From 2e70c834cbf29e0ec804b9933f731fab39ce838a Mon Sep 17 00:00:00 2001 From: agent-zero Date: Thu, 10 Sep 2026 06:30:07 -0400 Subject: [PATCH] docs(infrastructure-update): add mandatory digest-pin sweep to Wave 3 verification MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Digest-pinned images (image: repo@sha256:...) are invisible to 'docker compose pull' — the pin re-pulls the same digest forever, so new releases never appear. Verified 2026-09-10: audiobookshelf ran 2.34.0 for 7 weeks despite weekly pulls; un-pinned to :latest, now 2.36.0 (HTTP 200). Dockhand stack (also pinned) was removed 2026-09-10 as unused (user decision). Weekly task qSOOVzsU now sweeps for digest pins every run and flags them for user-approved un-pinning. --- infrastructure-update.prose.md | 1 + 1 file changed, 1 insertion(+) diff --git a/infrastructure-update.prose.md b/infrastructure-update.prose.md index cd8f724..7d609e4 100644 --- a/infrastructure-update.prose.md +++ b/infrastructure-update.prose.md @@ -100,6 +100,7 @@ Before ANY update wave: - NetBird test: `curl -s -o /dev/null -w '%{http_code}' https://netbird.sysloggh.net/` → 200 - harness-litellm cold start: allow 3-5 min after recreate — reports unhealthy and :4000 refuses connections while loading config/DB, then recovers to 200 on its own (verified 2026-09-08) - SearXNG test: `curl :8888` +- Digest-pin sweep: `grep -rn '@sha256:' /opt/*/docker-compose.y*` on every host — digest-pinned images are INVISIBLE to `docker compose pull` (the pin re-pulls the same digest forever, so new releases never appear). Flag every pin in the run report and propose un-pinning to a floating tag with user approval before editing. Found 2026-09-10: audiobookshelf was digest-pinned at 2.34.0 (container created 2026-07-18) and silently missed by every sweep; dockhand stack was also pinned (stack removed 2026-09-10, unused). After un-pinning audiobookshelf to :latest it updated to 2.36.0 and verified HTTP 200. ## Wave 4: Proxmox Kernel Reboot