Watchtower Docker Labels — Enable & Exclude Containers

What Are Watchtower Docker Labels?

Watchtower Docker labels are standard Docker container labels that control how Watchtower treats each container. They allow you to opt specific containers in or out of automatic updates — giving you granular control without multiple Watchtower instances.

There are two primary watchtower docker label values:

• com.centurylinklabs.watchtower.enable=true — opt this container in to updates
• com.centurylinklabs.watchtower.enable=false — opt this container out of updates (exclude)

Enabling Label-Only Mode (WATCHTOWER_LABEL_ENABLE)

By default, Watchtower updates all containers. To switch to opt-in mode where only labeled containers are updated, set WATCHTOWER_LABEL_ENABLE=true:

services:
  watchtower:
    image: containrrr/watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_LABEL_ENABLE=true  # Only update containers with enable=true label
      - WATCHTOWER_CLEANUP=true

With this mode active, no container is updated unless it has the explicit enable label. This is the safest approach for mixed environments containing production databases alongside auto-updatable services.

Watchtower Docker Label to Enable Updates

Add the watchtower docker label enable to containers you want auto-updated in your Docker Compose file:

services:
  # This container WILL be auto-updated
  webapp:
    image: myapp:latest
    restart: unless-stopped
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  # This container WILL be auto-updated
  nginx:
    image: nginx:latest
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  # This container will NOT be auto-updated (no label = ignored in label-enable mode)
  postgres:
    image: postgres:15
    restart: unless-stopped
    # No watchtower label

Watchtower Docker Exclude Container

Even without label-enable mode, you can watchtower docker exclude a specific container by setting the label to false:

services:
  # Watchtower will SKIP this container even in default (all-containers) mode
  mysql:
    image: mysql:8.0
    labels:
      - "com.centurylinklabs.watchtower.enable=false"

This is particularly useful for watchtower docker exclude container scenarios like databases, stateful services, or containers pinned to a specific version for compliance reasons.

Label Scope — Watchtower Instance Targeting

In multi-tenant environments, you can run multiple Watchtower instances and use scopes to control which Watchtower manages which containers:

# Watchtower instance for production
services:
  watchtower-prod:
    image: containrrr/watchtower
    environment:
      - WATCHTOWER_SCOPE=production
      - WATCHTOWER_LABEL_ENABLE=true

  app-prod:
    image: myapp:latest
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "com.centurylinklabs.watchtower.scope=production"

  # Managed by a different watchtower-staging instance
  app-staging:
    image: myapp:latest
    labels:
      - "com.centurylinklabs.watchtower.scope=staging"

Custom Image Pull Tag via Label

Use a label to specify which image tag Watchtower should pull for a container — overriding the default (current tag):

services:
  app:
    image: myapp:stable
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      # Pull from 'edge' tag instead of 'stable'
      - "com.centurylinklabs.watchtower.monitor-only=true"