Normally fine but if you want to be more careful about what is being pushed to your server you can use something like diun to get notifications and run updates manually.
Personally I love dockcheck, which I think is by a guy on the sub. I tend to just run that every now and again and be done with it unless I am notified of a perssing update, although I do still have a couple of things I don't care too much about just auto update with watchtower.