I think I'm going to have to spin up a VM to understand why you're doing things the way they are, instead of using a .env file with the docker-compose.yml, or docker secrets. The built-in way to run containers is very straightforward, and it seems at first glance that you're making it a bit more complicated than it needs to be. There's no need to mess with systemctl at all, for example.

Still not following. Are you setting up containers with portainer or something? My whole docker setup is in one docker-compose.yml. I use docker compose, not docker-compose. Maybe that's the issue?

Edit: that link is about running docker in Windows 10.

Watchtower works fine with docker compose. I'm not sure what you're trying to say.