Docker Watchers

⚡ Active by Default

Watchers are responsible for discovering and scanning Docker containers on local or remote Docker daemons.

Default Watcher

If no watcher is explicitly configured, a default watcher named local is automatically created, monitoring /var/run/docker.sock.

Per-Container Configuration

To customize how WUD monitors specific containers (opt-in/opt-out, tag filtering, semver transforms, custom display names, or trigger routing), see the Container Labels documentation.

---

Configuration Options

WUD_WATCHER_{watcher_name}_CAFILE

Optionalpath

Path to CA certificate PEM file (for TLS connection only)

Allowed values:File path

WUD_WATCHER_{watcher_name}_CERTFILE

Optionalpath

Path to client certificate PEM file (for TLS connection only)

Allowed values:File path

WUD_WATCHER_{watcher_name}_CRON

Optionalurldefault: 0 * * * *

CRON schedule for automatic checks

Allowed values:[Valid CRON expression](https://crontab.guru/)

WUD_WATCHER_{watcher_name}_HOST

Optionalstring

Docker daemon hostname or IP address to monitor

Allowed values:Hostname or IP

WUD_WATCHER_{watcher_name}_JITTER

Optionalintegerdefault: 60000

Random jitter in milliseconds applied to the CRON schedule to distribute load across registries (primarily Docker Hub)

Allowed values:> 0

WUD_WATCHER_{watcher_name}_KEYFILE

Optionalpath

Path to client private key PEM file (for TLS connection only)

Allowed values:File path

WUD_WATCHER_{watcher_name}_PORT

Optionalintegerdefault: 2375

Docker daemon TCP port to connect to

Allowed values:Port number

WUD_WATCHER_{watcher_name}_SOCKET

Optionalpathdefault: /var/run/docker.sock

Docker UNIX socket path to monitor

Allowed values:Valid UNIX socket path

WUD_WATCHER_{watcher_name}_WATCHALL

Optionalbooleandefault: false

Whether WUD should monitor all containers instead of only running ones

WUD_WATCHER_{watcher_name}_WATCHATSTART

Optionalbooleandefault: true

Whether WUD should check for image updates during startup

WUD_WATCHER_{watcher_name}_WATCHBYDEFAULT

Optionalbooleandefault: true

Whether WUD should monitor all discovered containers by default

WUD_WATCHER_{watcher_name}_WATCHEVENTS

Optionalbooleandefault: true

Whether WUD should listen for Docker daemon events in real-time

Multiple & Remote Watchers

You can configure multiple watchers to monitor both local and remote Docker hosts simultaneously.

• Remote Hosts: For remote Docker TCP and mutual TLS setup, see Remote Daemons & TLS Security.
• Rate Limits & Digests: To learn how digest polling works and prevent Docker Hub quota exhaustion, see Digest & Rate Limits.
• Per-Container Rules: To configure tag filtering and routing per container, see Container Labels.

---

Examples

1. Watch the local Docker host daily at 1:00 AM

Docker Compose

services:
  whatsupdocker:
    image: getwud/wud
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - WUD_WATCHER_LOCAL_CRON=0 1 * * *

Docker

docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e WUD_WATCHER_LOCAL_CRON="0 1 * * *" \
  getwud/wud

2. Watch all containers (including stopped / paused)

Docker Compose

services:
  whatsupdocker:
    image: getwud/wud
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - WUD_WATCHER_LOCAL_WATCHALL=true

Docker

docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e WUD_WATCHER_LOCAL_WATCHALL="true" \
  getwud/wud

3. Watch a remote Docker host via TCP (Port 2375)

Docker Compose

services:
  whatsupdocker:
    image: getwud/wud
    environment:
      - WUD_WATCHER_MYREMOTEHOST_HOST=myremotehost
      - WUD_WATCHER_MYREMOTEHOST_PORT=2375

Docker

docker run -d \
  -e WUD_WATCHER_MYREMOTEHOST_HOST="myremotehost" \
  -e WUD_WATCHER_MYREMOTEHOST_PORT="2375" \
  getwud/wud

4. Watch a remote Docker host with TLS (Port 2376)

Docker Compose

services:
  whatsupdocker:
    image: getwud/wud
    environment:
      - WUD_WATCHER_MYREMOTEHOST_HOST=myremotehost
      - WUD_WATCHER_MYREMOTEHOST_PORT=2376
      - WUD_WATCHER_MYREMOTEHOST_CAFILE=/certs/ca.pem
      - WUD_WATCHER_MYREMOTEHOST_CERTFILE=/certs/cert.pem
      - WUD_WATCHER_MYREMOTEHOST_KEYFILE=/certs/key.pem
    volumes:
      - /my-host/my-certs/ca.pem:/certs/ca.pem:ro
      - /my-host/my-certs/cert.pem:/certs/cert.pem:ro
      - /my-host/my-certs/key.pem:/certs/key.pem:ro

Docker

docker run -d \
  -e WUD_WATCHER_MYREMOTEHOST_HOST="myremotehost" \
  -e WUD_WATCHER_MYREMOTEHOST_PORT="2376" \
  -e WUD_WATCHER_MYREMOTEHOST_CAFILE="/certs/ca.pem" \
  -e WUD_WATCHER_MYREMOTEHOST_CERTFILE="/certs/cert.pem" \
  -e WUD_WATCHER_MYREMOTEHOST_KEYFILE="/certs/key.pem" \
  -v /my-host/my-certs/ca.pem:/certs/ca.pem:ro \
  -v /my-host/my-certs/cert.pem:/certs/cert.pem:ro \
  -v /my-host/my-certs/key.pem:/certs/key.pem:ro \
  getwud/wud

5. Watch multiple Docker hosts simultaneously

Docker Compose

services:
  whatsupdocker:
    image: getwud/wud
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - WUD_WATCHER_LOCAL_SOCKET=/var/run/docker.sock
      - WUD_WATCHER_PROD_HOST=prod-docker-host
      - WUD_WATCHER_STAGING_HOST=staging-docker-host

Docker

docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e WUD_WATCHER_LOCAL_SOCKET="/var/run/docker.sock" \
  -e WUD_WATCHER_PROD_HOST="prod-docker-host" \
  -e WUD_WATCHER_STAGING_HOST="staging-docker-host" \
  getwud/wud