chore(images): pin service image updates

Replace floating service images with reviewable tags or digests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

adguardhome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   adguard:
-    image: adguard/adguardhome:latest
+    image: adguard/adguardhome:v0.107.79
     container_name: adguardhome
     restart: unless-stopped
     ports:

adguardhome/k8s/adguard.yaml

@@ -65,7 +65,7 @@ spec:
     spec:
       containers:
         - name: adguard
-          image: adguard/adguardhome:latest
+          image: adguard/adguardhome:v0.107.79
           resources:
             limits:
               memory: "1.5Gi"

authentik/compose.yaml

@@ -1,6 +1,6 @@
 services:
   postgresql:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:15.19-alpine
     restart: unless-stopped
     env_file:
       - .env

authentik/k8s/postgresql.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: postgres
-          image: docker.io/library/postgres:15-alpine
+          image: docker.io/library/postgres:15.19-alpine
           env:
             - name: POSTGRES_DB
               value: authentik

cfddns/compose.yaml

@@ -1,6 +1,6 @@
 services:
   cloudflare-ddns:
-    image: timothyjmiller/cloudflare-ddns:latest
+    image: timothyjmiller/cloudflare-ddns:2.2.0
     container_name: cloudflare-ddns
     restart: unless-stopped
     security_opt:

cfddns/k8s/deployment.yaml

@@ -18,7 +18,7 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: cloudflare-ddns
-          image: timothyjmiller/cloudflare-ddns:latest
+          image: timothyjmiller/cloudflare-ddns:2.2.0
           imagePullPolicy: Always
           resources:
             requests:

checkmk/compose.yaml

@@ -1,6 +1,6 @@
 services:
   checkmk:
-    image: "checkmk/check-mk-raw:2.4.0-latest"
+    image: "checkmk/check-mk-raw:2.4.0-2026.09.14"
     container_name: "checkmk"
     restart: unless-stopped
     # ports:

checkmk/k8s/checkmk.yaml

@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
         - name: checkmk
-          image: checkmk/check-mk-raw:2.4.0-latest
+          image: checkmk/check-mk-raw:2.4.0-2026.09.14
           envFrom:
             - secretRef:
                 name: checkmk-secrets

converters/compose.yaml

@@ -1,7 +1,7 @@
 services:
   convertx:
     container_name: convertx
-    image: ghcr.io/c4illin/convertx:latest
+    image: ghcr.io/c4illin/convertx:v0.18.0
     restart: unless-stopped
     ports:
       - "9992:3000"
@@ -42,7 +42,7 @@ services:
 
   bentopdf:
     container_name: bentopdf
-    image: bentopdf/bentopdf:latest
+    image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
     restart: unless-stopped
     labels:
       - "traefik.enable=true"

converters/k8s/bentopdf.yaml

@@ -26,7 +26,7 @@ spec:
         app: bentopdf
     spec:
       containers:
-        - image: bentopdf/bentopdf:latest
+        - image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
           imagePullPolicy: Always
           name: bentopdf
           ports:

converters/k8s/convertx.yaml

@@ -26,7 +26,7 @@ spec:
         app: convertx
     spec:
       containers:
-        - image: ghcr.io/c4illin/convertx:latest
+        - image: ghcr.io/c4illin/convertx:v0.18.0
           name: convertx
           envFrom:
             - configMapRef:

dockmon/compose.yaml

@@ -1,6 +1,6 @@
 services:
   dockmon:
-    image: darthnorse/dockmon:latest
+    image: darthnorse/dockmon:2.4.5
     container_name: dockmon
     restart: unless-stopped
     # ports:

dockmon/k8s/dockmon.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: dockmon
-          image: darthnorse/dockmon:latest
+          image: darthnorse/dockmon:2.4.5
           ports:
             - containerPort: 443
           volumeMounts:

downtify/compose.yaml

@@ -1,7 +1,7 @@
 services:
   downtify:
     container_name: downtify
-    image: ghcr.io/henriquesebastiao/downtify:latest
+    image: ghcr.io/henriquesebastiao/downtify:2.12.0
     restart: unless-stopped
     # ports:
     #   - '7077:8000'

