Skip to content

Watchtower – Automated Updates in Container Manager on a Synology NAS

Important or Recent Updates
Historic UpdatesDate
New guide update for DSM7.2 and Container Manager30/04/2023
Added labels to GlueTUN container guide so updated information in this one to coincide06/05/2023
Added a 3rd option to just exclude specific containers via a label.23/11/2023
Historic Updates

What is Watchtower?

Watchtower requires access to the Docker socket, we are unable to set this up via the Synology GUI. This means we will be using Docker-Compose.

Let’s Begin

We will be setting up Watchtower using the Project functionality in Container Manager. This uses a compose file to tell Docker how to set up the container and also define some preferences.

Folder Setup

Let’s start by getting a folder set up for the container to use. Open up File Station create the following.


Container Manager

Next we are going to set up a ‘Project’ in Container Manager. Open up Container Manager and click on Project then on the right-hand side click ‘Create’.

In the next screen we will set up our General Settings, enter the following:

Project Name:watchtower
Source:Create docker-compose.yml

We have a couple of different composes available below, the first one is configured to update all running containers at 2am daily.

    image: containrrr/watchtower:latest
    container_name: watchtower
      - WATCHTOWER_SCHEDULE=0 0 2 * * *
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

As an addition to the method above you can exclude specific containers from updates by adding this line to their yaml (compose) details. This is likely faster than using method 2

      - com.centurylinklabs.watchtower.enable=false

The second has an added section where you can specify the names of the containers you would like to update (use the exact name of the container as per the Synology UI)

    image: containrrr/watchtower:latest
    container_name: watchtower
      - WATCHTOWER_SCHEDULE=0 0 2 * * *
    command: # add or remove the below as required
      - overseerr
      - plex
      - prowlarr
      - radarr
      - sonarr
      - tautulli
      - watchtower
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

You can copy and paste the one you wish to use into the blank section in Container Manager.

Environment Variables

We need to make some changes in order for watchtower to know what time it is where you are and what we want it to do. You can amend these in the compose based on your preferences.

VariableValueWhat it does
TZEurope/LondonChange this to your own timezone
WATCHTOWER_CLEANUPtrue or falseWe want to clean up the old docker images, if you don’t turn this on over the course of a few months you will find that the images start to eat a lot of space, and they are not even being used. (true or false)
WATCHTOWER_INCLUDE_STOPPEDtrue or falseDo you want to update any stopped containers, the container will stay stopped after being updated (true or false)
WATCHTOWER_REVIVE_STOPPEDtrue or falseIf a stopped container is updated do you want Watchtower to start it up? (true or false)
WATCHTOWER_SCHEDULE0 0 2 * * *Rather than setting the number of seconds to wait between checks you can set a schedule. The default I use for the guide is 2am every day, you can work out your own schedule using a cron schedule generator.

Click ‘Next’

You do not need to enable anything on the ‘Web portal settings’ screen click ‘Next’ again

On the final screen click Done which will begin the download of the container images and once downloaded they will be launched!

The image will now be downloaded and extracted. You should see ‘Code 0’ when it has finished.

You will now see your watchtower project running it should have a green status on the left-hand side.

You can now just leave Watchtower running you will never need to manually update your containers again.


I keep getting X container has stopped unexpectedly errors!
DSM does not know or understand that Watchtower is issuing commands in the background. So it makes the assumption that a container was stopped unexpectedly, but we know it was Watchtower doing an update.

Do I need to update Watchtower itself?
Nope it updates itself – quite clever really 🙂

Looking for some help, join our Discord community

If you are struggling with any steps in the guides or looking to branch out into other containers join our Discord community!

Buy me a beverage!

If you have found my site useful please consider pinging me a tip as it helps cover the cost of running things or just lets me stay hydrated. Plus 10% goes to the devs of the apps I do guides for every year.

Published inDockerSynologyUpdating Containers 7.2


  1. sp sp

    Since this does not use the synobridge, do we need to add the watchtower_default bridge to firewall exception?

    • Dr_Frankenstein Dr_Frankenstein

      It likely is not needed as Watchtower is asking Docker to do the checks etc.

  2. What are the alternatives to hardcoding env variables in docker-compose?

    Locally, I can run my project with docker compose –env-file ./ up –build via the terminal but I don’t have that option in the container manager and I would like to avoid putting passwords etc. in the file.

  3. Shiba Shiba

    Hi Doc, love your guides. Thanks so much for the effort you put in.

    When I put “0 0 2 * * *” into that handy crontab generator link, it says: “At 12:00 AM, on day 3 of the month”

    For a 2am schedule, should it not be: “0 2 * * *”

  4. Patrick Heywood Patrick Heywood

    I see watchtower (I am re-installing everything here) does not use the synobridge network, and the installation creates a watch_tower default network in container manager (DSM 7.2). Is this expected behavior, or do I include a synobridge network_mode statement in the compose file?

    • Dr_Frankenstein Dr_Frankenstein

      Hey,it doesn’t need access to the synobridge network so it is not added. It can sit on its own.

      • Bebop Bebop

        Hey Dr_Frankenstein,

        Sorry to revive an old thread but didn’t want to create new one for almost the same question. Would there be any issues with running watchtower on the same synobridge network? I’d prefer to keep all docker containers under that one bridge for the sake of not having a bunch of network names to keep track of. I’m slowly learning the networking ropes to properly set up my home network, and am trying to keep things neat and tidy if/when possible.


        • Dr_Frankenstein Dr_Frankenstein

          Hey nothing wrong with doing that purely up to you, the only reason I don’t have it on the same bridge is that it doesn’t require access to the other containers.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed. – writing Synology Docker Guides since 2016 – Join My Discord!