Support Docker Hardened Images lookups (dhi.io) on hosted app

[MShekow]

Tell us more.

From what I can tell, the hosted Renovate GitHub app already supports docker.io and thus can look up updates to Docker Hub images. However, Docker Inc. also offers Docker Hardened Images with a free tier. These are hosted on dhi.io.

It would be great if you could configure the same credentials you already configured for docker.io for dhi.io (they share the same credentials), to avoid package look-up errors.

[RahulGautamSingh]

Is this not possible today via hostRules? Or do you want that we use once set hostRule that matches docker.io host for dhi.io as well? Or the same for other ways it might be possible to configure docker creds?

[samweston-9fin]

@MShekow I'm glad this isn't just me! It seems to work some of the time but not at all reliably.

[stephengtuggy]

I tried updating one of my projects to use the dhi.io/python tag 3.14.5-debian13-sfw-dev in its Dockerfile, and Renovate started throwing errors. Maybe that tag is too complex for it to handle?

[pascal-hofmann]

I also can't get this to work.

I use this package rule, which at least points renovate to the correct docker registry, but the lookup still fails.

  "packageRules": [
    {
      "description": "Ensure renovate queries DHI (dhi.io) instead of looking for image dhi.io/** on index.docker.io.",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["dhi.io/**"],
      "registryUrls": ["https://dhi.io"]
    }
  ]

This is the error message:

Failed to look up docker package dhi.io/nginx: no-result (repository=[…], packageFile=[…]/Dockerfile, dependency=dhi.io/nginx)

[RahulGautamSingh]

@pascal-hofmann

You need a hostRules entry with Docker Hub credentials (they're shared between docker.io and dhi.io). Create a PAT with Public Repo Read-only access and add:

{
  "hostRules": [
    {
      "matchHost": "dhi.io",
      "username": "<your-docker-hub-username>",
      "password": "<your-PAT>"
    }
  ],
  "packageRules": [
    {
      "matchDatasources": ["docker"],
      "matchPackageNames": ["dhi.io/**"],
      "registryUrls": ["https://dhi.io"]
    }
  ]
}

On the hosted app, store the PAT as an encrypted secret / via the host-rules UI rather than in plaintext.

registryUrls only tells Renovate where to look it doesn't send any credentials, and dhi.io requires auth. That's why you get no-result: the datasource swallows the 401 and reports it as "no tags found" rather than an explicit auth error.

Heads up: even with auth configured, others in this thread have seen intermittent no-result failures from dhi.io itself (likely rate limiting), so it may still be flaky.

[MIJOTHY-V2]

I looked into this no-result failure that we've been experiencing and provided some detail on my investigation in #45249