downtify/k8s/downtify.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: downtify
-          image: ghcr.io/henriquesebastiao/downtify:latest
+          image: ghcr.io/henriquesebastiao/downtify:2.12.0
           ports:
             - containerPort: 8000
           volumeMounts:

edu_master/compose.yaml

@@ -1,6 +1,6 @@
 services:
   redis:
-    image: redis:alpine
+    image: redis:8.0.3-alpine
     restart: unless-stopped
     volumes:
       - redis-data:/data
@@ -11,7 +11,7 @@ services:
       retries: 5
 
   playwright-service:
-    image: mcr.microsoft.com/playwright:v1.56.0-jammy
+    image: mcr.microsoft.com/playwright:v1.56.1-jammy
     restart: unless-stopped
     command: npx -y playwright@1.56.0 run-server --port 3000 --path /ws
 

edu_master/k8s/playwright.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: playwright
-          image: mcr.microsoft.com/playwright:v1.56.0-jammy
+          image: mcr.microsoft.com/playwright:v1.56.1-jammy
           imagePullPolicy: IfNotPresent
           command:
             - npx

edu_master/k8s/redis.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:alpine
+          image: redis:8.0.3-alpine
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 6379

edu_master/k8s/session-keeper.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       initContainers:
         - name: wait-redis
-          image: redis:alpine
+          image: redis:8.0.3-alpine
           command:
             - /bin/sh
             - -ec

edu_master/k8s/webinar-checker.yaml

@@ -19,7 +19,7 @@ spec:
       # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
       initContainers:
         - name: wait-deps
-          image: redis:alpine
+          image: redis:8.0.3-alpine
           command:
             - /bin/sh
             - -ec

gitea/compose.yaml

@@ -1,6 +1,6 @@
 services:
   server:
-    image: docker.gitea.com/gitea:1.26
+    image: docker.gitea.com/gitea:1.27.3
     container_name: gitea
     restart: always
     environment:
@@ -61,7 +61,7 @@ services:
     depends_on:
       - db
   db:
-    image: docker.io/library/postgres:14
+    image: docker.io/library/postgres:14.24-alpine
     restart: always
     environment:
       - POSTGRES_USER=gitea

gitea/k8s/gitea.yaml

@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
         - name: gitea
-          image: docker.gitea.com/gitea:1.26
+          image: docker.gitea.com/gitea:1.27.3
           envFrom:
             - configMapRef:
                 name: gitea-config

gitea/k8s/postgres.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: gitea-postgres
-          image: postgres:14
+          image: postgres:14.24-alpine
           env:
             - name: POSTGRES_USER
               valueFrom:
@@ -45,7 +45,7 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: gitea-secrets
-                  key: GITEA__database__USER
+                  key: GITEA__database__NAME
           ports:
             - containerPort: 5432
               name: postgres

glance/compose.yaml

@@ -1,7 +1,7 @@
 services:
   glance:
     container_name: glance
-    image: glanceapp/glance
+    image: glanceapp/glance:v0.8.6
     restart: unless-stopped
     volumes:
       - ./config:/app/config:ro

glance/k8s/glance.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: glance
-          image: glanceapp/glance
+          image: glanceapp/glance:v0.8.6
           envFrom:
             - secretRef:
                 name: glance-secrets

headscale/compose.yaml

@@ -1,6 +1,6 @@
 services:
   headscale:
-    image: headscale/headscale:latest
+    image: headscale/headscale:0.29.3
     restart: unless-stopped
     container_name: headscale-server
     command: serve
@@ -53,7 +53,7 @@ services:
       - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
       - "traefik.http.routers.headscale-metrics-dev.tls=true"
   headplane:
-    image: ghcr.io/tale/headplane:latest
+    image: ghcr.io/tale/headplane:0.7.1
     container_name: headplane
     restart: unless-stopped
     ports:
@@ -100,7 +100,7 @@ services:
       - "traefik.http.routers.headplane-dev.entrypoints=websecure"
       - "traefik.http.routers.headplane-dev.tls=true"
   web:
-    image: goodieshq/headscale-admin:latest
+    image: goodieshq/headscale-admin:0.28.0
     restart: unless-stopped
     ports:
       - 10080:80

