Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer
BakedCatboy@lemmy.ml 6 days ago
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer
BakedCatboy@lemmy.ml 6 days ago
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
You mean watchtower by containrrr? That repo seems archived.
Also, if you don’t mind me asking, how does that even work? There is a far from zero chance of potentially breaking changes on any given update, so with auto-updates, do you just accept that something might suddenly stop working, or do you just get notifications that a new version is available and update manually?
If it breaks I either fix it (often it’s just an issue where the new version needs extra config added), or roll back to a backup if it really went wrong and I can’t recover otherwise.
Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.
BakedCatboy@lemmy.ml 4 days ago
I use one of the maintained forks of watchtower.
I use it to auto update within stable versions for things that are reputable enough to not make breaking changes, so nginx, apache, wireguard, traefik, etc. In over 10 years of running Plex I don’t think I’ve experienced a breaking update in the last 5-7 years at least, so I consider it safe enough. Any other software like Immich that I’m not sure if that’s safe, I keep it behind a vpn and update manually. But for things as big as nginx especially I feel very safe letting it auto update within a major version.