Secure Docker on Ubuntu Server

The whole setup in short

1. Verified installation - Docker from the official source, packages verified with a signing key
2. Admin-only access - only sudo controls Docker, the docker group stays empty
3. Secure defaults - logs cannot fill the disk, container ports open for the server itself only
4. A firewall for containers too - a port opened by mistake stays closed to the outside
5. Containers with minimal rights - no admin rights, no way to change their own files, limited CPU and memory

What do you need to solve?

Container vs. virtual machine

A container therefore does not separate an application from the server as firmly as a virtual machine. Its isolation is good, but only when it is set up correctly. That is what the rest of this guide is about.

Terms you will need

When Docker makes sense on a server

1. Docker runs with administrator (root) rights. Whoever can give it commands can take over the whole server: it is enough to start a container that sees all of the server's files.
2. Access to Docker = administrator rights. The docker group therefore gives full rights without a password. The docker.sock socket must never go into containers or onto the network.
3. Docker bypasses the firewall. It forwards a connection to a published port into the container before UFW checks it. By default it also opens the port on every server address, the internet included.
4. Containers share the server's kernel. The default restrictions are sensible, but options such as privileged or network_mode: host remove them.

• Ubuntu Server 22.04, 24.04 or 26.04 LTS (64-bit).
• A user <ADMIN_USER> with sudo rights who logs in with an SSH key.
• The UFW firewall enabled (Ubuntu UFW guide). Ideally SSH reachable only over a VPN such as Tailscale or from your local network.
• Automatic security updates (unattended-upgrades). Containers share the server's kernel, so keeping it up to date is essential.

Standard or rootless mode?

The installation (chapter 04) is the same for both modes. Chapters 05-08 describe standard mode, rootless follows in chapter 09.

Values you replace with your own

# anyone in the docker group gets a root shell on the host with this one line:
docker run --rm -it -v /:/host alpine chroot /host

This skips the password, 2FA and the log entry that sudo requires. A stolen SSH key is all an attacker needs. Run Docker with sudo docker. If you want Docker without sudo, use rootless mode.

The docker group must stay empty

getent group docker      # → docker:x:<GID>:   (nobody after the last colon)

# if someone is there, remove them:
sudo gpasswd -d <USER> docker

docker.sock does not belong in a container

Some tools (Portainer, Traefik, Watchtower, various dashboards) want docker.sock mounted into their container. Whoever takes over such a container takes over the whole server. If you really need the tool, put a go-between (a socket proxy) in front of the socket that allows reading only.

sudo tee /etc/docker/daemon.json >/dev/null <<'EOF'
{
  "log-driver": "local",
  "log-opts": {
    "max-size": "10m",
    "max-file": "5"
  },
  "live-restore": true,
  "no-new-privileges": true,
  "icc": false,
  "ip": "127.0.0.1",
  "default-network-opts": {
    "bridge": {
      "com.docker.network.bridge.host_binding_ipv4": "127.0.0.1"
    }
  },
  "default-address-pools": [
    { "base": "172.30.0.0/16", "size": 24 }
  ]
}
EOF
sudo chmod 0644 /etc/docker/daemon.json

sudo dockerd --validate --config-file=/etc/docker/daemon.json     # → configuration OK
sudo systemctl restart docker

sudo docker info --format '{{.LoggingDriver}} live-restore={{.LiveRestoreEnabled}}'
sudo docker info | grep -A5 'Security Options'     # apparmor, seccomp (builtin), cgroupns

# daemon defaults apply only to newly created containers and networks
cd /opt/stacks/<PROJECT>
sudo docker compose down && sudo docker compose up -d     # volumes are kept

The advanced option "userns-remap": "default" makes the administrator inside a container an ordinary user on the server. It complicates file permissions and rules out some options, though. Rootless mode gives the same protection more simply.

