I always use 'containrrr/watchtower' for years to update all my installed docker images from SSH. This updater container is configured to always be stopped except when it is started, always only once, from portainer. It works very well. The SSH installation command is:
docker run -d \
--name watchtower-updater \
-v /var/run/docker.sock:/var/run/docker.sock \
containrrr/watchtower --run-once
I forgot to say that I'm talking about docker tailscale/tailscale service update and any other docker image, and not about an kodi addon.