Once your image tags are pinned (why), the next problem is noticing new versions. Renovate solves that: it scans your repo and opens a pull request for each available update.
1. Put your stacks in Git
One repo with a folder per stack (immich/compose.yaml, vaultwarden/compose.yaml, …). Keep secrets out of Git and in ignored .env files.
2. Enable Renovate
Use the Renovate app on GitHub or self-host Renovate for Gitea/Forgejo. Renovate’s Docker Compose manager detects image: lines in compose files automatically.
Minimal renovate.json:
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:recommended"]
}3. Tune it for a homelab
- Don’t automerge database-backed apps. Review and update during a planned window.
- Group noisy, low-risk images if you like, with
packageRules. - Optionally pin digests. See Renovate’s Docker docs for digest pinning and versioning behaviour.
4. Review like a sysadmin
Each PR links release notes when Renovate can find them. Read them (or check the SafeToUpdate verdict), merge, then on the host:
git pull && docker compose pull && docker compose up -dChecklist
- Stacks in Git, secrets ignored
- Renovate enabled with
config:recommended - No automerge for stateful apps
- Merge → pull →
up -d→ verify