Where to publish ports

You reach a service on 127.0.0.1 remotely through an SSH tunnel. No port is opened, and it also works with a VPN such as Tailscale that allows SSH only:

# on your PC: forward local port 8080 to 127.0.0.1:8080 on the server
ssh -N -L 8080:127.0.0.1:8080 -p <SSH_PORT> <ADMIN_USER>@<SERVER>
# then open http://127.0.0.1:8080 in the browser on your PC

Do not use network_mode: host (every container port then becomes a server port) or "iptables": false (it breaks container networking and exposes containers to the local network).

A firewall for containers: the DOCKER-USER chain

Rules in the DOCKER-USER chain apply to connections into containers, and Docker never overwrites them. The rules below drop every connection from outside into a container except the ports you explicitly allow. Containers can still connect out (updates, APIs). We store them in /etc/ufw/after.rules, so UFW loads them at every boot.

ip -4 route show default          # → default via … dev <EXT_IF> …
sudo cp -a /etc/ufw/after.rules /etc/ufw/after.rules.bak

# safety net: in 10 minutes restore the original file and empty DOCKER-USER
sudo systemd-run --unit=rollback-docker-user --on-active=10min \
  /bin/sh -c 'cp -a /etc/ufw/after.rules.bak /etc/ufw/after.rules; iptables -F DOCKER-USER; ufw reload'

# BEGIN DOCKER-USER
*filter
:DOCKER-USER - [0:0]
# replies to existing connections (including those a container opened to the outside)
-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
# explicitly allowed public ports (original destination port, before DNAT)
-A DOCKER-USER -i <EXT_IF> -p tcp -m conntrack --ctorigdstport 80 --ctdir ORIGINAL -j RETURN
-A DOCKER-USER -i <EXT_IF> -p tcp -m conntrack --ctorigdstport 443 --ctdir ORIGINAL -j RETURN
# optional: your whole LAN may reach published ports
# -A DOCKER-USER -i <EXT_IF> -s <LAN_SUBNET> -j RETURN
# drop everything else coming from the external interface into containers
-A DOCKER-USER -i <EXT_IF> -j DROP
COMMIT
# END DOCKER-USER

sudo ufw reload
sudo ufw status verbose            # must say "Status: active", no errors
sudo iptables -S DOCKER-USER
sudo iptables -S FORWARD | head -5 # the first rules jump to DOCKER-USER

sudo systemctl stop rollback-docker-user.timer
systemctl list-timers rollback-docker-user.timer   # → 0 timers listed

sudo install -d -m 0750 -o root -g root /opt/stacks/<PROJECT>
cd /opt/stacks/<PROJECT>

Example: a hardened container

A web server (nginx) with restrictions that suit most containers. The comments explain each line:

services:
  web:
    # fixed version + digest: the image never changes without you knowing
    image: nginxinc/nginx-unprivileged:1.29-alpine@sha256:<DIGEST>
    user: "101:101"               # do not run as root inside the container
    read_only: true               # root filesystem is read-only
    tmpfs:
      - /tmp                      # writable only where the app needs it
    cap_drop:
      - ALL                       # no Linux capabilities
    security_opt:
      - no-new-privileges:true    # also in daemon.json; keep it visible here
    ports:
      - "127.0.0.1:8080:8080"     # server only / SSH tunnel
    mem_limit: 256m
    cpus: 0.50
    pids_limit: 200
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8080/"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - frontend

networks:
  frontend: {}

The first command gives you the digest for the image: line. The second block checks the settings and starts the container:

# the "Digest:" line is the value for @sha256:…
sudo docker buildx imagetools inspect nginxinc/nginx-unprivileged:1.29-alpine

sudo docker compose config      # prints the resolved file and reports errors
sudo docker compose up -d
sudo docker compose ps
sudo docker compose logs --tail=50

Rules for every container

Passwords

Compose hands a password to the container as the file /run/secrets/<name>. Most official images can read it through a variable ending in _FILE:

