How to Install and Secure Docker + Docker Compose on Ubuntu 26.04

Docker is open-source software that can package, deploy, and distribute applications consistently across different environments, ensuring they run as intended. Using Docker makes the development process much easier and more efficient. Docker Compose is a tool that allows you to run multi-container application environments based on definitions compiled in YAML files. Using this tool, you can easily manage complex development and production environments. In this article, we will show you how to install and secure Docker and Docker Compose on Ubuntu 26.04.

Prerequisites

• A fresh Ubuntu 26.04 server
• SSH root access or a user with sudo privileges is required

Conventions

# – given commands should be executed with root privileges either directly as a root user or by use of the sudo command
$ – given commands should be executed as a regular user

Step 1. Install Dependencies

In this article, we will install Docker from Docker’s repository. First, install the required dependencies, then proceed with the Docker installation. Let’s get started now.

# apt install ca-certificates curl gnupg -y

Step 2. Install Docker on Ubuntu 26.04

There are several methods for installing Docker on a Ubuntu 26.04 system. In this step, we will install Docker Engine from Docker’s Apt repository. This is by far the best and most recommended way to install Docker, as it makes it easy to perform updates. Before installing Docker Engine for the first time on a new host machine, you need to configure the Docker Apt repository. Then you can install and update Docker from the repository. Before installing it, we need to add and configure the repository first.

# install -m 0755 -d /etc/apt/keyrings
# curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
# chmod a+r /etc/apt/keyrings/docker.asc

It’s time to add the repository to the apt sources:

# tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

After adding the package, refresh the package list to update the available options.

# apt update

To install Docker packages, run the installation command for the latest version.

# apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

After the packages are installed, we can check the version of Docker installed with the following command:

# docker --version

You will get the following output:

Docker version 29.4.3, build 055a478

or run the ‘docker compose version’ command to check the Docker Compose version.

# docker compose version

The command will print this output:

Docker Compose version v5.1.3

Step 3. Add a System User

We will use a specific system user to run Docker. To do this, create a new user named ‘master’ by following your operating system’s user creation process.

# useradd -G docker,sudo -s /bin/bash -m -d /opt/master master

Now, let’s give the user a password.

# passwd master

Step 4. Run Docker without Sudo

The Docker daemon binds to a Unix socket. When running the Docker command without sudo, you will get this error message:

Permission denied while trying to connect to the Docker API at unix:///var/run/docker. sock.sock

To run Docker commands without sudo, we need to add the user we want to the Docker group:

# usermod -aG docker $USER

For example, to add the ‘master’ user to the docker group, run: usermod -aG docker master

Repeat this usermod command to add any other system users to the docker group as needed.

Step 5. Secure Docker and Docker Compose

Follow these key practices to secure Docker and Docker Compose on Ubuntu 26.04.

Secure the Host Operating System

Containers share the host kernel. If the host is compromised, all containers are at risk. So we need to be extra careful with the host.

• Disable root SSH logins and use key-based authentication instead of passwords for improved access control.
• Regularly update the OS and Docker to fix vulnerabilities.
• Use a Container-Optimized OS: Use operating systems like Bottlerocket or Alpine. These have fewer features, which means less for hackers to attack.

Secure the Docker Daemon

The Docker daemon runs with root privileges, making it a key security target.

• Protect the Socket: Never expose /var/run/docker.sock to containers. Use a proxy if communication with the container-daemon is required.
• Enable User Namespace Mapping: This maps the root user in a container to a non-root user on the host.
• Configure Docker to run without root when possible.
• Enable TLS: For remote access, use HTTPS with certificates.

Harden Container Images

Build images with minimal attack surface and trusted sources.

• Use trusted base images from official sources.
• Start with minimal base images like Alpine.
• Scan images for vulnerabilities with tools like Trivy or Docker Scout.
• Avoid Sensitive Information: Never store secrets like API keys in Dockerfiles or images. Use Docker Secrets when running.

Implement Least Privilege at Runtime

Run containers with the necessary capabilities.

• Do Not Run as Root: Set a non-root user in the Dockerfile.
• Drop Capabilities: Remove kernel capabilities.
• Use new-privileges: Prevent processes from gaining new privileges.
• ReadOnly Filesystem: Mount the container’s root filesystem as read-only. This prevents file modifications.

Secure Networking

Isolate containers to limit the impact of a breach.

• Use User-Defined Networks: Create networks to isolate container traffic.
• Restrict Port Exposure: Only publish necessary ports.
• Avoid using –network host.

Set Resource Limits

Prevent Denial of Service attacks.

• Limit Resources: Use flags like –memory, –cpus, and –restart to cap memory, CPU, and process usage, per container. This prevents a single container from consuming all host resources.

You’re Done!

That’s it! You have learned how to install and secure Docker and Docker Compose on Ubuntu 26.04.

If you are one of our web hosting customers and use our managed Ubuntu Hosting, you don’t have to follow this tutorial and install and secure Docker and Docker Compose on Ubuntu 26.04 yourself; our Linux admins will do it all for you. They are available 24×7 and will take care of your request immediately, and all you need to do is submit a ticket. Installing Docker and Docker Compose is not just about the installation; we can help you optimize and secure your Docker installation if you have an active service with us.

If you liked this post, please share it with your friends or leave a comment below.