Renovate Community Hosted - Renovate Taking a long time to pull down new image tag

[sthwang-metal]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

42.74.5

Please tell us more about your question or problem

Right now when we push a new tag to our image repo that our self-hosted harbor proxies images from, renovate doesn't pick up on the change for hours at a time. This is even after pulling the image through the proxy-cache manually and manually triggering a renovate scan in the UI after.

This is what our renovate config looks like:

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": [
        ...
    ],
    "packageRules": [
        {
            "description": "app-* images with versioned tags like 20260106T194232Z-221eef90-1.9.0",
            "groupName": "docker image tag bumps (helm & compose)",
            "groupSlug": "docker-image-tag-bumps",
            "matchDatasources": [
                "docker"
            ],
            "matchFileNames": [
                "helm/**/values*.yaml",
                "**/Dockerfile*",
                "**/docker-compose*.yml"
            ],
            "matchManagers": [
                "helm-values",
                "docker-compose",
                "dockerfile"
            ],
            "matchPackageNames": [
                "harbor.subdomain.domain.net/some-proxy-cache/image-repo/app-*"
            ],
            "allowedVersions": "/^\\d{8}T\\d{6}.*$/",
            "versioning": "regex:^(?<major>\\d{8})T(?<minor>\\d{6}).*$",
            "maxMajorIncrement": 100000
        },

We tried running a local runner on a personal laptop and it seems to pick up on the change immediately, with config:

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": ["config:recommended"],
    "packageRules": [
        {
            "description": "app-* images with versioned tags like 20260106T194232Z-221eef90-1.9.0",
            "groupName": "docker image tag bumps (helm & compose)",
            "groupSlug": "docker-image-tag-bumps",
            "matchDatasources": ["docker"],
            "matchFileNames": [
                "helm/**/values*.yaml",
                "**/Dockerfile*",
                "**/docker-compose*.yml"
            ],
            "matchManagers": ["helm-values", "docker-compose", "dockerfile"],
            "matchPackageNames": [
                "harbor.subdomain.domain.net/some-proxy-cache/image-repo/app-*",
            ],
            "allowedVersions": "/^\\d{8}T\\d{6}.*$/",
            "versioning": "regex:^(?<major>\\d{8})T(?<minor>\\d{6}).*$",
            "maxMajorIncrement": 100000
        },
    ],
}

Is there a cache value configured anywhere for docker cache duration?

i finally got around to debugging a longstanding issue and I think i finally figured it out. The issue is, sometimes, it can be up to 12 hours from the time an image tag hits harbor (i have renovate configured to look at harbor see first config) to actually get picked up by renovate.

it would be puzzling/frustrating; I'd verify the image is in Harbor (with oras tags ..., docker pull)run a renovate run, and itd be like "nothing new". Sometimes for 2, sometimes up to 12 hours. Id wake up the next day and the image would be there.
So I experimented with a LOCAL runner (see second config), which has no cache, and surprise surprise, it picks the image up instantly.

Therefore, my hypothesis is that the tags for a given docker container from Harbor are being cached in the cloud runners, probably as a defense against whacking that registry too hard. But im wondering if we can decrease this time, but id like to first know what the default cache value is.

Logs (if relevant)

No response

[sthwang-metal]

ok i just did another test that I think is pretty confirmatory:

• merged a tag into Harbor 20260108T193946Z-d8fd8bb2-1.10.0
• i ran renovate locally using the same built docker image. nothing! no PR
• i blew away that docker image completely, and repulled
• reran it after repull, and instant PR