How to Automate Docker Container Updates with Watchtower on Linux Cloud VPS

The Container Maintenance Dilemma

When running a self-hosted cloud server on Contabo or Hostinger VPS with 15+ Docker microservices (Nginx Proxy Manager, Umami, Ghost, Vaultwarden, Redis, Portainer), keeping them patched against zero-day CVE security vulnerabilities can feel like a full-time job. Manually running docker compose pull && docker compose up -d across dozens of repositories is tedious and frequently neglected.

Watchtower is an open-source automation utility that monitors all running Docker containers on your server. When a software maintainer pushes an updated image tag to Docker Hub, Quay, or GHCR, Watchtower silently pulls the new image layer, gracefully shuts down the running container, and restarts it with the exact same flags, volume mounts, and network configurations.

Safety First: Pinning Tags vs. Updating Blindly

Step 1: Deploying Watchtower with Docker Compose

Create a dedicated directory for Watchtower:

mkdir -p /opt/watchtower && cd /opt/watchtower
nano docker-compose.yml

Paste the following production-ready configuration:

services:
  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_REMOVE_VOLUMES=false
      - WATCHTOWER_INCLUDE_STOPPED=false
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
      - WATCHTOWER_NOTIFICATIONS=shoutrrr
      - WATCHTOWER_NOTIFICATION_URL=discord://TOKEN@WEBHOOK_ID
      - TZ=UTC

Key Watchtower Configuration Parameters Explained

• WATCHTOWER_CLEANUP=true: Automatically deletes old, dangling Docker images after updating to save hundreds of gigabytes of disk space over time.
• WATCHTOWER_SCHEDULE=0 0 4 * * *: Uses standard cron syntax to schedule checks every morning at 4:00 AM UTC when your website traffic is at its lowest.
• WATCHTOWER_NOTIFICATIONS=shoutrrr: Enables the multi-platform notification engine.
• /var/run/docker.sock: Grants Watchtower the necessary socket access to communicate with the host Docker daemon.

Step 2: Selective Updates Using Container Labels

If you only want Watchtower to update containers that you have explicitly verified, set the label-enable mode:

environment:
  - WATCHTOWER_LABEL_ENABLE=true

Then, in your other service compose files, simply add the label to opt-in:

services:
  umami:
    image: ghcr.io/umami-software/umami:postgresql-latest
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

Containers lacking this label will be completely ignored by Watchtower, safeguarding your mission-critical databases and payment gateways.

Step 3: Integrating Discord & Telegram Notifications

Watchtower integrates with Shoutrrr, allowing you to route deployment alerts to your preferred team messaging app:

For Discord:

WATCHTOWER_NOTIFICATION_URL=discord://webhook_token@webhook_id

For Telegram:

WATCHTOWER_NOTIFICATION_URL=telegram://BOT_TOKEN@telegram?chats=CHAT_ID

Step 4: Launching Watchtower

Start the Watchtower daemon:

docker compose up -d
docker compose logs -f watchtower

You will see confirmation logs indicating that Watchtower is active and scheduled for its next scanning cycle.

Summary

Deploying Watchtower on your Contabo or Hostinger Linux VPS guarantees that your reverse proxies, web apps, and utility containers receive upstream security patches automatically, while intelligent labels and cleanup routines preserve server stability and disk hygiene.