How to Install Docker and Docker Compose on an Ubuntu VPS

Docker lets you run databases, web apps and tools in isolated containers, so installing something new never messes up the rest of your server. This guide installs Docker Engine and Docker Compose on Ubuntu and runs a first real service.

1. Install from Docker's repository

sudo apt update
sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Check the install with sudo docker run hello-world.

2. Run Docker without sudo

sudo usermod -aG docker $USER
newgrp docker

Members of the docker group have effectively root-level power on the machine, so only add users you trust.

3. Your first Compose file

Create a folder and a compose.yaml that runs the Uptime Kuma monitoring tool:

mkdir -p ~/kuma && cd ~/kuma
cat > compose.yaml <<'EOF'
services:
  kuma:
    image: louislam/uptime-kuma:1
    restart: unless-stopped
    ports:
      - "127.0.0.1:3001:3001"
    volumes:
      - ./data:/app/data
EOF
docker compose up -d

Binding to 127.0.0.1 keeps the port off the public internet. Put a reverse proxy such as Nginx or Caddy in front when you want to reach it from outside.

Everyday commands

• docker ps lists running containers.
• docker compose logs -f follows the logs.
• docker compose pull && docker compose up -d updates to newer images.
• docker system prune removes unused images and stopped containers.

A security warning about firewalls

Docker writes its own iptables rules. A port published as "8080:80" can be reachable from the internet even if UFW says it is blocked. Publish only what must be public, bind private services to 127.0.0.1 and test from outside with a port scanner.

What to run next

Popular self-hosted apps include Nextcloud, Vaultwarden, Gitea, Plausible, n8n and Jellyfin. See our guide to self-hosting Nextcloud for a full example.