You can set notifications so you know which container are updated recently. If that container stops working, then just revert to previous image.

And configure when watchtower should run the update. I set mine to update at 8pm, so in case something breaks, I still have a few hours before bedtime to fix it.

Asus router with merlin firmware have an option called “global redirection” that can force LAN devices to use specific dns server.

https://imgur.com/a/iftioOx