Renovate

Last reviewed Aug 26, 2026 · 832 words

The best homelab use of Renovate has nothing to do with npm. Point it at the repository holding your Docker Compose files and it opens a pull request every time postgres, immich-server, or caddy publishes a new tag, with the release notes linked, on whatever schedule you set. That is Watchtower's job done properly: you see the change, read the notes, merge when ready, and rollback is git revert. Self-hosted, it runs as a cron job in a container against Gitea, Forgejo, or GitLab, and needs about 1 GB of RAM while working. The setup is 20 minutes. The tuning that stops it opening 40 PRs on day one is the part this guide is really about.

It's a cron job, not a service

Renovate has no daemon and no UI. Each run clones your repos, works out what's outdated, opens or updates PRs, and exits. So the Compose service should never be restart: always:

services:
  renovate:
    image: renovate/renovate:latest
    environment:
      RENOVATE_PLATFORM: gitea
      RENOVATE_ENDPOINT: https://git.example.com/api/v1
      RENOVATE_TOKEN: ${RENOVATE_TOKEN}
      RENOVATE_GIT_AUTHOR: "Renovate <[email protected]>"
      RENOVATE_AUTODISCOVER: "true"
      LOG_LEVEL: info

Trigger it with docker compose run --rm renovate from a host cron entry, nightly is plenty. Create a dedicated bot user on your forge, give it write access to the repos it should manage, and issue the token for that user; PRs then come from "Renovate" rather than from you. Forgejo works with the gitea platform setting. Autodiscover finds every repo the bot can see; if that's too broad, replace it with RENOVATE_REPOSITORIES: homelab/compose.

The onboarding PR, and the config that stops the flood

The first run doesn't update anything. It opens an onboarding PR that adds a renovate.json and lists what it would do. Merge that after editing it to something like:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "schedule:weekends",
    "group:allNonMajor"
  ],
  "prConcurrentLimit": 5,
  "packageRules": [
    {
      "matchUpdateTypes": ["major"],
      "labels": ["breaking"]
    }
  ]
}

Those three presets do most of the work. schedule:weekends means PRs arrive when you have time to look. group:allNonMajor folds every minor and patch bump into one PR instead of one per image. prConcurrentLimit caps the open count so the first weekend produces 5 PRs, not 40. Major updates stay separate and labelled, because a Postgres major is a migration, not a tag change. The catalogue is right that the option count is overwhelming; the trick is to start from a preset and add rules only when a specific PR annoys you.

Pin your tags or it has nothing to do

Renovate can only update a version it can read. image: postgres:latest gives it nothing; image: postgres:16.4 gives it a patch PR next month and a major PR when 17 lands. Go through your Compose files once and replace every latest with the tag currently running (docker inspect shows the image's actual tag or digest). If you also enable digest pinning (docker:pinDigests preset), Renovate appends @sha256:... and updates that too, which is the only way to guarantee that "16.4" on your disk is the same "16.4" as yesterday.

Where it beats Watchtower, and where Dependabot is enough

Watchtower pulls new images blind, at whatever time it wakes, with no record of what changed; the container updates post covers why that eventually bites. Renovate makes the update a diff. On the other side, if your repos live on GitHub, self-hosting Renovate is pointless: the hosted Renovate app from Mend is free for public and private repos, and Dependabot is built in. Self-hosting is for people whose Git lives on their own hardware, which is the audience of this site.

1 GB of RAM, a slow first run, AGPL

Renovate is a Node application and it clones repositories to work on them, so the first run against a big monorepo can take 10 minutes and a surprising amount of disk in /tmp/renovate. Later runs are faster because it caches package lookups. The AGPL-3.0 licence only matters if you modify Renovate and offer it as a service; running it for yourself is unrestricted. If 1 GB during a nightly job is a problem, run it on the same box as your forge and give the cron a window when nothing else is busy.

What I'd do

A bot user on Forgejo, the Compose file above, a nightly cron at 03:00, and the renovate.json with weekend scheduling and non-major grouping. Every tag pinned, digests on for the databases. Then treat Saturday morning's 2 or 3 PRs as the update ritual: read the notes, merge, docker compose pull && docker compose up -d. It replaces Watchtower for anything with data behind it, and I'd keep Watchtower only for stateless things I genuinely don't care about. That is the dev-tools workflow that made me stop dreading updates.