Watchtower watched your running containers, pulled newer images and restarted the containers automatically. The original project was archived on 17 December 2025 and the repository is now read only.
Our verdict on Watchtower#
Watchtower is archived. containrrr/watchtower went read only on 17 December 2025, the last release was v1.7.1 in November 2024, and the maintainers' own note says they stopped being Docker users and lost interest. They deliberately declined to bless a successor and warned that several active forks are, in their words, full of AI slop. nicholas-fedor/watchtower is the fork with the most visible activity and publishes nickfedor/watchtower, but evaluating it is your due diligence, not an endorsement. The archived build also has open reports of failing against newer Docker Engine API versions. Separately, and more importantly: do not point unattended updates at stateful containers. PostgreSQL, MariaDB, Nextcloud, Immich and Vaultwarden all run one-way schema migrations on start, and a 3am pull of a moving tag is how people lose data with no rollback. If you want the awareness without the risk, run Diun and do the upgrade yourself.
Who Watchtower is for#
Choose it if
- Stateless containers you would restart without thinking anyway: a reverse proxy, an exporter, a static site, a DNS resolver.
- Development and test machines where a broken container is an inconvenience rather than an incident.
- Existing installations you are keeping only until you have migrated to a maintained fork or to notify-only updates.
- Containers pinned to a specific minor tag, where the update it can apply is deliberately small.
Look elsewhere if
- Anything holds state. PostgreSQL, MariaDB, Nextcloud, Immich and Vaultwarden all migrate schemas irreversibly on first start of a new major version.
- The host is one you would call production. Upstream is archived and will not receive security fixes, and neither will its dependency tree.
- You are on a recent Docker Engine. The frozen v1.7.1 has open reports of incompatibility with newer Docker API versions.
What running it actually looks like#
One container with /var/run/docker.sock mounted, which is root-equivalent access to the host: anything that can talk to that socket can start a privileged container and own the machine. It polls every 24 hours by default via --interval, or on a cron expression with --schedule. --cleanup removes superseded images, and without it your disk accumulates old layers indefinitely. --label-enable flips it to opt-in so only containers carrying com.centurylinklabs.watchtower.enable=true are touched, which is the only configuration worth running. Private registries need ~/.docker/config.json mounted in. There is no listener unless you enable the HTTP update endpoint on 8080. Since the image is frozen at v1.7.1, there is nothing left to upgrade to: the only remaining deployment decision is whether to remove it.
Resource profile#
- Memory
- 15 MB idle, around 40 MB in ordinary use. Estimated, not documented. A small Go binary that sleeps between polls; memory rises only while it is comparing image manifests and pulling layers.
- CPU and acceleration
- Idle between intervals, and the default interval is 24 hours. Each cycle is registry API calls plus image pulls, so the real cost is bandwidth and disk, not CPU.
- Storage growth
- It stores nothing of its own, but it costs you disk indirectly: every update leaves the superseded image behind unless you run it with `--cleanup`.
- Operational load
- 2 of 5, Light. The component itself is set and forget by design, which is exactly the problem. It scores 2 rather than 1 because you are now running an archived binary with root-equivalent access to the Docker socket, and that is attention you owe it whether you spend it or not.
Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.
Data and backup surface#
Watchtower stores nothing. There is no database, no volume and no state to restore; its entire configuration is the flags and environment variables on its own container, plus optionally a mounted ~/.docker/config.json for registry credentials. What matters is the data belonging to the containers it updates. If you are running it at all, the backup that counts is the one for the stateful services underneath, taken before the update window rather than after, because Watchtower gives you no pre-update snapshot and no rollback path. Record the image digests you are currently running with docker inspect --format '{{.Image}}' so you can pin back to a known-good one when an update goes wrong.
Derived backup shape
File copy. Copy the config and data directories. Safe while running for anything that writes atomically.
Traps and surprises#
The repository is archived with no official successor
containrrr/watchtower became read only on 17 December 2025. The maintainers' announcement says plainly that they are no longer Docker users and lost interest, and they explicitly declined to recommend a fork, cautioning that some active ones are full of generated filler. If you keep using it you are running unmaintained code with root-equivalent host access. Either migrate to a fork you have personally reviewed, or move to notify-only.
The Docker socket is root on the host
Watchtower needs /var/run/docker.sock to inspect and recreate containers, and that socket is equivalent to root: any process holding it can start a container with the host filesystem mounted. That was an acceptable trade when the project was maintained. On an archived codebase with a frozen dependency tree it is a standing risk, and there is no read-only mode that still lets it do its job.
Moving tags cross major versions without warning
Watchtower updates whatever the tag currently resolves to, and :latest routinely crosses major versions. That is how a Nextcloud jumps two majors overnight, or a PostgreSQL container comes up refusing to read a data directory written by an older engine. Pin tags to a minor line at minimum, and accept that pinning is what removes most of the automation's value in the first place.
No cleanup means a full disk
Without --cleanup, every superseded image stays on disk as dangling layers, and a weekly cycle over a dozen containers fills a small VPS in months. The failure appears as unrelated write errors from other services rather than as anything mentioning Watchtower. Either run with --cleanup or schedule docker image prune separately, and monitor free space on the Docker data root.
The frozen build breaks on newer Docker Engine
v1.7.1 predates recent Docker Engine API changes and there are open reports of it failing against Docker 29 and later. Because the repository is archived, no fix is coming. The symptom is Watchtower running quietly and updating nothing, which looks identical to having nothing to update. Check its logs after any Docker Engine upgrade rather than assuming silence means everything is current.
Specifications#
- Category
- Security and update hygiene
- Licence
- Apache-2.0 (Permissive)
- Written in
- Go
- First release
- 2015
- Maturity
- Slowed
- Datastore
- none, it reads the Docker API
- Default ports
- none
- Ships as
- docker
- arm64 builds
- Yes
- Identity
- Not applicable. No accounts and no interface. It authenticates to registries with a mounted `config.json` and to Docker through the socket, which is the only credential that matters.
- Replaces
- Renovate, Dependabot, Portainer auto-update
- Project site
- containrrr.dev/watchtower
- Source
- github.com/containrrr/watchtower
- Documentation
- containrrr.dev/watchtower
Alternatives to Watchtower#
Everything else in security and update hygiene, closest in operational weight first.
| Tool | Ops load | Idle RAM | Licence |
|---|---|---|---|
| CrowdSec | 2, Light | 120 MB | MIT |
| Fail2ban | 2, Light | 40 MB | GPL-2.0-or-later |
| Diun | 1, Set and forget | 25 MB | MIT |
| Wazuh | 5, Project-grade | 6144 MB | GPL-2.0 |
Where Watchtower comes up elsewhere#
Reference
Sources#
Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.
Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.