Diun

Search the Marketplace for Diun on Ubuntu 24.04, choose your VM size, and attach an NSG that allows TCP 22 (SSH) from your management network. No other inbound port is needed, because Diun only makes outbound connections.

RG="diun-prod"; LOCATION="eastus"; VM_NAME="diun-01" IMAGE_URN="sac1647283583153:diun:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name diun-vnet --address-prefix 10.91.0.0/16 --subnet-name diun-subnet --subnet-prefix 10.91.1.0/24 az network nsg create -g "$RG" --name diun-nsg az network nsg rule create -g "$RG" --nsg-name diun-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:diun:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name diun-vnet --subnet diun-subnet --nsg diun-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Diun runs as a systemd service. Its local control API, which only Diun's own CLI subcommands use, is bound to loopback and is never reachable from the network.

sudo systemctl is-active diun ss -tln | grep 127.0.0.1:42286

You should see active and a single loopback listener on 127.0.0.1:42286. No other Diun listener exists on any interface.

On first boot, Diun writes a short quick-start note with the exact file paths and commands that you need. There is no secret to read here, because Diun has no login and no notifier credential ships in the image.

sudo cat /root/diun-info.txt grep -viE '^\s*#' /etc/diun/diun.yml | grep -iE 'password|token|webhookURL|apikey' || echo "no live notifier credential in the shipped config"

The note lists the config file, the watch list file, the notify log, the database path and the systemd unit name. The second command confirms that the shipped diun.yml carries no live notifier credential outside its commented example block.

This step shows Diun performing a real registry check against the starter watch list and sending a real notification, rather than a process sitting idle. The starter watch list ships with three well-known public images (nginx, redis, alpine), so you can see this the moment you connect.

cat /var/log/diun/notify.log journalctl -u diun --no-pager | grep -iE 'found|image\(s\) to analyze' | tail -6

The notify log holds one line per notification event, each with a real image reference, a status of new or update, and a timestamp. Diun's own log shows it querying the registry and finding the watched images. This confirms that Diun reaches out to Docker Hub and reports back, end to end.

Replace the starter watch list with the images that you care about. Edit /etc/diun/images.yml with your editor of choice (sudo vi /etc/diun/images.yml). Each entry is a Docker image reference. If you omit them, the registry defaults to docker.io and the tag defaults to latest.

- name: docker.io/library/postgres watch_repo: false - name: ghcr.io/your-org/your-app watch_repo: false

Save the file, then restart Diun to apply the change:

sudo systemctl restart diun
sudo systemctl is-active diun

The full field reference (including watch_repo to track every tag, include_tags / exclude_tags regular expressions, and per-image registry credentials via regopt) is documented at crazymax.dev/diun/providers/file.

Out of the box, new and updated image events are only logged locally, so you can see Diun working immediately with zero configuration. When you are ready, add your own notifier with your own credential by editing /etc/diun/diun.yml (sudo vi /etc/diun/diun.yml). Nothing is baked into the image, so you supply the credential.

For example, to also notify a Slack channel, add your own webhook URL under notif:

notif: script: cmd: "/usr/local/bin/diun-notify-log.sh" slack: webhookURL: https://hooks.slack.com/services/YOUR/OWN/WEBHOOK

Restart the service to apply the change:

sudo systemctl restart diun

Diun supports many notifiers besides Slack: email, Discord, Gotify, Matrix, ntfy, Pushover, RocketChat, Teams, Telegram, generic webhooks and more. Every notifier's configuration is documented at crazymax.dev/diun/notif. Each notifier needs only the credential fields that it lists, and you can enable more than one at once.