Watchtower Docker on TrueNAS SCALE — Auto-Update Container Apps

TrueNAS SCALE vs CORE — Docker Support

Before diving into Watchtower Docker TrueNAS setup, understand the two versions:

Feature	TrueNAS SCALE	TrueNAS CORE
OS Base	Linux (Debian)	FreeBSD
Docker Support	✓ Yes (via Apps)	✗ No (uses Jails)
Watchtower Compatible	✓ Yes	✗ No
ZFS Storage	✓ Yes	✓ Yes

This guide is for TrueNAS SCALE only. If you're on TrueNAS CORE, consider migrating to SCALE, or use a Jail with Linux compatibility for Docker (complex, not recommended).

Accessing Docker on TrueNAS SCALE

TrueNAS SCALE uses Docker internally for its Apps system. Access Docker via:

# Method 1: TrueNAS Shell (in WebUI → System → Shell)
docker ps

# Method 2: SSH
ssh admin@truenas.local
docker ps

# Check Docker socket location:
ls -la /var/run/docker.sock

Method 1: Install via TrueNAS Shell (Fastest)

# Open TrueNAS WebUI → System → Shell
# OR SSH into TrueNAS

docker run -d \
  --name watchtower \
  --restart unless-stopped \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /etc/localtime:/etc/localtime:ro \
  -e WATCHTOWER_CLEANUP=true \
  -e WATCHTOWER_SCHEDULE="0 0 4 * * *" \
  containrrr/watchtower

# Verify it's running:
docker logs watchtower

Method 2: TrueNAS Custom App (WebUI)

TrueNAS SCALE 24.10+ supports Custom Apps via Docker Compose in the WebUI:

1. Go to Apps → Discover Apps → Custom App
2. Click Install on Custom App
3. Set Application Name: watchtower
4. In the Docker Compose YAML field, paste:

services:
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
      - WATCHTOWER_ROLLING_RESTART=true

5. Click Install

Method 3: Docker Compose via SSH

# SSH into TrueNAS
ssh admin@truenas.local

# Create a directory for Watchtower config
mkdir -p /mnt/tank/docker/watchtower
cd /mnt/tank/docker/watchtower

# Create docker-compose.yml
cat > docker-compose.yml << 'EOF'
services:
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
      - WATCHTOWER_NOTIFICATION_URL=slack://TOKEN@CHANNEL
EOF

# Start Watchtower
docker compose up -d

TrueNAS-Specific Considerations

Persistent storage path

TrueNAS SCALE stores data on ZFS pools. Use a pool path for any persistent data:

# Store Docker configs on your data pool (not the system drive)
mkdir -p /mnt/tank/docker/watchtower
# Replace 'tank' with your pool name

TrueNAS Apps vs Watchtower

TrueNAS SCALE 24.10+ has a built-in app update mechanism. Watchtower and TrueNAS's built-in updates can coexist — Watchtower manages containers you deployed via Docker Compose/run, while TrueNAS manages apps deployed through the Apps catalog.

To avoid conflicts, use labels to scope Watchtower:

# On containers Watchtower should manage:
labels:
  - "com.centurylinklabs.watchtower.enable=true"

# On TrueNAS catalog apps (managed by TrueNAS):
labels:
  - "com.centurylinklabs.watchtower.enable=false"

# Enable label-only mode in Watchtower:
environment:
  - WATCHTOWER_LABEL_ENABLE=true

Protecting NAS-critical containers

# Always exclude databases and other data-sensitive containers:
labels:
  - "com.centurylinklabs.watchtower.enable=false"

# Recommended to exclude on TrueNAS:
# - PostgreSQL (used by many TrueNAS apps internally)
# - MariaDB
# - Any media metadata databases (Plex, Jellyfin data volumes)

Monitoring Watchtower on TrueNAS

# View logs in real-time
docker logs watchtower --follow

# Check container status
docker ps | grep watchtower

# View update history
docker logs watchtower | grep -E "(Checking|Updated|Stopping|Starting)"