Watchtower: Running multiple instances in the same scope

[michael-siebers]

Use Case

I am using docker images from DockerHub and a private registry. Since I ran into problems with DockerHub's new pull limit (c.f. #669), I wanted to decrease watchtower's update interval for DockerHub, but not for the private repository (CI/CD built images). So I, wanted to run two instances: one updating images from the private registry and one updating images from DockerHub.

What I tried

According to the documentation regarding running multiple instance the --scope argument is the way to go:

To define an instance monitoring scope, use the --scope argument or the WATCHTOWER_SCOPE environment variable on startup and set the _com.centurylinklabs.watchtower.scope_ label with the same value for the containers you want to include in this instance's scope (including the instance itself).

Thus I thought the following Docker Compose would work (_unnecessary details omitted_):

version: '3'

services:
    watchtower-private:
        image: containrrr/watchtower
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        command: --scope private
        labels:
            - "com.centurylinklabs.watchtower.scope=public"


    watchtower-public:
        image: containrrr/watchtower
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        command: --scope public
        labels:
            - "com.centurylinklabs.watchtower.scope=public"

I placed both watchtower containers in the 'public' scope as both use the same image available via DockerHub. This did not work, as watchtower-public cleared up watchtower-private. In hindsight, I misunderstood the documentation and this indeed expected behavior:

Notice that: - Multiple instances can't run with the same scope
I understood 'run with the same scope' as having the same --scope argument. However, having the same _com.centurylinklabs.watchtower.scope_ label is meant.

Questions / Feature Request

I see three possible solutions:

1. Place watchtower-private in the `private scope (com.centurylinklabs.watchtower.scope=private) and turn off watchtower for this container (com.centurylinklabs.watchtower.enable=false). Otherwise, I will generate too frequent requests at DockerHub.
2. Add a copy of the image _containrrr/watchtower_ in the private repository and use this in watchtower-private. Then watchtower-private could have frequent updates (but the watchtower image must be updated manually).
3. Run two watchtower in the same scope.

Solutions 1 and 2 have the drawback that watchtower itself is not updated automatically. Solution 3 would be a new feature.
Is it possible to realize my intended behavior somehow?

Bug

I'm not sure if this is a bug. But I think the behavior is unintended. The _running scope_ of a watchtower instance seems to be only determined by the _com.centurylinklabs.watchtower.scope_ label. This, allows to run multiple instances monitoring the same scope. The following Docker Compose works just fine:

version: '3'

services:
    watchtower-public1:
        image: containrrr/watchtower
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        command: --scope public
        labels:
            - "com.centurylinklabs.watchtower.scope=public"


    watchtower-public2:
        image: containrrr/watchtower
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        command: --scope public
        labels:
            - "com.centurylinklabs.watchtower.scope=some-other-scope"

[github-actions[bot]]

Hi there! 👋🏼 As you're new to this repo, we'd like to suggest that you read our code of conduct as well as our contribution guidelines. Thanks a bunch for opening your first issue! 🙏

[victorcmoura]

Hey, @michael-siebers! I'll clear up a few things that maybe will help you out.

When this feature was implemented, it was assumed that the Watchtower container would always belong to the same scope it monitored. So that might be the reason why it is behaving unexpectedly in your example.

Even though the second, working, compose can be a little strange to you, the practical consequence would be different updating intervals for the instance itself. So if it's not a requirement for your setup, I would recommend implementing it while the malfunctioning is being investigated and, if necessary, fixed.

Let me know if you have any other thoughts on this =)

[simskij]

Alternative 1 with both watchtowers enabled will be the preferred solution once #674 has been merged and released. Until then the second docker-compose will probably do the trick, as @victorcmoura suggested.

[michael-siebers]

Thank you very much. Things are clearer now. I will adopt an intermediate solution and wait for #674.
Thanks for putting in all the effort!

[victorcmoura]

@michael-siebers You're welcome! If you have any other questions, feel free to initiate a new discussion. I'm closing this one to keep things organized =)