Use Docker’s official apt repository on your Ubuntu or Debian VPS, verify the daemon with docker run hello-world, then run containers with deliberate port, storage, and privilege settings. The important VPS-specific detail is networking: a published Docker port can be forwarded around a conventional UFW rule. This tutorial covers a clean installation, non-root operation, container lifecycle, persistent data, Compose, and firewall controls that keep services private or intentionally public.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
What you need before installing Docker
Docker Engine runs on a virtual private server (VPS) as a system service. You administer the host over SSH, while Docker creates containers, networks, images, and volumes on that host. The commands below assume a newly provisioned Ubuntu or Debian server with a user that can run sudo.
As an Amazon Associate I earn from qualifying purchases.
- An SSH connection to the VPS and a user in the
sudogroup. - A supported 64-bit Ubuntu or Debian installation. Docker’s current Ubuntu installation page lists Resolute 26.04 LTS, Noble 24.04 LTS, and Jammy 22.04 LTS; its Debian page lists Trixie 13 (stable) and Bookworm 12 (oldstable). Check Docker’s support list when your distribution is newer or based on a derivative.
- Enough disk space for the Engine, image layers, writable container data, and logs. Images and volumes remain on the VPS until you remove them.
- A DNS name and a plan for which ports, if any, should be reachable from the Internet.
Take a snapshot of a production VPS before changing package sources or firewall rules. Do not expose an administration port merely to test Docker; keep SSH restricted using your provider firewall, UFW, or an equivalent control.
Choose an installation source
| Method | What you receive | When it makes sense |
|---|---|---|
| Docker’s official apt repository | Docker Engine (docker-ce), CLI (docker-ce-cli), containerd.io, Buildx, and the Compose plugin |
Recommended when you want Docker’s current Engine and plugin releases on a supported Ubuntu or Debian host. |
| Distribution package | Usually a package such as docker.io, maintained on the distribution’s release schedule |
Useful when your organisation requires only vendor-integrated packages; versions can lag Docker’s repository. |
Do not install both sources at once. Mixed packages can leave you with conflicting services or an unexpectedly old client. The procedure below removes common distribution packages, then installs Docker’s packages from one repository.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Install Docker Engine on Ubuntu
1. Remove conflicting packages
Removing a package does not remove images, containers, or volumes under /var/lib/docker. Never add purge or delete that directory unless you intentionally want to erase Docker data.
sudo apt update
sudo apt remove docker.io docker-doc docker-compose docker-compose-v2 docker-buildx podman-docker containerd runcApt may report that one or more packages are not installed. That is harmless. If an existing application depends on a package such as containerd, identify that dependency before proceeding.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →2. Add Docker’s signing key and apt repository
sudo apt update
sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt updateThe command reads the codename from /etc/os-release. If you are running an Ubuntu derivative or a development release that Docker does not list, stop here and use a supported base release rather than substituting a codename at random.
3. Install the Engine and plugins
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-pluginThis installs the daemon, command-line client, container runtime, Buildx image builder, and the modern docker compose subcommand. Confirm the service is running:
sudo systemctl status docker
sudo systemctl enable --now dockerenable --now starts Docker immediately and configures it to start after a normal reboot. On a VPS provider that uses a custom init system, check the provider’s image documentation if systemctl is unavailable.
Install Docker Engine on Debian
1. Remove conflicting packages
sudo apt update
sudo apt remove docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runcAs with Ubuntu, this removes packages but intentionally leaves Docker’s data directory alone.
Recommended Free Tools
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
2. Configure Docker’s Debian repository
sudo apt update
sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt updateDocker’s Debian list identifies Trixie 13 as stable and Bookworm 12 as oldstable. Verify that your release is listed before enabling the repository.
