Watchtower: Automatic Docker Container Updates

The Update Dilemma

Keeping Docker containers updated is important for security and features, but manually checking and updating dozens of containers is tedious. Watchtower automates this process.

But automatic updates can be risky. A bad update at 3 AM could break your services. Let's explore how to use Watchtower safely.

Basic Setup

services:
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
    restart: unless-stopped

This configuration checks for updates daily at 4 AM and removes old images after updating.

Notification Setup

Always know what Watchtower is doing:

environment:
  - WATCHTOWER_NOTIFICATIONS=shoutrrr
  - WATCHTOWER_NOTIFICATION_URL=telegram://token@telegram/?channels=chatid
  # Or Discord
  - WATCHTOWER_NOTIFICATION_URL=discord://token@webhookid
  # Or Email
  - WATCHTOWER_NOTIFICATION_URL=smtp://user:pass@host:port/[email protected]&[email protected]

Safe Update Strategies

Strategy 1: Monitor-Only Mode

Get notified of available updates without auto-applying:

environment:
  - WATCHTOWER_MONITOR_ONLY=true
  - WATCHTOWER_NOTIFICATIONS=shoutrrr

Strategy 2: Exclude Critical Containers

Label containers you want to manually update:

# In your service definition
services:
  database:
    image: postgres:15
    labels:
      - "com.centurylinklabs.watchtower.enable=false"

Strategy 3: Update Specific Containers Only

command: --label-enable
# Then label containers to update:
labels:
  - "com.centurylinklabs.watchtower.enable=true"

Rolling Restarts

Update containers one at a time to minimize downtime:

environment:
  - WATCHTOWER_ROLLING_RESTART=true

Best Practices

• Use specific tags: Pin versions instead of :latest for critical services
• Backup before updates: Schedule Watchtower after your backup runs
• Monitor logs: Check Watchtower logs regularly
• Exclude databases: Update databases manually with proper backup
• Test updates: Consider a staging environment for critical services

Complete Example

services:
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
      - WATCHTOWER_ROLLING_RESTART=true
      - WATCHTOWER_NOTIFICATIONS=shoutrrr
      - WATCHTOWER_NOTIFICATION_URL=telegram://token@telegram/?channels=chatid
      - WATCHTOWER_INCLUDE_STOPPED=false
      - WATCHTOWER_REVIVE_STOPPED=false
    restart: unless-stopped

Set and (Almost) Forget

With proper configuration, Watchtower keeps your homelab updated without constant attention. Just remember to check notifications and occasionally verify everything is running smoothly.