Watchtower monitors the images behind your running containers and can pull updates and recreate the containers automatically.

The genuine tension in using it

Automatic updates are convenient and occasionally destructive. A container that updates itself at 4am can also break itself at 4am, and self-hosted projects ship breaking changes more often than commercial software. That risk is real, and it is why many experienced operators run Watchtower in notification-only mode: it tells you an update exists and you apply it deliberately.

If you do enable automatic updates, pinning major versions in your Compose files rather than tracking latest prevents the worst outcomes, and excluding stateful services like databases from automatic updating is strongly advisable.

Notification-only mode

WATCHTOWER_MONITOR_ONLY=true

Combined with notifications to ntfy, Gotify, or email, this turns it into an update-availability monitor, which is arguably its best use.

Selective updating

Containers can opt in or out with labels, so you can automate the safe ones and hold back anything holding data. Scheduling controls when it runs, and cleanup removes old images so disk does not fill.

Alternatives

Diun is notification-only by design and does that job more cleanly. What’s Up Docker provides a UI showing available updates. Dockcheck is a shell script for people who prefer that. Komodo and Portainer handle updates as part of broader management.

License

Watchtower is released under the Apache License 2.0.

Links

• Website
• Repository