3. Install and start Docker
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo systemctl status dockerDecide whether to use sudo
By default, the Unix socket is owned by root, so ordinary users must prefix Docker commands with sudo. You can instead add a trusted account to the docker group:
- Create the group if it does not already exist:
sudo groupadd docker. If the group already exists, continue. - Add the current account:
sudo usermod -aG docker $USER. - Start a shell with the new group for the current session:
newgrp docker, or log out of SSH and sign in again. - Check access without sudo:
docker version.
Membership is effectively root-level access. A user who can control the Docker daemon can mount host filesystems, change namespaces, and start a privileged container. On a shared VPS, keep the default sudo docker ... workflow or grant the group only to accounts you fully trust.
Verify the installation
Run Docker’s small diagnostic image:
docker run hello-worldDocker downloads the image if it is not cached, creates a short-lived container, prints a success message, and exits. If you see a permission error, your shell has not picked up the new group membership; reconnect over SSH or use sudo docker run hello-world. If the daemon is unreachable, inspect sudo systemctl status docker and recent logs with sudo journalctl -u docker --no-pager -n 100.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Run your first useful container
Start a web server bound only to the VPS
This command runs an Nginx container in the background and maps host port 8080 to container port 80:
docker run -d --name web --restart unless-stopped -p 127.0.0.1:8080:80 nginx:alpine-ddetaches and returns the container ID.--name webgives the container a stable administrative name.--restart unless-stoppedstarts it after daemon or VPS restarts unless you deliberately stopped it.-p 127.0.0.1:8080:80publishes host port 8080 only on the loopback interface and forwards it to port 80 in the container.
Test locally on the VPS with curl http://127.0.0.1:8080. A remote browser cannot reach this mapping directly. Put a host-level reverse proxy in front of it when you need HTTPS or a public hostname.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Inspect, follow logs, stop, and remove it
docker ps
docker ps -a
docker logs --tail 100 web
docker logs -f web
docker inspect web
docker stop web
docker start web
docker rm webdocker rm removes the stopped container, not the image. Add -f only when you have confirmed that immediate termination is safe. Remove an unused image separately with docker image rm nginx:alpine.
Understand images, containers, volumes, and data
An image is an immutable template; a container is a runnable instance with a writable layer. Recreating a container normally discards changes made only in that writable layer. Store databases, uploads, and configuration that must survive replacement in a named volume or a host bind mount.
Named volume example
docker volume create app-data
docker run -d --name app --mount source=app-data,target=/var/lib/app example/image:1.0Docker manages the volume location. List and inspect it with docker volume ls and docker volume inspect app-data. Back up the volume at the application level whenever possible; copying raw database files while the database is writing can produce an unusable backup.
Bind mount example
sudo mkdir -p /srv/app/config
docker run -d --name app --mount type=bind,src=/srv/app/config,dst=/etc/app,readonly example/image:1.0Bind mounts expose a specific host path to the container. Set ownership and permissions deliberately, and use readonly for configuration that the process should not modify.
Use Docker Compose for multi-container applications
The official package installs the Compose plugin, invoked as docker compose (with a space), not the obsolete standalone docker-compose command. A minimal project might look like this:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
mkdir -p ~/web-stack && cd ~/web-stack
cat > compose.yaml <<'YAML'
services:
web:
image: nginx:alpine
restart: unless-stopped
ports:
- "127.0.0.1:8080:80"
YAML
docker compose up -d
docker compose ps
docker compose logs -f web
docker compose downdocker compose down removes the project’s containers and network but keeps named volumes unless you add --volumes. Treat that option as destructive. Pin image tags appropriate to your upgrade policy instead of relying on latest.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Publish ports safely on a VPS
Docker’s default bridge networking forwards a published port from a host address to a container. A mapping such as -p 8080:80 commonly binds on all host addresses (0.0.0.0), making the service reachable through the VPS’s public address. A mapping such as -p 127.0.0.1:8080:80 is host-only.
| Exposure choice | Example | Result |
|---|---|---|
| All host interfaces | -p 8080:80 or -p 0.0.0.0:8080:80 |
Potentially reachable from the Internet; requires deliberate filtering. |
| Loopback only | -p 127.0.0.1:8080:80 |
Only processes on the VPS can connect; suitable behind a host reverse proxy. |
| No published port | Omit -p |
Accessible only to connected containers on the Docker network unless you use another access method. |
Do not assume that allowing or denying a port with UFW alone controls every published container port. UFW normally writes to the host’s INPUT chain, while Docker forwards published traffic through its own rules. That forwarded packet can avoid the path where a basic UFW rule is evaluated.
