Watchtower ignoring disable labels and updating containers anyway

[spencerskinner99]

I have two containers which I do not want to have watchtower auto-updating, so I used the filter flags with the intent of watchtower not updating these containers. An example of how I have deployed these containers is below -

jackett:
    image: linuxserver/jackett
    container_name: jackett
    environment:
      PUID: '1001'
      PGID: '1001'
      TZ: GB
    network_mode: "service:transmission-openvpn"
    volumes:
    - /Docker_Configs/Jackett/config:/config
    - /media/VMRoot/VMMedia/:/downloads
    tty: true
    restart: unless-stopped
    depends_on:
      - "transmission-openvpn"
    labels:
      - com.centurylinklabs.watchtower.enable = "false"

My watchtower deployment is shown below too -

watchtower:
    image: containrrr/watchtower
    hostname: watchtower
    container_name: watchtower
    network_mode: le_bridge
    #environment:
     # WATCHTOWER_MONITOR_ONLY: "transmission-openvpn,jackett"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --interval 3600
    restart: unless-stopped
    
  

Ignore the monitor only section as that has been quoted out.

Despite having the above configuration the Jackett container is still updating, this causes a 502 bad gateway error and means all other containers which require access to this container cant really function as intended.

I also have a hunch that I may have not interpreted the documentation correctly, should I have the WATCHTOWER_LABEL_ENABLE set to FALSE in the environment variables?

I am running Docker 18.06.5

[zoispag]

Hi there,

in order for the com.centurylinklabs.watchtower.enable label to be taken into account, you need to either pass the --label-enable flag to the watchtower command or set the WATCHTOWER_LABEL_ENABLE environment variable.

Container selection

[zoispag]

Although it might have the same result, WATCHTOWER_LABEL_ENABLE expects a boolean value. For the object yml notation, you should write it as WATCHTOWER_LABEL_ENABLE: 1

Example from my docker-compose.yml file:

version: '3.5'

services:
  watchtower:
    image: containrrr/watchtower
    environment:
      TZ: Europe/Amsterdam
      WATCHTOWER_POLL_INTERVAL: 300       # Poll interval in seconds
      WATCHTOWER_INCLUDE_STOPPED: 1       # Include stopped containers
      WATCHTOWER_REVIVE_STOPPED: 1        # Restart stopped containers
      WATCHTOWER_CLEANUP: 1               # Delete unused image
      WATCHTOWER_LABEL_ENABLE: 1          # Only include containers with enable label
      WATCHTOWER_LIFECYCLE_HOOKS: 1       # Enable pre/post-update scripts
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ~/.docker/config.json:/config.json:ro
    labels:
      com.centurylinklabs.watchtower.enable: true

[KobesM]

Correct notation of labels with docker compose v2 is:

labels:
    com.example.description: "Accounting webapp"
    com.example.department: "Finance"
    com.example.label-with-empty-value: ""

So you should probably use:

labels:
    com.centurylinklabs.watchtower.enable: "false"

See: https://docs.docker.com/compose/compose-file/compose-file-v2/

[spencerskinner99]

I made the changes to the syntax as you have shown last night to

  jackett:
    image: linuxserver/jackett
    container_name: jackett
    environment:
      PUID: '1001'
      PGID: '1001'
      TZ: GB
    network_mode: "service:transmission-openvpn"
    volumes:
    - /Docker_Configs/Jackett/config:/config
    - /media/VMRoot/VMMedia/:/downloads
    tty: true
    restart: unless-stopped
    depends_on:
      - "transmission-openvpn"
    labels:
      com.centurylinklabs.watchtower.enable: "false"

And of course my Watchtower looks like this

watchtower:
    image: containrrr/watchtower
    hostname: watchtower
    container_name: watchtower
    network_mode: le_bridge
    environment:
      WATCHTOWER_LABEL_ENABLE: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --interval 3600
    restart: unless-stopped

Jackett was again updated last night causing it to 502 error. This has me confused now as surely with the labels set like they are, the container shouldnt be updating?

[spencerskinner99]

Portainer refuses to deploy it when the quotes are removed, from what I can see, all that adding those flags has done is meant that only Jackett gets updates and my other containers are no longer touched

[the-lazy-fox]

From what I see in the documentation:
"Do not update containers that have com.centurylinklabs.watchtower.enable label set to false and no --label-enable argument is passed. Note that only one or the other (targeting by enable label) can be used at the same time to target containers."

So you should remove WATCHTOWER_LABEL_ENABLE: 1 and try again as you changed your label to exclude.

https://containrrr.dev/watchtower/arguments/#filter_by_disable_label

[simonaronsson]

There are two ways of doing this, and usually, you'd pick the one which gives you to the least amount of duplication in your config:

Exclude everything except when the enable label is set to true:

  watchtower:
    [...]
    environment:
      WATCHTOWER_LABEL_ENABLE: 1
  included:
    [...]
    labels:
      com.centurylinklabs.watchtower.enable: "true"
  excluded:
    [...]

Include everything except when the enable label is set to false:

  watchtower:
    [...]
  included:
    [...]
  excluded:
    [...]
    labels:
      com.centurylinklabs.watchtower.enable: "false"    

Additional details in https://containrrr.dev/watchtower/arguments/#filter_by_disable_label and https://containrrr.dev/watchtower/container-selection/

If portainer refuses to read common yaml, I'd suggest opening an issue with them. This is perfectly valid when using docker-compose directly

[KevoM]

It throws me an error when updating the stack through Portainer. I had to write labels in plural in my docker-compose like so :

labels:
      - "com.centurylinklabs.watchtower.enable=false"

[piksel]

Yeah, updated the example to align with docker-compose YAML (also quoted the values, as the YAML types for label values are string, but bare true is interpeted as boolean).

[Trufax]

Hi sorry for digging this up but i think its not worth a separate request. If i want to get notifications for ALL containers, but only automatically update a subset of them, would this work?

Set the label: com.centurylinklabs.watchtower.monitor-only=true on all containers i just want to be notified. Set NO label on the containers i want to auto update.
Do i need to set : WATCHTOWER_LABEL_ENABLE=true on the watchtower container for this or not ?

Thanks

[piksel]

@Trufax yeah, that's the intended way. No need to use WATCHTOWER_LABEL_ENABLE=true.

[Silversurfer79]

What a pain in the a*%e to get this to working, espicially on patching specfic containers.

I found a way to get it to work, try this:

version: '3.5'


services:
  watchtower:
    image: containrrr/watchtower
    hostname: watchtower
    container_name: Watchtower
    environment:
      TZ: Europe/London
#     WATCHTOWER_RUN_ONCE: 1
      WATCHTOWER_POLL_INTERVAL: 86400        # Poll interval in seconds
#     WATCHTOWER_MONITOR_ONLY: 1             # Monitoring Only
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
     command: --debug true Bazarr Firefox Gluetun Jellyfin Lidarr      #Add all your apps here to be updated

Source
https://www.youtube.com/watch?v=BRpUlNmI4wM&t=479s

[simonaronsson]

Glad you found a solution that felt intuitive to you, although I'd still recommend what I described in the answer above for any others reading this thread. Also, as a side note, --debug true will include true as a container name to watch for updates as boolean flags take no arguments.