Just like using a remote desktop tool in a scam I suppose

Pinchflat also works pretty good

You would need to make touching a config file non existent. They’ve improved this over time, but not quite there I imagine.

Throwing my setup in: Traefik with Authentik

I use renovate myself. Via a cron job against a self hosted gitea instance.

https://github.com/renovatebot/renovate

Works for many dependency types including docker images. You can also have it pin non version tags (using digests).

I would be most interested in prebuilt versioned docker images and configuration via file or env vars.