How to automatically update Swarm services when the Docker daemon restarts

I'm using Docker Swarm, and I have condition: always in the restart_policy of my compose file, so my services are started automatically when the system reboots or the Docker daemon is restarted.

What I'm trying to achieve is to also have the services pull and run the latest image when the system reboots or the daemon is restarted. This is for an IoT device, so yes, I really do want to do this.

Now, if I manually take down and restart the stack, or if I use docker service update --force --image my-image:latest my-service, then the latest image is pulled and ran. But if I restart the system, it just keeps running the old image, and doesn't pull the latest one.

I could work around this by removing the restart policy and using systemd to manage lifecycle instead, but I really don't want that extra hassle or complexity, and I'm not even sure how to work that to restart services that crash.

Is there some way to achieve this with Docker Swarm alone?

You don't need a restart policy with swarm mode. Swarm mode will constantly try to reconcile any differences between the current and target state. I've seen cases where the restart policy enforced by the docker engine, and the implicit reconciliation in swarm mode have conflicted and resulted in issues. The restart policy would also restart the stopped container which would implicitly break the goal to use a new image since the image can not change for the life of a container. Swarm mode, conversely, will recreate any stopped containers with a new container.

To have swarm use the current value of a tag, rather than resolving that tag to an image digest on the initial deploy, you need docker stack deploy --resolve-image .... Note that I haven't tested if this will pull new images, I've only needed to use the feature to use locally built images that shouldn't be pulled from a registry. If Swarm mode doesn't pull new images, you'll also want an extra process to pull your image periodically.

StackExchange DevOps Q#11152, answer score: 2