Quick answer

What this guide helps you do

Install Docker Engine and the Compose plugin from Docker's official Ubuntu repository, verify the service and avoid common firewall and permissions mistakes.

Before you install

Use a supported 64-bit Ubuntu Server release and take a backup before changing a working host.

For new SmallGrid server work, Ubuntu 26.04 LTS is the current reference release. Ubuntu 24.04 LTS remains a valid supported target where Docker’s current compatibility list includes it and the procedure is unchanged.

As of 13 August 2026, Docker Engine 29.7.2 is the current documented 29.x patch. Docker 29.6.1 and 29.6.2 contained important security fixes, followed by another security fix and regression repairs in 29.7.x. Install the latest supported stable patch from Docker’s official repository rather than pinning an older example version.

cat /etc/os-release
uname -m
df -h /

If Docker already runs services, inventory containers, volumes and Compose projects before removing or replacing packages. Docker documents packages that can conflict with Docker CE, including distribution Docker packages, old Compose packages and separately installed containerd or runc.

Install from the official repository

Follow Docker’s current Install using the APT repository section to create the keyring and repository for your Ubuntu codename. Copy those setup commands from Docker rather than an old blog because repository syntax can change.

The package step installs the engine, CLI, container runtime, Buildx and Compose plugin:

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Verify the complete path

sudo systemctl status docker --no-pager
sudo docker version
sudo docker compose version
sudo docker run --rm hello-world

The test proves that the client reached the daemon, pulled an image and ran a container. It does not prove that application storage, DNS or published ports are correct.

Control administrative access

Using sudo docker is the explicit default. Membership of the docker group is effectively root-level access because a member can start privileged containers and mount host paths. Never make the Docker socket world-writable and never expose the unauthenticated daemon over TCP.

Review network exposure

Docker creates firewall rules for published ports. List listeners and container mappings:

sudo ss -lntup
sudo docker ps --format 'table {{.Names}}\t{{.Ports}}'
sudo iptables -S DOCKER-USER

Bind private services to a specific LAN address or 127.0.0.1 where appropriate. Apply deliberate filtering in the DOCKER-USER chain.

Reboot and troubleshoot

sudo systemctl is-enabled docker
sudo reboot

After reconnecting, check Docker and failed units. If the daemon failed, read its boot journal:

systemctl --failed
sudo systemctl is-active docker
sudo journalctl -u docker -b --no-pager -n 100

For socket permission errors, use sudo or deliberately configure the privileged docker group. For disk pressure, inspect with docker system df -v before deleting anything.

Verification checklist

  • Ubuntu release and architecture are supported.
  • Docker uses the intended official repository.
  • Engine and Compose versions are recorded.
  • The hello-world test succeeds.
  • Docker access is limited to administrators.
  • Published ports have been reviewed.
  • Docker starts after reboot.
  • Persistent data and backups are planned.

These instructions are guidance, not a claim that SmallGrid has tested every supported Ubuntu release.

Next: Docker Compose Explained for Beginners. For host maintenance, use How to Safely Update Docker Engine on Ubuntu. For Proxmox, see Build a Docker Server Inside Proxmox.

Official reference: Install Docker Engine on Ubuntu.