Skip to content

feat(docker): upgrade Kuma to 2.5.0 on the upstream rootless image - #42

Merged
andres-pcg merged 1 commit into
mainfrom
feat/kuma-2.5.0-rootless
Aug 21, 2026
Merged

feat(docker): upgrade Kuma to 2.5.0 on the upstream rootless image#42
andres-pcg merged 1 commit into
mainfrom
feat/kuma-2.5.0-rootless

Conversation

@andres-pcg

@andres-pcg andres-pcg commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Closes #44.

Stacked on #37 (auto-retargets to main when it merges). Upgrades 2.3.2 → 2.5.0 and switches the base to upstream's -rootless variant.

Why rootless-variant instead of our own USER node

Upstream has published -rootless images for every release since 2.0 (2.5.0-rootless inspected: User=node, /app/data chowned to node, same entrypoint/healthcheck). Same effect as #37's USER node, but the non-root contract is maintained upstream — future version bumps can't silently regress it on our side.

What 2.4.0 + 2.5.0 bring us (we skip 2.4.0)

  • Security: LiquidJS RCE fix (2.4.0, authenticated-only); upstream now holds npm deps on a 14-day cooldown against supply-chain attacks (2.5.0).
  • DB: stat_daily up/down columns widened SMALLINT → unsigned INTEGER (auto-migration on first boot).
  • DNS monitors: resolver port no longer pollutes the service URL.
  • Less rate-limit log spam; NTP monitor type available if we ever want it.
  • No breaking changes flagged in either release.

Verification (local, image built from this branch)

  • Runs as uid=1000(node); HTTP up; extra/healthcheck 200; container HEALTHCHECK healthy; log shows Uptime Kuma Version: 2.5.0; zero error lines with /app/data on a tmpfs like Cloud Run's in-memory volume.
  • Deploy naming unchanged: release v2.5.0substring(0,2) = v2 → same uptime-kuma-v2 service, in-place revision; LB/NEG untouched.
  • The dev preview deploy validates the MariaDB migration + smoke test on real Cloud Run.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the container image used to run Uptime Kuma by upgrading the upstream base image from 2.3.2 to 2.5.0 and switching to the upstream-supported -rootless variant so the non-root runtime contract is maintained by upstream rather than enforced locally in our Dockerfile.

Changes:

  • Bump UPTIME_KUMA_VERSION from 2.3.22.5.0.
  • Switch base image from louislam/uptime-kuma:${UPTIME_KUMA_VERSION} to louislam/uptime-kuma:${UPTIME_KUMA_VERSION}-rootless.
  • Remove the explicit USER node directive since the rootless upstream image already sets USER=node and prepares /app/data.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@andres-pcg
andres-pcg changed the base branch from fix/ci-lint-biome-zizmor to main August 21, 2026 07:40
@andres-pcg
andres-pcg force-pushed the feat/kuma-2.5.0-rootless branch from 9b6d676 to d83958d Compare August 21, 2026 07:41
The -rootless variant is upstream's supported non-root image (same
USER node contract we added by hand), so the guarantee survives future
version bumps without local patching.
@andres-pcg
andres-pcg force-pushed the feat/kuma-2.5.0-rootless branch from d83958d to af32cb1 Compare August 21, 2026 07:45
@andres-pcg
andres-pcg merged commit 7e94767 into main Aug 21, 2026
2 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

devops: upgrade Uptime Kuma 2.3.2 → 2.5.0 on the upstream rootless image

2 participants