Docker Engine and Compose

Docker Engine (dockerd) manages images, containers, networks, and volumes. The docker CLI talks to it; containerd is the lower runtime; Buildx builds images; the Compose plugin defines applications in YAML. Installing these components does not deploy an application.

Inspect first and avoid mixing package sources:

command -v docker || true
docker --version || true
docker compose version || true
dpkg -l | grep -E 'docker|containerd' || true

Use Docker's official Ubuntu repository rather than preferring docker.io:

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

Create /etc/apt/sources.list.d/docker.sources with the actual Ubuntu codename, dpkg --print-architecture, and Signed-By: /etc/apt/keyrings/docker.asc. Run apt update and apt-cache policy for every Docker package. Stop if the official repository has no candidate for the detected release.

sudo apt-get -s install docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo apt install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
systemctl is-enabled docker
systemctl is-active docker

After reviewing the simulation for removals, add only a trusted administrator to the Docker group and reconnect:

sudo usermod -aG docker "$VPS_USER"
id
docker info
docker run --rm hello-world

Never use chmod 666 /var/run/docker.sock. Docker-group membership already grants root-level capability. --rm removes the test container, not its cached image.

Images are templates, containers are instances, and volumes or deliberate host paths hold persistent data. Do not edit /var/lib/docker manually. Review every future published port because Docker networking can bypass UFW.