Docker Containers, Always Current. Zero Effort.

Watchtower Docker is an open-source container automation tool that monitors running Docker containers and automatically updates them when newer images are available on Docker Hub or a private registry. It is developed by the containrrr organization and distributed as containrrr/watchtower on Docker Hub. Watchtower connects to the Docker daemon, polls container registries on a schedule, pulls updated images, and gracefully restarts containers — preserving all volumes, environment variables, and network settings.

Watchtower for Docker is a container lifecycle manager that automates Docker image updates. When a new image tag or digest is detected, Watchtower: (1) pulls the updated Docker image from Docker Hub or your registry; (2) stops the running container gracefully; (3) starts a new container using the updated image with the same runtime parameters; and (4) optionally removes the old image (WATCHTOWER_CLEANUP=true). It can send notifications via Slack, email, or webhooks and can be scoped to specific containers using Docker labels.

Watchtower updates Docker containers in four automatic steps: it polls your container registry for a newer image digest; pulls the new Docker image when detected; gracefully stops the existing container with a configurable stop timeout; then starts a replacement container using the updated image while preserving all original parameters — volumes, env vars, ports, networks, labels, and restart policy. The process typically completes in seconds with no manual commands required.

In Docker Compose, Watchtower is added as an additional service inside your docker-compose.yml. It runs alongside your application containers, mounts the Docker socket, and automatically updates every other service in the Compose stack. You configure it with environment variables such as WATCHTOWER_CLEANUP=true, WATCHTOWER_POLL_INTERVAL, and WATCHTOWER_NOTIFICATIONS. This is the most common production deployment pattern for Watchtower Docker Compose setups.

The purpose of Watchtower Docker is to eliminate the manual work of keeping Docker containers up to date. Without Watchtower, keeping containers current requires logging into each host, running docker pull, stopping the old container, and restarting with the new image — repeated for every container, every time. Watchtower fully automates this cycle, ensuring every Docker container always runs the latest image version with zero human intervention. It is especially valuable in homelab setups, self-hosted application stacks, and small-to-medium production environments.

Most people are up and running in under 5 minutes: pull the image, mount the Docker socket, and Watchtower starts monitoring your containers immediately with sane defaults (24-hour poll interval). No signup, no agent installer, no dashboard to configure — see the install section above for copy-paste commands.

No. Watchtower talks directly to the Docker Engine socket and has no Kubernetes support — pods, Deployments, and Helm charts are out of scope. If you're on Kubernetes and want automated image updates, look at Keel or Flux/ArgoCD image-update automation instead.

Yes. Watchtower reads the same Docker credential store your host already uses, so if docker pull works against your private registry, Watchtower can poll it too. See our environment variables reference for registry auth options.

Mounting /var/run/docker.sock gives a container effective root access to the host — that's true of Watchtower or any tool that needs it. Use the official image, pin a specific version instead of :latest, and review the source before running it in a sensitive environment, same as you would for any image with socket access.

No — Watchtower is configuration- and log-driven, with an optional HTTP API for triggering updates on demand. If you want a clickable UI for container management alongside auto-updates, pair it with Portainer.

containrrr/watchtower is the official Watchtower Docker image hosted on Docker Hub. It is maintained by the containrrr organization and is the standard way to install Watchtower on any Docker host. You can pull it with docker pull containrrr/watchtower or reference it directly in your Docker Compose file.

Set the environment variable WATCHTOWER_CLEANUP=true in your Docker Compose file. When Watchtower updates a container, it will automatically remove the old Docker image from the host after the new one is running — preventing disk space from filling up over time. This is one of the most popular configuration options for production Docker Compose deployments.

Yes. Watchtower runs natively on Docker Swarm. Deploy it as a global service so it runs on every Swarm node and keeps all containers up to date cluster-wide. Mount the Docker socket via bind mount and set WATCHTOWER_CLEANUP=true to keep your Swarm nodes clean automatically.

Watchtower goes far beyond What's Up Docker. While What's Up Docker is a Watchtower alternative focused purely on sending notifications about available image updates, Watchtower actually performs the updates — pulling the new Docker image from Docker Hub, stopping the old container, and restarting with the updated image. Watchtower is the more complete Docker container management solution for teams who want automation, not just alerts.

Mount your Docker config file (~/.docker/config.json) into the Watchtower container and it will automatically use your registry credentials. This works for AWS ECR, Google Container Registry, GitHub Container Registry, and any private Docker registry. No extra configuration needed — Watchtower reads the standard Docker authentication file.

The fastest way to install Watchtower Docker is a single docker run command: docker run -d --name watchtower --restart unless-stopped -v /var/run/docker.sock:/var/run/docker.sock -e WATCHTOWER_CLEANUP=true containrrr/watchtower. This pulls the official containrrr/watchtower image and starts monitoring all running containers immediately. For Docker Compose, add Watchtower as a service in your docker-compose.yml. Watchtower works identically on Linux, macOS Docker Desktop, Windows Docker Desktop, Synology, Unraid, Proxmox, Raspberry Pi, and TrueNAS SCALE.

Using Watchtower Docker is three steps: (1) Run Watchtower alongside your existing containers, mounting the Docker socket; (2) Configure your update schedule via WATCHTOWER_POLL_INTERVAL (seconds) or WATCHTOWER_SCHEDULE (6-field cron); (3) Optionally set WATCHTOWER_CLEANUP=true and a notification URL. Watchtower runs silently in the background from that point — every container on the host is checked and updated automatically. Check docker logs watchtower to see what it's doing.

The original containrrr/watchtower project was archived on December 17, 2025. The GitHub repository is now read-only — no new releases, bug fixes, or security patches will be issued by the containrrr organization. The existing image still works for current Docker versions, but running an unmaintained image carries long-term risk as the Docker API evolves.

The actively maintained replacement is nickfedor/watchtower (also published as nicholas-fedor/watchtower), a community fork maintained by Nicholas Fedor with full API compatibility and continued releases. If you are starting a new deployment or want continued security support, migrate to the nickfedor fork. See also: What happened to Watchtower and what to do next.

Watchtower Docker is widely used in production environments, but with a few considerations: (1) It requires the Docker socket mount, which is equivalent to root access on the host — use a socket proxy for hardened environments; (2) Auto-updates can introduce breaking changes from upstream images — use label-based opt-in (WATCHTOWER_LABEL_ENABLE=true) for critical services; (3) For databases (PostgreSQL, MySQL), always exclude them from auto-updates. For homelab, self-hosted apps, and non-critical production services, Watchtower with WATCHTOWER_CLEANUP=true and daily scheduling is the recommended approach.