Watchtower Container Updates
Watchtower automatic container base image updates.
Overview
Watchtower is an automated Docker container update service that continuously monitors running containers for base image updates and performs rolling updates without manual intervention. Originally developed by CenturyLinkLabs and now maintained by Containrrr, Watchtower addresses the critical DevOps challenge of keeping containerized applications current with security patches and feature updates while minimizing downtime. It works by periodically polling Docker registries for newer image versions, comparing them against running containers, and automatically pulling new images and recreating containers when updates are detected.
This Watchtower configuration establishes an automated container lifecycle management system that operates independently in the background, scanning all running containers every 24 hours by default. The setup includes automatic cleanup of old images to prevent disk space bloat, timezone synchronization for accurate scheduling, and selective monitoring that focuses only on active containers while ignoring stopped ones. Watchtower connects directly to the Docker daemon through the Docker socket, giving it the necessary permissions to manage container lifecycles across the entire host system.
This automation stack is particularly valuable for homelab enthusiasts, small development teams, and organizations running containerized services without dedicated DevOps personnel. Unlike manual update processes that require scheduling maintenance windows and coordinating deployments, Watchtower enables a "set it and forget it" approach to container maintenance. The configuration provides intelligent defaults that balance update frequency with system stability, making it ideal for environments where containers need to stay current but don't require enterprise-grade deployment orchestration.
Key Features
- Automatic base image monitoring and container recreation when updates are detected
- Configurable polling intervals from minutes to days for update frequency control
- Selective container management using Docker labels to include or exclude specific containers
- Automatic cleanup of outdated Docker images to prevent disk space accumulation
- Rolling restart capability that updates containers one at a time to maintain service availability
- Private Docker registry support with authentication for enterprise image repositories
- Lifecycle hooks for pre-update and post-update custom scripting and notifications
- Multiple notification channels including email, Slack, Teams, and webhook integrations
Common Use Cases
- 1Homelab servers running media centers, network attached storage, and home automation containers
- 2Development and staging environments where teams need latest features without manual intervention
- 3Small business applications requiring automatic security updates for compliance requirements
- 4IoT and edge computing deployments where manual updates are impractical or impossible
- 5Personal VPS hosting multiple services that need to stay current with minimal maintenance overhead
- 6Educational environments where students deploy containers that should automatically receive updates
- 7Prototype and demo environments where showcasing latest features requires current container versions
Prerequisites
- Docker Engine 19.03+ with Docker Compose v2.0+ for container orchestration support
- Minimum 64MB RAM available for Watchtower container operation and image processing
- Docker socket access permissions for container lifecycle management and image operations
- Network connectivity to Docker registries (Docker Hub, private registries) for image polling
- Sufficient disk space for downloading new images during update cycles (varies by container size)
- Understanding of Docker labels and container naming for selective update configuration
For development & testing. Review security settings, change default credentials, and test thoroughly before production use. See Terms
docker-compose.yml
docker-compose.yml
1services: 2 watchtower: 3 image: containrrr/watchtower:latest4 container_name: watchtower5 environment: 6 - TZ=${TZ}7 - WATCHTOWER_CLEANUP=true8 - WATCHTOWER_POLL_INTERVAL=864009 - WATCHTOWER_INCLUDE_STOPPED=false10 - WATCHTOWER_REVIVE_STOPPED=false11 volumes: 12 - /var/run/docker.sock:/var/run/docker.sock13 restart: unless-stopped14 networks: 15 - watchtower-network1617volumes: 18 watchtower_data: 1920networks: 21 watchtower-network: 22 driver: bridge.env Template
.env
1# Watchtower2TZ=UTCUsage Notes
- 1Runs automatically
- 2Default: checks every 24 hours
- 3Use labels to include/exclude containers
- 4Notifications via email, Slack, etc.
- 5Monitors only running containers
Quick Start
terminal
1# 1. Create the compose file2cat > docker-compose.yml << 'EOF'3services:4 watchtower:5 image: containrrr/watchtower:latest6 container_name: watchtower7 environment:8 - TZ=${TZ}9 - WATCHTOWER_CLEANUP=true10 - WATCHTOWER_POLL_INTERVAL=8640011 - WATCHTOWER_INCLUDE_STOPPED=false12 - WATCHTOWER_REVIVE_STOPPED=false13 volumes:14 - /var/run/docker.sock:/var/run/docker.sock15 restart: unless-stopped16 networks:17 - watchtower-network1819volumes:20 watchtower_data:2122networks:23 watchtower-network:24 driver: bridge25EOF2627# 2. Create the .env file28cat > .env << 'EOF'29# Watchtower30TZ=UTC31EOF3233# 3. Start the services34docker compose up -d3536# 4. View logs37docker compose logs -fOne-Liner
Run this command to download and set up the recipe in one step:
terminal
1curl -fsSL https://docker.recipes/api/recipes/watchtower-updates/run | bashTroubleshooting
- Permission denied accessing Docker socket: Add watchtower container to docker group or verify socket permissions are 666
- Watchtower not detecting image updates: Check registry connectivity and verify image tags aren't using 'latest' ambiguously
- Container recreation fails with dependency errors: Review container start order and add depends_on declarations to dependent services
- High disk usage from old images: Verify WATCHTOWER_CLEANUP=true is set and consider adding WATCHTOWER_INCLUDE_RESTARTING=true
- Containers not updating despite new images available: Check container labels for com.centurylinklabs.watchtower.enable=false exclusions
- Watchtower consuming excessive CPU during scans: Increase WATCHTOWER_POLL_INTERVAL to reduce scanning frequency and system load
Community Notes
Loading...
Loading notes...
Download Recipe Kit
Get all files in a ready-to-deploy package
Includes docker-compose.yml, .env template, README, and license
Ad Space
Shortcuts: C CopyF FavoriteD Download