Install Docker on Debian

Docker isolates applications in containers and makes a reproducible stack easier to deploy. On a NeoHeberg VPS, the system is itself a container: Docker can work, but some storage or permission features must be tested. This procedure installs Docker from the official repository, checks it and states the limits to know.

Add the official repository

sudo apt update
sudo apt install -y ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list >/dev/null
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

The official repository provides current versions; the Debian docker.io package is older. Download the key into a dedicated keyring and avoid apt-key, which is obsolete. The signed-by field limits the key to this repository.

Verify the daemon

sudo systemctl enable --now docker
sudo docker run --rm hello-world
sudo docker version
sudo docker compose version

hello-world checks the daemon, storage and networking. If the download fails, check DNS resolution and outbound access before touching the firewall. docker compose version confirms the plugin is installed; the separate docker-compose command is no longer needed.

Use a non-root account

sudo usermod -aG docker user

Log in again for the group to take effect, or run newgrp docker in the current session. The docker group is equivalent to root: a member can mount / inside a container and read system secrets. Only add the deployment accounts you need, never a shared account.

Network and socket security

Ports published by Docker bypass UFW: Docker inserts its own nftables rules before the firewall. Two options: publish on 127.0.0.1:PORT and let Nginx expose the service, or manage Docker rules explicitly. Never mount /var/run/docker.sock into an untrusted container: that amounts to giving root on the machine running Docker. Pin images by version instead of using latest.

Container limits and troubleshooting

A NeoHeberg VPS is an isolated system container. Docker starts, but the overlay2 driver or volume permissions may fail depending on the configuration. docker info shows the active storage driver. On error, test fuse-overlayfs, which is slower, before concluding. No kernel module can be loaded from the VPS. Validate your workload before production and keep a backup of volumes.

Common failures are best read in this order:

• Cannot connect to the Docker daemon: service stopped or missing group rights.
• Permission denied on a volume: UID/GID differ from the container user.
• Full disk: docker system df, then remove unused images or volumes.
• Daemon log: journalctl -u docker -n 100 --no-pager.