Docker

Module

runtime.docker

Category

Runtimes

What it installs

• Docker Engine from Docker’s own repository, and the Compose and buildx plugins with it.
• The dev user in the docker group, so no docker command on this machine needs sudo.
• A daemon configuration that rotates container logs instead of letting them fill the disk.
• Published ports bound to 127.0.0.1 on the default bridge and on every network docker network create or Compose makes: -p 5432:5432 answers on the server and through the SSH session, not on the internet, over IPv4 or IPv6.

What it asks you for

• Whether to install Compose.
• Where images live. Empty means /var/lib/docker; give a path if another disk has the room.
• The size of one log file. Empty means 10m, kept three deep per container.

Good to know

The daemon listens on its socket and on nothing else. Docker’s rules come before the firewall’s, so a port published on every address would be open whatever ufw says: to put a container on the web, route a project’s subdomain to its port through Caddy or the tunnel. To publish one directly anyway, name the address — -p 0.0.0.0:8080:80, or 0.0.0.0:8080:80 under ports in a compose file — knowing ufw will not filter it. On a server that ran containers before this setting, dockerd keeps its default bridge while a container runs, each network keeps the options it was created with, and each container its ports: the install names the ones still open on every address, and closing them takes stopping the containers, sudo systemctl restart docker, then docker compose down && docker compose up -d in each project and docker network rm then create for a network made by hand. With nothing running, the install restarts the daemon itself. Uninstalling takes back the engine and leaves your images, volumes and containers where they are.

All services