Every service, a versioned image.
Each service runs as a container from an image kept in a private registry. Divan’s estate shows the shape: a web front end, a backend with its workers, a document editor, a diagram editor, a workflow engine, video, a secrets store and remote sessions, each a named service. What runs is written down in Compose files, not assembled by hand.
What it holds
| Private registry (Forgejo) | where every image the estate runs is kept |
|---|---|
| Docker Compose | each stack written down in one file |
| Portainer CE | deploys and manages the stacks |
| Watchtower | moves labelled services to a new image |
| Background workers | separate services for slow and scheduled work |
| OpenBao | the secrets store in Divan’s estate |
What it promises
Pulled from your own registry
Production hosts pull finished images from the private registry. In Divan’s estate every image comes from there, third-party ones such as PostgreSQL and Collabora included.
Pinned where it matters
Third-party services run at a stated version, such as PostgreSQL 16, Meilisearch 1.11 and OpenBao 2.7.1. Moving to a new one is a decision, not a surprise.
Updates roll out by label
Watchtower checks for new images every hour and recreates only the services labelled for it. A service that should change only by hand is labelled to stay put.
Written down, not remembered
Each stack is a Compose file kept in a repository and deployed through Portainer. What runs can be read from a file instead of pieced together from a server.
What people ask
Can you run software we already use?
If it ships as a container image, it can be copied into the private registry and run beside the rest. Divan’s estate runs Collabora, draw.io, Flowable and OpenBao this way.
Who decides when an update goes live?
You do, service by service. Services labelled for automatic updates move to a new image within the hour it is published. The others wait for a deploy someone runs.
Does production depend on public registries?
Not at run time. Hosts pull images from the private registry. Public package registries are used only while building, through a cache.