This package has three image sources: the Nextcloud image (built locally from the official nextcloud:<version>-apache image, with ffmpeg layered on), plus Postgres and Valkey sidecars pulled directly from Docker Hub.
The upstream for the Nextcloud image is nextcloud/docker, which publishes to
library/nextcloudon Docker Hub. It is not nextcloud/server — that's the server source code, and the Docker image is released on its own cadence (not every server release ships an image immediately). Treat the Docker Hub tag as the source of truth for what's bumpable.
Nextcloud (library/nextcloud on Docker Hub):
curl -fsSL "https://hub.docker.com/v2/repositories/library/nextcloud/tags?page_size=50&ordering=last_updated" \
| jq -r '.results[].name' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+-apache$' | headCurrent pin: the NEXTCLOUD_VERSION ARG default in nextcloud.Dockerfile.
Postgres (library/postgres on Docker Hub):
curl -fsSL "https://hub.docker.com/v2/repositories/library/postgres/tags?page_size=30&ordering=last_updated" \
| jq -r '.results[].name' | grep -E '^17.*alpine' | headCurrent pin: postgres:17-alpine in startos/manifest/index.ts (images.postgres.source.dockerTag).
Valkey (valkey/valkey on Docker Hub):
curl -fsSL "https://hub.docker.com/v2/repositories/valkey/valkey/tags?page_size=30&ordering=last_updated" \
| jq -r '.results[].name' | grep -E '^9.*alpine' | headCurrent pin: valkey/valkey:9-alpine in startos/manifest/index.ts (images.valkey.source.dockerTag).
Nextcloud — bump the NEXTCLOUD_VERSION ARG default in nextcloud.Dockerfile to the new patch version (e.g. 32.0.9 → 32.0.10). The -apache suffix is appended by the FROM line; don't include it in the ARG value.
A major bump (e.g. 33.0.8 → 34.0.3) needs five more checks:
- Diff
core/shipped.jsonbetween the two tags and add whatever the new major appends todefaultEnabledandalwaysEnabledto thedefaultAppslist instartos/actions/maintenance/disableUnstableApps.ts.occ app:disableexits non-zero on analwaysEnabledapp, and the action runs underexecFail, so one missing id breaks the recovery action a locked-out user is told to run. - Check
$OC_VersionCanBeUpgradedFromin the new tag'sversion.php. Nextcloud upgrades one major at a time, so every version the registry still lists must be within one major of the new image —guardUpstreamUpgradeinstartos/init/bootstrapNextcloud.tsrefuses the rest before the version graph runs. - Move the version graph's floor to the previous major:
startos/versions/declares onlycurrentand a<previous major>.0.0:0floor whoseupisIMPOSSIBLE. A floor left a major lower letscanMigrateFromaccept installs the guard then refuses, so StartOS offers them this release instead of the previous major's. - Diff
config/config.sample.phpbetween the two tags against the keysstartos/fileModels/config.php.tsmodels, and against the defaults the README andinstructions.mdquote. - Re-check the new major's system requirements page for the supported PostgreSQL and PHP versions.
Postgres — change the dockerTag value in images.postgres.source in startos/manifest/index.ts. The pin tracks the 17 major; bumping across major versions (e.g. 17 → 18) requires a data migration in startos/versions/.
Valkey — change the dockerTag value in images.valkey.source in startos/manifest/index.ts. The pin tracks the 9 major.