Watchtower (maintained fork): automatic container image updates

Watchtower is a small Go program that runs as a container itself, checks the registry for new versions of the images your other containers use, and when it finds one, pulls it, stops the old container and starts a new one with the same options. The original project, containrrr/watchtower, was archived in late 2025; nicholas-fedor/watchtower is the actively maintained fork with about 4.6k stars, regular releases and the same Apache 2.0 licence.

What it does

On a schedule (by default once a day) Watchtower compares the digest of each running container’s image with the registry. If they differ, it recreates the container with the new image, keeping volumes, ports, environment variables and networks. It can send notifications through email, Slack, Discord, Gotify and others via the Shoutrrr library, and can be limited to containers with a specific label so that only the services you choose are updated automatically.

When to use it

• Home servers and small self-hosted setups where you want security updates without logging in every week.
• Containers whose images use a stable tag that moves with minor releases, such as nginx:1.27 or an application’s latest you trust.
• Not for databases or anything where an unattended version jump could break data: pin those and update them deliberately. Watchtower can also only check, not update, with --monitor-only.

How to install or try it

docker run --detach \
  --name watchtower \
  --volume /var/run/docker.sock:/var/run/docker.sock \
  nickfedor/watchtower

The Docker socket mount lets Watchtower see and recreate containers, which means it has root-level access to the host. Careful: a container that Watchtower recreates loses anything stored in its writable layer, so make sure your services keep data in volumes before enabling it. Add --label-enable to the command and com.centurylinklabs.watchtower.enable=true as a label on each container you want updated to opt in service by service.

Credit

Watchtower was created by CenturyLink Labs, maintained for years by the containrrr team, and is now carried on by Nicholas Fedor and contributors at github.com/nicholas-fedor/watchtower. Documentation: watchtower.nickfedor.com.