unknown flag: --label

[R8s6]

Describe the bug
I tried to exclude ngnix from being updated by watchtower, so I tried what the documentation suggested, but when --label argument is passed, watchtower encounters a fatal error:

time="2021-[redacted]" level=fatal msg="unknown flag: --label"

To Reproduce
add a --label flag:

sudo docker run -d \
    --restart always \
    --name watchtower \
    -v /var/run/docker.sock:/var/run/docker.sock \
    containrrr/watchtower \
    --label-enable=true \
    --label=com.centurylinklabs.watchtower.enable=false \
    ngnix

Expected behavior
watchtower updates all containers except ngnix

Environment

• Platform: Synology DS1815 DSM 6.2
• Architecture: x86_64
• Docker version: Docker version 18.09.8, build bfed4f5

because watchtower simply won't run, here's running docker logs watchtower:

Usage:
  watchtower [flags]

Flags:
  -a, --api-version string                          api version to use by docker client (default "1.25")
  -c, --cleanup                                     remove previously used images after updating
  -d, --debug                                       enable debug mode with verbose logging
      --enable-lifecycle-hooks                      Enable the execution of commands triggered by pre- and post-update lifecycle hooks
  -h, --help                                        help for watchtower
  -H, --host string                                 daemon socket to connect to (default "unix:///var/run/docker.sock")
      --http-api-metrics                            Runs Watchtower with the Prometheus metrics API enabled
      --http-api-token string                       Sets an authentication token to HTTP API requests.
      --http-api-update                             Runs Watchtower in HTTP API mode, so that image updates must to be triggered by a request
      --include-restarting                          Will also include restarting containers
  -S, --include-stopped                             Will also include created and exited containers
  -i, --interval int                                poll interval (in seconds) (default 86400)
  -e, --label-enable                                watch containers where the com.centurylinklabs.watchtower.enable label is true
  -m, --monitor-only                                Will only monitor for new images, not update the containers
      --no-color                                    Disable ANSI color escape codes in log output
      --no-pull                                     do not pull any new images
      --no-restart                                  do not restart any containers
      --no-startup-message                          Prevents watchtower from sending a startup message
      --notification-email-delay int                Delay before sending notifications, expressed in seconds
      --notification-email-from string              Address to send notification emails from
      --notification-email-server string            SMTP server to send notification emails through
      --notification-email-server-password string   SMTP server password for sending notifications
      --notification-email-server-port int          SMTP server port to send notification emails through (default 25)
      --notification-email-server-tls-skip-verify   Controls whether watchtower verifies the SMTP server's certificate chain and host name.
                                                    Should only be used for testing.
      --notification-email-server-user string       SMTP server user for sending notifications
      --notification-email-subjecttag string        Subject prefix tag for notifications via mail
      --notification-email-to string                Address to send notification emails to
      --notification-gotify-tls-skip-verify         Controls whether watchtower verifies the Gotify server's certificate chain and host name.
                                                    Should only be used for testing.
      --notification-gotify-token string            The Gotify Application required to query the Gotify API
      --notification-gotify-url string              The Gotify URL to send notifications to
      --notification-msteams-data                   The MSTeams notifier will try to extract log entry fields as MSTeams message facts
      --notification-msteams-hook string            The MSTeams WebHook URL to send notifications to
      --notification-slack-channel string           A string which overrides the webhook's default channel. Example: #my-custom-channel
      --notification-slack-hook-url string          The Slack Hook URL to send notifications to
      --notification-slack-icon-emoji string        An emoji code string to use in place of the default icon
      --notification-slack-icon-url string          An icon image URL string to use in place of the default icon
      --notification-slack-identifier string        A string which will be used to identify the messages coming from this watchtower instance (default "watchtower")
      --notification-template string                The shoutrrr text/template for the messages
      --notification-url stringArray                The shoutrrr URL to send notifications to
  -n, --notifications strings                        notification types to send (valid: email, slack, msteams, gotify, shoutrrr)
      --notifications-level string                  The log level used for sending notifications. Possible values: panic, fatal, error, warn, info or debug (default "info")
      --remove-volumes                              remove attached volumes before updating
      --revive-stopped                              Will also start stopped containers that were updated, if include-stopped is active
      --rolling-restart                             Restart containers one at a time
  -R, --run-once                                    Run once now and exit
  -s, --schedule string                             the cron expression which defines when to update
      --scope string                                Defines a monitoring scope for the Watchtower instance.
  -t, --stop-timeout duration                       timeout before a container is forcefully stopped (default 10s)
  -v, --tlsverify                                   use TLS and verify the remote
      --trace                                       enable trace mode with very verbose logging - caution, exposes credentials

time="2021-[redacted]" level=fatal msg="unknown flag: --label"
Error: unknown flag: --label

Thanks!

[piksel]

The --label argument is for the docker CLI, but the --label-enable is for watchtower itself. Since they are both passed after the container name, they will be passed to the exuctable inside the container (watchtower).
But even if you moved the --label= argument to before continrrr/watchtower, it probably won't do what you expect, as that label needs to be put on the containers that you want to be automatically updated, on THEIR docker run commands.
You are also specifying nginx as an argument, which would only target the container with the name nginx. Perhaps you can explain what you are trying to achieve?

Either start the nginx container with the label set to false (--label=com.centurylinklabs.watchtower.enable=false if you are using docker run), or start watchtower with an inclusive list of all the containers who should be updated:

docker run -d \
    --restart unless-stopped \
    --name watchtower \
    -v /var/run/docker.sock:/var/run/docker.sock \
    containrrr/watchtower \
    container_to_update_1 container_to_update_2 container_to_update_3

[R8s6]

Thanks for the explanation!

I was trying to exclude certain docker containers from being updated by watchtower, in this example, ngnix.

What's the correct way to achieve that?

Thank you.

[piksel]

Either start the nginx container with the label set to false (--label=com.centurylinklabs.watchtower.enable=false if you are using docker run), or start watchtower with an inclusive list of all the containers who should be updated:

docker run -d \
    --restart unless-stopped \
    --name watchtower \
    -v /var/run/docker.sock:/var/run/docker.sock \
    containrrr/watchtower \
    container_to_update_1 container_to_update_2 container_to_update_3

[R8s6]

Oh I see it now. The label --label=com.centurylinklabs.watchtower.enable=false is to be assigned to the target container, not inside the watchtower container.

I'll give it a try, thanks a lot for the help.

Case closed.