What Watchtower does
Watchtower monitors running containers, checks whether newer images are available, and can recreate containers with the same configuration. It can be limited to named containers or label-selected workloads.
Why I use it selectively
Automatic updates are useful for low-risk services, but they are not a replacement for change control. I use scoped policies so important databases, identity systems and stateful services are not updated blindly.
My operating rules
- Opt containers in with labels rather than watching everything
- Send notifications before or after changes
- Back up persistent state before risky upgrades
- Pin versions where compatibility matters
- Keep maintenance windows and rollback notes
- Confirm health checks after recreation
Docker Compose example
docker-compose.yml
services:
watchtower:
image: containrrr/watchtower:latest
container_name: watchtower
restart: unless-stopped
environment:
WATCHTOWER_LABEL_ENABLE: "true"
WATCHTOWER_CLEANUP: "true"
WATCHTOWER_SCHEDULE: "0 0 4 * * *"
volumes:
- /var/run/docker.sock:/var/run/docker.sock