What Is Docker? Installing Docker on Ubuntu

Docker vs a virtual server

They are not competitors but complements: a typical setup is to rent a VPS, install Docker on it and run your applications as containers.

Installing Docker on Ubuntu and Debian

The docker.io package in your distribution's own repository often lags behind. We recommend Docker's official repository. After connecting to your server over SSH, run these commands in order.

1. Install the prerequisites and add Docker's signing key:

   sudo apt update
   sudo apt install ca-certificates curl
   sudo install -m 0755 -d /etc/apt/keyrings
   sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
   sudo chmod a+r /etc/apt/keyrings/docker.asc
   

2. Add the Docker repository:

   echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
   

3. Install Docker and the Compose plugin:

   sudo apt update
   sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
   

4. Test the installation:

   sudo docker run hello-world
   

   
   If you see "Hello from Docker!", the installation is complete.

On Debian, follow the same steps but replace ubuntu with debian in the URLs in steps 1 and 2.

AlmaLinux and Rocky Linux

On RHEL-based distributions, use Docker's RHEL repository:

sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker

Using Docker without sudo

If you don't want to type sudo before every command, add your user to the docker group, then log out and back in:

sudo usermod -aG docker $USER

Keep in mind that a user in the docker group effectively has root privileges. Only add users you trust.

Essential Docker commands

You can start a single container with docker run:

docker run -d --name web -p 8080:80 --restart unless-stopped nginx

-d runs the container in the background, -p 8080:80 maps the server's port 8080 to the container's port 80, and --restart unless-stopped brings the container back up automatically when the server reboots.

Deploying an app with Docker Compose

Managing many options or several containers through long docker run commands gets unwieldy. Docker Compose keeps the whole configuration in a single compose.yaml file. As an example, let's deploy Uptime Kuma, an open-source tool that monitors whether your sites and servers are up.

Create a folder and write a compose.yaml file in it:

services:
    uptime-kuma:
        image: louislam/uptime-kuma:1
        restart: unless-stopped
        ports:
            - '3001:3001'
        volumes:
            - ./data:/app/data

Then run this in the same folder:

docker compose up -d

The app is now available at http://server-ip:3001. Its data lives in the data directory next to the file, so it survives even if you delete the container. The Compose commands you'll use most:

• docker compose ps: Shows the status of your services.
• docker compose logs -f: Follows the logs of all services.
• docker compose pull && docker compose up -d: Pulls new images and re-creates the containers on the new version.
• docker compose down: Stops the services and removes the containers; volumes and bind-mounted folders stay in place.

For a real website, rather than exposing the app directly, we recommend putting a reverse proxy such as Nginx or Caddy in front of it and serving it on your domain with an SSL certificate.

Docker and the firewall

This is the part that surprises Docker users most: ports published by Docker bypass ufw. Docker adds its own iptables rules for ports opened with -p or ports:, and these rules are processed before ufw's. A database port that looks closed in ufw can therefore be open to the internet.

To prevent this, bind ports that only need local access to the loopback address:

ports:
    - '127.0.0.1:3306:3306'

Better still, don't publish ports for services like databases at all. Services in the same Compose file can reach each other by service name (for example db:3306); publish only the ports that genuinely need to be public. We explain how ports and firewalls work in What is a port?

Keeping Docker updated and healthy

• Pin image versions. Use a major version such as postgres:16 instead of latest, so an update never jumps a major version unexpectedly.
• Update regularly. Docker Engine updates with your system packages during apt upgrade. Refresh your images regularly with docker compose pull.
• Watch disk usage. Old images and logs add up over time. docker system df shows usage and docker system prune cleans it up.
• Back up your volumes. Server backups help, but taking regular database dumps as well is the safest approach.

Nodesty servers for Docker

To get the most out of Docker, you need a server with root access and KVM virtualization. Nodesty's AMD Ryzen 9 9950X VPS plans suit web applications and game servers with their high single-core speed, while AMD EPYC 7763 VPS plans offer plenty of RAM for many containers and databases. Both include NVMe storage, nShield DDoS protection and free daily backups kept for 7 days; pick Ubuntu, Debian or AlmaLinux and you can have Docker running within minutes.