telnetdoogie-labs/synology-docker 3.1

on GitHub

Highlights

This release makes the updater fail safely. Instead of guessing or carrying on after an error, it now stops before it can leave Docker half-updated. It also refuses to replace the Docker engine while any container still uses Synology's removed db log driver. Thanks to @gundestrup for the work, and for adding the project's first regression tests and CI.

Behavior changes

Please read these before updating. Some runs that used to go through will now stop with an error.

• Containers on the db logger now block engine updates. If any container, running or stopped, still uses db, update and install list those containers and exit. The message tells you what to do:

  1. If your daemon default is still db, run sudo ./syno_docker_update.sh logger first.
  2. Review your containers with sudo ./syno_docker_list_containers.sh and recreate them, or export them to Compose projects with stateful-docker-migration-flow.
  3. Run the update again.

  Runs that don't replace the engine (--target compose, --target driver, --stage) are not blocked. --force skips this check.

• No more fallback versions. If the script can't look up the latest Docker or Compose version, it stops. It no longer falls back to Docker 20.10.11 / Compose 2.1.1.

• Downgrades need both --force and an explicit version. For example, --docker 28.5.1 --force. An offline install archive older than your current Docker also needs --force.

• DSM 6 and 7 only. Other DSM major versions are now rejected outright, even with --force.

• A failed start always exits with an error, even with --force. If something fails after Docker stops, the script prints the backup path and exits. It does not try to restart a mixed set of binaries. Restore with sudo ./syno_docker_update.sh --backup /path/to/backup.tgz restore.

• A missing startup-script anchor is now an error. Previously, the script warned and continued.

• --stage changes nothing on the host. It no longer installs iptables modules or the AppArmor profile, and it keeps the downloads in a private folder whose path it prints. You can pass that folder to install PATH.

Safety improvements

• Backups are written to a private temp file, checked with tar -t, then moved into place. An existing backup is never overwritten. Backups now include the managed AppArmor profile when it's present.
• Restore checks the backup archive before extracting it, and stops if any binary, config, or script fails to restore.
• cp, tar, chown, and chmod failures now stop the update instead of being ignored.
• Edits to start-stop-status and dockerd.json are made on a temporary copy and moved into place, so a failure can't leave a half-edited file.
• Downloads (Docker, Compose, runc, kernel modules) are HTTPS-only with a minimum of TLS 1.2, including redirects.
• Each run uses its own private temp folder instead of a shared /tmp/docker_update.
• Docker is stopped later in the update, after the downloads and extraction are done, so it's down for less time.
• The logger command now backs up before stopping Docker.
• The updater checks that its helper scripts are present and executable before doing anything.
• An unrecognized Container Manager status now stops the run instead of waiting.

Container tools

• syno_docker_list_containers.sh now includes stopped containers, handles Compose paths with spaces, and exits with an error if Docker can't be queried, instead of showing an empty list.
• container_recreate.sh hints now include --log-driver local, and environment variables no longer match on name prefixes (for example, FOO no longer picks up FOO_EXTRA).
• Note: recreate hints still print environment values in plain text. Review them before sharing or running them, or use the migration tool for anything sensitive.

Kernel modules and AppArmor

• iptables modules download into a private temp folder rather than your working directory. If the modules are already installed, it skips the download check.
• The AppArmor wrapper and profile are still rewritten on every run. They're now staged before replacement; if installation fails, the parser and files are restored, and restore removes only profiles this project manages.

Testing and CI

• New mocked regression suite that runs in a throwaway Docker container (see the README's Testing section).
• GitHub Actions runs the suite, ShellCheck (pinned by digest), and a bash 4.3 check for DSM 6 compatibility.
• tests/check-dsm-runtime.sh checks that a NAS has the tools the updater needs.

Known limitations

• DSM 6 has not been tested on physical hardware and is best-effort (#121).

Follow-ups

• #117 Verify kernel modules against per-release checksums
• #118 Add --ignore-db-logger separate from --force
• #119 Convert [ tests to [[ in Bash-only scripts
• #120 Split tests/workflows.sh into smaller test files
• #121 Validate DSM 6 on physical hardware
• #122 Quote args and redact env values in container_recreate.sh hints

What's Changed

• [FR] feat(update): add regression tests, CI, and fail-safe guards for DSM 6/7 (#114) by @bslatyer in #123

New Contributors

• @gundestrup made their first contribution in #114

Full Changelog: 3.0...3.1