[Bug]: New container fails to start due to port already being allocated

[vderaa]

Bug Report Checklist

• I checked existing issues and found no duplicates.
• I have reviewed Watchtower's documentation and confirmed compliance with documented configuration specifications.
• I have restarted Docker, re-pulled the latest image, and confirmed that the issue persists.

Bug Description

Hey. Still having issues with Watchtower auto-updating.

It creates the new container and renames it, but still fails to start and clean-up due to Network Driver failures.

Manual fix: Start the container manually and assign the container to a network

Steps to Reproduce

1. Watchtower auto-updates
2. Fails to start new container due to Network Driver Failure

Expected Behavior

Watchtower should update automatically, assign the correct network to the container and start it.

Watchtower Version

latest

Docker Version

Client: Docker Engine - Community
 Version:           29.2.1
 API version:       1.53
 Go version:        go1.25.6
 Git commit:        a5c7197
 Built:             Mon Feb  2 17:17:24 2026
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          29.2.1
  API version:      1.53 (minimum version 1.44)
  Go version:       go1.25.6
  Git commit:       6bc6209
  Built:            Mon Feb  2 17:17:24 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.2.1
  GitCommit:        dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Docker Info (optional)

Docker Compose Configuration

There are more services in Docker Compose, but I've only listed watchtower and networking here. Can provide full list if needed. Only watchtower is using port 8080.

services:
  watchtower:
    image: nickfedor/watchtower:latest
    container_name: watchtower
    networks:
      - vdera_bridge
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_POLL_INTERVAL=900
      - WATCHTOWER_NOTIFICATIONS=slack
      - WATCHTOWER_NOTIFICATION_SLACK_HOOK_URL=https://hooks.slack.com/services/*Removed*
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_NOTIFICATIONS_DELAY=10
      - WATCHTOWER_LOG_LEVEL=debug
    ports:
      - '8080:8080'
    logging:
      driver: journald
      options:
        tag: "{{.Name}}"

networks:
  vdera_bridge:
    name: vdera_bridge
    ipam:
      driver: default
      config:
        - subnet: '172.18.0.0/16'
          gateway: '172.18.0.1'

Docker CLI Command

Debug Logs

Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Starting container with updated configuration" container=watchtower image="nickfedor/watchtower:latest"
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Label not found" container=watchtower label=com.centurylinklabs.zodiac.original-image
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Using Config.Image for image name" container=watchtower
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Detected Docker via marker file /.dockerenv"
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Obtaining source container network configuration" client_version=1.51 container=watchtower image="nickfedor/watchtower:latest"
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Initialized empty network configuration" container=watchtower id=82754530b636 version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Evaluated network mode" container=watchtower id=82754530b636 is_host=false network_mode=vdera_bridge version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Copied endpoint settings" container=82754530b636 version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Filtered aliases" container=82754530b636 source_aliases="[watchtower watchtower]" target_aliases="[watchtower watchtower]" version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Added endpoint to network config" container=watchtower id=82754530b636 network=vdera_bridge version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="MAC address found in network configuration" container=82754530b636 mac_address="ce:c2:97:61:84:4b" network=vdera_bridge version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="MAC address validation passed" container=82754530b636 version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Label not found" container=watchtower label=com.centurylinklabs.zodiac.original-image
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Using Config.Image for image name" container=watchtower
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Generated create config" container=watchtower image="nickfedor/watchtower:latest"
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Detected Docker, copied all CPU settings" container=watchtower id=82754530b636
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Found MAC address in config" container=82754530b636 mac_address="ce:c2:97:61:84:4b" min_version=1.24 network=vdera_bridge version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Verified MAC address configuration" container=82754530b636 min_version=1.24 version=1.51
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Using full network config for API version >= 1.44 or single network" container=watchtower id=82754530b636
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Creating new container" container=watchtower id=82754530b636
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Created container successfully" container=watchtower id=82754530b636 new_id=c9b56b258d763dcd87e14507987eee58118293b28a080318f9026391693d7348
Feb 17 21:19:05 Dementor watchtower[1731989]: time="2026-02-17T21:19:05Z" level=debug msg="Renaming container to correct name" container=watchtower id=82754530b636
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Failed to start new container" container=watchtower error="Error response from daemon: failed to set up container networking: driver failed programming external connectivity on endpoint watchtower (e752f5189faffa7d8ad465bd93e395963b1191a1907dbf4519cf9953e54918f8): Bind for 0.0.0.0:8080 failed: port is already allocated" id=8>
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Failed to start new container" container=watchtower error="failed to set up container networking: driver failed programming external connectivity on endpoint watchtower (e752f5189faffa7d8ad465bd93e395963b1191a1907dbf4519cf9953e54918f8): Bind for 0.0.0.0:8080 failed: port is already allocated" id=8>
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Failed to start container" container=watchtower error="failed to set up container networking: driver failed programming external connectivity on endpoint watchtower (e752f5189faffa7d8ad465bd93e395963b1191a1907dbf4519cf9953e54918f8): Bind for 0.0.0.0:8080 failed: port is already allocated" id=8>
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Checking watchtower label" label=com.centurylinklabs.watchtower ok=true val=true
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Checked if container is Watchtower" container=watchtower is_watchtower=true
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Cleaning up failed Watchtower container" container=watchtower image="nickfedor/watchtower:latest"
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Stop timeout not set in container config" container=watchtower
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Label not found" container=watchtower label=com.centurylinklabs.watchtower.stop-signal
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Stop signal not set, using default SIGTERM" container=watchtower
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Log entry queued for batching" entries_count=2 fields.level=info legacy_template=true message="Stopping container" notify=no
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=info msg="Stopping container" container=watchtower id=82754530b636 signal=SIGTERM timeout=30s
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Received interrupt signal, stopping scheduler..."
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Waiting for running update to be finished..."
Feb 17 21:19:06 Dementor watchtower[1731989]: time="2026-02-17T21:19:06Z" level=debug msg="Checking lock status before shutdown."
Feb 21 18:47:52 Dementor watchtower[1731989]: time="2026-02-21T18:47:52Z" level=debug msg="Configured logging settings" fields.level=debug format=auto no_color=false
Feb 21 18:47:52 Dementor watchtower[1731989]: time="2026-02-21T18:47:52Z" level=debug msg="Retrieved cron schedule specification from flags" scheduleSpec="@every 900s"
Feb 21 18:47:52 Dementor watchtower[1731989]: time="2026-02-21T18:47:52Z" level=debug msg="Retrieved operational flags" cleanup=true monitor_only=false no_restart=false timeout=30s
Feb 21 18:47:52 Dementor watchtower[1731989]: time="2026-02-21T18:47:52Z" level=debug msg="Set environment variable" env=DOCKER_HOST value="unix:///var/run/docker.sock"
Feb 21 18:47:52 Dementor watchtower[1731989]: time="2026-02-21T18:47:52Z" level=debug msg="Configured Docker environment variables" certPath= host="unix:///var/run/docker.sock" tls=false version=
Feb 21 18:47:52 Dementor watchtower[1731989]: time="2026-02-21T18:47:52Z" level=debug msg="Initialized Docker client" client_version=1.51 server_version=1.53
Feb 21 18:47:52 Dementor watchtower[1731989]: time="2026-02-21T18:47:52Z" level=debug msg="Attempting to get current container ID using mountinfo detection"
Feb 21 18:47:52 Dementor watchtower[1731989]: time="2026-02-21T18:47:52Z" level=debug msg="Read mountinfo file successfully" file=/proc/self/mountinfo

