How to install Docker and Docker Compose on Ubuntu and Debian

Step 1. Add the Docker repository and install the packages

The same commands work on Ubuntu and Debian: /etc/os-release fills in the distribution name and release. This is the official method from the Docker documentation:

sudo apt update
sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
. /etc/os-release
sudo curl -fsSL "https://download.docker.com/linux/$ID/gpg" -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/$ID ${UBUNTU_CODENAME:-$VERSION_CODENAME} stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Step 2. Check the installation

Run the hello-world test container and check the Compose version - both commands should finish without errors:

sudo docker run --rm hello-world
docker compose version

If hello-world prints its greeting, the Engine works. The Docker service is already enabled at boot and will come back after a server reboot.

Step 3. Run without sudo

To stop typing sudo before every docker command, add your user to the docker group and log in over SSH again:

sudo usermod -aG docker $USER
# log out of SSH and back in, then:
docker ps

Step 4. A first Docker Compose project

Create a project directory and a compose.yaml file - the example runs nginx reachable only from the server itself on port 8080:

services:
  web:
    image: nginx:alpine
    ports:
      - "127.0.0.1:8080:80"
    restart: unless-stopped

docker compose up -d
docker compose ps
docker compose logs -f

restart: unless-stopped brings the container back after a crash and after a server reboot - it needs no separate systemd service.

Docker and UFW: ports open around the firewall

Docker writes its own iptables rules for published ports, and they match before UFW rules do. A port published as 8080:80 is reachable from the internet even if UFW keeps it closed. So:

• publish internal services (databases, admin panels, APIs without auth) only on 127.0.0.1, as in the example above;
• expose a single reverse proxy (nginx, Caddy, Traefik) on ports 80 and 443 and let it forward requests to containers - the HTTPS guide shows how to set up nginx with a free certificate;
• do not publish ports at all for containers that need no outside access - within one Compose project they reach each other by service name.

Step 5. Cap log size

By default Docker keeps container logs with no size limit, and a chatty container can fill the whole disk. Cap them at three 10 MB files per container. The setting applies to containers created after it - recreate existing ones with docker compose up -d --force-recreate.

sudo tee /etc/docker/daemon.json > /dev/null <<'EOF'
{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" }
}
EOF
sudo systemctl restart docker

How to free disk space

Old images pile up after every update. The first command shows what takes the space, the second removes images no container uses:

docker system df
docker image prune -a