Upgrade using Docker Compose

Upgrade a Docker Compose deployment of Anchore Enterprise to a newer release within the same major version.

This procedure upgrades a Docker Compose deployment of Anchore Enterprise to a newer release within the same major version. Before you begin, review Prepare for the Upgrade.

This procedure applies to upgrades within v6.x only. It reuses your existing volumes and configuration, which is not valid when migrating from v5.x. For that, follow the v5.x → v6.x Migration Guide.

Upgrading a host with no outbound internet access? See Air-Gapped Upgrade before you begin. You’ll need to mirror the new image tags to your registry (or move them as a tarball) before restarting the stack below.

Upgrade Procedure

Step 1: Review the Release Notes

View the Anchore Enterprise Release Notes for the target version. The release notes call out breaking changes, new or changed configuration, and any version-specific upgrade instructions you need to plan for before starting.

Step 2: Stop Anchore Enterprise

docker compose down

Step 3: Back Up Your Data Volumes

As described in Prepare for the Upgrade, make a copy of any data volumes before proceeding.

Step 4: Back Up Your Original Compose File

cp docker-compose.yaml docker-compose.yaml.backup

Step 5: Update Your Compose File

Download the compose file that ships with the target release and check it against your current file to see if there any changes that may affect your deployment, such as new services, environment variables, or volume definitions:

curl -sSfL https://docs.anchore.com/current/docs/deployment/docker_compose/docker-compose.yaml > docker-compose-new.yaml

The name field in the compose file you download differs from the one in your existing file, because it tracks the release. If your deployment started on a v6.0.x quickstart, the volume name differs too — quickstart volumes were versioned per release up to v6.0.x and have been stable since v6.1.0. Do not copy either value across. Keep the values already in your docker-compose.yaml so your deployment keeps reading the volume it has been writing to.

name: "<your-existing-project-name>"
volumes:
  <your-existing-volume-name>:
    external: false

The current URL always serves the latest release.

Fold any relevant changes into your docker-compose.yaml. If the diff shows nothing beyond version bumps, confirm every service is still present in your file and update the image tags in place. All services using the enterprise image move to the new release tag, while the ui service uses the separately versioned enterprise-ui image:

 services:
   api:
-    image: docker.io/anchore/enterprise:<your-current-version>
+    image: docker.io/anchore/enterprise:v6.2.0
   ui:
-    image: docker.io/anchore/enterprise-ui:<your-current-ui-version>
+    image: docker.io/anchore/enterprise-ui:v6.2.0

Step 6: Restart the Anchore Enterprise Containers

docker compose up -d

Step 7: Confirm the Services Start

Watch the output of the previous to confirm all the services start. Once they have all started, you can use the below command to list the running services and confirm that they are all healthy.

docker ps

Step 8: Verify the New Version Is Running

Once the containers are up, verify the new version is running:

anchorectl system status

1 - Upgrade Air-Gapped using Docker Compose

A routine v6.x upgrade in an air-gapped Docker Compose deployment just needs the new image tags mirrored to your registry (or moved as a tarball) before you restart the stack. Unlike the major-version migration, there’s no new compose file, no new Dockerfile.anchore-db, and no rebuild required — you’re bumping versions on a running deployment, not standing up a new one. Your docker-compose.yaml stays as-is, provided you don’t touch the project name or database volume name.

Throughout this guide, the low side is the internet-facing system and the high side is the air-gapped system.

Prepare the Images (low side)

Review the Release Notes for the target version to confirm which image tags actually changed. enterprise/enterprise-ui always move together; redis (and, less often, the PostgreSQL/pg_cron combination baked into anchore:db) can change independently, so don’t assume they’re unchanged from your last upgrade — diff the new reference docker-compose.yaml and Dockerfile.anchore-db against what you last mirrored if you’re unsure.

Pull the images that changed:

docker pull docker.io/anchore/enterprise:v6.2.0
docker pull docker.io/anchore/enterprise-ui:v6.2.0
docker pull docker.io/redis:7.4.6

Only if Dockerfile.anchore-db changed for this release, rebuild the database image:
```
docker build -f Dockerfile.anchore-db -t anchore:db .
```
This is uncommon for a routine upgrade — most releases don’t touch the database image at all. If it didn’t change, skip this step; there’s nothing new to move for anchore-db.

Move the Images to the High Side

Choose one of the following, matching the equivalent step in the Air-Gapped Docker Compose deployment guide, for only the images that actually changed in step 2 (and step 3, if it applied):

Private container registry (recommended) — re-tag, then push directly, or save/transfer/load/push, exactly as described in Option 1.
Local image tarball — for hosts with no registry available, as described in Option 2.

Update Your Compose File

If this deployment was already deployed air-gapped, your docker-compose.yaml already points every image: line at your private registry or local image names — you only need to bump the tag on the lines that changed. The enterprise image is referenced by many services (api, catalog, component-catalog, queue, policy-engine, analyzer, reports, reports_worker, notifications, data-syncer, db-preflight), so update every occurrence:

  api:
    image: <registry>/anchore/enterprise:v6.2.0

Leave everything else in the file untouched — in particular, do not touch name: at the top of the file or the database volume name. Changing either causes Compose to stand up a new, empty deployment instead of upgrading this one.

Restart the Stack

Continue with the main Upgrade using Docker Compose procedure starting at Step 6: Restart the Anchore Enterprise Containers — monitoring the catalog logs and verifying the new version with anchorectl system status need no changes for an air-gapped host.