Check against a mirror
Update checks go out over HTTPS straight to the registry named in the image reference — which means they ignore the daemon's own registry-mirrors completely. On a network where only the mirror is reachable, air-gapped or behind a proxy that allows one host, docker pull worked while Docksentry reported "unreachable" on every cycle. Same confusing pair of facts as the HTTP-only registries fixed in v1.70.0.
REGISTRY_MIRRORS=docker.io=mirror.internal,ghcr.io=ghcr.mirror.internal
Verified against a real pull-through cache: the HEAD goes to the mirror, unmapped registries are untouched.
Lookups only, deliberately. Pulling still hands the container's own image reference to the daemon. Pulling from somewhere else would rewrite that reference — nginx:1.25 becoming mirror.internal/nginx:1.25 — and then the container no longer matches its own compose file, and the next check compares against something different again. Docker's registry-mirrors in daemon.json is the right place for the pull side, and it covers every pull on the host rather than only ours.
Unlimited swap did not survive a recreate
MemorySwap: -1 was skipped alongside 0, on the assumption that omitting the flag was a no-op. The comment in the code said as much. It was wrong:
--memory=256m --memory-swap=-1 -> MemorySwap -1
--memory=256m -> MemorySwap 536870912 (2x, Docker's default)
So a container explicitly given unlimited swap quietly acquired a swap cap on its first update, and could be OOM-killed afterwards where it was not before.
One slow docker call discarded the whole sweep
_get_image_created calls the backend unguarded, and the backend raises on timeout. Nothing wrapped the container loop, so a single slow docker image inspect took every result with it — including containers already checked — and the pending file was never written.
Each container is its own try now, and a failure is treated exactly like a failed registry check: the container keeps whatever pending entry it had, because being unable to look is not evidence that nothing is pending.
Upgrading is the usual docker pull ghcr.io/amayer1983/docksentry:latest, or nothing at all with auto-selfupdate on.