diun document

README.md

@@ -64,6 +64,34 @@ docker exec nginx nginx -s reload
 git add . && git commit && git push
 ```
 
+**Updating an app (Diun notification received):**
+
+Diun emails when a watched image has a new digest on the registry. The email
+names the image (e.g. `postgres:17-alpine`), not the container. To find which
+container uses it:
+
+```bash
+docker ps --filter "ancestor=<image>:<tag>" --format '{{.Names}}'
+```
+
+Then apply the update from that app's directory:
+
+```bash
+cd /opt/argento/docker/<app>
+docker compose pull
+docker compose up -d
+docker ps   # verify container is healthy
+```
+
+Then smoke-test the app (open the UI, or `curl -I https://<domain>`).
+
+Caveats before pulling:
+
+- Diun only reports that a digest changed -- it does not say the update is safe. For apps with schema migrations (Nextcloud, Immich, Gitea, Postgres), skim the release notes first.
+- For major version bumps, run `./scripts/backup.sh` manually before pulling so the USB has a fresh snapshot.
+- Postgres major version bumps (e.g. 17 -> 18) cannot reuse the old data dir -- a plain `compose up -d` will fail to start. See [RUNBOOK.md](RUNBOOK.md#maintenance-postgres-major-version-upgrade).
+- After several updates, reclaim disk with `docker image prune -f`.
+
 **Adding a new app:**
 
 1. Create `docker/<app>/compose.yaml` with `container_name` and `shared` network