iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
Use Docker’s official APT repository on a supported Ubuntu or Debian VPS, install the Engine and Compose plugin, verify it with hello-world, then publish only the ports you actually intend to expose. The important VPS-specific detail is that Docker’s port-forwarding rules can bypass a normal UFW rule, so host-only bindings or rules in Docker’s DOCKER-USER chain are part of a safe installation.
What you will build
This tutorial sets up Docker Engine on a rented Linux VPS and runs a disposable web container. It covers package selection, repository installation, non-root operation, boot startup, port publishing, UFW interaction, and cleanup. Commands assume an account with SSH access and sudo privileges.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Ubuntu: Docker’s current installation page lists Resolute 26.04 LTS, Noble 24.04 LTS, and Jammy 22.04 LTS.
- Debian: the listed releases are Trixie 13 (stable) and Bookworm 12 (oldstable).
- Architecture: the APT repository command uses your VPS architecture automatically; most VPS instances are amd64 or arm64.
- Network: you need outbound HTTPS access so APT can reach the repository and Docker can download images.
- Privileges: use an administrative account for installation. You can continue with
sudo docker ..., or configure trusted users for non-root use later.
Release names and package availability change. If your distribution is not one of the releases above, stop and check Docker’s current Engine installation page instead of forcing a repository codename.
Choose the package source before installing
| Method | What you get | When to use it | Main trade-off |
|---|---|---|---|
| Docker’s official APT repository | docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin, and docker-compose-plugin |
Recommended for a current Engine and the official Compose v2 plugin | You maintain an additional repository and should review upgrades |
Distribution package such as docker.io |
The version and plugin set maintained by Ubuntu or Debian | Only when your organization requires distribution-maintained packages | May be older or package Docker components differently |
Do not install both sets casually. Remove conflicting distribution packages first, then install the complete set from one source.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Remove conflicting Docker packages
On a fresh VPS this command may report that some packages are not installed; that is harmless. It removes common distribution packages and older names that can conflict with the official packages.
sudo apt remove -y docker.io docker-compose docker-doc docker-compose-v2 docker-buildx podman-dockerRemoving packages does not automatically remove images, containers, volumes, or configuration under /var/lib/docker. If this is an existing host, list what you need before deleting data. A destructive reset would remove Docker’s data directory and is outside a normal upgrade.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Install Docker Engine on Ubuntu
1. Confirm the release and refresh APT
. /etc/os-release && printf '%s %sn' "$ID" "$VERSION_ID"
sudo apt update
sudo apt install -y ca-certificates curlThe output should identify a supported Ubuntu release. A derivative distribution may report an Ubuntu base but use a different codename; verify compatibility before adding the repository.
2. Add Docker’s signing key and repository
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt updateThe key is stored in a root-owned keyring, and the repository line selects the codename reported by Ubuntu. If apt update returns a missing Release file, do not substitute a nearby codename blindly; remove the list file and use a supported release.
3. Install the Engine and plugins
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-pluginThis installs the daemon, command-line client, container runtime, Buildx builder, and the Compose v2 CLI plugin as a matched set.
Install Docker Engine on Debian
1. Confirm Debian and install prerequisites
. /etc/os-release && printf '%s %sn' "$ID" "$VERSION_ID"
sudo apt update
sudo apt install -y ca-certificates curlThe supported releases listed for this procedure are Debian 13 “Trixie” and Debian 12 “Bookworm.”