kener/compose.yaml

@@ -1,6 +1,6 @@
 services:
   kener:
-    image: rajnandan1/kener:4.0.23
+    image: rajnandan1/kener:4.1.5
     container_name: kener
     restart: unless-stopped
     # ports:
@@ -36,7 +36,7 @@ services:
       - proxy
       - kener
   redis:
-    image: redis:7-alpine
+    image: redis:7.4.11-alpine
     container_name: kener-redis
     restart: unless-stopped
     volumes:

kener/k8s/kener.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: kener
-          image: rajnandan1/kener:4.1.0
+          image: rajnandan1/kener:4.1.5
           envFrom:
             - configMapRef:
                 name: kener-config

kener/k8s/redis.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7-alpine
+          image: redis:7.4.11-alpine
           ports:
             - containerPort: 6379
           volumeMounts:

metube/compose.yaml

@@ -1,6 +1,6 @@
 services:
   metube:
-    image: ghcr.io/alexta69/metube
+    image: ghcr.io/alexta69/metube:2026.08.28
     container_name: metube
     restart: unless-stopped
     # ports:

metube/k8s/metube.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: metube
-          image: ghcr.io/alexta69/metube
+          image: ghcr.io/alexta69/metube:2026.08.28
           envFrom:
             - configMapRef:
                 name: metube-config

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n
+    image: docker.n8n.io/n8nio/n8n:2.38.7
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n
+          image: docker.n8n.io/n8nio/n8n:2.38.7
           envFrom:
             - configMapRef:
                 name: n8n-config

netronome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   netronome:
-    image: ghcr.io/autobrr/netronome:latest
+    image: ghcr.io/autobrr/netronome:v0.14.0
     restart: unless-stopped
     container_name: netronome
     ports:
@@ -33,7 +33,7 @@ services:
         condition: service_healthy
   postgres:
     container_name: netronome-postgres
-    image: postgres:17-alpine
+    image: postgres:17.11-alpine
     environment:
       - POSTGRES_USER=netronome
       - POSTGRES_PASSWORD=netronome

netronome/k8s/netronome.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: netronome
-          image: ghcr.io/autobrr/netronome:latest
+          image: ghcr.io/autobrr/netronome:v0.14.0
           ports:
             - name: netronome-port
               protocol: TCP

netronome/k8s/postgres.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: netronome-postgres
-          image: postgres:17-alpine
+          image: postgres:17.11-alpine
           ports:
             - name: postgres-port
               protocol: TCP

penpot/compose.yaml

@@ -84,7 +84,7 @@ services:
   #     - "443:443"
 
   penpot-frontend:
-    image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/frontend:${PENPOT_VERSION:-2.17.2}"
     restart: always
     # ports:
     #   - 9001:8080
@@ -119,7 +119,7 @@ services:
     environment:
       <<: [*penpot-flags, *penpot-http-body-size]
   penpot-backend:
-    image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/backend:${PENPOT_VERSION:-2.17.2}"
     restart: always
 
     volumes:
@@ -189,7 +189,7 @@ services:
       # PENPOT_SMTP_SSL: false
 
   penpot-exporter:
-    image: "penpotapp/exporter:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/exporter:${PENPOT_VERSION:-2.17.2}"
     restart: always
 
     depends_on:
@@ -209,7 +209,7 @@ services:
       PENPOT_REDIS_URI: redis://penpot-valkey/0
 
   penpot-postgres:
-    image: "postgres:15"
+    image: "postgres:15.19-alpine"
     restart: always
     stop_signal: SIGINT
 
