English | Deutsch

Container Pilot

Controlled Docker Updates

A Docker update manager with a Web UI, per-container policies, health checks, and automatic rollback.

A safer Watchtower alternative focused on control and recovery.

Watchtower automates updates. Container Pilot manages updates.

Container Pilot detects Docker image updates, lets administrators approve or automate them per container, validates the replacement container, and restores the previous container automatically when startup or health validation fails.

The project is currently a release candidate. Test it with non-critical workloads before enabling automatic updates broadly.

Product preview

Authentic screenshot of the current interface. Only instance-specific data such as container names, image names, IDs, user name, and server address has been anonymized; the interface and displayed functions are unchanged.

Quick start

Requirements: Docker Engine, Docker Compose, and a trusted internal management network.

mkdir container-pilot && cd container-pilot
mkdir -p secrets
openssl rand -base64 32 > secrets/admin_password
chmod 600 secrets/admin_password
curl -fsSLO https://raw.githubusercontent.com/DeepZone/container-pilot/main/compose.yml
docker compose pull
docker compose up -d

Open http://YOUR-DOCKER-HOST:3080. The initial account is admin; its generated password is stored in secrets/admin_password. Change the password after the first login.

Native HTTPS is available through compose.https.yml; an HTTPS reverse proxy remains supported. See HTTPS and reverse proxy.

Container Pilot requires write access to /var/run/docker.sock. Treat administrator access to its Web UI as privileged access to the Docker host. Do not expose it directly to the public Internet.

See Installation for localhost binding, upgrades, and a minimal Compose example.

Why Container Pilot?

The core workflow is deliberately small:

Detect → Decide → Update → Verify → Recover

• Web UI for running and stopped containers
• Docker Hub and public GHCR update detection
• Manual updates and configurable automatic checks
• Explicit automatic-update policy per container
• Fixed-tag updates without silently switching to latest
• Optional, confirmed switch to latest
• Docker healthcheck validation and startup stability checks
• Automatic recovery when an update does not become ready
• Manual rollback to the previous image digest
• Explicit disposal of an unused rollback image
• Event history and per-container action locks
• Administrator and read-only viewer roles
• Container configuration reconstruction, including mounts, networks, ports, environment, and restart policy
• Safe self-update flow through a separate helper container
• Opt-in Watchtower policy import with a read-only preview and per-rule confirmation
• Optional anonymous usage statistics with an exact payload preview and full administrator control

Optional anonymous usage statistics

Container Pilot includes voluntary, privacy-minimizing usage statistics to help us understand how the project behaves across real installations and different deployment scenarios. The feature is disabled by default and sends nothing until an administrator explicitly enables it.

When enabled, only the smallest useful set of aggregated technical data is reported, such as the Container Pilot and Docker versions, architecture, general operating system, aggregate container counts, enabled feature categories, and cumulative update results. Container Pilot never reports container or image names, IP addresses, hostnames, registry domains, credentials, environment variables, mount paths, or application data. The Web UI shows the exact payload before it is sent, and reporting can be disabled or deleted at any time.

We appreciate every administrator who voluntarily enables this feature. These anonymous field insights help us prioritize compatibility, reliability, and accessibility work so Container Pilot can serve as many environments and users as possible. Full details are available in Telemetry and privacy.

Important safety boundary

An image rollback does not restore volumes, databases, or application data. An updated application may perform an irreversible database migration before a failed healthcheck is detected. Create application-aware backups before major upgrades or automatic updates of stateful services.

Container Pilot also cannot modify external Compose files. A later docker compose up may restore the image reference declared in that Compose project.

Read Security, Updates, and Rollback before enabling unattended updates.

Documentation

• Installation
• Configuration
• Security model
• Update behavior
• Rollback behavior
• Reverse proxy setup
• Troubleshooting
• Release process
• Migrate from Watchtower
• Container Pilot and Watchtower
• Container Pilot and WUD
• Release-candidate testing
• Webhook notifications
• Private registries
• Telemetry and privacy
• Project website
• Roadmap
• Changelog

Images and release channels

Published multi-architecture images are available from:

ghcr.io/deepzone/container-pilot

• Complete version tags such as 0.9.0-rc.13 are fixed release references and must never be reused.
• Release candidates use the rc channel once published by the release workflow.
• latest, major, and minor aliases are reserved for stable releases.
• Successful builds from main use the moving edge tag and a commit-specific sha-* tag. They are development builds, not releases.

Supported platforms: linux/amd64 and linux/arm64.

Development and tests

git clone https://github.com/DeepZone/container-pilot.git
cd container-pilot
npm test
docker compose -f compose.yml -f compose.dev.yml up --build

The Docker integration suite creates isolated fixture containers, volumes, and networks:

npm run test:integration

Current limitations

• Private Docker Hub, GHCR, GitLab, and generic OCI registries are supported through Docker Secret credentials.
• Containers without a Docker healthcheck can only be observed for process stability during the configured startup grace period.
• Technical health does not replace application-specific end-to-end testing.
• The Web UI supports English and German with browser detection and a persistent manual selector.

Contributing and security

Anonymous usage statistics are optional, disabled by default, and documented transparently in Telemetry and privacy.

Contributions are welcome. Read CONTRIBUTING.md before opening a pull request.

Help test the release candidate

Run RC13 on a non-critical workload and share what you learn. Use the testing guide, report reproducible defects through GitHub Issues, and share broader test results or questions in GitHub Discussions.

Do not publish credentials, tokens, private image names, internal addresses, or complete state files in issues. Report vulnerabilities according to SECURITY.md.

License and copyright

Copyright © 2026 NoiSens Media.

Container Pilot is released under the MIT License.