watchtower-compose.yml

# --------------------------------------------------------------------------
# Watchtower is awesome. It allows automatically updating Docker containers,
# even itself. It's configured to run once daily at 3AM here.
# --------------------------------------------------------------------------

# quick network info:
# - subnet: 172.22.0.0/24
# - port: 2375

services:
  # use docker-socket-proxy for watchtower's Docker access
  watchtower-socket-proxy:
    container_name: watchtower-socket-proxy
    image: tecnativa/docker-socket-proxy
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    networks: # uses the socket proxy network
      watchtower_socket_network:
        ipv4_address: 172.22.0.10  # assign a static IP for firewall ease
    privileged: true
    ports:
      - 2375:2375
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - LOG_LEVEL=info
      - POST=1
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
    labels:
      - "com.centurylinklabs.watchtower.monitor-only=true"

  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    depends_on:
      - watchtower-socket-proxy
    environment:
      - DOCKER_HOST=tcp://watchtower-socket-proxy:2375
      - TZ=America/New_York
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_INCLUDE_STOPPED=true # update stopped containers
      - WATCHTOWER_REVIVE_STOPPED=false # but don't start them after
      - WATCHTOWER_SCHEDULE=0 0 3 * * * # daily at 3:00:00 AM
      - WATCHTOWER_NOTIFICATION_EMAIL_FROM=${GMAIL}
      - WATCHTOWER_NOTIFICATION_EMAIL_TO=${GMAIL}
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.gmail.com
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=${GMAIL}
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=${GMAIL_PASSWORD} # https://myaccount.google.com/apppasswords
      - WATCHTOWER_NOTIFICATION_EMAIL_DELAY=30
      - WATCHTOWER_NOTIFICATIONS=email
    networks:
      watchtower_socket_network:
        ipv4_address: 172.22.0.11  # assign a static IP for firewall ease
    restart: unless-stopped

networks:
  watchtower_socket_network:
    # a custom network that all docker socket requests are routed through
    name: watchtower_socket_network
    driver: bridge
    ipam:
      config:
        - subnet: "172.22.0.0/24"
          gateway: "172.22.0.1"
          ip_range: "172.22.0.0/24"