Automating Container Updates with Watchtower

One of the ongoing burdens of self-hosting is keeping software updated. Every application in your stack releases patches and new versions regularly. Without automation, someone has to manually pull new images and restart containers, a task that is boring, error-prone, and often postponed. Watchtower fixes this.

What Watchtower Does

Watchtower monitors your running Docker containers and checks for updated base images. When it finds one, it pulls the new image and gracefully restarts the container. The default mode checks every 24 hours. You can configure per-container schedules, send notifications through Slack or email after each update, and exclude containers that should never auto-update.

Update Strategies

Not every container should update automatically. Production databases need careful version transitions. Containers that are part of a service mesh may need coordinated updates. Watchtower supports fine-grained control:

• Automatic (default): Auto-update everything. Good for monitoring tools, reverse proxies, and utilities
• Notify only: Check for updates and send a notification but do not apply them. Good for critical applications where you want to review changes first
• Excluded: Never check for updates. Good for database containers and pinned-version services

The VPS1 Approach

We use a layered update strategy. Watchtower handles the routine layer: Uptime Kuma, Nginx Proxy Manager, Pi-hole, and other utilities auto-update nightly. For the application layer, Nextcloud, CRM, and project management tools, Watchtower notifies us of updates and we apply them during scheduled maintenance windows after reviewing changelogs. For the database layer, PostgreSQL and Redis are pinned to specific versions and updated manually during planned maintenance.

Risks of Auto-Updates

Auto-updating sounds risky, and it can be. A breaking change in a new version could take your CRM offline. This is why we recommend running Watchtower with notification-only mode for business-critical applications and manual updates for infrastructure. The key benefit is that Watchtower surfaces updates you would otherwise miss. You decide which to apply and when.

For managed clients, VPS1 handles the entire update lifecycle. You never need to think about container versions.