Selfhosted

Some apps have breaking changes. If you can restore a complete backup when that occurs, you can recover. Immich is famous for its breaking changes

Why not just let Watchtower do it for you?

I used to have my docker updates done automatically. However, as the services I used to run just for myself have started to be used by other people (family, friends), I am less tolerant of having things break. So, instead of something like watchtower, I run diun these days. I have it set up to ping me in a discord channel when a docker update is available. Then, I can actually perform the update when I have time and attention to troubleshoot any issues that may come up.

I get a summary once a week of all the updates. I then check the release notes and if nothing needs any changes just run the ansible playbook that updates to those releases. I don't want to get up and first thing in the morning read alert emails because an update failed over night, so i sit down for 10 minutes once a week.

I run a mixed setup, many of the "less important" containers are on watchtower auto-update, the rest on notification (reverse proxy, Nextcloud, etc).

But I also have many of them on specific branches instead of "latest".

That's what I do as well. Even with immich. It may break but it's usually just a simple change in the env file

Depends on how you like to roll. If you enjoy waking up to a service not working then go for it.

But it very much depends on what containers you're using and what tags you're pulling.

Depends on the application really. For example, I don't need to update Jellyfin and the arrs as soon as the new updates drop. They work just fine and I'm not waiting for any particular fixes.

I recommend, reading the release changelogs actively. For most services you can just put the github release page in an RSS reader to get a notification when a new release hits, so you can quickly look for any breaking changes, also this will give you info about new features.

I have been using watchtower for a few years. No problems with auto updates so far, but keep your backup handy.

I have watchtower configured to update most, but not all containers.

It runs after the nightly backup of everything runs, so if something explodes, I've got a backup that's recent and revertible. I also don't update certain types of containers (databases, critical infrastructure, etc.) automatically so that the blast radius of a bad update when I'm not there doing it is limited.

In the last ~3 years I've had exactly zero instances of 'oops shit's fucked!', but I also don't run anything that's in a massive state of flux and constantly having breaking changes (see: immich).

It really depends on the project. Some of them take breaking changes seriously and don't do them and auto migrate and others will throw them out on "minor" number releases and there might be a lot of breaking changes but you only run into one that impacts you occasionally. I typically don't want containers that are going to be a lot of work to keep up to date so I jettison projects that have unreliable releases for whatever reason and if they put out a breaking change its a good time to re evaluate whether I want that container at all and look at alternatives.

So no its not safe, but depending on the project it actually can be.

No, but you should already have good backups in place (right??) so restoring if something breaks isn't too hard.

Basically why i feel more comfortable with LXC than docker for my home lab services. It feels more like a VM in management.

We run a good mix of docker, vm’s and bare metal at work; no containers are auto-updated

I've been doing it for a few years and haven't had any issues. The risk/reward decision is yours.

only if your happy that you could get a duff build and kill the service, I now watch with https://newreleases.io/ and update as needed