Watchtower: Auto-Update Your Docker Containers Without Lifting a Finger

Keeping Docker containers up to date is one of those chores that feels important but nobody wants to do manually. You pull an image, run it, and forget about it until something breaks or you notice a security advisory six months later.

Watchtower fixes that. It watches your running containers, checks for new images, and applies updates automatically. No cron jobs, no manual restarting, no "I'll get to it next week" procrastination.

What It Does

Watchtower runs as a container itself. You point it at your Docker socket (or a remote Docker host), and it periodically polls the image registries for updates. When it finds a newer version of an image you're running, it stops the container, pulls the fresh image, and restarts the container with all the same configuration (volumes, ports, environment variables, restart policies).

It's essentially a smart, automated replacement for manually running docker pull and docker compose up -d on a schedule.

Why It's Cool

A few things make Watchtower stand out:

• No code changes required. You don't need to instrument your containers or add hooks. Watchtower just works if your containers use the latest tag or a specific version that gets updated.
• Granular control. You can label specific containers to be ignored, update them on a custom schedule, or even set up notifications (Slack, email, and more) so you know what changed.
• Works with any registry. Docker Hub, private registries, GitLab, GitHub Container Registry, you name it.
• Live updates with minimal downtime. Watchtower sends a SIGTERM to the old container, waits for it to finish gracefully (if you set that up), then spins up the new one.

The clever part is how it reuses existing container configuration. It reads the old container's settings before stopping it, so you don't lose your custom network settings or volume mounts.

How to Try It

The fastest way to see Watchtower in action is to run it with Docker. Just put this in a terminal:

docker run -d --name watchtower \
  -v /var/run/docker.sock:/var/run/docker.sock \
  containrrr/watchtower

That's it. Watchtower will check all running containers every 24 hours and update them if new images exist. You can also pass a --interval flag in seconds to check more frequently, like --interval 3600 for hourly checks.

If you use Docker Compose, just add Watchtower as a service in your docker-compose.yml. For more advanced setups (like monitoring only specific containers or sending notifications), the README on GitHub has all the details.

Final Thoughts

Watchtower is one of those tools that feels unnecessary until you use it, and then you wonder why you didn't add it sooner. It's not perfect—if you need zero-downtime deployments or complex orchestration, you'd want something heavier. But for personal projects, small teams, or dev environments, it saves you from "oh no, I'm running a container from 2022" syndrome.

It's also a nice complement to automated image builds. If you push a new version of your image to a registry, Watchtower will pick it up and roll it out. Simple, effective, and completely hands-off.

Follow us at @githubprojects for more developer tools and open source gems.