Published: 29.09.2026
Docker runs applications in containers, which package a program with its libraries and settings so that it behaves the same way on any machine that runs Docker. On a Linux VPS it is a practical way to run databases, web tools and small services without installing each one by hand. Our virtual servers come with full root access, so you install and manage Docker yourself. This guide covers the installation, a first container, Compose for several services and regular cleanup.
Before you install
- Update the system first, following the basic steps for your distribution.
- Decide who needs Docker access, because membership of the docker group gives root-level power.
- Plan the firewall, because Docker can publish container ports in a way that bypasses some firewall rules.
- Check that the disk has enough free space for images, which can grow quickly.
Installing Docker
On Debian and Ubuntu, you can install Docker from the official Docker repository by following the instructions on Docker's website, or use the docker.io package from your distribution if its version suits you. Avoid running install scripts copied from unknown sources, even when they look convenient. After installation, start the service and enable it at boot with the systemctl command, using the enable and start options together and the service name docker.
To run Docker commands without sudo, add your user to the docker group with the usermod command and the append group option, then log out and back in. The docker group is effectively root access, because a container can reach the host file system, so add only accounts you trust.
Your first container
Run the test container with the command docker run hello-world. Docker downloads a small image from a public registry, starts it, prints a message and exits. Then list the images with docker images, and list all containers, including stopped ones, with docker ps and the all option. These steps confirm that the engine, the network and the download work.
Compose for several services
Docker Compose describes several containers in one YAML file, with their images, ports, volumes and environment settings. Start the project from the folder that contains the file with docker compose up and the detached option, which is written as -d, and stop it with docker compose down. Keep secrets such as passwords in a separate file with restricted permissions, not in files you share or commit to version control. Check the installed version with docker compose version.
Ports and the firewall
Docker writes its own firewall rules, so a container port published with the publish option can be reachable even when your firewall rule would normally block it. Publish ports only where they are needed, and bind them to the loopback address when only the server itself should reach them. Test from outside after each change. The free firewall in the client area can add a second layer in front of the server.
Regular cleanup
Old images, stopped containers and unused volumes take disk space. Check usage with the docker system df command, which shows the space used by images, containers and volumes. The docker system prune command removes stopped containers, unused networks and dangling images, but it keeps volumes unless you add the volumes option. Read the prompt carefully, and export any important data before you clean up anything that holds it.
Updating images
Update an application by pulling its new image with docker compose pull, then recreating the containers with docker compose up and the detached option. Note the image version each service runs. Avoid the latest tag for important services, because it can change without warning when you pull it again.
Frequently asked questions
Do I need Docker for a website? No. Docker helps when you run several services or want repeatable environments. A single website can run without it.
Why can my user not run Docker? Docker needs permission to use its socket. Add the user to the docker group, then log out and back in, or run the commands with sudo.
Is Docker safe on a public server? It can be, when you keep images updated, publish only the ports you need and limit who can use Docker. Treat the docker group as root-level access.
