Skip to content

Instantly share code, notes, and snippets.

@cybergitt

cybergitt/install-docker-on-ubuntu-in-2026.md

Last active January 21, 2026 03:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save cybergitt/6c42f66a80679592b78f085975542df4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save cybergitt/6c42f66a80679592b78f085975542df4 to your computer and use it in GitHub Desktop.
Download ZIP
How to Install Docker on Ubuntu in 2026
Raw
install-docker-on-ubuntu-in-2026.md

Rootless Docker

This guide teaches how to use Rootlesskit and Docker to install a Rootless Docker and run Docker containers in Rootless mode. The setup works for Linux (Ubuntu, Debian, etc.), and Raspberry PI Docker allows you to create Rootless containers. This means, Docker Engine will create and run these containers in Rootless mode. They will run as unprivileged to the user namespaces creating them.

Supported Ubuntu Versions

Docker is available for installation from the standard Ubuntu repositories, but those packages are often outdated. To ensure you get the latest stable version, we’ll install Docker from the official Docker repository.

At the time of writing, the Docker repository provides packages for the following Ubuntu versions:

  • Ubuntu 25.10 (Questing)
  • Ubuntu 25.04 (Plucky)
  • Ubuntu 24.04 LTS (Noble Numbat)
  • Ubuntu 22.04 LTS (Jammy Jellyfish)

Install Rootless Docker Kit and Run Rootless Container Mode

You will learn different ways to get Rootless container ready:

  • Using Docker Engine
  • Using Rootlesskit

Docker and Rootlesskit allow you to create these rootless containers. Rootlesskit must be installed if you want Docker to inherit Rootless mode. Actually, Docker Daemon will need root-level access on the host system. Rootlesskit will then run containers as normal users. In this guide, you will learn:

  • How to use rootlesskit to install rootless Docker Daemon.
  • When you need to use Docker Rootless Mode.
  • The advantages and limitations of Docker Rootless containers.
  • How to use the installed rootlesskit and run Docker containers on - Rootless Mode.
  • How to Expose Privileged Ports with Rootless Docker (ports below 1024).
  • Use Cases for Running Rootless Docker Containers.
  • How to Uninstall rootlesskit and remove Docker Rootless Mode.

Prerequisites

Before you begin, make sure that:

  • You are running a 64-bit supported Ubuntu version
  • You have a user account with sudo privileges
  • Your system is connected to the internet and up to date

Uninstall any old or conflicting Docker packages first to avoid any potential issues:

sudo apt remove docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc

Installing Docker on Ubuntu

Installing Docker on Ubuntu is relatively straightforward. We’ll enable the Docker repository, import the repository GPG key, and install the Docker packages.

Step 1: Update the Package Index and Install Dependencies

First, update the package index and install packages required to use repositories over HTTPS :

sudo apt update
sudo apt install ca-certificates curl gnupg lsb-release

Step 2: Import Docker’s Official GPG Key

Add Docker’s official GPG key so your system can verify package authenticity:

sudo mkdir -p /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

Step 3: Add the Docker APT Repository

Add the Docker repository to your system:

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list

$(lsb_release -cs) command prints your Ubuntu codename. For example, if you have Ubuntu version 24.04 the command will print noble.

Step 4: Install Docker Engine

Now that the Docker repository is enabled, update the package index and install Docker:

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Installing a Specific Docker Version (Optional)

If you want to install a specific Docker version instead of the latest one, first list the available versions:

sudo apt update
apt list -a docker-ce

The available Docker versions are printed in the second column:

docker-ce/noble 5:29.1.4-1~ubuntu.24.04~noble amd64
docker-ce/noble 5:29.1.3-1~ubuntu.24.04~noble amd64
docker-ce/noble 5:29.1.2-1~ubuntu.24.04~noble amd64

Install a specific version by adding =<VERSION> after the package name.

