docs(docker): use literal image tags so Dependabot maintains the example

Move the MariaDB, Redis, Collabora and Traefik image tags out of the .env
indirection and into literal tags in docker-compose.yml, then restore the
Dependabot `docker` ecosystem entry. Dependabot's compose parser reads image
tags literally and cannot resolve `${VAR}` interpolation or read the .env
file, so the previous env-var indirection meant Dependabot produced no update
PRs. Literal tags make the four infrastructure images automatically
maintained.

ownCloud keeps `owncloud/server:${OWNCLOUD_IMAGE}`: its version is a single
source of truth driven by the {latest-server-download-version} docs attribute
and reused by the Quick Evaluation example, so it is bumped deliberately
rather than by Dependabot.

Drop the now-unused MARIADB_IMAGE/REDIS_IMAGE/COLLABORA_IMAGE/TRAEFIK_IMAGE
variables from dot.env and their rows from the settings table, and reword the
"Pin image versions" note to match.

The smoke-test harness pinned Traefik to v3.6 (v3.3 fails against Docker
Engine >= 29) via ${TRAEFIK_IMAGE} in test.env; since the base file now hard-
codes v3.3, relocate that pin to an `image:` override in
docker-compose.override.yml so CI keeps booting.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

Author: DeepDiver1975

.github/dependabot.yml

@@ -27,3 +27,20 @@ updates:
         update-types:
           - minor
           - patch
+
+  # Docker images in the admin-manual compose example. Only literal image tags
+  # are updated here (owncloud/server uses ${OWNCLOUD_IMAGE} interpolation, which
+  # Dependabot cannot resolve, so it is intentionally left for manual bumps).
+  - package-ecosystem: docker
+    directory: "/modules/admin_manual/examples/installation/docker"
+    schedule:
+      interval: weekly
+      day: sunday
+      time: '22:00'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch

modules/admin_manual/examples/installation/docker/docker-compose.yml

@@ -68,7 +68,10 @@ services:
     # Collabora Online Development Edition (CODE): the self-hosted office server
     # that ownCloud connects to as a WOPI client. See the "Enabling Collabora
     # Online (CODE)" section of the documentation for the required occ wiring.
-    image: collabora/code:${COLLABORA_IMAGE}
+    # Image tag pinned here (not in .env) so Dependabot keeps it current — see
+    # .github/dependabot.yml. Do not re-parameterize it: Dependabot cannot read
+    # ${VAR} interpolation.
+    image: collabora/code:24.04.13.2.1
     container_name: owncloud_collabora
     restart: always
     environment:
@@ -107,7 +110,8 @@ services:
     # ownCloud and Collabora containers. Routing/TLS is driven by the labels on
     # each service above; WebSocket upgrades (needed by CODE) are handled
     # transparently by Traefik.
-    image: traefik:${TRAEFIK_IMAGE}
+    # Pinned tag maintained by Dependabot (see .github/dependabot.yml).
+    image: traefik:v3.3
     container_name: owncloud_proxy
     restart: always
     command:
@@ -136,7 +140,8 @@ services:
       - frontend
 
   mariadb:
-    image: mariadb:${MARIADB_IMAGE}
+    # Pinned tag maintained by Dependabot (see .github/dependabot.yml).
+    image: mariadb:10.11
     container_name: owncloud_mariadb
     restart: always
     # No host ports are published. MariaDB is reached only by ownCloud over the
@@ -160,7 +165,8 @@ services:
       - backend
 
   redis:
-    image: redis:${REDIS_IMAGE}
+    # Pinned tag maintained by Dependabot (see .github/dependabot.yml).
+    image: redis:7
     container_name: owncloud_redis
     restart: always
     # No host ports are published. Redis is reached only by ownCloud over the

modules/admin_manual/examples/installation/docker/dot.env

@@ -6,8 +6,6 @@ OWNCLOUD_IMAGE={latest-server-download-version}
 OWNCLOUD_DOMAIN=owncloud.example.com
 OWNCLOUD_TRUSTED_DOMAINS=owncloud.example.com
 OWNCLOUD_OVERWRITE_CLI_URL=https://owncloud.example.com
-MARIADB_IMAGE=10.11
-REDIS_IMAGE=7
 
 # Initial ownCloud web UI admin account (used for first setup only).
 ADMIN_USERNAME=admin
@@ -22,12 +20,8 @@ COLLABORA_DOMAIN=collabora.example.com
 # Regex of the ownCloud host CODE accepts as WOPI host. Escape every dot with a
 # backslash so it is not treated as a regex wildcard.
 OWNCLOUD_DOMAIN_REGEX=owncloud\.example\.com
-# Pin CODE to a specific version for reproducible, auditable upgrades rather than
-# tracking the floating "latest" tag. Bump this deliberately when upgrading.
-COLLABORA_IMAGE=24.04.13.2.1
 COLLABORA_ADMIN_USERNAME=admin
 COLLABORA_ADMIN_PASSWORD=CHANGE_ME_COLLABORA
 
