Watchtower: Inclusion of docker secrets not working

[kevdogg]

I'm originally referencing this closed issue:
https://github.com/containrrr/watchtower/issues/532

It was my understanding the use of docker secrets was merged to next release on Jun 10. Perhaps it was not.

Briefly I'm trying to pass the WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD as a docker secret and not as plaintext within configuration file.

The following will work:

```
watchtower:
image: containrrr/watchtower:latest-dev
container_name: watchtower
restart: always
networks:
- net
command: --schedule "0 0 */4 * * *"
....
....
environment:
- WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=PASSWORDHERE

However the inclusion of docker secrets such as below will not:

 ```
secrets:
  watchtower_notification_email_server_secret:
    file: ./watchtower_notification_email_server.secret

 watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: always
    networks:
      - net
    command: --schedule "0 0 */4 * * *"
    secrets:
      - watchtower_notification_email_server_secret
    ....
    ....
    environment:
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD_FILE=/run/secrets/watchtower_notification_email_server_secret

I thought this functionality was included??? I tested this against the latest-dev image.

[simskij]

Hey @kevdogg,

When it comes to latest-dev, this is not a supported image but rather something we use while we develop watchtower. Regarding the feature you're talking about, information on how to use it is available here.

Best,
Simme

[kevdogg]

Thanks for reply @simskij

I've tested against latest and latest-dev (wasn't sure which one to test) ###See below -- I guess my testing wasn't good enough against latest-dev.

I also tried with the following but gmail didn't recognize the password when examining the logs:

...
 - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=/run/secrets/watchtower_notification_email_server_secret
...

I'm not exactly sure how docker secrets are implemented -- since secrets references a file, and then this secret is passed to the Watchtower variable. The documentation you linked doesn't exactly mention the use of docker secrets. I don't want to make the assumption the use of docker secrets in this manner is implemented when its not. Perhaps there is a different method to employ secrets?? I can post my entire watchtower compose section if helpful.

---

Correction:
Despite what I posted above -- the above implementation worked against containrrr/watchtower:latest-dev but not against containrrr/watchtower:latest. I was under the impression this docker secrets change made it into the main repository.
Sorry about the confusion

[piksel]

Can this be closed then @kevdogg?

[kevdogg]

@piksel -- Not sure how to answer this question as I don't run the board however I just wish the change were pushed to latest rather than being in latest-dev. It's been quite some time since the code underwent review (6/2020) and I thought it would have been merged awhile ago. Not sure if there is a problem with the implementation or code review or other issue.

[piksel]

No, nothing like that. latest-dev is just a snapshot of the development branch, and as such is generally less stable. Releasing a new version means pushing out code to thousands of running instances to users that rely on watchtower to not break their setups.
This means that we have to be careful with what we release, and when we do it. Unfortunately, that also means that certain features have to wait a bit longer than might seem necessary.

[simskij]

Should be released in latest now as part of v1.0.3. See release log in https://github.com/containrrr/watchtower/releases/tag/v1.0.3

[kevdogg]

@simskij - Thanks for your work on this.