Watchtower failing to check for updates - "Parsed container image ref has no tag" error

[brianfromm]

Environment

• Immich version: 1.138.0
• Docker setup: docker-compose
• Watchtower for automatic updates

Issue

Watchtower is reporting an issue while checking for Immich updates and generating this error every hour:

Could not do a head request for "docker.io/valkey/valkey:8bookworm@sha256:fec42f399876eb6faf9e008570597741c87ff7662a54185593e74b09ce83d177",
falling back to regular pull.

Reason: Parsed container image ref has no tag:
docker.io/valkey/valkey@sha256:fec42f399876eb6faf9e008570597741c87ff7662a54185593e74b09ce83d177

Question

The error mentions Valkey (Redis replacement) using a SHA instead of a proper tag, which is causing Watchtower to fail its update checks.

1. Is this expected behavior for the Valkey container in Immich?
2. Should I exclude Valkey from Watchtower monitoring?
3. Or is there a recommended way to handle automatic updates with this setup?

Additional Context

This happens every time Watchtower runs its scheduled check. The actual functionality seems unaffected, but the noise in notifications is problematic.

Thanks for any guidance on the recommended approach for Watchtower + Immich!

[brianfromm]

I was able to get to the bottom of this. The issue wasn’t with Immich itself, but with how Watchtower behaves when images are pinned to a digest.

• Valkey and Postgres in the Immich compose file are referenced with @sha256 digests. That means Docker will always pull that exact build, and Watchtower can’t really “update” them. Since digest references don’t have a mutable tag, Watchtower logs Parsed container image ref has no tag and falls back to a normal pull — which is effectively pointless noise, because digests never change.
• The right approach for me was to tell Watchtower to ignore those two services by adding:

labels:
  - com.centurylinklabs.watchtower.enable=false

For the other Immich services (immich-server, immich-machine-learning), I decided I do want to know when a new release is out, but I’d rather update them myself. For those, I added:

labels:
  - com.centurylinklabs.watchtower.monitor-only=true

That way Watchtower still checks and sends me a Slack notification, but doesn’t auto-restart or pull a new image.

So in short:

• Digest-pinned infra (Valkey/Postgres) → excluded from Watchtower
• Immich app services → notify-only

That cleaned up the noise in my notifications and gives me a safe workflow: stable DB/cache, and visibility into new Immich releases without surprise updates.