Skip to main content

Docker/OCI

Publish container images to registries using Universal Release.

Detection​

Automatically detected when Dockerfile exists.

Configuration​

ecosystems:
  docker:
    enabled: true
    registries:
      - ghcr.io/org/image
      - docker.io/org/image
      - registry.company.com/image
    validation:
      build: true
      scan: true
    platforms:
      - linux/amd64
      - linux/arm64

Credentials​

Store registry credentials:

# GitHub Container Registry
release secrets set GITHUB_TOKEN

# Docker Hub
release secrets set DOCKER_TOKEN

# Custom registry
release secrets set CUSTOM_REGISTRY_TOKEN

Publishing​

# Publish to all configured registries
release publish --ecosystem docker

# Dry run (build without push)
release publish --ecosystem docker --dry-run

# Specific tag
release publish --ecosystem docker --tag latest

Multi-Registry Publishing​

Universal Release publishes to all configured registries:

ecosystems:
  docker:
    registries:
      - ghcr.io/myorg/myapp
      - docker.io/myorg/myapp

This publishes to both GHCR and Docker Hub automatically.

Multi-Platform Builds​

Build for multiple architectures:

ecosystems:
  docker:
    platforms:
      - linux/amd64
      - linux/arm64
      - linux/arm/v7

Uses docker buildx internally.

Validation​

Universal Release validates:

  • ✅ Dockerfile exists
  • ✅ Image builds successfully
  • ✅ Security scan passes (if enabled)
  • ✅ Registry credentials are valid

Rollback​

Docker/OCI doesn't support native rollback. You must:

  1. Untag the version
  2. Re-push previous version
  3. Update dependent systems

Best Practices​

Use Multi-Stage Builds​

FROM node:20-alpine AS builder
WORKDIR /app
COPY package.json bun.lockb ./
RUN bun install
COPY . .
RUN bun run build

FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
CMD ["node", "dist/index.js"]

Tag Strategy​

Universal Release creates multiple tags:

  • 1.2.3 - Exact version
  • 1.2 - Minor version
  • 1 - Major version
  • latest - Latest stable

Version Management​

Version is typically managed via Git tags:

# Tag the release
release version --bump minor

# Publish with that version
release publish --ecosystem docker

Security Scanning​

Enable security scanning:

ecosystems:
  docker:
    validation:
      scan: true
      scanTool: trivy # or grype, snyk

Next Steps​