# password file readable by root only, never typed into the shell history
sudo install -d -m 0700 /opt/stacks/<PROJECT>/secrets
openssl rand -base64 32 | sudo tee /opt/stacks/<PROJECT>/secrets/db_password >/dev/null
sudo chmod 0600 /opt/stacks/<PROJECT>/secrets/db_password

services:
  db:
    image: postgres:18-alpine@sha256:<DIGEST>
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password
    volumes:
      - db-data:/var/lib/postgresql
    networks:
      - backend

networks:
  backend:
    internal: true      # no internet access, no published ports

volumes:
  db-data: {}

secrets:
  db_password:
    file: ./secrets/db_password

The password file must be readable by the user the application in the container runs as. If it cannot read it, change the file's owner to that user; do not make it readable for everyone.

sudo apt install uidmap dbus-user-session docker-ce-rootless-extras systemd-container

# stop the system-wide (rootful) daemon - rootless does not need it
sudo systemctl disable --now docker.service docker.socket
sudo rm -f /var/run/docker.sock

# a dedicated user for containers: no password, no sudo
sudo adduser --disabled-password --gecos "" <DOCKER_USER>
grep '^<DOCKER_USER>:' /etc/subuid /etc/subgid     # at least 65536 IDs each

# start the user's daemon at boot, even when nobody is logged in
sudo loginctl enable-linger <DOCKER_USER>

# a full systemd session for the user (sudo -iu / su - do not create one)
sudo machinectl shell <DOCKER_USER>@

# --- now as <DOCKER_USER> ---
dockerd-rootless-setuptool.sh install
systemctl --user enable docker
docker context use rootless
docker info | grep -Ei 'context|rootless|cgroup'

sudo install -d -m 0755 /etc/systemd/system/user@.service.d
sudo tee /etc/systemd/system/user@.service.d/delegate.conf >/dev/null <<'EOF'
[Service]
Delegate=cpu cpuset io memory pids
EOF
sudo systemctl daemon-reload
# takes effect once the user's systemd instance restarts (simplest: reboot)

Ports and firewall

In rootless mode the UFW firewall applies to containers too, and the DOCKER-USER chain is not needed. Allow a port that should be reachable from outside in UFW (sudo ufw allow 443/tcp). An ordinary user may not open ports below 1024 (e.g. 80 and 443); allow it for the rootlesskit program only:

# allow ports below 1024 only for rootlesskit, not for every user
sudo setcap cap_net_bind_service=ep "$(command -v rootlesskit)"

# as <DOCKER_USER>:
systemctl --user restart docker

Repeat the command after every update of docker-ce-rootless-extras; the update removes the permission.

Other limitations

• By default a container does not see the visitor's real IP (a problem e.g. for website logs). The documentation describes the fix.
• The privileged option does not give full rights, and ping in a container may not work.
• Data lives in the user's ~/.local/share/docker, not in /var/lib/docker. Keep that in mind for backups.

Docker - option A: automatically

Adds Docker to the automatic updates. Thanks to live-restore, containers survive the update without a restart.

sudo tee /etc/apt/apt.conf.d/52unattended-upgrades-docker >/dev/null <<'EOF'
Unattended-Upgrade::Origins-Pattern {
        "site=download.docker.com";
};
EOF

# dry run: Docker packages must show up as allowed
sudo unattended-upgrade --dry-run --debug 2>&1 | grep -iE 'docker|containerd'

Docker - option B: manually

For a server where you schedule restarts yourself. Follow the release notes and security advisories. Update regularly (e.g. monthly) and right after a security fix.

sudo apt update
apt list --upgradable 2>/dev/null | grep -E 'docker|containerd'
sudo apt install --only-upgrade docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Application images

1. Follow new versions of the application and the vendor's security advisories.
2. Change the version and digest in compose.yaml.
3. Pull the new image, deploy it, check the status and delete old images:

cd /opt/stacks/<PROJECT>
# after changing tag + digest in compose.yaml:
sudo docker compose pull
sudo docker compose up -d
sudo docker compose ps
sudo docker image prune

Tools that update containers automatically need access to docker.sock and deploy anything new without a check. They do not belong on a server. A scanner (Trivy, Docker Scout) finds known vulnerabilities in images.

