Problem

Some time ago, I noticed that a few of the integration tests using LocalStack were failing. It turned out that the container image had not been updated for two and a half years! I thought it would be a good idea to bring it up to date…

Solution

At first, I thought about setting the container image version to the latest, but it is not a good idea - it can lead to unexpected test failures when a new version of the image is released.

Second thought was about using Dependabot, but I noticed that it sadly does not support updating code.

Luckily, Dependabot supports updating Dockerfiles, so I created a Dockerfile named Dockerfile.localstack in test/resources folder with the following content:

FROM localstack/localstack:4.14.0

Then I pointed Dependabot to this file:

version: 2

updates:
  - package-ecosystem: docker
    directory: "/src/test/resources"
    schedule:
      interval: daily

Above configuration tells Dependabot to check for updates in Dockerfile.* files every day. When a new version of the image is released, Dependabot will create a pull request with the updated version.

The last part is to make tests use the image from Dockerfile.localstack:

import org.testcontainers.utility.DockerImageName;

// ...

private static DockerImageName imageNameFromResource(String resourceName) {
    var content = getResourceContent(resourceName);
    var matcher = Pattern.compile("^FROM\\s+(\\S+)").matcher(content);
    if (matcher.find()) {
        return DockerImageName.parse(matcher.group(1).trim());
    } else {
        var errMsg = "Invalid docker image format. Current image: `%s`".formatted(content);
        throw new IllegalArgumentException(errMsg);
    }
}

private static String getResourceContent(String resourceName) {
    try (var reader = Files.newBufferedReader(Path.of(resourceName))) {
        return reader.readLine();
    } catch (IOException e) {
        throw new RuntimeException("Failed to read resource content", e);
    }
}

In the above code, imageNameFromResource method reads the content of the resource file and extracts the image name from it.

When completed, this setup allows you to have atomic pull requests with an updated image version. Any incompatibility would cause the tests to fail, making it easy to fix the issue within the same pull request.

Caveats

When I used Renovate instead of Dependabot I noticed that renovate pins digests of images alongside version tags. This improves build stability, but it is not handled properly by Testcontainers. Until this PR gets into new Testcontainers version I recommend turning off digest pinning in Renovate config:

{
  "matchManagers": [
    "dockerfile"
  ],
  "matchFileNames": [
    "src/test/resources/**"
  ],
  "pinDigests": false
}

Summary

In this article, I showed how to keep Testcontainers tests up to date with Dependabot. This approach can be used for any container image, not just LocalStack. It is a great way to ensure that tests are always using the latest version of the image, while preserving the stability of the test setup.