Control Docker traffic with DOCKER-USER
Docker’s documented insertion point for administrator filtering is the DOCKER-USER chain. Rules appended only to the ordinary FORWARD chain run after Docker’s accept rules and may not see traffic Docker has already accepted.
Free tools Windows power users keep installed
One-click scans. No signup required.
Find the container address
docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' webFiltering in DOCKER-USER occurs after destination NAT, so match the container’s internal IP and port. Container addresses can change when a container is recreated; use a stable network design or regenerate rules as part of deployment.
Allow one source and reject other traffic
The following example allows an established connection, permits TCP port 80 only from the documented example address 203.0.113.10, then drops other traffic to that container port. Replace the example address and container IP with values appropriate to your network.
sudo iptables -I DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
sudo iptables -I DOCKER-USER -s 203.0.113.10 -p tcp -d 172.17.0.2 --dport 80 -j ACCEPT
sudo iptables -A DOCKER-USER -p tcp -d 172.17.0.2 --dport 80 -j DROPRule order matters. Review the active chain with sudo iptables -L DOCKER-USER -n -v --line-numbers. If you need to match the original client address after Docker’s NAT, use the conntrack extension; that adds processing overhead and should be tested under your workload. Make firewall rules persistent using the persistence method supported by your VPS distribution, and verify them after a reboot.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Use a UFW helper only with testing
ufw-docker is a community helper that edits /etc/ufw/after.rules and provides per-container filtering rules. Similar guides edit that file directly. These are workarounds around Docker/UFW interaction, not Docker’s own firewall model. Test on a non-production VPS, inspect every generated rule, and keep a provider console or out-of-band recovery path in case you lock yourself out.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCommon failures and recovery steps
“Cannot connect to the Docker daemon”
- Check the service:
sudo systemctl status docker. - Start it:
sudo systemctl start docker. - Read errors:
sudo journalctl -u docker -n 100 --no-pager. - Check disk space with
df -h; a full filesystem can prevent the daemon from creating metadata.
Permission denied on /var/run/docker.sock
Use sudo, or complete the group procedure, then start a new login session. Confirm with id that docker appears in your groups. Remember that group membership grants root-equivalent control.
Port already allocated
Find the process using the host port with sudo ss -ltnp | grep ':8080'. Stop or reconfigure that service, or publish a different host port, for example -p 127.0.0.1:8081:80. The container port can remain 80.
The container exits immediately
Check docker ps -a and docker logs container-name. Containers stop when their main process exits; a shell or one-shot command is not a long-running service. Correct the command, configuration, environment variables, or mounted-file permissions, then recreate the container.
UFW says a port is denied but the container is reachable
Confirm the published mapping with docker ps. If it binds to 0.0.0.0, move it to 127.0.0.1, add an explicit DOCKER-USER policy, or use a carefully reviewed helper. Test from both the VPS and an external network; local success does not prove public exposure is blocked.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
A safe operating checklist
- Use a supported Ubuntu or Debian release and Docker’s official repository for the Engine packages.
- Install only the packages you need: Engine, CLI, containerd, Buildx, and Compose.
- Enable the service and verify it with
docker run hello-world. - Grant
dockergroup membership only to trusted users. - Bind internal services to
127.0.0.1or leave ports unpublished unless they must be public. - For published ports, enforce policy in
DOCKER-USERand account for post-NAT container addresses. - Keep application state in named volumes or controlled bind mounts, and back it up.
- Pin image versions, review logs, patch the host, and test firewall changes before applying them to production.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
