Skip to content
Getting Started
Docker Secrets

Docker Secrets

Overview

Watchtower supports the use of Docker Secrets to provide a way for using sensitive values without exposing them as environment variables.

The following supported configuration options allow for users to reference a filepath instead of directly referencing the secret value (e.g. WATCHTOWER_HTTP_API_TOKEN=/run/secrets/api_token instead of WATCHTOWER_HTTP_API_TOKEN=secret_token).

Watchtower will then check whether the provided value is a path to an existing file on disk. Upon successful validation, the contents of the file are read and used as the value instead.

Supported Configuration Options

Configuration OptionDeprecated
HTTP API TokenNo
HTTP API Events TokenNo
Notification URLNo
Email Server PasswordYes
Gotify TokenYes
Microsoft Teams HookYes
Slack Hook URLYes

Watchtower v2 Legacy Notification Deprecation

Deprecated notification configuration options will be removed with the release of Watchtower v2.

Use the the NOTIFICATION URL with the appropriate Shoutrrr URL scheme instead.

  • For the Notification URL option, when a value is a path to a file, each non-empty line in the file is treated as a separate notification URL.
  • This file-based support works with any mechanism that can make a file available inside the container at runtime.
  • You specify the path to the file inside the container (e.g. /run/secrets/http_api_token).

Examples

HTTP API Token

Provide the HTTP API Token from a file.

services:
    watchtower:
        image: nickfedor/watchtower:latest
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        secrets:
            - api_token
        environment:
            - WATCHTOWER_HTTP_API_TOKEN=/run/secrets/api_token
            # Enable an endpoint that requires the token
            - WATCHTOWER_HTTP_API_ENDPOINTS=metrics
        ports:
            - "8080:8080"
        restart: unless-stopped

secrets:
    api_token:
        file: ./secrets/api_token.txt

HTTP API Events Token

Provide the HTTP API Events Token from a file.

services:
    watchtower:
        image: nickfedor/watchtower:latest
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        secrets:
            - events_token
        environment:
            - WATCHTOWER_HTTP_API_EVENTS_TOKEN=/run/secrets/events_token
            - WATCHTOWER_HTTP_API_ENDPOINTS=events
        ports:
            - "8080:8080"
        restart: unless-stopped

secrets:
    events_token:
        file: ./secrets/events_token.txt

Notification URL

Provide the Notification URL value(s) from a file. The file may contain one or more Shoutrrr URLs (one per line).

services:
    watchtower:
        image: nickfedor/watchtower:latest
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        secrets:
            - notification_url
        environment:
            - WATCHTOWER_NOTIFICATION_URL=/run/secrets/notification_url
        restart: unless-stopped

secrets:
    notification_url:
        file: ./secrets/notification_url.txt
Last updated on
Container SelectionUpdating Watchtower