> sends a message to my Telegram whenever one of my containers has an update available

I use Podman auto update for this. It looks for updated images and automatically downloads them and restarts the container.

Almost my entire self hosted setup is auto updating. A good feeling in this era of daily CVEs.

▲

peddling-brink 2 days ago | parent [-]

Ahh yes, but what about supply chain compromise?

▲

prmoustache 2 days ago | parent | next [-]

Well it is only a useful point if you audit/analyse images anyway.

Supply chain risks is a serious subject but the fact you blindly update manually or automatically doesn't change a thing.

▲

szmarczak a day ago | parent [-]

It does change a thing. Manually updating after a week after new version release has lower chance of it being a supply chain attack (it would've been noticed and fixed already).

	▲	prmoustache 21 hours ago \| parent [-]
		> it would've been noticed and fixed already Not necessarily.

▲

rbanffy 2 days ago | parent | prev [-]

Many companies have cooldown policies - you can’t get a library or image or anything if it’s not been up for a given timespan. It assumes people will realize and publish updates within that period.

That, of course, in addition to scanning, validating, and all other sorts of paranoia, because only the paranoids survive.