Auto-update tools pull :latest and recreate containers unattended. That’s convenient until a release needs a manual migration step. A safer pattern: get told about updates, then apply them yourself with the weekend workflow.
Option 1: DIUN (Docker Image Update Notifier)
DIUN only notifies. It never changes your containers. It watches registries and sends alerts to Discord, Slack, Telegram, ntfy, email and more. With the Docker provider you opt containers in with labels:
services:
immich-server:
image: ghcr.io/immich-app/immich-server:v3.3.4
labels:
- "diun.enable=true"DIUN can also watch for new tags of a repo, which matters once you’ve pinned versions (a pinned tag never “updates”, so a newer tag is what you want to hear about).
Option 2: Watchtower in monitor-only mode
If you already run Watchtower, set its monitor-only option (--monitor-only / WATCHTOWER_MONITOR_ONLY=true). It then sends notifications without updating. Watchtower compares the image behind your current tag, so it fits :latest-style tags better than pinned versions.
Where auto-update is acceptable
Stateless, easily replaced containers (a static site, a dashboard) are low-risk. Anything with a database (Immich, Nextcloud, Paperless-ngx, authentik, Vaultwarden) should be updated deliberately, with a backup.
Checklist
- Notifications set up (DIUN or Watchtower monitor-only)
- Database-backed apps excluded from auto-updates
- Updates applied in a planned window with backups