Latest Watchtower fork? (github.com)
from blazeknave@lemmy.world to selfhosted@lemmy.world on 12 Mar 16:05
https://lemmy.world/post/26729082

cross-posted from: lemmy.world/post/26728988

Hi - I’m rebuilding my homelab and want to give docker compose another try. It looks like Watchtower is years out of date now. I see two forks that look more promising per techgaun.github.io/active-forks/index.html#https:…

These two: github.com/beatkind/watchtower github.com/nicholas-fedor/watchtower

The former seems to have more activity. What are you all using?

#selfhosted

threaded - newest

BlackEco@lemmy.blackeco.com on 12 Mar 16:26 next collapse

The first one also has better code coverage and way more pulls on Docker Hub.

roofuskit@lemmy.world on 12 Mar 16:32 next collapse

Those of you self hosters who use watchtower, what’s your use case?

ShortN0te@lemmy.ml on 12 Mar 16:34 next collapse

Automatic updates. Works like a dream. Depending on what you are running it can obviously cause issues, either server side breaking or server,client communication issues

morethanevil@lemmy.fedifriends.social on 12 Mar 16:35 next collapse

I only let me notify about updates. I don’t want autoupdates, because some projects may have breaking changes (looking at you Immich 😁)

I get a message from watchtower over Gotify and then I can read the changelog

blazeknave@lemmy.world on 12 Mar 17:04 next collapse

I’ve been thinking about this. Can you do that with watchtower? Don’t need diem or anything?

morethanevil@lemmy.fedifriends.social on 12 Mar 17:25 collapse

It is very easy. Here is my compose:

services:
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
    command: --interval 10800
    logging:
      driver: local
    environment:
          WATCHTOWER_NOTIFICATION_URL: gotify://
          WATCHTOWER_NOTIFICATIONS_HOSTNAME: Fancy name
          WATCHTOWER_MONITOR_ONLY: true
          WATCHTOWER_WARN_ON_HEAD_FAILURE: never

Every 3 hours it will check for updates, send a message via Gotify and pull the new images. It will not restart the containers with the new images.

bigDottee@geekroom.tech on 12 Mar 21:44 next collapse

Honestly I think this might be a better way than what I’m using now. I’ve subbed to dockerrelease.io (edit: docker-notify.com) and releasealert.dev … get spammed all day everyday because the devs keep pushing all sorts of updates to old branches… or because those sites aren’t configured well.

roofuskit@lemmy.world on 12 Mar 23:11 collapse

Is it possible to have it auto update say one container and notify the rest?

morethanevil@lemmy.fedifriends.social on 13 Mar 04:11 next collapse

No, because MONITOR_ONLY is for all

VeryNiiiice@sh.itjust.works on 16 Mar 05:51 collapse

Yes. There is a label you would need to apply to all of your containers to specify whether or not to update: com.centurylinklabs.watchtower.monitor-only=true

mac@lemm.ee on 13 Mar 00:26 next collapse

I just use RSS for this ¯_(ツ)_/¯

Appoxo@lemmy.dbzer0.com on 13 Mar 13:15 collapse

You can use scopes to limit updates to pre-determinded containers.

blazeknave@lemmy.world on 12 Mar 17:03 next collapse

ADHD and not technical by trade so it’s not in my DNA to remember

BakedCatboy@lemmy.ml on 13 Mar 02:28 next collapse

I use it to auto update nginx and haproxy containers, since they adhere very well to semver there is very little risk of breakage if you use the correct tag and not just :latest. I haven’t had a single issue in many years, and it’s nice to know that I’ll get critical security updates within 24h of images being pushed.

ZeldaFreak@lemmy.world on 13 Mar 10:52 next collapse

Auto update. Works like a charm, except PostgreSQL. For me it’s good enough and even though works with containers, where they don’t recommend it. I do have backups and for my private time, I don’t get paid, so it should be as maintenance as possible from my side.

I do check from time to time if something is broken and I noticed a container where they removed a version tag, I was using. The “biggest” thing that was broken, was my gitea server where they changed the config for the default Theme.

Also that’s why I hate PostgreSQL. It requires manual labor for updating. Had a recipe Docker and they cut support for previous major version quickly. Not good. That stuff could break, ist an option with every update. This is why backups exist. As a single user, it’s not a problem. For a big system, I wouldn’t do auto updates, so I can check if everything works.

Appoxo@lemmy.dbzer0.com on 13 Mar 13:14 collapse

Thw only it provides: Auto-updating.

roofuskit@lemmy.world on 13 Mar 16:33 next collapse

Yeah but what are you updating that is so non-critical you can trust watchtower to update it unattended, without reading release notes?

Appoxo@lemmy.dbzer0.com on 13 Mar 17:43 collapse

traefik, authelia, the *arrs etc.
I disabled auto updates for databases.

Bakkoda@sh.itjust.works on 13 Mar 16:42 collapse

I just have it send a notification of available update. No auto for me.

ShortN0te@lemmy.ml on 12 Mar 16:37 next collapse

Years out of date

What problems does it have? Never ran into an issue for my usecase.

blazeknave@lemmy.world on 12 Mar 17:04 collapse

I don’t know. Last time I used it was maintained. Seems like a security vulnerability running something this critical out of date, no?

ShortN0te@lemmy.ml on 12 Mar 17:37 collapse

Just because there is no update does not mean there are security vulnerabilities to worry about, or do you have a specific one that is not fixed?

The attack vector seems very narrow to me. It checks the container registry downloads the containers and runs some docker commands.

It has no interface, so in order to attack it you either have to compromise the container registry (but then it would be easier to compromise the containers you download) the secure connection used to download the containers (https is quite stable) or something on the server side.

Also the project does not really look that abundant to me.

EDIT: So i have not checked this, but watchtower is probably using docker for most steps anyway? So basically the only thing that could be attacked is via the notifications watchtower is sending?

jlh@lemmy.jlh.name on 12 Mar 17:16 collapse

Use renovate instead, it supports dockerfiles.

docs.renovatebot.com/docker/