About Docker
Docker is a container engine: it packages an application and its dependencies into an image, then runs it in isolation on the host's kernel. Developers use it to get the same environment locally and in production. Small teams use it to host several services on one machine without their dependencies getting in each other's way.
On delivery, your Linux VPS (Debian 12, Debian 13, Ubuntu 22.04 or 24.04, and Ubuntu 20.04 with the caveats described below) has Docker Engine installed from Docker's official apt repository. The docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin and docker-compose-plugin packages are in place, and the docker and containerd services are enabled at boot.
The repository signing key is checked against its fingerprint before installation. A hello-world container runs at the end of the recipe to confirm that the daemon responds. After that the server is yours: no user is added to the docker group by default, and no application is deployed on your behalf.
What you can do with Docker
Official Docker apt repository
Packages come from download.docker.com, with a signing key whose fingerprint is verified. Updates go through apt, like the rest of the system.
Compose and Buildx included
The Compose plugin runs as
docker compose(no hyphen), and Buildx builds your images. You can deploy a multi-service stack from your first login.Log rotation preconfigured
If
/etc/docker/daemon.jsondoes not exist, the recipe writes it with thejson-filedriver, 10 MB per file and 3 files kept. Container logs do not quietly fill the disk.Conflicting packages removed
Unofficial packages such as
docker.io,podman-docker,containerdorruncare removed before installation. This avoids the version mix-ups that make the daemon fail.Root-equivalent access under control
No account is added to the
dockergroup, which is equivalent to root access. You decide who gets that privilege.Readable installation log
Each step is logged in
/var/log/docker-install.log, and the/var/lib/docker-install.donefile confirms that the recipe ran to completion.
Get started with Docker
From order to production in a few minutes.
- 1
Order the VPS with Docker ticked
Choose a Linux VPS in Paris or Frankfurt, select Debian 12, Debian 13, Ubuntu 22.04 or 24.04, then tick Docker in the "Applications" tab of the order form.
- 2
Connect and check the installation
Once the server is delivered, connect over SSH with the credentials you received. The installation runs on first boot: if the marker file does not exist yet, wait a moment and follow the log.
Bashssh USER@SERVER_IP cat /var/lib/docker-install.done tail -n 20 /var/log/docker-install.log - 3
Run your first container
Check the versions, then start a test web server. The port is published on 127.0.0.1 only, so it is not exposed to the Internet while you test.
Bashdocker --version && docker compose version docker run -d --name web -p 127.0.0.1:8080:80 nginx curl -I http://127.0.0.1:8080 - 4
Secure it before production
Put a reverse proxy (Caddy, Traefik or Nginx) in front of your services to handle YOUR_DOMAIN over HTTPS, and publish only ports 80 and 443 to the Internet. Keep other ports on 127.0.0.1, because ports published by Docker bypass ufw. Finally, back up your volumes and compose files.
Bashdocker volume ls docker compose up -d
Docker use cases
Host several isolated services
A PostgreSQL database, a web application and a monitoring tool each run in their own container, described in a single
compose.yamlfile. You update or restart them independently.Deploy a self-hosted application
Many open source projects (n8n, Nextcloud, Gitea, Uptime Kuma...) publish a Docker image and an example Compose file. The VPS is ready to run them with no preparation.
Build and test images
With Buildx, you build images on a dedicated remote machine without loading your workstation. This is useful for a lightweight CI pipeline or integration tests.
Mirror production in staging
A second VPS with the same Docker version and the same Compose files gives you a staging environment close to production, with little added administration.
Docker FAQ
The recipe installs docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin and docker-compose-plugin from Docker's official apt repository. The docker and containerd services are enabled at boot. With Compose v2, the command is docker compose, not docker-compose.
More about Docker
Firewall and published ports
This is the most common trap. When you publish a port with -p 8080:80, Docker writes its own iptables rules, and that traffic is handled before the rules of ufw or firewalld. A ufw deny 8080 therefore blocks nothing.
There are two reliable approaches: bind the port to the loopback interface (-p 127.0.0.1:8080:80) and expose the service through a reverse proxy, or filter in the DOCKER-USER chain, which Docker evaluates before its own rules. The first is simpler and is enough in most cases.
The docker group and sudo
Membership of the docker group is equivalent to root access on the machine: a container can mount the host's filesystem. The recipe does not add anyone to this group. If you want to work with an unprivileged account, add it yourself, then log in again.
Bashsudo usermod -aG docker USER
Container logs
The /etc/docker/daemon.json file written at delivery limits each container to 3 files of 10 MB. It is only created if it did not already exist. To change these values, edit it and restart the daemon. The new settings apply only to containers created after the restart.
Bashsudo systemctl restart docker
Updates
The Docker repository is declared in /etc/apt/sources.list.d/docker.sources, so new versions arrive with your regular apt updates. Schedule them for a time when a daemon restart is acceptable: it can interrupt your containers unless the live-restore option is enabled.
Bashsudo apt update && sudo apt install --only-upgrade docker-ce docker-ce-cli containerd.io
Ubuntu 20.04
Docker no longer officially supports Ubuntu 20.04. The recipe still attempts the installation if the Docker repository still publishes packages for that release, and it writes a warning to the log. For a production server, choose Ubuntu 22.04, Ubuntu 24.04, Debian 12 or Debian 13, all of which are supported.
Backups
Images can be pulled again, your data cannot. Back up named volumes, bind-mounted directories and your compose.yaml files along with their environment variables. For a database, prefer a logical dump (pg_dump, mysqldump) over copying the volume while it is live.
