From c68469783cf4c9cfee28f3a54e9bc281735dfda9 Mon Sep 17 00:00:00 2001
From: TheGeneralist <180094941+thegeneralist01@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:55:46 +0200
Subject: [PATCH] chore(docker): pin yt-dlp and twitter-api-client versions to
 match Nix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- yt-dlp: pip install yt-dlp → yt-dlp==2026.8.19 (matches flake.nix pin)
- twitter-api-client: unpinned → 0.10.22 (matches flake.nix)
- docs: add Docker subsection to 'Keeping yt-dlp fresh' explaining that
  rebuilding the image is the Docker equivalent of the Nix/self-update
  paths, and that there is no in-container yt-dlp update path
---
 Dockerfile     | 4 ++--
 docs/README.md | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b0ec93b..2586e85 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -73,8 +73,8 @@ RUN npm install -g single-file-cli
 # conflicts with Debian's system Python packages.
 RUN python3 -m venv /opt/archivr-venv \
     && /opt/archivr-venv/bin/pip install --no-cache-dir \
-        yt-dlp \
-        twitter-api-client
+        "yt-dlp==2026.8.19" \
+        "twitter-api-client==0.10.22"
 
 # Download Chromium extensions used during headless captures.
 # uBlock Origin Lite (MV3) — ad/tracker blocking.
diff --git a/docs/README.md b/docs/README.md
index 8e4d3c9..1b8fb80 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -319,6 +319,15 @@ nix build .#archivr-server
 git commit -am "chore(nix): yt-dlp OLD → $NEW"
 ```
 
+**4. Docker:** yt-dlp is pinned to a specific version in the `Dockerfile` (`pip install "yt-dlp==<version>"`), matching the Nix pin. To update, bump the version string in the `Dockerfile` venv install step to match the new Nix version, then rebuild:
+
+```sh
+docker build -t archivr-server .
+docker compose up -d
+```
+
+There is no in-container self-update path — `archivr yt-dlp update` writes to a host state directory that does not survive container restarts. Rebuild the image when captures start returning HTTP 403.
+
 ## Deployment
 
 ### Security