How to Automatically Update Docker Containers with Watchtower

Running a homelab full of Docker containers means each one has its own image that can fall behind on security patches and bug fixes if you’re not manually pulling updates regularly. Setting up Watchtower for Docker updates automates this entirely, checking for newer image versions and seamlessly redeploying containers with the latest release, without you needing to manually run docker pull and recreate each container yourself.

What Is Watchtower?

Watchtower is a free, open-source tool that monitors running Docker containers and automatically updates them when a newer image version becomes available on the registry. It works by periodically checking each monitored container’s image against its source registry, and if a newer version exists, pulls it down and gracefully replaces the running container while preserving its configuration.

Why Automate Container Updates

• Security patching – many self-hosted applications ship security fixes as new image releases; automatic updates close those gaps quickly
• Reduced manual maintenance – no need to remember which of a dozen containers need checking for updates
• Consistency – every monitored container stays reasonably current without relying on you remembering to check each one individually

Installing Watchtower

The simplest deployment runs Watchtower itself as a container, given access to the Docker socket so it can manage other containers:

yaml

version: '3'
services:
  watchtower:
    image: containrrr/watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --interval 86400

docker compose up -d

The --interval 86400 flag sets Watchtower to check for updates once every 24 hours.

Monitoring Specific Containers Only

By default, Watchtower monitors every running container on the host. To limit it to specific containers instead, list their names explicitly:

yaml

    command: --interval 86400 nginx-proxy-manager pihole jellyfin

This is useful if you have certain containers you’d rather update manually, such as ones with configurations sensitive to version changes.

Excluding Specific Containers

Alternatively, label containers you want Watchtower to skip, leaving everything else under automatic monitoring:

yaml

  myapp:
    image: someapp:latest
    labels:
      - "com.centurylinklabs.watchtower.enable=false"

Getting Notified of Updates

Rather than updates happening silently, configure Watchtower to send notifications through services like Discord, Slack, email, or Telegram whenever it applies an update:

yaml

    environment:
      - WATCHTOWER_NOTIFICATIONS=shoutrrr
      - WATCHTOWER_NOTIFICATION_URL=discord://webhook-token@webhook-id

This keeps you informed about what changed without needing to actively check logs.

Running a One-Time Manual Check

To trigger an immediate update check outside the regular schedule, run Watchtower with the --run-once flag:

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtower --run-once

Considerations Before Fully Automating Everything

Automatic updates carry some risk — a new image version could occasionally introduce breaking changes or require accompanying configuration updates that Watchtower has no way of knowing about. For critical services, consider either excluding them from automatic updates (updating manually after reviewing release notes) or configuring Watchtower’s notification feature so you at least know immediately when something has changed, even if you don’t intervene beforehand.

Combining Watchtower with Backups

Since Watchtower changes running containers automatically, pairing it with a solid backup routine (covered in the earlier Proxmox and Proxmox Backup Server guides, if your containers run inside VMs) ensures that if an automatic update ever does cause a problem, rolling back to a known-good state remains straightforward.

Final Thoughts

Setting up Watchtower for Docker updates removes one of the most tedious ongoing maintenance tasks in a container-heavy homelab, keeping images reasonably current without manual intervention for every single service. Combined with sensible exclusions for sensitive containers and notification alerts for visibility, Watchtower strikes a good balance between automation and control for most self-hosted setups.