| SLEEP_TIME | Time interval between update checks (default: 5 minutes) | 5m |
| IGNORELIST_SERVICES | Space-separated list of services to ignore during updates | shepherd my-other-service |
| FILTER_SERVICES | Filter for specifying services to update (matches docker service ls filter) | label=com.mydomain.autodeploy |
| ROLLBACK_ON_FAILURE | Roll back a service to the previous version if an update fails | true |
| UPDATE_OPTIONS | Additional options for the docker service update command | --update-delay=30s |
| TIMEOUT | Timeout for the docker service update process (default: 5 minutes) | 300 |
| APPRISE_SIDECAR_URL | URL for the Apprise sidecar service to enable update notifications | apprise-microservice:5000 |
| IMAGE_AUTOCLEAN_LIMIT | Enable old image autocleaning on service update | 5 |
| RUN_ONCE_AND_EXIT | Run Shepherd once and then exit | true |
| WITH_REGISTRY_AUTH | Enable private registry authentication | true |
| REGISTRY_USER / REGISTRY_PASSWORD | Credentials for private registry authentication | user123 / secret_password |
| REGISTRIES_FILE | Path to the secret file containing multiple registry authentication entries | /var/run/secrets/shepherd-registries-auth |
| WITH_INSECURE_REGISTRY | Enable connection to an insecure private registry | true |
| WITH_NO_RESOLVE_IMAGE | Prevent pulling images from the registry | true |
| TZ | Set the timezone for log entries | Europe/Zurich |
