How to Install Watchtower on a VPS for Docker Update Notifications

Watchtower is a lightweight, open-source tool that monitors your running Docker containers and automatically updates them when a new image version is available, and can notify you whenever an update happens. This guide walks through installing it on a VPS and setting up notifications.

Before starting, connect to your VPS via SSH with a user that has sudo privileges and has Docker already installed.

Note: the original containrrr/watchtower image is no longer actively maintained. This guide uses nickfedor/watchtower, a fully compatible, actively maintained fork that works as a drop-in replacement.

Step 1: Run Watchtower with Docker

Start Watchtower with a single command. Mounting the Docker socket lets it communicate with the Docker daemon to check and update your other containers:

docker run -d \
  --name watchtower \
  --restart unless-stopped \
  -v /var/run/docker.sock:/var/run/docker.sock \
  nickfedor/watchtower

By default, Watchtower checks all running containers for updates every 24 hours and updates them silently in the background, with no notifications sent.

Step 2: Set an Update Schedule

To control exactly when Watchtower checks for updates, use the WATCHTOWER_SCHEDULE variable with a cron expression. This example checks daily at 4 AM:

docker run -d \
  --name watchtower \
  --restart unless-stopped \
  -e WATCHTOWER_SCHEDULE="0 0 4 * * *" \
  -e WATCHTOWER_CLEANUP=true \
  -v /var/run/docker.sock:/var/run/docker.sock \
  nickfedor/watchtower

WATCHTOWER_CLEANUP=true removes old, unused images after a container is updated, which keeps disk usage from growing over time.

Step 3: Enable Update Notifications

Watchtower can send a notification whenever it updates a container, using services such as Telegram, Discord, Slack, or email. This example configures Telegram notifications:

docker run -d \
  --name watchtower \
  --restart unless-stopped \
  -e WATCHTOWER_SCHEDULE="0 0 4 * * *" \
  -e WATCHTOWER_CLEANUP=true \
  -e WATCHTOWER_NOTIFICATIONS=shoutrrr \
  -e WATCHTOWER_NOTIFICATION_URL="telegram://YOUR_BOT_TOKEN@telegram/?channels=YOUR_CHAT_ID" \
  -v /var/run/docker.sock:/var/run/docker.sock \
  nickfedor/watchtower

Replace YOUR_BOT_TOKEN and YOUR_CHAT_ID with your own Telegram bot token and chat ID. Discord, Slack, and email notifications follow the same WATCHTOWER_NOTIFICATION_URL format, using their own connection string syntax.

Step 4: Limit Updates to Specific Containers

By default, Watchtower updates every running container on the server. To only update containers you've explicitly approved, enable label-based filtering:

-e WATCHTOWER_LABEL_ENABLE=true

Then add this label to any container you want Watchtower to manage:

--label com.centurylinklabs.watchtower.enable=true

Containers without this label are left untouched, which is especially useful for databases or other services where an automatic restart could cause downtime.

Step 5: Verify Watchtower Is Running

Check that the container started correctly and review its logs:

docker ps
docker logs watchtower

The logs will confirm Watchtower's active schedule and show its next check for container updates, and going forward, any updates or notifications will appear here as well.

Running Watchtower alongside your other containers keeps them patched with minimal manual effort, which matters most on a server handling multiple services at once. A Linux VPS with enough RAM and CPU headroom gives Docker and Watchtower the resources they need to run smoothly alongside your applications.

With Watchtower running, your Docker containers stay up to date automatically, and you'll know exactly when an update happens instead of finding out weeks later.