Restarting drydock is triggering updates of some containers

[begunfx]

Drydock version

v1.5.0-rc.1

What happened?

I believe this behavior was present with 1.4.5 but wasn't sure until now. My tdarr controller and calibre-web and one of my tdarr-nodes had updated without intervention. I do NOT have any labels in any of those containers.

What did you expect?

No containers that have the auto update label to update - especially on a container restart

Steps to reproduce

Not sure.

Relevant configuration

Drydock config:

services:
  drydock:
    image: ghcr.io/codeswhat/drydock:1.5.0-rc.1
    container_name: drydock
    restart: unless-stopped
    ports:
      - "3010:3000"
    depends_on:
      socket-proxy:
        condition: service_healthy
    volumes:
      - /volume1/docker/drydock:/store
    labels:
      - "dd.watch=true"
    healthcheck:
      test: curl --fail http://localhost:${DD_SERVER_PORT:-3000}/health || exit 1
      interval: 10s
      timeout: 10s
      retries: 3
      start_period: 10s
    environment:
      # --- Oauth2/OpenID ---
      - DD_PUBLIC_URL=https://<redacted>
      - DD_AUTH_OIDC_AUTHENTIK_CLIENTID=<redacted>
      - DD_AUTH_OIDC_AUTHENTIK_CLIENTSECRET=
      - DD_AUTH_OIDC_AUTHENTIK_DISCOVERY=https://auth.justthebeguns.com/application/o/drydock/.well-known/openid-configuration
      - DD_AUTH_OIDC_AUTHENTIK_INSECURE=true #for self-signed certificates use this to skip TLS verification for OIDC
      - DD_AUTH_OIDC_AUTHENTIK_REDIRECT=false # optional (to skip internal login page)
      
      # --- CRON SCHEDULE ---
      - DD_WATCHER_DATAVAULT_CRON=15 */6 * * *
      - DD_WATCHER_DATAVAULT_JITTER=900000

      # --- PERMISSIONS ---
      - PUID=1000
      - PGID=1000

      # --- OTHER ---
      - TZ=America/Los_Angeles
      - DD_SESSION_SECRET=<redacted>

      # --- SECURITY SCANNING ---
      - DD_SECURITY_SCANNER=trivy
      - DD_SECURITY_SCAN_CRON=0 2 * * *
      - DD_SECURITY_BLOCK_SEVERITY=NONE
      
      # --- BASIC AUTH ---
      - DD_AUTH_BASIC_ADMIN_USER=admin
      - DD_AUTH_BASIC_ADMIN_HASH=<redacted>
      
      # --- LOCAL DATAVAULT DISCOVERY (Global Watcher) ---
      - DD_WATCHER_DATAVAULT_HOST=drydock-socket-proxy
      - DD_WATCHER_DATAVAULT_PORT=2375
      - DD_WATCHER_DATAVAULT_WATCHBYDEFAULT=true

      # --- LOCAL DATAVAULT EXECUTION (Trigger Connection) ---
      - DD_TRIGGER_DOCKER_DATAVAULT_PRUNE=true

      # --- REMOTE HOST MEDIAVAULT ---
      - DD_AGENT_MEDIAVAULT_HOST=mediavault
      - DD_AGENT_MEDIAVAULT_PORT=3010
      - DD_AGENT_MEDIAVAULT_SECRET=<redacted>

      # --- REMOTE HOST TMVAULT ---
      - DD_AGENT_TMVAULT_HOST=tmvault
      - DD_AGENT_TMVAULT_PORT=3010
      - DD_AGENT_TMVAULT_SECRET=<redacted>

      # --- REMOTE HOST SERVICEVAULT ---
      - DD_AGENT_SERVICEVAULT_HOST=servicevault
      - DD_AGENT_SERVICEVAULT_PORT=3010
      - DD_AGENT_SERVICEVAULT_SECRET=<redacted>

      # --- REMOTE HOST SERVICEVAULT2 ---
      - DD_AGENT_SERVICEVAULT2_HOST=servicevault2
      - DD_AGENT_SERVICEVAULT2_PORT=3010
      - DD_AGENT_SERVICEVAULT2_SECRET=<redacted>
      
      # --- OBSERVABILITY ---
      - DD_METRICS_PROMETHEUS_ENABLE=true
      - DD_SERVER_METRICS_AUTH=false

      # --- GMAIL SMTP CONFIG ---
      - DD_TRIGGER_SMTP_GMAIL_HOST=smtp.gmail.com
      - DD_TRIGGER_SMTP_GMAIL_PORT=587
      - DD_TRIGGER_SMTP_GMAIL_USER=<redacted>@gmail.com
      - DD_TRIGGER_SMTP_GMAIL_PASS=<redacted>
      - DD_TRIGGER_SMTP_GMAIL_FROM=<redacted>@gmail.com
      - DD_TRIGGER_SMTP_GMAIL_TO=<redacted>
      - DD_TRIGGER_SMTP_GMAIL_TLS_ENABLED=false
      - DD_TRIGGER_SMTP_GMAIL_MODE=batch
      
