Question 1

How does Drydock detect when a container image has a newer version?

Accepted Answer

On every poll cycle Drydock reads the image reference and current digest from each watched container, then queries the upstream registry for available tags. It applies your per-container tag filters (dd.tag.include / dd.tag.exclude regex patterns compiled with re2js for linear-time evaluation) and semantic-version ordering to determine the latest eligible tag. If the latest digest differs from the running one, the container is flagged as having an available update. SSE keeps connected browser sessions in sync in real time without polling on the client side.

Question 2

Which container registries does Drydock support?

Accepted Answer

Drydock ships with 23 registry providers: Docker Hub, GitHub Container Registry (GHCR), Amazon ECR, Google Container Registry (GCR), Google Artifact Registry (GAR), GitLab Registry, Red Hat Quay, LinuxServer Container Registry (LSCR), Azure Container Registry (ACR), Harbor, JFrog Artifactory, Sonatype Nexus, Gitea, Forgejo, Codeberg, and more — plus a generic private-registry provider for anything that speaks HTTP Basic or bearer token auth. TLS customization (CA file, insecure skip-verify) is available on every provider.

Question 3

What is the difference between a notification and an action trigger?

Accepted Answer

Notifications (DD_NOTIFICATION_* env vars) send a message when an update is detected — Slack, Discord, Telegram, Microsoft Teams, SMTP, Gotify, NTFY, MQTT, Kafka, HTTP webhooks, and more. Actions (DD_ACTION_* env vars) execute the update: the docker action re-pulls and restarts the container, dockercompose runs docker compose pull/up on your stack, and command invokes an arbitrary shell script. You can combine both in the same pipeline — notify a channel and apply the update. Note: DD_TRIGGER_* is a deprecated alias scheduled for removal; use the canonical DD_NOTIFICATION_* or DD_ACTION_* prefix in any new config.

Question 4

How do I control which containers Drydock watches and which tags it considers?

Accepted Answer

Drydock watches every container by default. Add dd.watch=false to opt a container out, or set DD_WATCHER_{name}_WATCHBYDEFAULT=false to flip that watcher to opt-in mode, where only containers labeled dd.watch=true are watched. Use dd.tag.include with a regex to restrict which tags are eligible — for example dd.tag.include=^\d+\.\d+\.\d+$ to match only semver tags. dd.tag.exclude filters out tags that match. dd.tag.transform applies a rewrite to the tag string before matching. dd.display.name overrides the container name shown in the dashboard, and dd.group groups containers into collapsible stacks.

Question 5

What is the controller-agent architecture and when do I need it?

Accepted Answer

A Drydock instance can run as a controller (hosts the REST API and dashboard), an agent (runs watchers and triggers on a remote Docker host), or both. Agents stream container events back to the controller over SSE, so you can monitor containers spread across multiple hosts or cloud environments from a single dashboard — no raw Docker socket needs to be exposed across the network. A single-host setup runs everything in one container; add agents with DD_AGENT_* variables when you need to reach remote hosts.

Question 6

How does Drydock compare to Watchtower?

Accepted Answer

Watchtower auto-updates containers on a schedule with minimal config and no UI. Drydock is an update management platform: it detects what is available, shows you a dashboard, lets you preview and approve changes, backs up images before applying them, and rolls back automatically if the new container fails its health check. It also adds security scanning (Trivy/Grype CVEs, SBOM generation, Cosign signature verification) and per-container update policies. If you want silent automatic updates, Watchtower is simpler. If you want visibility, control, security gates, and notification integrations, Drydock fits better.

Question 7

Does Drydock support vulnerability scanning and image signature verification?

Accepted Answer

Yes. Drydock integrates Trivy and Grype (DD_SECURITY_SCANNER=trivy|grype|both) for CVE scanning and SBOM generation for any image in your update queue. The Update Bouncer deployment gate supports Cosign signature verification — you can block an update from being applied if the new image is unsigned or signed by an unexpected identity. Scanning and verification are opt-in per container or globally, and results surface in the dashboard alongside the available-update list so you can make an informed decision before pulling.

Question 8

Is Drydock open source, and how do I get started?

Accepted Answer

Drydock is AGPL-3.0 licensed and free to self-host. The fastest path is a single docker run mounting /var/run/docker.sock and setting DD_WATCHER_LOCAL_SOCKET=/var/run/docker.sock plus DD_ANONYMOUS_AUTH_CONFIRM=true for a quick local trial — the dashboard is available on port 3000. For production, use Docker Compose with a persistent volume at /store for the database and add a notification trigger such as DD_NOTIFICATION_SLACK_* for update alerts. Authentication (OIDC via Authelia/Auth0/Authentik, the built-in username/password, or an explicit anonymous opt-in) is required — without one configured the instance fails closed, API requests return 401, and /health returns 503. Full configuration docs are at getdrydock.com/docs.

Container Update
Monitoring

Everything you need

Get started in seconds

See it in action!

Roadmap

Star History

How we compare

Part of the CodesWhat stack

Frequently asked questions

Feature	Drydock	Portainer	Diun	WatchtowerArchived
Web UI	Yes	Yes	No	No
Update notifications	Yes	Partial	Yes	Yes
Multi-registry support	Yes	Partial	Partial	Partial
Vulnerability scanning	Yes	No	No	No
Dry-run + rollback	Yes	No	No	No
Distributed agents	Yes	No	No	No

Container UpdateMonitoring

Everything you need

Get started in seconds

See it in action!

Roadmap

Star History

How we compare

Part of the CodesWhat stack

Frequently asked questions

How does Drydock detect when a container image has a newer version?+

Which container registries does Drydock support?+

What is the difference between a notification and an action trigger?+

How do I control which containers Drydock watches and which tags it considers?+

What is the controller-agent architecture and when do I need it?+

How does Drydock compare to Watchtower?+

Does Drydock support vulnerability scanning and image signature verification?+

Is Drydock open source, and how do I get started?+

Container Update
Monitoring