gtzhost logo

NORTH AMERICA

EUROPE

ASIA

How to Install & Secure Docker on Ubuntu 26.04

Docker is one of the most popular tools for running applications inside containers. If you have a fresh Ubuntu 26.04 LTS ("Resolute Raccoon") server or desktop, this guide will show you, step by step, how to install Docker the right way and how to lock it down so it does not become a security risk.

By the end of this tutorial, you will have:

  • Docker Engine, Docker CLI, containerd, and the Docker Compose plugin installed from Docker's official repository

  • A working test container running on your system

  • A non-root user who can safely run Docker commands

  • A set of practical security settings that protect your server

Let's get started.

What You Need Before You Begin

  • A server or PC running Ubuntu 26.04 LTS

  • A user account with sudo access

  • A stable internet connection

  • Basic comfort using the terminal

You do not need any prior Docker experience. Each command below is explained in plain language.

Step 1: Update Your System

Before installing anything new, refresh your package list and update existing packages. This avoids conflicts later.

bash 
sudo apt update
sudo apt upgrade -y

Step 2: Remove Old or Conflicting Docker Packages

Ubuntu ships with its own container-related packages that are usually outdated. Remove them first so they don't clash with the official Docker packages.

bash 
sudo apt remove -y docker docker-engine docker.io containerd runc

If any of these packages were never installed, Ubuntu will simply say so and move on — that's normal.

Step 3: Install Required Dependencies

Docker's repository is accessed over HTTPS, so you need a few supporting tools first.

bash 
sudo apt update
sudo apt install -y ca-certificates curl gnupg

Step 4: Add Docker's Official GPG Key

This key lets your system verify that the Docker packages you download are genuine and not tampered with.

bash 
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

Step 5: Add the Docker Repository

Now tell APT (Ubuntu's package manager) where to find Docker's packages.

bash 
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update

Step 6: Install Docker Engine

You're ready to install Docker itself, along with the CLI, containerd (the container runtime), Buildx (for building images), and the Compose plugin (for running multi-container apps).

bash 
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Step 7: Start and Enable Docker

Make sure Docker is running now and starts automatically every time your server boots.

bash 
sudo systemctl start docker
sudo systemctl enable docker

Check that it's active:

bash 
sudo systemctl status docker

You should see a green "active (running)" line. Press q to exit this view.

Step 8: Test Your Installation

Run Docker's official test container to confirm everything works.

bash 
sudo docker run hello-world

If you see a message starting with "Hello from Docker!", your installation is successful. You can also check the installed version at any time:

bash 
docker version

Step 9: Run Docker Without Typing sudo Every Time

By default, only root and users in the docker group can run Docker commands. Add your own user to this group so you don't need sudo for every command.

bash 
sudo usermod -aG docker $USER

Log out and log back in (or run newgrp docker) for this change to take effect. Then test it:

bash 
docker run hello-world

A security note: membership in the docker group is effectively equivalent to root access on the whole machine, because Docker containers can mount the host filesystem. Only add trusted users to this group, and never add it to shared or public accounts.

Securing Your Docker Installation

Getting Docker installed is only half the job. The steps below will help you run it safely, especially on a server that's exposed to the internet.

1. Keep Docker Updated

Security patches for Docker come out regularly. Update it the same way you update the rest of your system.

bash 
sudo apt update
sudo apt upgrade -y

2. Never Expose the Docker Socket Publicly

The Docker socket (/var/run/docker.sock) gives full control over your host. Do not bind it to a network port or share it with containers unless you fully understand the risk. Avoid commands or configurations that mount this socket into untrusted containers.

3. Avoid Running Containers as Root

Many container images run as root by default. Where possible, run containers with a specific user ID instead:

bash 
docker run --user 1000:1000 your-image

Or better, build your own images with a non-root USER instruction in the Dockerfile.

4. Limit Container Resources

Prevent a single container from using up all your server's memory or CPU:

bash 
docker run --memory="512m" --cpus="1.0" your-image

5. Use Trusted Images Only

Pull images only from official sources or verified publishers on Docker Hub. Before running an unfamiliar image, check its source, star count, and last update date.

6. Enable a Firewall

Docker can quietly open ports and bypass some default firewall rules. If you use UFW, review your rules after installing Docker, and be explicit about which ports should be reachable from outside.

bash 
sudo ufw status verbose

7. Scan Images for Vulnerabilities

Use a scanning tool such as docker scout (built into recent Docker CLI versions) to check images for known vulnerabilities before deploying them.

bash 
docker scout quickview your-image

8. Keep Containers Isolated

Avoid using --privileged mode unless it's absolutely necessary. Privileged containers can access host devices directly and remove most of the isolation Docker normally provides.

9. Set Up Logging and Monitoring

Keep an eye on container activity so you notice unusual behavior early.

bash 
docker logs <container_name>

For production systems, consider forwarding logs to a centralized logging tool.

10. Remove Unused Containers and Images

Old containers and images can pile up and increase your attack surface. Clean them up periodically:

bash 
docker system prune -a

Run this with care — it removes anything not currently in use.

Uninstalling Docker (If You Ever Need To)

If you ever need to remove Docker completely:

bash 
sudo apt purge -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo rm -rf /var/lib/docker
sudo rm -rf /var/lib/containerd

Note that this deletes all containers, images, and volumes on your system, so make backups first if you need them.

Frequently Asked Questions

Does Ubuntu 26.04 come with Docker pre-installed?+

No. You need to install it manually, which is exactly what this guide covers.

Can I install Docker Desktop instead of Docker Engine on a server?+

Docker Desktop is meant for desktop use with a graphical interface. For servers, Docker Engine (covered in this guide) is the correct choice.

Is it safe to add my user to the docker group?+

It's convenient, but keep in mind it grants root-level power over the host. Only do this on machines and accounts you fully trust.

How do I check which Docker Compose version I have?+

Run docker compose version in your terminal.

Final Thoughts

You now have a fully working, properly secured Docker setup on Ubuntu 26.04 LTS. Installing Docker only takes a few minutes, but the security habits above — avoiding root containers, limiting resources, using trusted images, and keeping everything updated — are what actually keep your server safe over the long run.

If you run into issues during installation, double check that you're using a genuine Ubuntu 26.04 system and that each command above completed without errors before moving to the next step.