet to auto-tag and stuff, so for the time being our CI can only do :latest. – Liris

Answer 1

You really shouldn't use latest in production or anything beyond local machine testing/learning. It makes everything ambiguous as to which image you're using, and you can't tell in docker service ls/ps if it's current by default and all sorts of other ambiguities (like SHA's not being visible in Docker Hub's GUI).

If you have no way around it, at least Swarm tries to query your registry and check for an updated SHA. If it sees one with docker service update --image <username>/<repo> <servicename> then it will pull and do a rolling update. You can watch docker events to be sure things are happening, and you can use docker service ps --no-trunc <servicename> to check afterward and see the SHA hashes of old and new images.

Satirical

Thanks for the tip! The environment is not prod, it's just a temp integration environment until devops team gets ownership – Liris

So basically just run docker service update with --image flag, right? – Liris

For your information, the latest version of Portainer (1.18.0) gives you the abiliy to update a service via a click and to force a new image digest resolution (that'll update the image associated to a service). – Expense

Answer 2

If you are using a compose file to deploy a service. I would not recommend using this command:

docker service update --image <username>/<repo> <servicename>    

This causes your file to be out of date and no longer the source of record for your service configuration. Instead, update your compose file with the specific image version, as Bret Fisher suggested, and run this command:

docker stack deploy -c </path/to/compose.yml> <servicename>

Keeping valid records is important if other people are also managing the swarm.

Washboard

Hey, thanks for the answer. I did the update and there was a hot minute where the old container was down and the new one wasn't up yet. I only have one replica but I expected the new container to come up before the old one shutdown. Is there a way to do this? Or do I have to have more than one replica? – Medullary

I would try a "start-first" order under the 'update-config' section of compose. docs.docker.com/compose/compose-file/#update_config – Washboard

Answer 3

To add to Bret Fisher's answer, running docker stack deploy -c compose-file.yml with the same compose-file.yml file, and having an image tagged as latest will indeed compare the SHA of the images and redeploy the corresponding service's image if needed.

This is thanks to the --resolve-image flag added in Docker 17.09, which default to always.

And while testing it, I found out that it would even pull the newest image if needed too.

Related GitHub issue: https://github.com/moby/moby/issues/30951#issuecomment-342647614.

Younker