How to Install Docker on Ubuntu

Before you start

• A supported Ubuntu: Docker supports the 64-bit versions of Ubuntu 26.04, 24.04 and 22.04 LTS. Check yours with cat /etc/os-release.
• A KVM server, not a container: Docker needs its own kernel features. It runs on any KVM VPS, but often not on container-based (OpenVZ or LXC) plans.
• Root or a user with sudo. The commands below use sudo; if you are logged in as root, you can leave it out.

Avoid the docker.io package from Ubuntu's own repository and the Snap version for servers: Docker's repository gets new versions first, and it is what Docker's own documentation uses.

Step 1: Remove conflicting packages

If you installed Docker before from another source, remove those packages first. On a fresh server apt simply reports that none are installed:

sudo apt remove $(dpkg --get-selections docker.io docker-compose docker-compose-v2 docker-doc docker-buildx podman-docker containerd runc | cut -f1)

Images and volumes in /var/lib/docker/ are not deleted by this.

Step 2: Add Docker's repository

These commands, from Docker's documentation, add Docker's signing key and its apt repository for your Ubuntu version:

sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update

Step 3: Install Docker and Compose

sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

This installs Docker Engine, the command-line tool, the Buildx builder and the Compose plugin. Check that it works:

sudo docker run hello-world
docker compose version

The first command downloads a tiny test image and prints a welcome message. On Ubuntu, Docker starts automatically at boot, so there is nothing to enable.

Compose is the docker compose command, with a space. The old docker-compose with a hyphen is the retired first version; guides that still use it work with the new command too.

Step 4: Permissions and log rotation

Running docker without sudo. Add your user to the docker group, then log out and back in:

sudo usermod -aG docker $USER

Be aware that Docker itself warns this group grants root-level privileges: anyone in it can control the whole server. Add only users you would give root to.

Limit log size. By default container logs grow without limit and can fill the disk. Create /etc/docker/daemon.json:

{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" }
}

Then sudo systemctl restart docker. The limit applies to containers created after the change, so recreate existing ones.

A first Compose file

Compose describes your containers in one file. Create a folder with a compose.yaml:

services:
  web:
    image: nginx:stable
    ports:
      - "127.0.0.1:8080:80"
    restart: unless-stopped

Start it with docker compose up -d, check it with docker compose ps and read its logs with docker compose logs. restart: unless-stopped brings the container back after a crash or a reboot. The port is bound to 127.0.0.1 on purpose, as the next section explains.

Docker and ufw: the firewall trap

This catches almost everyone. When you publish a port, for example -p 8080:80, Docker adds its own firewall rules that are applied before ufw's. The port is open to the internet even if ufw says it is closed.

• Bind ports to localhost when only the server itself needs them, such as a database or an app behind a reverse proxy: 127.0.0.1:8080:80.
• Do not publish database ports at all; let containers reach each other over a Docker network instead.
• For filtering by source address, add rules to the DOCKER-USER iptables chain, which Docker checks before its own.

The same applies to game servers run in Docker; see how to set up a VPS for game servers.

Docker on a HytHost VPS

HytHost VPS plans run on KVM, so each VPS has its own kernel and Docker runs without restrictions. Pick Ubuntu 24.04 or 22.04 at checkout, connect over SSH and follow the steps above. You get full root access, SSD storage and DDoS protection, and you can upgrade to a bigger plan later as your containers grow.