Background

In November/December 2020 Home Assistant went into a unhealthy state if Watchtower was found on the host.

It doesn't have to be a running container. It's enough to have a docker image on the host with a tag that starts with (or after the last slash, starts with) watchtower.

Supervisor searches for images that matches a few patterns, and if an image matches, the system is marked as unhealthy and you cannot perform any upgrades.

To fix an unhealthy Home Assistant

If the Supervisor logs (Frontend > Supervisor > System) reports that you have containers that are not supported, you need to remove the images from the host.

In my case I was running containrrr/watchtower.

To remove it, on the host execute:

docker rmi containrrr/watchtower:latest

If you're running Portainer this can be done under Images.

Then restart Supervisor (Frontend > Supervisor > Restart). After a minute, if you reload the page, the unhealthy state should be gone.

Code

Links to the code in Supervisor that searches for images

At the time of writing this (December 4, 2020): https://github.com/home-assistant/supervisor/blob/0b085354db9677fb65e450fe488c4f8dbfb99215/supervisor/resolution/evaluations/container.py#L16
Main branch: https://github.com/home-assistant/supervisor/blob/main/supervisor/resolution/evaluations/container.py

How to run Watchtower on the same host as Home Assistant

WARNING! If not configured correctly, running Watchtower can cause all sorts of problems to your Home Assistant installation

Make sure you've configured Watchtower to only monitor non Home Assistant containers.

The easiest way to configure Watchtower is to list the containers to monitor as arguments, see https://containrrr.dev/watchtower/arguments/

Workaround

The simplest workaround I've come up with to run Watchtower without Home Assistant detecting it, is to run an image that isn't called Watchtower.

So download Watchtower, put another tag name on it, remove the offending tag (the image will not actually be deleted as it has other tags), and run it under the new tag name.

Run this on the host

docker pull containrrr/watchtower:latest
docker tag containrrr/watchtower:latest my-special-tower
docker rmi containrrr/watchtower:latest

Then use the image my-special-tower instead of containrrr/watchtower.

You can use any name you want, as long as it isn't one that matches what Supervisor is looking for (see links to code above).

The only annoyance is that now you need to update watchtower manually, by executing the commands above and then restart the container.

You could put it in a script and schedule it to run avery now and then, and if you run the container in docker-compose, add docker-compose up -d watchtower at the end of the script. up will only restart the container if it has been updated.