Migrating from Docker-Compose To Quadlets

[Unit]
Description={{ service }} service
Requires=network-online.target
After=network-online.target
StartLimitIntervalSec=0                         # don't limit number of restarts in a specific window

[Service]
WorkingDirectory=/opt/{{ service }}
Type=simple
TimeoutStartSec=5min                            # need a pretty long startup timeout for image pulls
Restart=always
RestartSec=10s                                  # restart after a 10s delay

ExecStartPre=sh -c 'until ping -c 1 google.com; do sleep 1; done'
ExecStartPre=docker-compose pull
ExecStart=docker-compose up
ExecStop=docker-compose down
ExecReload=docker-compose pull

[Install]
WantedBy=multi-user.target

#!/usr/bin/env python3
#
# Script to check if a running container has an updated image. We look in the compose.yml file to find a list
# of containers to check. Then we pull the lastest images and compare the digest of each image to the running container's
# image digest.

import subprocess
import sys
import os
import yaml

def docker_run(command, capture_output=True, check=True, input_data=None):
    """
    Executes a docker command and returns the output.

    Args:
        command (list): A list of strings representing the docker command and its arguments.
        capture_output (bool, optional): Whether to capture the standard output and standard error. Defaults to True.
        check (bool, optional): Whether to raise a CalledProcessError if the command returns a non-zero exit code. Defaults to True.
        input_data (str, bytes, optional): data to be passed to the stdin of the subprocess.

    Returns:
        subprocess.CompletedProcess: A CompletedProcess instance containing information about the executed command.

    Raises:
        subprocess.CalledProcessError: If the command returns a non-zero exit code and check is True.
    """
    try:
        result = subprocess.run(
            ["docker"] + command,
            capture_output=capture_output,
            text=True,
            check=check,
            input=input_data,
            )
        return result
    except subprocess.CalledProcessError as e:
        print(f"Error executing docker command: {e}")
        raise

def get_container_image_digest(container_name):
    """Retrieves the image hash for a running docker container."""
    try:
        result = docker_run(["inspect", "--format", "{{.ImageDigest}}", container_name])
        if result.stdout:
            return result.stdout.strip()
        else:
            return []
    except subprocess.CalledProcessError as e:
        print(f"Error during docker inspect: {e}")
        return None

def get_image_digest(image_name):
    """Retrieves the hash for a docker image."""
    try:
        result = docker_run(["inspect", "--format", "{{.Digest}}", image_name])
        if result.stdout:
            return result.stdout.strip()
        else:
            return []
    except subprocess.CalledProcessError as e:
        print(f"Error during docker inspect: {e}")
        return None

def pull_images(compose_file):
    """Pulls images using docker-compose."""
    try:
        subprocess.run(
            ["docker-compose", "-f", compose_file, "pull"],
            check=True
        )
        return True
    except subprocess.CalledProcessError:
        return False

def get_images(compose_file):
    """Gets a dictionary of service names and image names from the compose file."""
    try:
        with open(compose_file, 'r') as f:
            compose_data = yaml.safe_load(f)
            services = {}
            for service_name, service_data in compose_data['services'].items():
                if 'container_name' in service_data:
                    if 'image' in service_data:
                        services[service_data['container_name']] = service_data['image']
            return services
    except FileNotFoundError:
        print(f"Error: Compose file '{compose_file}' not found.")
        return None
    except KeyError:
        print(f"Error: 'services' or 'image' key not found in compose file.")
        return None
    except yaml.YAMLError as e:
        print(f"Error: Invalid YAML in compose file: {e}")
        return None

def main():
    if len(sys.argv) != 2:
        print("Usage: python script.py <compose_file>")
        return

    compose_file = sys.argv[1]
    images = get_images(compose_file)
    if images is None:
        print(f"No images found in {compose_file} - be sure your services have a container_name and image defined.")
        return

    if pull_images(compose_file):
        # Fetch the current image digests
        image_digests = {}
        for container_name, image_name in images.items():
            image_digests[container_name] = get_image_digest(image_name)

        # Get the running container's digest so we can compare to the current image
        running_digests = {}
        for container_name, image_name in images.items():
            running_digests[container_name] = get_container_image_digest(container_name)

        image_updated = False
        for container_name, image_name in images.items():
            running_digest = running_digests[container_name]
            image_digest = image_digests[container_name]

            if image_digest and running_digest and image_digest != running_digest:
                print(f"Service '{container_name}' image '{image_name}' was updated. Digest changed from '{running_digest}' to '{image_digest}'.")
                image_updated = True
            elif running_digest and image_digest and running_digest == image_digest:
                print(f"Service '{container_name}' image '{image_name}' was not updated. Digest remained the same ('{running_digest}').")
            elif not image_digest:
                print(f"Service '{container_name}' image '{image_name}' not found after pull. An unexpected error occurred.")
            else:
                print(f"Service '{container_name}' image '{image_name}' error determining update status.")
        print(f"Image Updated: {image_updated}")
    else:
        print("Error pulling images.")

if __name__ == "__main__":
    main()

- name: restart service-foo when new image exists
  become: yes
  command: "check-compose-updates /opt/service-foo/compose.yml"
  register: check_updates
  changed_when: "'Image Updated: True' in check_updates.stdout"
  notify: restart service-foo

[Unit]
Description=Miniflux Network

[Network]
NetworkName=miniflux

[Install]
WantedBy=default.target

[Unit]
Description=Miniflux DB Container
Requires=miniflux-network.service
After=miniflux-network.service
StartLimitIntervalSec=300
StartLimitBurst=5

[Container]
AutoUpdate=registry
ContainerName=minifluxdb
Image=docker.io/library/postgres:17-alpine
Network=miniflux.network
Volume=/opt/miniflux/data/db:/var/lib/postgresql/data
Environment=POSTGRES_USER=miniflux
Environment=POSTGRES_DB=miniflux
Secret=miniflux_db_pwd,type=env,target=POSTGRES_PASSWORD
HealthCmd=pg_isready -U miniflux
HealthInterval=10s
HealthStartPeriod=30s

[Service]
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

[Unit]
Description=Miniflux Container
Requires=minifluxdb.service
After=minifluxdb.service
StartLimitIntervalSec=300
StartLimitBurst=5

[Container]
AutoUpdate=registry
ContainerName=miniflux
Image=ghcr.io/miniflux/miniflux:latest
Network=miniflux.network
Network=traefik.network
Environment=ADMIN_USERNAME=fuzz
Environment=ADMIN_PASSWORD=
Environment=AUTH_PROXY_HEADER=X-Forwarded-User
Environment=AUTH_PROXY_USER_CREATION=true
Environment=BASE_URL=https://rss.example.com
Environment=HTTPS=true
Environment=LOG_DATE_TIME=true
Environment=RUN_MIGRATIONS=1
Secret=miniflux_db_url,type=env,target=DATABASE_URL
Label=traefik.enable=true
Label=traefik.http.routers.miniflux.rule="Host(`rss.example.com`)"
Label=traefik.http.routers.miniflux.entrypoints="websecure"
Label=traefik.http.routers.miniflux.middlewares="oidc-auth@file"

[Service]
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

- name: Stop and disable podman-auto-update.timer so we can manually run auto-update
  become: yes
  ansible.builtin.systemd:
    name: podman-auto-update.timer
    state: stopped
    enabled: false

- name: Manually run the podman-auto-update service to update any out of date containers
  become: yes
  ansible.builtin.systemd:
    name: podman-auto-update.service
    state: started