Where Does Watchtower Store Config and Credentials?
Watchtower keeps no local database: schedule and scope come from flags while registry auth rides a mounted docker config.
Last updated
Watchtower stores nothing of its own. Update interval, scope, and notifications arrive as command flags or environment variables. The Docker socket mount gives it control; an optional config mount gives it registry logins.
That statelessness makes moves trivial and audits simple. The compose file is the entire configuration. Credential handling deserves care, since bind-mounted config files break when editors replace inodes.
Where Watchtower stores this, by platform
/var/run/docker.sock (plus optional /config.json mount)
Stateless by design. Socket mount provides control, /config.json mount provides registry auth. Schedule and scope come from flags or compose.
Frequently asked questions
How do I move Watchtower to a new server?
Copy the compose definition or run flags to the new host. There is no state to migrate. Registry credentials move through the mounted docker config file.
How does Watchtower authenticate to private registries?
Mount the host docker config at /config.json inside the container, or pass REPO_USER and REPO_PASS. Two-factor registries need the config file route, since passwords alone fail.
Notice an outdated path? Let us know.