Automated Docker Base Image Tag Watch
Every morning, WebRun opens Docker Hub, checks the base image repositories your Dockerfiles pull from, finds tags published since yesterday with their digests and push dates, records each in Notion against the services that use it, and pings Telegram when a base image you depend on has moved.
How do I get notified when a Docker base image publishes a new tag?
WebRun checks Docker Hub every morning for new tags on the base images your Dockerfiles pull from, capturing push dates and digests, including pinned tags that quietly repointed. It records each against the services that use it in Notion and pings Telegram, so rebuilds are planned rather than forced later.
- Upstream base image changes are known the morning they land
- A pinned tag that repointed is caught, not just brand new tags
- Every alert names the services a rebuild would touch
Built for platform engineers · DevOps teams · SRE · backend engineering leads
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
hub.docker.comin a real browser with your saved login - no setup, no API keys. -
1
Docker Hub - check upstream base image tags
docker.com
WebRun opens Docker Hub to check upstream base image tags. - Open each base image repository on your watch list
- Read the tags published since the previous run with their push dates and image digests
- Check whether a floating tag you pin to, such as a major version or a stable line, now points at a new digest
- Note anything marked deprecated or no longer receiving updates
Done when Every watched base image has its new tags and any digest change since yesterday recorded.
-
2
Notion - record tags against your services
notion.so
WebRun opens Notion to record tags against your services. - Update the base image page with the new tag, its digest, and the date it was pushed
- List the services whose Dockerfiles pull that base, so the blast radius of a rebuild is clear
- Keep the previous digest alongside the new one so a rollback target is always written down
Done when Notion shows the current tag and digest per base image, with the services that depend on each.
-
3
Telegram - ping when a rebuild is due
telegram.org
WebRun opens Telegram to ping when a rebuild is due. - Send a short message when a base image your services pull has published a new tag or moved a pinned digest
- Name the image, the new tag, the push date, and the services that would be rebuilt
- Skip the message on a morning where nothing upstream moved
Done when Any base image that moved has a Telegram message naming it and the services affected.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will it rebuild or push images for me?
No. WebRun reads Docker Hub and reports what moved upstream. Rebuilding, retagging, or pushing an image stays with your pipeline, so no build is triggered by a run.
Does it catch a pinned tag whose digest changed?
Yes. It compares the digest behind each floating tag with the one recorded last time, so a stable or major-version tag that quietly repointed is flagged like any new tag.
How does it know which services are affected?
You map each base image to the services that pull it once, and the Notion page keeps that mapping, so every alert names the services a rebuild would touch.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.