Install Docker on Ubuntu. Then stop it opening holes in your firewall.

1. 01

   Remove conflicting packages

   sudo apt remove $(dpkg --get-selections docker.io docker-compose docker-compose-v2 docker-doc docker-buildx podman-docker containerd runc | cut -f1)

   On a fresh server this removes nothing. That’s fine.

2. 02

   Add Docker’s repository

   sudo apt update
   sudo apt install ca-certificates curl
   sudo install -m 0755 -d /etc/apt/keyrings
   sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
   sudo chmod a+r /etc/apt/keyrings/docker.asc
   sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
   Types: deb
   URIs: https://download.docker.com/linux/ubuntu
   Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
   Components: stable
   Architectures: $(dpkg --print-architecture)
   Signed-By: /etc/apt/keyrings/docker.asc
   EOF
   sudo apt update

3. 03

   Install

   sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

4. 04

   Check it works

   sudo docker run hello-world
   docker compose version

   On Ubuntu, Docker starts on boot by default.

The convenience script is meant for testing and development, not a server you rely on. And if a guide leads with apt-key add, skip it: that’s deprecated, and the keyring file above replaces it.

Why: ufw filters traffic in the INPUT chain. Docker redirects traffic for a published port earlier, in the nat table, and sends it on to the container. Those packets are routed before the firewall rules can be applied.

And by default, a published port listens on every address, 0.0.0.0 and [::]. Publishing is open to the world unless you say otherwise.

A public 80 or 443 is usually fine: that’s your reverse proxy or website. A public database or admin panel is the one to fix today.

Moving to a fresh server anyway? Deploy a Lite 6, set the daemon.json from the next chapter before your first container, and nothing is ever public by accident.

1. Publish to localhost, put a reverse proxy in front

# docker run
docker run -d -p 127.0.0.1:8080:80 nginx

# compose.yaml
services:
  app:
    ports:
      - "127.0.0.1:8080:80"

Only the server itself can reach port 8080. A reverse proxy (Caddy, nginx, Traefik) on 80 and 443 is then the only thing facing the internet, and it adds HTTPS.

2. Make localhost the default for the whole server

Put this in /etc/docker/daemon.json, then sudo systemctl restart docker:

{
  "ip": "127.0.0.1",
  "default-network-opts": {
    "bridge": { "com.docker.network.bridge.host_binding_ipv4": "127.0.0.1" }
  },
  "log-driver": "local"
}

"ip" covers the default network; the host_binding_ipv4 option covers user-defined networks, which is what Compose creates. In our test a Compose service with plain "8080:80" then listened on 127.0.0.1 only. Ports you really want public, like your proxy’s 443, now need 0.0.0.0:443:443 written out.

3. Allow-list in the DOCKER-USER chain

sudo iptables -I DOCKER-USER -i eth0 ! -s 203.0.113.10 -j DROP

Docker processes DOCKER-USER before its own rules, so this drops traffic to published ports from everyone except 203.0.113.10. Swap in your interface (ip route shows it) and your IP.

Here’s the thing: the docker group grants root-level privileges. Anyone in it can start a container that mounts / and change any file on the server.

The local logging driver rotates and compresses logs by itself, keeping 100 MB per container. It’s the "log-driver": "local" line in the daemon.json above. Restart Docker, then recreate containers: the setting only applies to containers created after the change.

sudo systemctl restart docker
docker compose up -d --force-recreate

• Docker Engine comes from apt. Ubuntu’s automatic updates skip Docker’s repo unless you add it; our unattended upgrades tutorial shows the line, and why restarting Docker automatically needs care.
• Your images never update through apt. Pull and recreate:

docker compose pull
docker compose up -d
docker image prune

The last line removes old images that nothing uses. It asks before deleting.