ssh-action VS watchtower

This GitHub action will use another ssh-action action to handle the remote ssh connection. After storing the connection credentials in the GitHub repository secrets, this can securely/dynamically connect to the remote Ubuntu machine. The last key for this action job is the script, or verbatim Ubuntu commands that will be run. For the sake of brevity, I have only written pseudo-code for the deployment steps.

If you have SSH setup, you could have the your pipeline SSH in and run start your script. A quick search found a few actions that might work, including this one that does most of the heavy lifting for you. Just setup your secrets, give it the command you want to run, and it'll go from there. Good luck!

Then on my backend and frontend GitHub repos, I'll have another GitHub Actions workflow that uses something like appleboy/ssh-action to simply SSH into my server, pull the new images, and re-start the containers, whenever someone pushes to master.

Personally I use GitHub Actions that connects via SSH and runs custom bash deploy scripts.

Executing remote ssh commands using appleboy/ssh-action@master.

Yeah it's definitely a pet project. I'll look into Puppet for actual applications. Do you think that something like this would be a good, realistic alternative rather than going over HTTPS, if the use case is just a few simple, repeated shell commands: https://github.com/marketplace/actions/ssh-remote-commands

SSH Remote Commands

Or you combine part of both and use a GitHub action to run the script from the first action as a remote SSH command: https://github.com/marketplace/actions/ssh-remote-commands

You could add a Github Action to your repo which uses https://github.com/appleboy/ssh-action that SSHs into your server, pulls the repo there and restarts pm2.

Related: https://github.com/containrrr/watchtower

> if you're using the docker image, upgrades are a breeze. Just bump the tag on the image, redeploy, and you're done.

Or you could just run Watchtower beside it and it will automatically update your docker containers. https://github.com/containrrr/watchtower If you are OK with automated updates.

So i primarily use containers on my local machine walled off from the internet, so it's not a big concern for me. Watchtower [1] is popular among home server users too which automatically updates containers to the latest image.

For production uses I think companies generally build their own containers. They would have a common base linux container and build the other containers based off that with a typical CI/CD pipeline. So if glibc is patched, it's probably patched in the base container and the others are then rebuilt. You don't have to patch each container individually, just the base. Production also minimizes the scope of containers with nothing installed except what's necessary so they have few dependencies.

[1] https://github.com/containrrr/watchtower

You can use Watchtower (https://containrrr.dev/watchtower/) that solves problem of manual pulling on VPS.

I checked https://containrrr.dev/watchtower/ and Arguments, but I don't understand where to attach that using portainer.

Again, there are options to automate some of the burden here by using tools such as Watchtower.

Have you ever deployed a Docker app on a server, but everytime you push a new version of your image to a Docker registry you need to manually restart your app? If you want to automate this restarting, this blog post is for you! I am now going to show you how you can do this with literally 1 simple command using Watchtower!