# 1) nobody in the docker group, no API on the network
getent group docker
sudo ss -tlnp | grep -E ':2375|:2376'          # → nothing

# 2) daemon security options
sudo docker info | grep -A5 'Security Options'
sudo docker info --format '{{.LoggingDriver}} live-restore={{.LiveRestoreEnabled}}'

# 3) where ports are published (0.0.0.0 / [::] only for ports meant to be public)
sudo docker ps --format 'table {{.Names}}\t{{.Ports}}'
sudo ss -tlnp | grep -E 'docker-proxy|rootlesskit'

# 4) firewall safety net
sudo iptables -S DOCKER-USER

# 5) settings of every running container
sudo docker inspect --format '{{.Name}} user={{.Config.User}} ro={{.HostConfig.ReadonlyRootfs}} priv={{.HostConfig.Privileged}} caps={{.HostConfig.CapDrop}} sec={{.HostConfig.SecurityOpt}}' $(sudo docker ps -q)

Test from outside

From a computer outside your network (another server, a phone on mobile data), find out which ports are open. Only the ones you allowed may be open, typically 80 and 443 for a website:

# from a machine OUTSIDE your network
nmap -Pn -p 80,443,2375,2376,5432,6379,8080,<SSH_PORT> <PUBLIC_IP>

Test the container firewall with a container that opens a port to the internet on purpose. From outside, the port must be filtered (blocked):

# on the server: publish a test port on all addresses on purpose
sudo docker run --rm -d --name test-leak -p 0.0.0.0:8081:8080 nginxinc/nginx-unprivileged:alpine

# from outside: port 8081 must be "filtered", not "open"
nmap -Pn -p 8081 <PUBLIC_IP>

# on the server: clean up
sudo docker stop test-leak

The CIS Docker Benchmark offers a detailed checklist. A small server does not need to meet every item.

sudo apt purge docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-ce-rootless-extras
sudo rm -rf /var/lib/docker /var/lib/containerd
sudo rm -f /etc/apt/sources.list.d/docker.sources /etc/apt/keyrings/docker.asc
sudo rm -f /etc/apt/apt.conf.d/52unattended-upgrades-docker
sudo rm -rf /etc/docker
sudo apt update

Delete the BEGIN DOCKER-USER … END DOCKER-USER block from /etc/ufw/after.rules and run sudo ufw reload. Uninstall rootless mode before apt purge:

# as <DOCKER_USER>, before apt purge:
dockerd-rootless-setuptool.sh uninstall
rootlesskit rm -rf ~/.local/share/docker

# as <ADMIN_USER>:
sudo loginctl disable-linger <DOCKER_USER>

This guide is based on Docker's official documentation (verified on 27 October 2026):

• Install Docker Engine on UbuntuSupported versions, repository, install script and firewall.
• Linux post-installation stepsThe docker group and its rights, log rotation.
• Docker Engine securityDaemon risks, capabilities, user namespaces.
• Protect the Docker daemon socketRemote access only over SSH or TLS.
• Packet filtering and firewallsDocker and UFW.
• Docker with iptablesThe DOCKER-USER chain.
• Port publishing and mappingPublishing ports and the default address.
• dockerd referenceEvery daemon.json setting.
• Rootless modeInstalling rootless mode.
• Rootless - tips and troubleshootingAppArmor, low ports, limits, uninstall.
• Compose file referenceEvery compose.yaml option.
• OWASP Docker Security Cheat SheetAn overview of security recommendations.

Related

• Ubuntu Server guidesSSH keys, 2FA, Fail2Ban, updates, VPN, time sync.
• SSH keysLogging in with a key instead of a password.
• Unattended upgradesAutomatic security updates.
• Tailscale on Ubuntu Server (Czech)SSH only over a private network.

How to cite this publication (APA 7)Nepor, V. (2026, October 28). Docker on Ubuntu Server: Secure Installation and Configuration. Vrealmatic. https://vrealmatic.com/ubuntu/docker

Share