      # --- PUSHOVER CONFIG ---
      - DD_TRIGGER_PUSHOVER_MOBILE_USER=<redacted>
      - DD_TRIGGER_PUSHOVER_MOBILE_TOKEN=<redacted>

      # --- DOCKER HUB (PUBLIC/PRIVATE) ---
      - DD_REGISTRY_HUB_PUBLIC_AUTH=<redacted>
      - DD_REGISTRY_HUB_PRIVATE_AUTH=<redacted>

      # --- GITHUB CONTAINER REGISTRY (GHCR) ---
      - DD_REGISTRY_GHCR_PRIVATE_USERNAME=<redacted>
      - DD_REGISTRY_GHCR_PRIVATE_TOKEN=<redacted>

  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: drydock-socket-proxy
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - EVENTS=1
      - SERVICES=1
      - POST=1
      - DELETE=1
      - NETWORKS=1
      - VOLUMES=1
      - LOG_LEVEL=info
      - RATE_LIMIT_HTTP=100
      - RATE_LIMIT_INTERVAL=1m
      - TIMEOUT=86400s
    healthcheck:
      test: wget --spider http://localhost:2375/version || exit 1
      interval: 5s
      timeout: 3s
      retries: 3
      start_period: 5s

Logs

Installation method

Docker Compose

Docker version

24.0.1

OS / Architecture

Synology DSM 7

[s-b-e-n-s-o-n]

Thanks for reporting this — I was able to reproduce and trace the root cause.

Root cause

Your configuration has two settings that combine to produce the behavior you're seeing:

1. DD_WATCHER_DATAVAULT_WATCHBYDEFAULT=true — all containers on the host are watched, even without a dd.watch=true label
2. DD_TRIGGER_DOCKER_DATAVAULT_PRUNE=true — this registers a Docker action trigger, which by default auto-executes for all watched containers

The Docker trigger's AUTO mode was defaulting to all (equivalent to AUTO=true), meaning any watched container with an available update would be automatically pulled + recreated — no opt-in label required.

On startup, Drydock runs an immediate watch cycle (within 1 second), finds updates for those containers, and the Docker trigger fires for all of them because nothing blocks it (no dd.action.exclude labels).

Immediate workaround

Add this to your environment to require containers to explicitly opt in:

- DD_TRIGGER_DOCKER_DATAVAULT_AUTO=oninclude

Then add dd.action.include=docker labels to containers you want auto-updated:

labels:
  - dd.watch=true
  - dd.action.include=docker

Containers without the dd.action.include label will still be watched and notifications will fire, but the Docker trigger won't recreate them.

Fix

This default was too aggressive for action triggers that destructively modify containers. I've changed the default AUTO mode for action triggers (Docker, Docker Compose, Command) from all to oninclude. Notification triggers (Slack, email, Pushover, etc.) are unchanged and still default to all.

This will ship in the next RC. To restore the previous behavior explicitly, set DD_TRIGGER_DOCKER_DATAVAULT_AUTO=true.

[begunfx]

I added at your suggestion:
- DD_TRIGGER_DOCKER_DATAVAULT_AUTO=oninclude

But I'm seeing in my drydock startup log:
2026/03/24 07:50AM 30 pid=7 hostname=b2d2bf8cf3c6 name=drydock component=trigger.docker.mediavault msg=Registering for auto execution

for all my hosts. If I'm reading that right, it's saying that containers will auto update.

[s-b-e-n-s-o-n]

That log message is from the RC1 code — it shows the same text for both auto=all and auto=oninclude (the updated log message that distinguishes them is in the next RC).

The key thing: you set DD_TRIGGER_DOCKER_DATAVAULT_AUTO=oninclude for your local trigger, but the log shows trigger.docker.mediavault — that's the Docker trigger for your mediavault agent, which doesn't have the override.

You have Docker triggers for each agent host. For the workaround to cover all of them, you'd need:

- DD_TRIGGER_DOCKER_DATAVAULT_AUTO=oninclude
- DD_TRIGGER_DOCKER_MEDIAVAULT_AUTO=oninclude
- DD_TRIGGER_DOCKER_TMVAULT_AUTO=oninclude
- DD_TRIGGER_DOCKER_SERVICEVAULT_AUTO=oninclude
- DD_TRIGGER_DOCKER_SERVICEVAULT2_AUTO=oninclude

The next RC changes the default for all action triggers to oninclude, so you won't need any of these overrides — they'll all default to opt-in. Until then, add the lines above to cover all your hosts.

[begunfx]

Ah okay. Thanks!

[s-b-e-n-s-o-n]

Reopening — this was closed without reporter confirmation that the fix actually works. Sorry about that.

[s-b-e-n-s-o-n]

Fixed in v1.5.0-rc.2. Action triggers (docker, dockercompose, command) now default to auto=oninclude instead of auto=all, meaning they require an explicit dd.trigger.include label before auto-updating containers. Please update and let us know if this resolves the issue.

[begunfx]

I disabled oninclude statements and don't seem to be triggering updates on container restart. I think we can close this now. Thanks!