⚓ ShipLog reads the changelog before you update — right inside Unraid's native Docker tab. Next to each container it shows what actually changes between your running image and the newest: the release notes, a deterministic risk badge (patch / minor / major) and the real version jump (e.g. 1.7 → 1.8).

Read-only — it never pulls, recreates or stops anything. Optional: AI changelog summaries via a local Ollama, and Matrix notifications.

Table of Contents

1. What is this?
2. Screenshots
3. Features
4. Install on Unraid
5. Configuration
6. How it works
7. Security
8. License
9. Support this project

1. What is this?

A single static Go binary on a distroless image (~tens of MB, low idle RAM) that polls the read-only Docker socket, resolves which images have updates, fetches the changelog for the version span, classifies the risk, and serves it on a small status page + JSON API. The headline experience — a changelog bubble next to each container in Unraid's Docker tab — ships as a companion Unraid plugin; this engine is the brain and works on any Docker host via its status page.

2. Screenshots

Click the Changelog chip on any container — the bubble shows the version jump, a risk badge, the release notes, an optional AI summary, and a read-only Update-now button, right in Unraid's Docker tab.

A Changelog chip sits on every container: a coloured dot when an update is waiting, grey when you're up to date.

Settings: poll interval, a live engine-status line, optional GitHub / Docker Hub tokens for more changelogs, Ollama (with autodetect) for AI summaries, and Matrix alerts.

3. Features

4. Install on Unraid

The Community Applications template is published in the unraid-apps feed (search ShipLog in the Apps tab once it lands). The only required mount is the Docker socket, read-only:

-v /var/run/docker.sock:/var/run/docker.sock:ro
-v /mnt/user/appdata/shiplog:/config
-p 8484:8484

Open the WebUI on port 8484.

5. Configuration

On the Unraid plugin the settings page groups these into tabs — General, Updates, Notifications, Sources — so it stays tidy as it grows. The AUTOUPDATE_* keys below are Unraid-plugin only (the generic container image stays a read-only advisor).

6. How it works

Every POLL_INTERVAL, for each container:

1. Discover via the read-only Docker socket (image ref, digest, OCI labels). Digest-pinned (image@sha256:…), image-ID-referenced and locally built containers are recognised here and honestly labelled — they have no upstream to check, so no registry call is made for them.
2. Resolve the newest tag + same-tag digest from the registry (Docker Hub / GHCR / generic OCI v2, anonymous). Manifest checks are HEAD-only and don't consume Docker Hub's pull rate limit; the tags/list call is subject only to generic throttling, which ShipLog meets with per-request retries (honouring Retry-After), a per-host request gate, bearer-token caching, one lookup per distinct image per sweep, and a host-wide backoff after a hard 429.
3. Changelog via a layered provider chain — first hit wins: the image's org.opencontainers.image.source label → GitHub releases between the tags; otherwise a version-delta fallback with a compare link.
4. Risk is a deterministic function of the version delta, then escalated to critical if a release note in the update span flags a breaking change (required migration, removed extension, dropped API).
5. Store in SQLite (status + a small per-container version history) and surface on the API + status page.

7. Security

ShipLog mounts the Docker socket read-only and never issues a write call over it — the engine itself cannot start, stop, recreate, or pull anything directly. Update actions (the one-click bulk update, and on the Unraid plugin the opt-in scheduled auto-update) are handed to Unraid's own container-update tooling, which performs the pull + recreate; ShipLog only triggers it, and only for a container it has already classified as having an eligible update. The generic container image has no update path at all and stays a pure read-only advisor. v1 has no authentication and is intended for a trusted LAN; do not expose port 8484 to the internet. It makes outbound HTTPS calls to image registries and (for changelogs) GitHub.

8. License

Copyright (C) 2026 Junker der Provinz.

ShipLog is free software under the GNU Affero General Public License v3.0 (AGPL-3.0); see LICENSE. You may run, study, share and modify it. If you distribute it, or run a modified version as a network service, you must release your source under the same AGPL-3.0 terms and keep the existing copyright and attribution notices intact.

Name and branding are not licensed. The AGPL covers the source code only. "ShipLog", its logo and its branding remain reserved: a fork or derivative must use its own distinct name and branding, and may not present itself as ShipLog. This keeps it unambiguous which project is the original.

9. Support this project

Questions, bugs, ideas? Unraid support thread → (or open a GitHub issue).