 # Reverse proxy (Traefik) and Let's Encrypt
-TRAEFIK_IMAGE=v3.3
 LETSENCRYPT_EMAIL=admin@example.com

modules/admin_manual/pages/installation/installing_with_docker.adoc

@@ -149,7 +149,7 @@ This example is a *starting point*, not a hardened deployment. Before you expose
 * *Keep the data tier private.* MariaDB and Redis are intentionally *not* published to the host and live on an internal `backend` network. Do not add `ports:` entries for them — an exposed, weakly-authenticated database or an unauthenticated Redis on a public host is trivially exploitable.
 * *Do not expose the Collabora admin console.* The example restricts the CODE admin console (`/browser/dist/admincontrol`, `/cool/adminws`) to private source ranges via a Traefik `ipallowlist` middleware. Adjust the ranges to match your network; never open these paths to the internet.
 * *Docker socket exposure.* The Traefik proxy mounts the Docker socket so it can read container labels. This grants control of the Docker daemon — effectively root on the host — and the `:ro` flag does *not* restrict the Docker API. For a hardened setup, place a scoped https://github.com/Tecnativa/docker-socket-proxy[docker-socket-proxy] in front of it.
-* *Pin image versions.* `COLLABORA_IMAGE` ships pinned to a specific version; keep it (and `OWNCLOUD_IMAGE`) pinned rather than tracking a floating `latest` tag, so upgrades are deliberate, reproducible, and auditable (see xref:#upgrading-owncloud[Upgrading ownCloud]).
+* *Pin image versions.* The MariaDB, Redis, Collabora and Traefik images are pinned to specific tags directly in the `docker-compose.yml` file (kept current automatically via Dependabot in the docs repository); the ownCloud version is set with `OWNCLOUD_IMAGE` in the `.env` file. Keep them pinned rather than tracking a floating `latest` tag, so upgrades are deliberate, reproducible, and auditable (see xref:#upgrading-owncloud[Upgrading ownCloud]).
 ====
 
 . Create an `.env` configuration file in the same directory, which contains the required configuration settings.
@@ -211,14 +211,6 @@ a| xref:{config-sample}#override-cli-url[OWNCLOUD_OVERWRITE_CLI_URL]
 | The MariaDB `owncloud` user password (also used by ownCloud to connect)
 | `CHANGE_ME_DB_APP`
 
-| `MARIADB_IMAGE`
-| The mariadb version
-| `10.11`
-
-| `REDIS_IMAGE`
-| The redis version
-| `7`
-
 | `COLLABORA_DOMAIN`
 | The public hostname Collabora Online (CODE) is served at
 | `collabora.example.com`
@@ -228,10 +220,6 @@ a| The ownCloud host that CODE accepts as WOPI host, as a regular expression. +
 Escape every dot with a backslash.
 | `owncloud\.example\.com`
 
-| `COLLABORA_IMAGE`
-| The Collabora Online (CODE) version
-| `latest`
-
 | `COLLABORA_ADMIN_USERNAME`
 | The Collabora admin console username
 | `admin`
@@ -240,10 +228,6 @@ Escape every dot with a backslash.
 | The Collabora admin console password
 | `CHANGE_ME_COLLABORA`
 
-| `TRAEFIK_IMAGE`
-| The Traefik reverse proxy version
-| `v3.3`
-
 | `LETSENCRYPT_EMAIL`
 | The email address used for Let's Encrypt certificate registration
 | `admin@example.com`

tests/docker-compose/docker-compose.override.yml

@@ -35,6 +35,12 @@ services:
       - traefik.http.routers.collabora-admin.tls.certresolver=
 
   proxy:
+    # Pinned to v3.6 for the test harness (the shipped example uses v3.3): the
+    # Docker provider in Traefik < 3.6 probes the daemon with API version 1.24
+    # before negotiating, which Docker Engine >= 29 refuses. v3.6 negotiates
+    # first, so the harness boots on modern local daemons and on CI alike. The
+    # routing/TLS behaviour under test is identical across these 3.x releases.
+    image: traefik:v3.6
     command:
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false

tests/docker-compose/test.env

@@ -7,16 +7,12 @@
 #   - test credentials (never reused anywhere real).
 
 # Pinned so a run is reproducible and CI is not surprised by a new release.
+# Only OWNCLOUD_IMAGE is set here: the base compose file uses
+# owncloud/server:${OWNCLOUD_IMAGE} (its version tracks the docs release), while
+# the MariaDB, Redis, Collabora and Traefik tags are literal in the base file.
+# The harness pins Traefik to v3.6 via image: in docker-compose.override.yml
+# (the shipped v3.3 fails against Docker Engine >= 29 — see the note there).
 OWNCLOUD_IMAGE=10.15.0
-MARIADB_IMAGE=10.11
-REDIS_IMAGE=7
-COLLABORA_IMAGE=24.04.13.2.1
-# Pinned to v3.6 for the test harness (not v3.3 like the shipped example): the
-# Docker provider in Traefik < 3.6 probes the daemon with API version 1.24
-# before negotiating, which Docker Engine >= 29 refuses. v3.6 negotiates first,
-# so the harness boots on modern local daemons and on CI alike. The routing/TLS
-# behaviour under test is identical across these 3.x releases.
-TRAEFIK_IMAGE=v3.6
 
 # *.localhost always resolves to 127.0.0.1; the smoke test uses curl --resolve.
 OWNCLOUD_DOMAIN=owncloud.localhost