run the latest Docker image, and upgrade it using systemd timers (example for Gitlab-CI Runner)

docker-gitlab-runner.service

[Unit]
Description=GITLAB Runner for Docker
Documentation=https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/blob/master/docs/install/docker.md
ConditionArchitecture=x86-64
ConditionACPower=true
AssertFileNotEmpty=/var/gitlab-runner/config/config.toml
After=docker.service docker-gitlab.service update-gitlab-runner.service
Requires=docker.service
Wants=update-gitlab-runner.service

[Service]
Restart=on-abort
RestartForceExitStatus=1
RestartSec=15s
ExecStartPre=-/opt/docker/docker kill gitlab-runner
ExecStartPre=-/opt/docker/docker rm gitlab-runner
ExecStart=/opt/docker/docker run --rm --name gitlab-runner \
  --hostname %H \
  --add-host your.gitlab.instance:10.0.0.0 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /var/gitlab-runner/config:/etc/gitlab-runner \
  gitlab/gitlab-runner:alpine
ExecStop=/opt/docker/docker stop -t 15 gitlab-runner

[Install]
WantedBy=multi-user.target

[X-Fleet]
Global=true
MachineMetadata="ssl=avx2" "type=metal"
MachineMetadata="ssl=avx" "type=metal"

is-latest-docker-image.sh

#!/bin/bash

set -euo pipefail

: ${name:="${1%:*}"}
: ${name:="blitznote/debase"}
: ${tag:="${1##*:}"}
tag="${tag#${name}}"
: ${tag:="latest"}
: ${registry:="https://registry.hub.docker.com"}
: ${auth:="https://auth.docker.io"}

: ${err_not_latest:=72}

if ! docker inspect "${name}:${tag}" &>/dev/null; then
  >&2 printf "Local image not found: %s\n" "${name}:${tag}"
  exit ${err_not_latest}
fi

# Get the auth token.
: ${token:=""}
if [[ "${token}" == "" ]]; then
  read token < <(curl --fail --silent --show-error --location \
      -H 'Accept: application/json' \
      "${auth}/token?service=registry.docker.io&scope=repository:${name}:pull" \
    | jq -r '.token // .access_token')
fi

# Get the top hash.
remote_id=$( \
  curl --fail --silent --show-error --location \
    -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
    -H "Authorization: Bearer ${token}" \
    "${registry}/v2/${name}/manifests/${tag}" \
  | jq -r '.config.digest' \
)

local_id=$(docker inspect "${name}:${tag}" | jq -r '.[0].Id')

if [[ "${remote_id}" == "${local_id}" ]]; then
  exit 0
fi

exit ${err_not_latest}

update-gitlab-runner.service

[Unit]
Description=update Gitlab CI Runner
ConditionArchitecture=x86-64
ConditionACPower=true
ConditionFileNotEmpty=/var/gitlab-runner/config/config.toml
After=docker.service docker-gitlab.service
Requires=docker.service

[Service]
Type=oneshot
TimeoutStartSec=2min
SuccessExitStatus=5
Environment=PATH=/opt/sbin:/opt/bin:/opt/docker:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ExecStart=/bin/bash -c "if ! /opt/bin/is-latest-docker-image.sh gitlab/gitlab-runner:alpine; then \
    docker pull gitlab/gitlab-runner:alpine \
    && systemctl --no-block try-restart docker-gitlab-runner.service; \
  else \
    exit 0; \
  fi"

[Install]
WantedBy=multi-user.target

update-gitlab-runner.timer

[Unit]
Description=update Gitlab CI Runner
ConditionACPower=true
ConditionFileNotEmpty=/var/gitlab-runner/config/config.toml

[Timer]
OnUnitInactiveSec=8h

[Install]
WantedBy=timers.target