1. Official Docker Repository & APT Setup
Avoid installing the outdated distribution package docker.io. Configure the upstream official Docker CE repository:
# 1. Uninstall legacy Docker packages
for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do apt-get remove -y $pkg; done
# 2. Install TLS dependencies and Docker GPG key
apt-get update && apt-get install -y ca-certificates curl gnupg
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/$(. /etc/os-release && echo "$ID")/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg
# 3. Add official Docker apt repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$(. /etc/os-release && echo "$ID") $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
2. Installing Docker Engine & Compose v2
apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
# Grant current non-root user docker group membership
usermod -aG docker $USER
# Verify installation versions
docker --version && docker compose version
3. Production daemon.json Tuning (Log Limits)
Unconstrained container stdout logs will saturate your NVMe root volume. Restrict log rotation and enable daemon live-restore in /etc/docker/daemon.json:
{
"log-driver": "json-file",
"log-opts": {
"max-size": "50m",
"max-file": "3"
},
"live-restore": true,
"features": {
"buildkit": true
}
}
systemctl restart docker
4. Critical Security Fix: UFW Docker Port Bypass
🚨 Critical Security Alert:
By default, Docker injects iptables rules that completely bypass the UFW firewall. Published container ports (-p 8080:80) become globally exposed to the entire public internet, ignoring UFW rules.
✅ Solution A: Bind to Localhost (127.0.0.1)
Specify ports as 127.0.0.1:8080:80 so only a local proxy can forward connections.
✅ Solution B: Install Open-Source ufw-docker Firewall Patch
wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
chmod +x /usr/local/bin/ufw-docker
ufw-docker install
systemctl restart ufw
5. Production Docker Compose Boilerplate with SSL Proxy
Production-ready Docker Compose blueprint for reverse-proxying web microservices:
services:
app:
image: nginx:alpine
container_name: web_service
restart: unless-stopped
ports:
- "127.0.0.1:8080:80"
volumes:
- ./html:/usr/share/nginx/html:ro
networks:
- internal_net
networks:
internal_net:
driver: bridge
6. Deploying Portainer CE Management Dashboard
For visual container telemetry, live log inspection, and web shell access, deploy Portainer CE:
docker volume create portainer_data
docker run -d -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest
Open https://<YOUR_SERVER_IP>:9443 in your browser to initialize administrator credentials.
7. Container Maintenance & Automated Disk Pruning
Routine cleanup of orphaned build caches and stopped containers keeps storage lean:
# 1. Inspect storage usage breakdown
docker system df
# 2. Prune unused containers and networks
docker system prune -f
# 3. Aggressive purge including unreferenced volumes
docker system prune -a --volumes -f
8. Frequently Asked Questions (FAQ)
Q: Why does UFW fail to block ports published by Docker containers?
Docker modifies the Linux iptables NAT PREROUTING chain directly, which is evaluated before the UFW INPUT chain. Consequently, published ports (-p 8080:80) accept connections from the public internet, bypassing UFW completely unless bound to 127.0.0.1 or guarded by ufw-docker.
Q: How to recover disk space when /var/lib/docker/overlay2 consumes all storage?
Inspect storage distribution with "docker system df". Safely prune orphaned containers and unused images with "docker system prune -a --volumes". Most importantly, enforce log rotation in daemon.json to stop runaway stdout logs.
Q: What differs between local Docker Compose and running on a Netcup production VPS?
In production: 1. Pin explicit version tags instead of "latest"; 2. Enforce "restart: unless-stopped" for automatic recovery; 3. Never publish database ports to the host interface—interconnect services via private Docker bridge networks.
Q: Does Docker introduce a noticeable performance penalty on Netcup AMD EPYC servers?
Negligible (< 1% overhead). Docker utilizes native Linux kernel namespaces and cgroups for process isolation rather than hardware emulation, allowing containers to exploit raw AMD EPYC compute and PCIe 4.0 NVMe RAID-10 throughput.
Markus S.
Senior Cloud Infrastructure Architect & Linux Sysadmin
Markus focuses on European cloud hosting economics, server performance optimization, and KVM virtualization. All benchmarks, setup guides, and VAT exemption procedures are verified on self-funded Netcup instances hosted in the Nuremberg datacenter (AMD EPYC hardware).
📚 Recommended Reading: Essential Netcup Guides & Benchmarks
Hands-on tutorials to help you maximize savings, configure servers, and make informed choices
Netcup 0% VAT Exemption Guide: Automatic Tax Removal for Non-EU Users
Complete walkthrough on qualifying for automatic 0% German VAT, invoice updates, and billing formulas.
Netcup Registration & Order Guide: Identity Verification & Fraud Check Tips
From plan selection to CCP portal activation. Avoid order cancellations and delays.
Netcup vs Hetzner Cloud: Geekbench 6 Scores, Network Routing & Pricing Comparison
In-depth analysis of dedicated vCPU consistency, traffic quotas, and datacenter connectivity.
Netcup Custom ISO Tutorial: Install Windows & Linux via SCP Panel
Mount external ISOs with VirtIO drivers via Server Control Panel (SCP) and VNC access.
💰 Netcup Verified Coupons & Discounts
We maintain an updated collection of verified netcup discount codes, with real-time automatic synchronization. Get up to 30% off or free months on your next order.
Browse All Coupons →