Recommended Free Tools
2. Add the Debian repository
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt updateKeep the codename produced by /etc/os-release. If your image uses a derivative or an unlisted release, use Docker’s current compatibility guidance rather than guessing.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
3. Install the packages
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-pluginStart Docker and verify the installation
Most packages start the service immediately. Check it explicitly and enable it for boot:
sudo systemctl enable --now docker
sudo systemctl status docker --no-pagerA status of active (running) means the daemon is accepting requests. If the service fails, inspect the recent journal before retrying:
sudo journalctl -u docker --no-pager -n 100Run Docker’s small verification image:
sudo docker run hello-worldThe command downloads the image if necessary, prints a success message, and exits. Confirm that the command exits with status zero. A registry timeout points to outbound DNS, HTTPS, or provider egress filtering; a daemon connection error points to the service state.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUse Docker without typing sudo
By default, the Unix socket is owned by root. Add a user to Docker’s group only when that account is trusted:
sudo groupadd docker
sudo usermod -aG docker $USER
newgrp dockergroupadd can report that the group already exists; continue with usermod. Logging out and back in through SSH is the most reliable way to load the new group membership. Then test:
docker run hello-worldIf you still receive a permission error, run id to check that docker appears in the groups, reconnect to SSH, and retry. Do not make the Docker socket world-writable.
Membership is effectively root-level access: a process that can control the Docker daemon can mount host directories, start privileged containers, and otherwise take over the VPS. On a shared server, keep the group limited to administrators and use sudo docker for everyone else.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Run a real container
Download an image
docker pull nginx:alpineTags are mutable labels. For production, pin a reviewed image tag or digest and establish an update procedure rather than relying on an unqualified latest tag.
Start a web server
docker run -d --name web-demo -p 127.0.0.1:8080:80 nginx:alpineThe flags run the container detached, assign it a predictable name, and map host port 8080 to container port 80. Binding to 127.0.0.1 makes the service reachable only from the VPS itself. Check it locally:
curl http://127.0.0.1:8080
docker ps
docker logs web-demoPublish a service publicly only when required
docker rm -f web-demo
docker run -d --name web-demo -p 80:80 nginx:alpineWith no host address in the mapping, Docker listens on the host’s addresses (effectively 0.0.0.0 for IPv4). Remote clients can then reach the container through the VPS address, subject to provider networking and any firewall policy. Do not publish databases, admin panels, or internal APIs this way unless you have deliberately secured and filtered them.
| Mapping | Reachability | Typical use |
|---|---|---|
127.0.0.1:8080:80 |
VPS itself only | Backend behind a host reverse proxy or SSH tunnel |
0.0.0.0:8080:80 or 8080:80 |
All IPv4 host interfaces | A service intentionally exposed to the network |
No -p option |
Container network only | Workers and services consumed by other containers |
Why published ports can bypass UFW
UFW primarily writes filtering rules for the host’s normal INPUT path. Docker creates NAT and forwarding rules for published ports, so traffic destined for a container can be forwarded without traversing the UFW rule you expected to protect the host. This is why a port can remain reachable after sudo ufw deny 8080.
Docker’s own guidance places administrator filtering in the DOCKER-USER chain. Rules appended later to the ordinary FORWARD chain may run after Docker has already accepted the packet.
Option 1: bind to localhost
For services that should never accept direct Internet traffic, use a host-only mapping such as 127.0.0.1:8080:80. This is the simplest control because packets from remote interfaces never match the published socket.
Option 2: filter in DOCKER-USER
Inspect the container’s address and published port:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' web-demo
docker port web-demoFiltering in DOCKER-USER occurs after Docker’s destination NAT. Rules therefore match the container’s internal address and port, not the original host-side port. For example, after confirming that the container address is 172.18.0.2 and its service listens on port 80, a deny rule could be:
sudo iptables -I DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
sudo iptables -I DOCKER-USER -i eth0 -p tcp -d 172.18.0.2 --dport 80 -j DROPReplace eth0 and the example container address with values from your host. Test from an external machine and from the VPS itself. Persist firewall rules using the mechanism supported by your distribution; rules entered interactively can disappear after a reboot or firewall reload.
If you need to match the original client address rather than the post-NAT destination, Docker documents using the conntrack extension. Conntrack inspection adds work to packet processing, so apply it selectively and measure on busy systems.
Option 3: use a UFW integration helper
A community helper such as ufw-docker can add Docker-aware rules to /etc/ufw/after.rules and provide per-container controls. Treat this as community guidance rather than Docker behavior: review the generated rules, back up the file, test on a non-production VPS, and retest after Docker or UFW upgrades.
