Only notify when a new digest is at least N days old

[debdutgoswami]

Description

Hey, would you consider a config option that gates notifications by manifest age?

Something like:

watch:
  schedule: "0 9 * * 0"
  min_image_age: 168h

Or as a per-image label: diun.min_image_age=168h.

The idea is: skip notifying about a new digest until it's been around for a while. If the manifest's Created timestamp is younger than the threshold, hold off, it'll get picked up on the next scheduled run once it ages in.

Two reasons this would be useful:

Day-zero noise. Watching :latest means seeing every rebuild the moment it ships. Most of the time I don't want to update on day one; I want to wait a bit and see if it's stable.

Supply chain safety. If a maintainer account or build pipeline gets compromised and a malicious image gets pushed to a rolling tag, those bad artifacts usually get caught and yanked within hours to days. A min-age gate means I never see the notification for a tag that didn't survive that window; by the time I'm notified, the community has had a chance to flag it. It's a cheap, voluntary "let the herd test it first" defense.

The data is already on hand .Entry.Manifest.Created is exposed in templates today. The change would be using it to filter as well as display.

Happy to take a stab at a PR if the idea has legs. Thanks for diun, it's exactly the right shape of tool.

[crazy-max]

Thanks for the suggestion. I understand the use case, but I'm not convinced this belongs in Diun as a notification gate.

Diun's job is mostly to detect image changes and notify about them. A cooldown/min-age policy makes more sense in tools that actually decide when to act on updates, like Renovate or Dependabot, where delaying an update PR is part of the dependency management workflow.

If this were ever added here, I think it should be called cooldown, not min_image_age, and it probably should not live under notification settings. It would need to be handled before Diun records the new digest, otherwise the first run would save the digest, skip the notification, and later runs would see it as unchanged.

[einfallstoll]

I just searched the docs for this exact feature and came here to suggest this as well.

In my opinion it should live on a per-image or per-registry configuration. E.g., I want updates as soon as they are pushed on certain images (maybe the ones I create myself, or my organization), but have a delay on public registries.

Personally, I use diun on my VPS and manually trigger updates in Dockge as soon as an update is available. That's why this kind of delay / cooldown could help to mitigate basic supply chains attack and also give a bit of a cooldown (I like the name).

Alternatively, I could also imagine that it could make sense for diun to notify every outdated container (not just the first time an update is detected) and set the interval to weekly or less.