Additional Context

No response

[nicholas-fedor]

@vderaa I hope you have properly addressed the webhook, as merely editing this issue is not an appropriate resolution.

[vderaa]

@vderaa I hope you have properly addressed the webhook, as merely editing this issue is not an appropriate resolution.

Thanks for checking... I was supposed to remove it, but totally forgot! It has been rotated as Slack notified me as soon as I'd posted it!

[vbtrek]

In case it helps, I get this issue on a Raspberry Pi running Debian Linux 13 (trixie) (Raspberry Pi OS Lite), same docker versions as above, I get an email from my RPI:
Watchtower self-update pull failed, sleeping to prevent rapid restarts | delay=5m0s

Compose:

  watchtower-updater:
    image: nickfedor/watchtower:latest
    container_name: watchtower-updater
    networks:
      - internal
    environment:
      - TZ=Europe/London
      - WATCHTOWER_DOCKER_CONFIG=/config.json
      - WATCHTOWER_SCOPE=AutoUpdate
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_INCLUDE_STOPPED=false
      - WATCHTOWER_REVIVE_STOPPED=false
      - WATCHTOWER_DEBUG=true
      - WATCHTOWER_MONITOR_ONLY=false
      - WATCHTOWER_NO_STARTUP_MESSAGE=true
      - WATCHTOWER_NOTIFICATIONS_HOSTNAME=RPI-NODE1
      - WATCHTOWER_NOTIFICATIONS=email
      - WATCHTOWER_NOTIFICATION_EMAIL_FROM=hidden
      - WATCHTOWER_NOTIFICATION_EMAIL_TO=hidden
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=hidden
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=hidden
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=hidden
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=hidden
      - WATCHTOWER_NOTIFICATION_EMAIL_DELAY=2
      - WATCHTOWER_SCHEDULE=0 0 2 * * *
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /root/.docker/config.json:/config.json:ro
    labels:
      - "com.centurylinklabs.watchtower.scope=AutoUpdate"

[lluisd]

here my logs on self update

2026-03-25 04:12:53.900 info [watchtower] time="2026-03-25T04:12:53+01:00" level=info msg="Stopping container" container=watchtower id=a6d295bb0955 signal=SIGTERM timeout=30s 
2026-03-25 04:12:56.360 info [watchtower] time="2026-03-25T04:12:56+01:00" level=info msg="Initiating HTTP server shutdown due to context cancellation" 
2026-03-25 04:12:56.485 warn [watchtower] time="2026-03-25T04:12:56+01:00" level=warning msg="Context canceled while waiting for running update." 

[nicholas-fedor]

Docker does not release ports while a container is still running.

If you're delegating a port to Watchtower for the HTTP API, then self-updates will fail because the old Watchtower container is still using the port when the new Watchtower container is being created.

The only way to really overcome this architectural limitation is by using an ephemeral container to manage self-updates. For now, the best way to avoid this issue is to not permit self-updates when using the HTTP API.