Every machine in detail
Identity, certificate, install and reboot status at a glance. Deselect individual updates before you trigger the install.
Self-hosted · Open source · Windows & Linux Every update in view.
No surprises.
UpdateWatch2 shows you which machines need which updates – and you decide when to install and when to reboot. A single Docker container, agents for Windows and Linux, secured by its own certificate authority.
1 Docker container – API and UI
mTLS on every agent connection
x64 + arm64 for server and agents
AGPL-3.0 free to use and self-host
Features
Everything you need for patch management
From first registration to scheduled reboot – no cloud dependency, no subscription.
-
Mutual TLS by default
A built-in internal CA, with client and server certificates on every request. New agents stay locked out until you approve them.
-
Fleet overview
Every machine with its OS, version, last check-in and pending updates. Filter, sort and act on many at once.
-
Install selectively
Trigger all or just some pending updates with a click. A reboot never happens on its own – you decide that separately.
-
Maintenance windows
Schedules that run once, weekly, every N days or on a cron expression – with deadlines, history and failure emails.
-
Self-updating agents
The server fetches new agent releases from GitHub and hands them out SHA-256-verified. Agents need no internet access.
-
Local or Active Directory
Sign in with the local admin or via LDAP against an AD group – with brute-force protection and trusted IPs.
-
Notifications
Email when too many updates pile up or too many machines are affected – plus warnings before certificates expire.
-
Configurable live
Update filters, audit log, pagination, log level: nearly every setting applies instantly, no restart needed.
Screenshots
See UpdateWatch2 in action
The UI speaks German and English, comes in light and dark – and works all the way down to your phone.
Schedules instead of night shifts
Define maintenance windows for fixed groups of machines: install, reboot or both – optionally rebooting only when actually required.
Certificates under control
Set lifetimes, rotate the CA root in three steps and see which agents still need to catch up – without dropping connections.
Notified when it matters
Thresholds for updates per machine and affected machines overall, test email included.
On the go, too
The whole UI is responsive – approve, install and reboot right from your phone.
Security
Trust is issued, not assumed
Every connection between agent and server is authenticated by certificates on both sides. The server ships with its own certificate authority for that.
- 01
Register
A new agent signs up – and stays locked out.
- 02
Approve
You confirm it individually or in bulk. Only then does it get its certificate.
- 03
Renew
Certificates renew themselves before they expire. Lost one? Just reissue it.
- 04
Rotate
Swap the CA root with a transition window – no downtime.
Platforms
Runs where your machines are
-
Server
Docker image for linux/amd64 and linux/arm64 – from a Raspberry Pi to a cloud VM.
-
Windows agent
Windows service with an NSIS installer for x64 and ARM64, updates via the Windows Update API.
-
Linux agent
systemd service as .deb and .rpm for amd64 and arm64, updates via apt or dnf.
Install
Up and running in five minutes
One command starts the server. The first admin password is printed to the container log.
-
01Start the server
docker run -d \ --name updatewatch2-server \ -p 8795:8795 -p 8796:8796 \ -e UPDATEWATCH2_SERVER_HOSTNAME=updatewatch2.example.com \ -v uw2-data:/app/data \ -v uw2-certs:/app/certs \ -v uw2-agent-updates:/app/agent-updates \ --restart unless-stopped \ ghcr.io/vulture20/updatewatch2-server:latest -
02Sign in
Open
http://localhost:8795and sign in asadmin.docker logs updatewatch2-servershows the password. -
03Install agents
Installers and packages for Windows and Linux are in the agent releases. Then approve new agents in the UI.