@@ -233,7 +233,7 @@ services:
       - POSTGRES_PASSWORD=penpot
 
   penpot-valkey:
-    image: valkey/valkey:8.1
+    image: valkey/valkey:8.1.10
     restart: always
 
     healthcheck:

portainer/compose.yaml

@@ -1,6 +1,6 @@
 services:
   portainer:
-    image: portainer/portainer-ce:2.41.0
+    image: portainer/portainer-ce:2.45.0
     container_name: portainer
     restart: always
     volumes:

portainer/k8s/portainer.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: portainer
-          image: portainer/portainer-ce:2.41.0
+          image: portainer/portainer-ce:2.45.0
           ports:
             - containerPort: 9000
           volumeMounts:

prometheus-stack/compose.yaml

@@ -1,6 +1,6 @@
 services:
   grafana:
-    image: grafana/grafana:11.6.0
+    image: grafana/grafana:13.2.1
     container_name: prometheus-grafana
     restart: unless-stopped
     env_file:
@@ -30,7 +30,7 @@ services:
       - proxy
 
   prometheus:
-    image: prom/prometheus:v3.2.1
+    image: prom/prometheus:v3.14.0
     container_name: prometheus-prometheus
     restart: unless-stopped
     command:
@@ -44,7 +44,7 @@ services:
       - proxy
 
   alertmanager:
-    image: prom/alertmanager:v0.28.1
+    image: prom/alertmanager:v0.34.0
     container_name: prometheus-alertmanager
     restart: unless-stopped
     command:

searxng/compose.yaml

@@ -3,7 +3,7 @@
 services:
   core:
     container_name: searxng-core
-    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-latest}
+    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.09.13-d4ce87c23}
     restart: unless-stopped
     # ports:
     # - ${SEARXNG_PORT:-8080}
@@ -31,7 +31,7 @@ services:
 
   valkey:
     container_name: searxng-valkey
-    image: docker.io/valkey/valkey:9-alpine
+    image: docker.io/valkey/valkey:9.1.2-alpine
     command: valkey-server --save 30 1 --loglevel warning
     restart: unless-stopped
     volumes:

searxng/k8s/searxng.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: searxng
-          image: docker.io/searxng/searxng:latest
+          image: docker.io/searxng/searxng:2026.09.13-d4ce87c23
           envFrom:
             - configMapRef:
                 name: searxng-config

searxng/k8s/valkey.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: valkey
-          image: docker.io/valkey/valkey:9-alpine
+          image: docker.io/valkey/valkey:9.1.2-alpine
           command:
             - valkey-server
             - --save

termix/compose.yaml

@@ -1,6 +1,6 @@
 services:
   termix:
-    image: ghcr.io/lukegus/termix:latest
+    image: ghcr.io/lukegus/termix:2.7.1
     container_name: termix
     restart: unless-stopped
     # ports:

termix/k8s/termix.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: termix
-          image: ghcr.io/lukegus/termix:latest
+          image: ghcr.io/lukegus/termix:2.7.1
           envFrom:
             - configMapRef:
                 name: termix-config

traefik/compose.yaml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: traefik:v3.7.4
+    image: traefik:v3.7.13
     container_name: traefik
     restart: unless-stopped
     command:

uptime-kuma/compose.yaml

@@ -1,6 +1,6 @@
 services:
   uptime-kuma:
-    image: louislam/uptime-kuma:2
+    image: louislam/uptime-kuma:2.5.4
     container_name: uptime-kuma
     restart: unless-stopped
     volumes:

uptime-kuma/k8s/uptime-kuma.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: uptime-kuma
-          image: louislam/uptime-kuma:2
+          image: louislam/uptime-kuma:2.5.4
           resources:
             limits:
               memory: "3Gi"

vaultwarden/compose.yaml

@@ -1,7 +1,7 @@
 services:
   server:
     container_name: vaultwarden-server
-    image: vaultwarden/server:latest
+    image: vaultwarden/server:1.37.3
     restart: unless-stopped
     ports:
       - 9993:80

vaultwarden/k8s/vaultwarden.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:latest
+          image: vaultwarden/server:1.37.3
           ports:
             - containerPort: 80
           envFrom: