Install Docker on Ubuntu and Essential Docker Commands

A reliable Docker installation starts with Docker's own apt repository, not the distribution package. This guide installs Docker Engine on Ubuntu as the official documentation recommends, then covers the CLI commands that run and manage containers, images, networks and volumes.

By the end, you can set up Docker on a fresh VM and handle everyday container operations from the terminal.

Prerequisites

• An Ubuntu machine or VM with a user that has sudo access
• Outbound internet access to download.docker.com and Docker Hub

Install Docker Engine on Ubuntu

These steps follow the official guide, Install Docker Engine on Ubuntu.

Remove old or conflicting packages

Ubuntu's own docker.io package and similar packages can conflict with Docker's packages. Remove any that are installed:

$ sudo apt remove $(dpkg --get-selections docker.io docker-compose docker-compose-v2 docker-doc docker-buildx podman-docker containerd runc | cut -f1)

Add Docker's apt repository

Download Docker's GPG key into its own keyring file, then add a repository entry that trusts only that key (Signed-By). The old apt-key add method is deprecated because it trusted the key for every repository on the system.

$ sudo apt update
$ sudo apt install ca-certificates curl
$ sudo install -m 0755 -d /etc/apt/keyrings
$ sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
$ sudo chmod a+r /etc/apt/keyrings/docker.asc
$ sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
$ sudo apt update

Install the packages and test

$ sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
$ sudo docker run hello-world

This installs the engine, the CLI, containerd, BuildKit (buildx) and Docker Compose v2 (docker compose). If hello-world prints its welcome message, the engine is working.

Quick alternative: the convenience script

For disposable lab VMs, I sometimes use Docker's script from get.docker.com. It detects the distribution and sets up the same repository. Docker does not recommend it for production.

$ curl -fsSL https://get.docker.com -o get-docker.sh
$ sudo sh ./get-docker.sh

Run Docker without sudo

Add your user to the docker group, then start a new shell session (or log out and back in):

$ sudo usermod -aG docker $USER
$ newgrp docker
$ docker run hello-world

Uninstall Docker

$ sudo apt purge docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-ce-rootless-extras
$ sudo rm -rf /var/lib/docker
$ sudo rm -rf /var/lib/containerd
$ sudo rm /etc/apt/sources.list.d/docker.sources
$ sudo rm /etc/apt/keyrings/docker.asc

Removing /var/lib/docker deletes all images, containers and volumes, so back up anything you need first.

CLI structure

Docker groups commands by object: docker container ..., docker image ..., docker network ..., docker volume .... The older short forms still work, for example docker ps is the same as docker container ls. Run any group without a subcommand to see what it offers:

In the examples below, CIN means a container ID or name.

Running containers

$ docker container run -d --name web -p 8085:80 --restart unless-stopped nginx:1.27
$ docker container ls
$ curl http://localhost:8085

This starts nginx in the background, names it web, maps host port 8085 to container port 80, and tells Docker to restart it unless it is stopped manually.

Two rules about ports and restart policies caused the most problems in my lab:

• Two containers cannot use the same host port. 8080:8080 for one container and 8081:8080 for another is fine.
• always restarts the container even after you stop it, once the daemon restarts. unless-stopped respects a manual stop.

Managing containers

Reading docker container inspect

inspect prints the full JSON description of a container. These fields are the most useful during troubleshooting:

Working with images

To publish an image to Docker Hub, log in, tag it with your account namespace, and push it:

$ docker login
$ docker image tag jenkins_data:latest deependrabhatta/jenkins_data:v1
$ docker image push deependrabhatta/jenkins_data:v1
$ docker image pull deependrabhatta/jenkins_data:v1

To move images between machines without a registry, use save and load:

$ docker image save -o nginx.tar nginx:1.27
$ docker image load -i nginx.tar

save/load keep the image with all its layers, tags and history. container export with image import is different: it creates a new single-layer image from a container's filesystem and loses the history and settings such as CMD.

Networks

Create a custom bridge network with its own address range:

$ docker network create \
    --driver bridge \
    --subnet 192.168.10.0/24 \
    --gateway 192.168.10.1 \
    --ip-range 192.168.10.0/28 \
    --label env=lab \
    my_custom_network

--ip-range limits the addresses Docker hands out automatically, and it must sit inside --subnet. Run two containers on it, one with a fixed IP:

$ docker container run -d --name app1 --network my_custom_network nginx:1.27
$ docker container run -d --name app2 --network my_custom_network --ip 192.168.10.50 nginx:1.27
$ docker container exec app1 getent hosts app2

On a user-defined network, containers reach each other by name, as the getent command confirms. A fixed --ip only works on a user-defined network that has a subnet set.

Volumes and bind mounts

Both -v and --mount attach storage. --mount is more verbose but more explicit, and it returns an error if a bind-mount source does not exist.

$ docker container run -d --name db1 -v myvol:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=changeme mysql:8.0
$ docker container run -d --name db2 --mount type=volume,source=myvol2,target=/var/lib/mysql -e MYSQL_ROOT_PASSWORD=changeme mysql:8.0

$ docker container run -d --name site1 -v /home/vagrant/site:/usr/share/nginx/html nginx:1.27
$ docker container run -d --name site2 --mount type=bind,source=/home/vagrant/site,target=/usr/share/nginx/html nginx:1.27

Cleanup and system commands

Docker Compose commands are in part 4 and Swarm commands in part 5.

Common mistakes

• permission denied ... docker.sock: your user is not in the docker group yet, or you have not started a new session after adding it.
• port is already allocated: another container or host process already uses that host port. Pick another host port.
• Lost data after docker rm: the data lived in the container's own filesystem. Use a volume for anything that must survive.
• Running prune too broadly: docker system prune -a --volumes also deletes volumes that no container is using at that moment.

Key takeaways

• Install Docker from Docker's apt repository with a dedicated keyring and Signed-By, not with apt-key.
• The docker group is root-equivalent; treat it like sudo.
• docker container, image, network and volume cover most daily work, and --help works at every level.
• Use save/load to copy images intact; export/import flattens them into a single layer.
• Use user-defined networks so containers find each other by name, and volumes for data that must persist.

Next in this series: Dockerfile Instructions, Best Practices and Harbor Registry.