Renovate as a one-shot container

When you leave GitHub, you leave its bot ecosystem too. No Dependabot, no Actions-triggered Renovate. If you want automated dependency updates, you wire it up yourself.

Mine’s been running for months across both my self-hosted Forgejo and GitHub repos. The commit log is wall-to-wall Renovate PRs 🤖 — proof it works. It runs while I’m at work, at a match, or away with the family. I come back to PRs, not stale images.

Not a daemon

The key decision: Renovate runs as a one-shot Docker container, not a service. It starts, scans every repo, creates or updates PRs, and exits. Nothing listening, nothing to restart.

Two services, one compose file — one per platform:

services:
  renovate-forgejo:
    image: renovate/renovate:latest@sha256:…
    restart: "no"
    environment:
      - RENOVATE_PLATFORM=forgejo
      - RENOVATE_ENDPOINT=https://git.maiis.ch/api/v1
      - RENOVATE_TOKEN=${RENOVATE_TOKEN_FORGEJO}
      - RENOVATE_AUTODISCOVER=true
      - RENOVATE_AUTODISCOVER_FILTER=maiis/*
      - RENOVATE_ONBOARDING=false
      - RENOVATE_DEPENDENCY_DASHBOARD=false

  renovate-github:
    image: renovate/renovate:latest@sha256:…
    restart: "no"
    environment:
      - RENOVATE_PLATFORM=github
      - RENOVATE_TOKEN=${RENOVATE_TOKEN_GITHUB}
      - RENOVATE_REPOSITORIES=${GITHUB_REPOSITORIES}

Swap the platform flag and the token — everything else is the same. RENOVATE_DEPENDENCY_DASHBOARD=false on the Forgejo instance specifically: leaving it on triggers API calls that reliably timeout on Forgejo.

What it updates

It’s all Docker Compose files pinned to SHA256 digests — no floating tags, every image locked to an exact hash. Renovate groups all outdated digests into a single PR and auto-merges it. Minor and major version bumps get their own labeled PR; those need a manual approval, then the platform’s automerge handles the rest. One click.

The takeaway

The only things GitHub provided here were a trigger and a runner — the rest was always just Renovate. Point it at any host, flip the platform flag, run it however you like. The homelab it keeps updated is reachable from anywhere — that’s a different post 🏠.