fix: serialize lscr.io checks — one scoped Watchtower per container at 3-min intervals

jellyfin/arr-stack/docker-compose.yml

@@ -12,6 +12,8 @@ services:
     volumes:
       - /srv/docker/radarr/config:/config
       - /mnt/media:/data
+    labels:
+      - "com.centurylinklabs.watchtower.scope=radarr"
 
   sonarr:
     container_name: sonarr
@@ -26,6 +28,8 @@ services:
     volumes:
       - /srv/docker/sonarr/config:/config
       - /mnt/media:/data
+    labels:
+      - "com.centurylinklabs.watchtower.scope=sonarr"
 
   prowlarr:
     container_name: prowlarr
@@ -51,6 +55,8 @@ services:
     environment:
       - TZ=America/Chicago
 
+  # Main watchtower — handles unscoped containers (flaresolverr, portainer-agent)
+  # Runs at 4:09 AM — last in sequence, after all lscr.io checks are done
   watchtower:
     image: containrrr/watchtower
     container_name: watchtower
@@ -69,16 +75,69 @@ services:
       - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=2l79229z6r4y8x8y
       - WATCHTOWER_NOTIFICATIONS_LEVEL=info
       - WATCHTOWER_CLEANUP=true
-      - WATCHTOWER_SCHEDULE=0 0 4 * * *
+      - WATCHTOWER_SCHEDULE=0 9 4 * * *
       - WATCHTOWER_ROLLING_RESTART=true
       - WATCHTOWER_ROLLING_RESTART_TIMEOUT=30s
       - WATCHTOWER_HTTP_API_PERIODIC_POLLS=false
       - WATCHTOWER_CONTAINER_WAIT_BEFORE_STOPPING=60s
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
 
-  # Separate scoped instance for prowlarr — staggered 5 min later to avoid
-  # concurrent lscr.io/ghcr.io rate limit bursts. Prowlarr must carry the
-  # com.centurylinklabs.watchtower.scope=prowlarr label (set above) so the
-  # main watchtower ignores it and only this instance manages it.
+  # Scoped watchtower for radarr only — runs first at 4:00 AM
+  watchtower-radarr:
+    image: containrrr/watchtower
+    container_name: watchtower-radarr
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/jgitta/.docker/config.json:/config.json:ro
+    environment:
+      - TZ=America/Chicago
+      - WATCHTOWER_SCOPE=radarr
+      - WATCHTOWER_NOTIFICATIONS=email
+      - WATCHTOWER_NOTIFICATION_EMAIL_FROM=jgitta@jgitta.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_TO=jgitta@jgitta.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.fastmail.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=jgitta@jgitta.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=2l79229z6r4y8x8y
+      - WATCHTOWER_NOTIFICATIONS_LEVEL=info
+      - WATCHTOWER_CLEANUP=true
+      - WATCHTOWER_SCHEDULE=0 0 4 * * *
+      - WATCHTOWER_ROLLING_RESTART=true
+      - WATCHTOWER_ROLLING_RESTART_TIMEOUT=30s
+      - WATCHTOWER_CONTAINER_WAIT_BEFORE_STOPPING=60s
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+
+  # Scoped watchtower for sonarr only — runs at 4:03 AM
+  watchtower-sonarr:
+    image: containrrr/watchtower
+    container_name: watchtower-sonarr
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/jgitta/.docker/config.json:/config.json:ro
+    environment:
+      - TZ=America/Chicago
+      - WATCHTOWER_SCOPE=sonarr
+      - WATCHTOWER_NOTIFICATIONS=email
+      - WATCHTOWER_NOTIFICATION_EMAIL_FROM=jgitta@jgitta.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_TO=jgitta@jgitta.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.fastmail.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=jgitta@jgitta.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=2l79229z6r4y8x8y
+      - WATCHTOWER_NOTIFICATIONS_LEVEL=info
+      - WATCHTOWER_CLEANUP=true
+      - WATCHTOWER_SCHEDULE=0 3 4 * * *
+      - WATCHTOWER_ROLLING_RESTART=true
+      - WATCHTOWER_ROLLING_RESTART_TIMEOUT=30s
+      - WATCHTOWER_CONTAINER_WAIT_BEFORE_STOPPING=60s
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+
+  # Scoped watchtower for prowlarr only — runs at 4:06 AM
   watchtower-prowlarr:
     image: containrrr/watchtower
     container_name: watchtower-prowlarr
@@ -98,7 +157,9 @@ services:
       - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=2l79229z6r4y8x8y
       - WATCHTOWER_NOTIFICATIONS_LEVEL=info
       - WATCHTOWER_CLEANUP=true
-      - WATCHTOWER_SCHEDULE=0 5 4 * * *
+      - WATCHTOWER_SCHEDULE=0 6 4 * * *
       - WATCHTOWER_ROLLING_RESTART=true
       - WATCHTOWER_ROLLING_RESTART_TIMEOUT=30s
       - WATCHTOWER_CONTAINER_WAIT_BEFORE_STOPPING=60s
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"