Keeps your Docker containers up to date, without surprises.

Status: early release (Docker images only). Wren lists what runs on each server (containers, Unraid template containers, Compose stacks and script-updated stacks), checks for new versions and updates what you approve, now or at a time you choose, with a snapshot, a health check and an automatic rollback. Automatic updates inside a window, the Vigilant Vole integration (maintenance windows and monitor-based health checks), ~40 notification channels, a REST API with OpenAPI and MCP tools, in 26 languages. It is tested on Unraid; other Linux Docker hosts are best-effort, btrfs subvolume snapshots are untested on real pools and ZFS uses plain copies. The translations are unreviewed drafts. Installers and static binaries come later. The design is in docs/design.md; to build and run it, see docs/development.md.

Wise Wren ("Wren") keeps the Docker containers on your servers up to date. It checks for new versions on a schedule you choose, tells you about them, and updates only what you approve, or what you have explicitly allowed it to update on its own.

Today, keeping a home server current often means a manual check every day. Unraid's update button covers containers made from its templates, but not Compose stacks or apps that update with a vendor's own script. Other tools either only notify (Diun, What's Up Docker) or update blindly (Watchtower). None of them pause your monitoring, take a snapshot first, check health afterwards and roll back.

What it does

• Notify, approve or automatic. Each server has a default mode and each target can override it. Approve is the default: one click updates now, or at a time you choose.
• Scheduled updates. Approve during the day, update tonight. A scheduled update shows as planned maintenance in Vigilant Vole ahead of time.
• Safe updates, every time. Each run goes through the same steps:
  1. preflight: the new image is pulled before anything stops;
  2. a maintenance window opens in Vigilant Vole;
  3. the target stops gracefully;
  4. a snapshot of its data is taken;
  5. the update runs;
  6. a health check: the containers are healthy and the linked monitors stay up;
  7. on failure, an automatic rollback of the image or Compose files and the data;
  8. the window closes and you get the result.
• Notifications through the same ~40 channels as Vigilant Vole, from ntfy on your phone to email and Discord. One per new version, with a digest option.
• One Wren, several servers, through a small agent on each.

Three kinds of targets

Wren never changes anything you haven't allowed

With automatic updates off, which is the default for every server and target, Wren updates nothing on its own. Automatic updates only run inside a window you set, and any container or stack can be excluded. An approval is for one version: if a newer one appears before it runs, Wren asks again. Scripts are defined on each server, and Wren can only ask for them by name, so it can never become a remote shell.

Install

Wren is a server (the web UI, once) plus a small agent on every Docker host it looks after. Start the server:

mkdir wise-wren && cd wise-wren
curl -fsSLO https://raw.githubusercontent.com/Ferdinand99/Wise-Wren/main/docker-compose.yml
docker compose up -d

Open http://<host>:3003/setup to create the first admin, set the address agents use under Settings → General (or WW_PUBLIC_URL), then Servers → Add server: Wren shows the agent's token once, with the docker run line for that host. On Unraid, install Wise Wren and Wise Wren Agent from Community Applications (templates). Images are on GHCR for amd64 and arm64: ghcr.io/ferdinand99/wise-wren and ghcr.io/ferdinand99/wise-wren-agent, :<version> or :latest.

The agent has the Docker socket, which is root on its host. Read the guides before the first update:

• Installing the server
• Adding an agent: agent.toml, the same-path rule, [updates] allow/deny, script stacks
• Updates, approvals and schedules: modes, approvals, scheduled updates, auto windows
• Snapshots and rollback: snapshots are not backups
• Vigilant Vole: maintenance windows and monitor health (VV 0.9.0 or later)
• Security notes and Upgrading

Planned for v1

Most of the table is in the early releases; static binaries, a Linux installer and wider testing on other Linux hosts come before v1.0. Not in v1: the iOS app (planned later), updating Unraid OS, plugins, VMs, LXC or Kubernetes, building images from source, and offsite backups (Wren's snapshots are short-lived rollback points, not backups). See docs/design.md for the full scope and the phases.

Wren is part of Hedgerow, a family of small self-hosted apps, with Vigilant Vole, Nimble Newt and Keen Kestrel. Like its siblings, it is one Rust binary with SQLite in the family's design, plus a small agent for each server.

License

MIT