Build and run a small application with Compose
The Compose plugin is installed as docker-compose-plugin and is invoked with a space: docker compose, not the legacy hyphenated docker-compose command.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutemkdir -p ~/vps-demo
cd ~/vps-demo
cat > compose.yaml <<'YAML'
services:
web:
image: nginx:alpine
ports:
- "127.0.0.1:8080:80"
restart: unless-stopped
YAML
docker compose up -d
docker compose ps
docker compose logs --tail=50 webThe restart policy brings the service back after a daemon restart, but it does not replace backups, health checks, or application-level recovery. Stop and remove the example stack with:
docker compose downdown removes the containers and network created by the project. It does not remove the image; named volumes also remain unless you explicitly add the volume-removal option.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Day-to-day container administration
| Task | Command | What to check |
|---|---|---|
| List running containers | docker ps |
Name, status, and published ports |
| List all containers | docker ps -a |
Exited containers and their exit state |
| Read logs | docker logs --tail=100 --follow NAME |
Startup errors and repeated crash loops |
| Restart a service | docker restart NAME |
Whether the process returns to a healthy state |
| Open a shell | docker exec -it NAME sh |
Use only for diagnosis; make persistent changes in the image or configuration |
| Inspect configuration | docker inspect NAME |
Mounts, networks, environment, and restart policy |
| Remove a stopped container | docker rm NAME |
Confirm that no required data is stored only in the container layer |
Container filesystems are disposable. Store persistent application data in named volumes or bind mounts, restrict mount paths, and back up the resulting host directories or volume data.
Troubleshoot common VPS failures
APT reports an unsupported distribution
Check /etc/os-release, remove the repository list you added, and use a supported Ubuntu or Debian image. Do not point a Trixie host at Bookworm or an Ubuntu host at a Debian repository.
The daemon will not start
Run sudo systemctl status docker and sudo journalctl -u docker -n 100. Common causes include a malformed daemon configuration, a full filesystem, or another process already using a required socket. Correct the reported cause, then run sudo systemctl restart docker.
hello-world works only with sudo
The current shell has not received its new supplementary group. Reconnect through SSH or run newgrp docker; verify with id. If the account is intentionally not trusted with root-equivalent Docker access, continue using sudo docker.
The container is running but the site is unreachable
- Run
docker psand confirm the port mapping is present. - Test locally with
curl 127.0.0.1:PORT. - Check that the application listens on the container port you mapped, not only on an unrelated port.
- For remote access, verify the mapping is not bound to
127.0.0.1, then inspect the provider firewall, UFW behavior, andDOCKER-USERrules.
The image download fails
Check DNS resolution, outbound TCP 443, the VPS provider’s egress policy, and available disk space. Docker stores image layers under its data directory; a full root filesystem can prevent both pulls and container startup.
Security checklist for a Linux VPS
- Use the official repository and keep the Engine, containerd, and Compose plugin updated through APT.
- Grant Docker-group membership only to trusted administrators because it is root-equivalent.
- Publish the smallest possible set of ports; bind internal services to
127.0.0.1or leave them on a private Docker network. - Assume UFW alone does not constrain published container ports. Enforce policy with host-only bindings,
DOCKER-USER, or a reviewed integration helper. - Pin production images to reviewed tags or digests and scan your images in the workflow you already use.
- Never place secrets in a public image layer or commit them to a Compose file. Use protected environment injection or a dedicated secret store.
- Limit bind mounts, especially mounts of
/,/var/run/docker.sock, or sensitive host directories. - Back up volumes and configuration separately from the VPS disk, and test restoration.
- Monitor disk, memory, CPU, and container restart loops; a container restarting successfully is not proof that the application is healthy.
Remove the tutorial resources
For the standalone container, stop and remove it, then optionally delete the image:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →docker rm -f web-demo
docker image rm nginx:alpineFor the Compose example, run docker compose down from ~/vps-demo. Removing Docker itself is a separate administrative change and can affect every application on the VPS; plan it only after exporting required data and disabling dependent services.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
