Dockgate: container updates with a person at the gate

A handful of Docker hosts is easy to run and surprisingly hard to keep current. Fully automatic updaters will happily pull a newer image with new critical vulnerabilities, while doing it by hand means nobody notices the fixes waiting. Dockgate sits between those extremes: it watches the whole fleet from one place, works out which updates are actually worth taking, and runs them only after a person approves.

Outbound agents, pinned identities

A small agent on each host reads the local Docker socket and reports containers, images, and health to a central server every minute. Agents only connect outbound and never listen on a port. They enroll once with a short-lived, single-use token that carries the server's CA pin, then authenticate with mutual TLS; the server pins each agent's key and can revoke it.

Update checks compare each container's local digest with what its tag resolves to now using manifest HEAD requests, so checking costs no pulls and no registry rate limit.

Scanning without trusting the hosts

Vulnerability scanning is split. The agent runs Trivy in a throwaway container with no network, no capabilities, and a read-only root filesystem, producing an SBOM of the image's packages. The server holds the vulnerability database and matches every SBOM itself, re-matching the fleet whenever the database updates. An agent can only upload an SBOM the server asked it for, for its own containers.

The server also scans each update candidate straight from the registry and compares it with the running image. An update is actionable when it fixes critical or high findings without introducing a new critical one. A host whose images have not been scanned reports unknown rather than looking clean.

Gated update jobs

An operator or an AI assistant can request an update over MCP, but the request only files a job. It is refused outright when there is no scanned candidate or the container is not running. Otherwise a notification links to a job page showing what the update fixes and introduces, and approval requires an OIDC sign-in. The agent then pulls the exact digest, recreates the container with the same configuration, networks, and volumes, and waits for it to come up healthy, restoring the old container if it does not. Unapproved jobs expire after a day.

Dockgate can also file one Taskboard task per actionable update, so routine fleet hygiene shows up in the same queue as everything else. A report-only policy audit flags privileged containers, mounted Docker sockets, host networking, and unpinned tags without blocking anything.

Source and documentation: github.com/kilo666mj/dockgate.