Watchtower Remote Hosts & TLS — Managing a Docker Daemon You Don't Run On

Why Manage a Remote Docker Host?

Normally Watchtower runs on the same host as the containers it watches, talking to the local Docker daemon over the /var/run/docker.sock Unix socket. But you don't strictly need to run it there — the Docker Engine can also be controlled remotely over TCP, which means one Watchtower instance can, in principle, manage a Docker daemon on a completely different machine.

Setting DOCKER_HOST

Point Watchtower at the remote daemon with the standard DOCKER_HOST environment variable instead of the socket mount:

docker run -d \
  --name watchtower \
  -e DOCKER_HOST="tcp://10.0.1.2:2375" \
  containrrr/watchtower

Or with the --host flag directly:

docker run -d --name watchtower containrrr/watchtower --host "tcp://10.0.1.2:2375"

Note what's missing here: no -v /var/run/docker.sock:/var/run/docker.sock. When Watchtower is talking to a remote endpoint over the network, it doesn't touch the local socket at all — the container running Watchtower doesn't even need Docker access on its own host.

The Remote Daemon Has to Be Listening

By default, the Docker daemon only listens on the local Unix socket — it does not expose a TCP port out of the box. To make tcp://10.0.1.2:2375 reachable, the target machine's Docker daemon needs to be configured to listen on TCP, typically via its daemon.json or systemd unit. That configuration is outside Watchtower's scope — it's a standard Docker Engine setting, and how you do it depends on your host's init system and distro.

Securing the Connection with TLS

Port 2375 (plain TCP) is unauthenticated — anyone who can reach it has root-equivalent control over that host, because they can run arbitrary containers. Docker's own answer to this is TLS client-certificate authentication, conventionally served on port 2376:

1. Generate a CA, server certificate, and client certificate for the remote daemon (Docker's own docs cover the OpenSSL commands for this — it's a standard Docker Engine TLS setup, not Watchtower-specific).
2. Configure the remote daemon to require TLS and only accept connections presenting a client cert signed by your CA.
3. Mount the client certificate, key, and CA cert into the Watchtower container, and point DOCKER_HOST at the TLS port with the daemon's standard TLS environment variables (DOCKER_TLS_VERIFY=1, DOCKER_CERT_PATH=/certs).

docker run -d \
  --name watchtower \
  -e DOCKER_HOST="tcp://10.0.1.2:2376" \
  -e DOCKER_TLS_VERIFY=1 \
  -e DOCKER_CERT_PATH=/certs \
  -v /path/to/client-certs:/certs:ro \
  containrrr/watchtower

When You Probably Don't Need This

For most single-host setups — one server, one Compose stack — running Watchtower locally with the socket mount is simpler and has a smaller attack surface than exposing the Docker API over the network at all. Remote-host management earns its complexity when you're centrally managing several hosts from one place, not as a default.