Watchtower Docker for Self-Hosted Apps — Complete Homelab Guide

Why Watchtower Is Perfect for Homelab Docker

The Watchtower Docker homelab combination is one of the most popular setups in the self-hosting community. Here's why:

• Security patches arrive automatically — open-source projects like Vaultwarden, Nextcloud, and Home Assistant push security fixes frequently. Without automation, homelabbers run outdated (vulnerable) software for weeks.
• No SSH sessions required — set up Watchtower once and forget it. Updates happen on schedule while you sleep.
• Disk stays clean — with WATCHTOWER_CLEANUP=true, old images are removed automatically after each update.
• Notifications keep you informed — Watchtower sends a Slack or Telegram message every time it updates a container, so you know exactly what changed and when.

Base Watchtower Configuration for Homelab

This is the recommended starting point for any self-hosted Docker homelab with Watchtower:

services:
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
    environment:
      # Update at 3 AM every night
      - WATCHTOWER_SCHEDULE=0 0 3 * * *
      - TZ=America/New_York

      # Clean up old images automatically
      - WATCHTOWER_CLEANUP=true

      # Update containers one at a time (safer for multi-container stacks)
      - WATCHTOWER_ROLLING_RESTART=true

      # Notify via Telegram when anything updates
      - WATCHTOWER_NOTIFICATION_URL=telegram://BOT_TOKEN@telegram?channels=CHAT_ID

Auto-Update n8n with Watchtower

n8n is a workflow automation platform with a very active release cycle — new versions ship weekly. Watchtower Docker update n8n keeps it current automatically:

services:
  n8n:
    image: n8nio/n8n
    container_name: n8n
    restart: unless-stopped
    ports:
      - "5678:5678"
    volumes:
      - n8n_data:/home/node/.n8n
    environment:
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=yourpassword
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_LABEL_ENABLE=true   # Only update labeled containers

volumes:
  n8n_data:

Ollama Docker Compose Auto-Update with Watchtower

Ollama (the local LLM runner) is updated frequently with new model support and performance improvements. An Ollama Docker Compose auto-update Watchtower setup:

services:
  ollama:
    image: ollama/ollama
    container_name: ollama
    restart: unless-stopped
    ports:
      - "11434:11434"
    volumes:
      - ollama_data:/root/.ollama
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui
    restart: unless-stopped
    ports:
      - "3000:8080"
    volumes:
      - open_webui_data:/app/backend/data
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  watchtower:
    image: containrrr/watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_LABEL_ENABLE=true
      - WATCHTOWER_SCHEDULE=0 0 5 * * *
      - WATCHTOWER_TIMEOUT=60s   # Ollama needs more time to stop gracefully

volumes:
  ollama_data:
  open_webui_data:

Watchtower on macOS Docker Desktop

Watchtower Docker macOS with Docker Desktop works the same as Linux — no special configuration required. Docker Desktop creates a standard /var/run/docker.sock compatibility socket:

# macOS: exact same command as Linux
docker run -d \
  --name watchtower \
  --restart unless-stopped \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -e WATCHTOWER_CLEANUP=true \
  -e WATCHTOWER_POLL_INTERVAL=86400 \
  containrrr/watchtower

# If you get a socket permission error on macOS:
# Docker Desktop → Settings → Advanced → Enable "Allow the default Docker socket to be used"

Container-Specific Recommendations

Not all self-hosted containers should be auto-updated equally. Here's a guide for popular self-hosted apps:

Excluding Critical Containers

# Exclude databases and critical services from Watchtower
services:
  postgres:
    image: postgres:16
    labels:
      - "com.centurylinklabs.watchtower.enable=false"   # Never auto-update

  nextcloud:
    image: nextcloud:latest
    labels:
      - "com.centurylinklabs.watchtower.enable=false"   # Manual major version updates

  vaultwarden:
    image: vaultwarden/server:latest
    labels:
      - "com.centurylinklabs.watchtower.enable=true"    # Always auto-update for security

  n8n:
    image: n8nio/n8n
    labels:
      - "com.centurylinklabs.watchtower.enable=true"    # Safe to auto-update