Developers

What is Docker and how do you use it on a VPS?

3 November 2026 6 min read

Docker is a tool that runs an application, together with everything it needs, inside an isolated package called a container. On a VPS, using Docker means you start an app from a ready-made package instead of installing it piece by piece on the server. Setup and removal take a few commands, and apps don't disturb each other's settings.

Unlike a virtual machine, a container doesn't carry its own operating system. It shares the server's kernel, so it starts in seconds and uses little memory. The trade-off is that its isolation is not as strong as a virtual machine's.

Four terms are enough to start

Term	What it means
Image	The ready-made package of an application. It is downloaded from a registry such as Docker Hub.
Container	A running copy started from an image.
Volume	Persistent storage that keeps your data even when the container is deleted.
Compose	A tool that defines several containers in one `compose.yaml` file and manages them with a single command.

Deleting a container deletes the files inside it. Mount anything that must survive, such as a database, on a volume or on a folder of the server.

How do you install Docker on Ubuntu?

First connect to the server with SSH. The docker.io package from Ubuntu's repositories works, and Seturack's pre-installed Docker server uses it. For the latest version, use Docker's own apt repository. According to Docker's official documentation, Ubuntu packages such as docker.io and docker-compose conflict with Docker's own packages, so remove them first if they are installed.

Follow the "apt repository" section on Docker's Ubuntu install page to add the repository's signing key and source. Run the commands from there as they are, because they change between releases.
Install the packages: sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
Check that the service is running: sudo systemctl status docker
Run the test container: sudo docker run --rm hello-world

If you see the welcome message, Docker is ready. On Ubuntu and Debian the service starts on every boot by itself.

Your first container

Start a web server with a single command:

docker run -d --name web --restart unless-stopped -p 80:80 nginx:1.30

-d runs the container in the background. --restart unless-stopped starts it again when the server reboots or the container crashes. -p 80:80 connects port 80 of the server to the container. nginx:1.30 is the image name and version tag. The tag is only an example, so pick the current stable tag from the official Nginx page on Docker Hub. Open the server's IP address in a browser and you will see the Nginx welcome page. To remove it, run docker rm -f web.

Mount a volume for persistent data, for example -v sitedata:/usr/share/nginx/html. You list volumes with docker volume ls. Services in the same compose.yaml file reach each other by service name, so your application connects to the database as db, for example.

When you have several containers, put them all in a compose.yaml file and run docker compose up -d in the folder of the file. The image, restart, ports and volumes keys in the file match the flags above. You check the state with docker compose ps, read logs with docker compose logs -f and shut everything down with docker compose down.

Commands you will use every day

Command	What it does
`docker ps`	Lists running containers. Add `-a` to see stopped ones too.
`docker logs -f web`	Follows the log of the `web` container live.
`docker exec -it web sh`	Opens a shell inside the container.
`docker stats`	Shows CPU and memory use of the containers.
`docker compose pull` and `docker compose up -d`	Downloads the new image and replaces the container with the new one. Data in volumes is kept.

Before you update, read the app's release notes and raise the version tag in the compose file yourself. The point of pinning the tag is that an update becomes a decision, not an accident.

Four things to watch out for

Docker bypasses ufw rules. According to the official documentation, ports that Docker publishes are opened before ufw's rules apply. A ufw rule that denies such a port has no effect. Bind a service that must not be reachable from outside to the local address only, for example -p 127.0.0.1:5432:5432. Containers on the same Docker network can already reach each other, so you don't need to publish a database.
The latest tag. If you give no tag, latest is pulled. On the next pull your app can jump to a version you didn't expect. Write a specific tag and schedule updates yourself.
The docker group means root. Adding a user to the docker group gives that user root-level privileges (official documentation). Add only accounts you trust.
Logs and images fill the disk. Docker's default log setting has no size limit. Set one on the container: --log-opt max-size=10m --log-opt max-file=3. docker system df shows disk usage, and docker image prune removes untagged images.

Docker or a direct install?

Docker helps when you run several apps that need different versions on one server, when you want to try an app and remove it cleanly, or when the developer publishes an official image. For a simple case such as a single WordPress site, a direct install is fine too. Docker is an extra layer: updating it, monitoring it and backing up the volumes are your job. If you are unsure, start with one small application. You don't have to move everything to Docker at once.

Docker comes ready on Seturack

If you don't want to install Docker yourself, you can order a server with the Docker app. Docker and Compose come installed, and the setup takes about 2.5 minutes. The firewall (ufw) is on and only the SSH port is open to the outside, fail2ban protects SSH, and container logs are limited to 3 files of 10 MB each per container. The app has no web interface, so the panel shows no site address. The port trap above applies here too. To start with a ready server, see the Docker VPS page.