Update images used in "docker run" commands & docker-compose files?

[Chekote]

Howdy!

I'm loving Dependabot. Thanks for making such a great and valuable tool!

One of the things I use it for is keeping my Docker images up to date. But Dependabot only submits PRs to update the "FROM" of Dockerfiles. I was hoping that it could also submit PRs to bump images used both in shell scripts that use "docker run" commands, and also in Docker Compose yaml files.

Is this something you have considered?

Kind regards,

Chekoté

[exvuma]

Running shell scripts can be tricky for us to run automatically for you. Supporting docker-compose could be feasible for dependabot to keep up to date though, would that help solve the problem you are having?

[Chekote]

That would certainly help, yes.

To clarify regarding the shell scripts: I would not expect you to run them, but instead use static analysis to find instances of docker run, and extract the image tag. Once you do that, you can check for an update and submit a PR replacing the tag with the new version.

[Chekote]

For example: This script https://github.com/Chekote/docker-php/blob/master/bin/php