Is Watchtower Still Maintained? The 2026 Answer

The Short Answer

Watchtower is one of the most popular tools for automatically updating Docker containers, but its official status changed at the end of 2025. The original repository, containrrr/watchtower, was archived on December 17, 2025, following a maintainer discussion (GitHub discussion #2135). Its last release was v1.7.1, published in November 2023.

However, the project did not die. A maintained community fork — nickfedor/watchtower, maintained at github.com/nicholas-fedor/watchtower — took over active development and, as of 2026, ships version v1.20.x. All WATCHTOWER_* environment variables and com.centurylinklabs.watchtower.* Docker labels work identically, so migration is a single-line image change.

So: the original is no longer maintained, but Watchtower itself absolutely is — you just need to be on the right image.

What "Archived" Actually Means for Your Containers

On GitHub, archiving a repository makes it read-only. Nobody can merge pull requests, close issues, or cut releases. The code stays online, but it is frozen in time. For a security-adjacent tool like Watchtower, the practical consequences are:

• No security patches. Watchtower mounts the Docker socket, which means it runs with privileges equivalent to root on the host. A frozen codebase is a growing risk: any vulnerability discovered after November 2023 in the old v1.7.1 binary will never be fixed. This is the single strongest reason to stop using containrrr/watchtower.
• No compatibility fixes. Docker engine APIs, Compose behavior, and registry authentication schemes keep evolving. The archived binary will drift out of compatibility over time — and it already produces errors like client version too old against newer Docker engines.
• No bug fixes or new notification integrations. Issues reported against the original repo are never triaged.

A common question: will containrrr/watchtower:latest still pull and run? Yes — Docker Hub keeps serving the archived image, so existing setups keep working in the narrow sense. Nothing about the archive breaks the binary you already have. The problem is what happens around it: the Docker engine keeps evolving, registries keep changing authentication behavior, and every month that passes without a patch widens the window of known, unfixable issues in a binary that holds your Docker socket. "Still runs" is not the same as "still maintained," and for a privileged tool the difference matters.

There is a fuller timeline of the archive decision, including the discussion that led to it, in our companion piece: Watchtower Discontinued? The Archive Explained.

The Maintained Fork: nickfedor/watchtower

The community fork lives on Docker Hub as nickfedor/watchtower and on GitHub as github.com/nicholas-fedor/watchtower. As of 2026 it ships v1.20.x releases — well ahead of the frozen v1.7.1 — and continues to merge fixes, update dependencies, and respond to issues.

The key fact for migration: it is a drop-in replacement. Every environment variable you already know — WATCHTOWER_CLEANUP, WATCHTOWER_SCHEDULE, WATCHTOWER_POLL_INTERVAL, WATCHTOWER_LABEL_ENABLE, WATCHTOWER_MONITOR_ONLY, WATCHTOWER_NOTIFICATION_URL, WATCHTOWER_DEBUG, TZ — behaves the same, and all container labels under com.centurylinklabs.watchtower.* work identically.

To switch, change one line in your Compose file:

services:
watchtower:
  image: nickfedor/watchtower:latest
  container_name: watchtower
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock
  environment:
    - WATCHTOWER_CLEANUP=true
    - WATCHTOWER_SCHEDULE=0 0 4 * * *
    - TZ=UTC
  restart: unless-stopped

Then run docker compose pull && docker compose up -d. There is a step-by-step walkthrough with verification steps in our nickfedor migration guide.

Should You Still Use Watchtower in 2026?

Yes — with two qualifications. First, use the maintained fork, not the archived original. Second, follow the practices that make unattended updates safe:

• Use WATCHTOWER_LABEL_ENABLE=true and opt containers in explicitly with com.centurylinklabs.watchtower.enable=true. This prevents Watchtower from restarting things you forgot about, like your database.
• Enable notifications via WATCHTOWER_NOTIFICATION_URL (Shoutrrr URLs such as discord://TOKEN@CHANNEL_ID or telegram://TOKEN@telegram?channels=CHANNEL) so you always know what was updated. See our notifications guide for working examples.
• Schedule updates with WATCHTOWER_SCHEDULE (a 6-field cron with seconds first — 0 0 4 * * * means daily at 04:00) instead of the default 24-hour poll, so restarts happen in a maintenance window.
• Consider WATCHTOWER_MONITOR_ONLY=true for stateful services, which reports available updates without restarting anything.

New to the tool entirely? Start with how to install Watchtower with Docker and the Compose setup guide.

If You Want Out: Alternatives to Watchtower

The archive news pushed many users to reconsider whether they want automatic restarts at all. The most popular alternative is Diun (crazymax/diun) — a notify-only updater that tells you when new images are available but never touches a running container. If you like being in control, read our full Diun Docker setup guide.

For a full comparison of Watchtower against Diun, Renovate, and other options, see Watchtower alternatives and the head-to-head Watchtower vs Diun breakdown.

The Fork Lineage: How nickfedor Became the Maintained Watchtower

When the original repository was archived, the project did not simply stop — it moved. The fork at github.com/nicholas-fedor/watchtower, published on Docker Hub as nickfedor/watchtower, picked up where containrrr/watchtower left off and has continued active development ever since. As of 2026 it ships v1.20.x releases, far ahead of the archived v1.7.1.

The fork's guiding principle is compatibility: it is a drop-in replacement for the original. That means every WATCHTOWER_* environment variable (WATCHTOWER_CLEANUP, WATCHTOWER_SCHEDULE, WATCHTOWER_POLL_INTERVAL, WATCHTOWER_LABEL_ENABLE, WATCHTOWER_MONITOR_ONLY, WATCHTOWER_NOTIFICATION_URL, WATCHTOWER_DEBUG, TZ) works exactly as documented for the original, and every com.centurylinklabs.watchtower.* Docker label is honored. Existing Compose files, label-based opt-in setups, and notification URLs need no changes beyond the image name.

This continuity is why the community answer to "is Watchtower still maintained?" is a qualified yes: the name on the repository changed, but the tool, its configuration surface, and its behavior did not. The full migration walkthrough is in our nickfedor migration guide.

How to Check Which Image You Are Running

Many users are unsure whether they are on the archived original or the maintained fork. Here is how to check in under a minute:

docker images | grep -i watchtower
docker inspect --format='{{.Config.Image}}' watchtower

The first command lists the Watchtower image in your local store and its tag; the second shows the exact image the running container was created from. If you see containrrr/watchtower, you are on the archived build — frozen at v1.7.1 from November 2023, receiving no security patches. If you see nickfedor/watchtower, you are on the maintained fork.

Also check your Compose file directly: open docker-compose.yml (or wherever you define the service) and look at the image: line under the Watchtower service. If it still says containrrr/watchtower, change it to nickfedor/watchtower and run docker compose pull && docker compose up -d. For a step-by-step with verification, see the migration guide, and if anything behaves oddly after switching, the troubleshooting index covers the common post-migration issues.

The Verdict

Watchtower is not dead — it changed hands. The original containrrr/watchtower is archived and unpatched; the nickfedor/watchtower fork is actively maintained at v1.20.x in 2026. Point your Compose file at the fork, enable labels and notifications, and Watchtower remains a safe, supported way to keep your containers updated.