Cupdate

Cupdate is a lightweight, zero-configuration service that discovers container images running on Kubernetes, Docker or Podman hosts, identifies newer available image versions, and surfaces version and vulnerability metadata through a UI, API and RSS feed.

Key Features

• Auto-detects container images in use across Kubernetes clusters or Docker/Podman hosts (single or multiple, local or remote)
• Identifies latest available image versions and correlates them with deployed versions
• Vulnerability data aggregation using registry or third-party sources (e.g., Docker Scout, Clair, GitHub Advisories, OSV) when available
• Visual UI for browsing images, versions, dependants and release notes
• Machine-friendly APIs and RSS feeds for integrations and automation
• Lightweight design with low CPU and memory footprint suitable for running alongside existing infrastructure
• Supports multiple OCI registries and common hosts (examples: docker.io, ghcr.io, quay.io, registry.k8s.io and other OCI-compliant registries)

Use Cases

• DevOps teams auditing deployed container images to prioritize manual upgrades
• Security teams reviewing aggregated vulnerability metadata for images in production
• Platform or SRE engineers building dashboards or automation that integrate image/version data via the API or RSS

Limitations and Considerations

• Cupdate does not perform deployments or modify manifests; it is intended as a discovery and reporting/dashboard tool, not an automated updater
• Podman support is labelled beta and requires Docker socket compatibility mode; behavior and compatibility may change
• Vulnerability coverage depends on participating registries and available SBOMs/advisories; not all images or registries will provide full scan data

Cupdate is intended as a discovery and observability tool to help teams see what container images are in use and what updates exist. It is suited to complement CI/CD or automated manifest-updater services rather than replace them.