watchtower: add WATCHTOWER_COOLDOWN_DELAY=24h (v-next supply-chain guard)

Image must exist in the registry >=24h before Watchtower adopts it, so a compromised/broken just-pushed :latest isn't pulled instantly. Per-container override via com.centurylinklabs.watchtower.cooldown-delay. Fleet-wide. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-05 17:39:59 -04:00
parent 736eba6328
commit b3ab94cd13
1 changed files with 1 additions and 0 deletions
@@ -172,6 +172,7 @@ services:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_HTTP_API_UPDATE=true
+      - WATCHTOWER_COOLDOWN_DELAY=24h
      - WATCHTOWER_HTTP_API_TOKEN={{ watchtower_api_token }}
      - TZ={{ timezone }}
      - WATCHTOWER_CLEANUP=true