orbitd

Orbitd

A lightweight, set-and-forget container update daemon for Docker.

Orbitd monitors your containers and automatically updates them when new images are available, preserving all configuration, networks, volumes, and labels.

Features

• Zero Configuration: Works out of the box with sensible defaults
• Automatic Rollback: Restores previous container on update failure
• Flexible Policies: Digest-only or semantic versioning (patch/minor/major)
• Label Control: Opt-in or opt-out specific containers
• Image Cleanup: Removes old images after successful updates

Quick Start

services:
  orbitd:
    image: ghcr.io/mizuchilabs/orbitd:latest
    container_name: orbitd
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

That's it. Orbitd will check all containers every 12 hours (by default) and update them when new digests are available.

Since v0.1.9, you can also run orbitd in docker swarm:

services:
  orbitd:
    image: ghcr.io/mizuchilabs/orbitd:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager

Configuration

All settings are optional. Configure via environment variables or CLI flags:

Scheduling

Orbitd uses standard cron expressions or interval descriptors for scheduling updates via the ORBITD_SCHEDULE environment variable (or --schedule flag).

Examples:

• @every 12h - Run every 12 hours from start (Default)
• @every 30m - Run every 30 minutes
• 0 3 * * * - Run daily at 3:00 AM
• 0 0 * * 0 - Run weekly on Sunday at midnight

Update Policies

Semver policies require valid semver tags. Non-semver tags fall back to digest updates.

Container Labels

By default, orbitd monitors all running containers. Use ORBITD_REQUIRE_LABEL=true to switch to opt-in mode, where only containers with orbitd.enable=true are monitored.

You can also override the update policy per container with orbitd.policy:

services:
  # Opt-in to monitoring (required when require-label is enabled)
  app:
    image: myapp:latest
    labels:
      - "orbitd.enable=true"

  # Override policy for this container
  api:
    image: myapi:1.0.0
    labels:
      - "orbitd.enable=true"
      - "orbitd.policy=minor"

  # Not monitored (no label)
  database:
    image: postgres:15

Installation

Docker (recommended)

docker run -d \
  --name orbitd \
  --restart unless-stopped \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  ghcr.io/mizuchilabs/orbitd:latest

Binary

Download from releases and run:

./orbitd start

Private Registries

Orbitd uses Docker's default credential chain to authenticate with private registries. To pull images from private repositories, mount your Docker config file into the orbitd container:

services:
  orbitd:
    image: ghcr.io/mizuchilabs/orbitd:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/youruser/.docker/config.json:/root/.docker/config.json:ro

This config file is populated by running docker login on your host. Orbitd will use these credentials for both image tag discovery and pulling.

License

Apache 2.0 License - see LICENSE for details

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.