For example to install version “5:29.1.4-1ubuntu.24.04noble” you would type:

DOCKER_VERSION=5:29.1.4-1~ubuntu.24.04~noble
sudo apt-get install docker-ce=$DOCKER_VERSION docker-ce-cli=$DOCKER_VERSION containerd.io docker-buildx-plugin docker-compose-plugin

Verify the Docker Installation

Once the installation completes, the Docker service starts automatically.

Check the service status:

sudo systemctl status docker

Check the Docker you have installed (Together with Docker compose):

sudo docker --version
docker compose version

You must have Docker ready before proceeding to the next step. If you had challenges setting up Docker. Check Install Docker Engine on Ubuntu.

Installing Rootless Docker using Docker (With Rootlesskit)

docker.io is the Official Docker Engine maintainer. Let’s see the steps you need to Get

docker.io to run Docker as Rootless.

Prerequisites

Before adding Docker as Rootless, if the system-wide Docker daemon is already running, consider disabling it:

sudo systemctl disable --now docker.service docker.socket
sudo rm /var/run/docker.sock

Should you choose not to shut down the docker service and socket, you will need to use the --force parameter in the next section. There are no known issues, but until you shutdown and disable you're still running rootful Docker.

Install dbus-user-session package if not installed

sudo apt install -y dbus-user-session

and relogin

Ensure you have uidmap dependency ready to manage user namespace. Install uidmap package if not installed

sudo apt install -y uidmap

If running in a terminal where the user was not directly logged into, you will need to install systemd-container sudo apt install -y systemd-container , then switch to TheUser with the command sudo machinectl shell TheUser@.

If you install docker-ce-rootless-extras using the deb package (apt-get install docker-ce-rootless-extras), then the AppArmor profile for rootlesskit is already bundled with the apparmor deb package. With this installation method, you don't need to add any manual the AppArmor configuration. If you install the rootless extras using the installation script, however, you must add an AppArmor profile for rootlesskit manually:

  1. Create and install the currently logged-in user's AppArmor profile: 
    filename=$(echo $HOME/bin/rootlesskit | sed -e s@^/@@ -e s@/@.@g) cat <<EOF > ~/${filename}
abi <abi/4.0>,
include <tunables/global>
"$HOME/bin/rootlesskit" flags=(unconfined) {
    userns,
    include if exists <local/${filename}>
}
EOF
sudo mv ~/${filename} /etc/apparmor.d/${filename}
  2. Restart AppArmor. 
    systemctl restart apparmor.service

Go ahead and use Docker Community (docker-ce) to get Docker Rootless ready

  • If you installed Docker 20.10 or later with RPM/DEB packages, you should have dockerd-rootless-setuptool.sh in /usr/bin. Run dockerd-rootless-setuptool.sh install as a non-root user to set up the daemon:
dockerd-rootless-setuptool.sh install
  • If you do not have permission to run package managers like apt-get and dnf, consider using the installation script available at https://get.docker.com/rootless. Since static packages are not available for s390x, hence it is not supported for s390x.
curl -fsSL https://get.docker.com/rootless | sh

Docker should be ready in Rootless mode

  • Check the following paths and copy them (These paths are visible and the end of the above curl Output)

Example paths are as follows:

export PATH=/home/ubuntu/bin:$PATH
export DOCKER_HOST=unix:///run/user/1000/docker.sock

Make sure you only copy your paths as the $user with the Linux user on your machine.

A Rootless Docker container will use these paths as a pair of environment variables to run your Rootless Docker Mode. Go ahead and open the .bashrc file with your editor and add your Rootless paths:

nano ~/.bashrc
vi ~/.bashrc

If you’re using ZSH, use the .zshrc file. Now, Add your paths and save your file.

How to Run A Docker Container Rootless Mode

You Rootless Docker set up ready. Make sure the Docker Daemon is really Rootless:

systemctl --user start docker

Run the following command to let your system always start your rootless Docker Engine at startup:

systemctl --user enable docker

To launch the daemon on system startup, enable the systemd service and lingering:

sudo loginctl enable-linger $(whoami)

Then check Rootless Docker status:

systemctl --user status docker

Now it’s time to run your first Rootless Mode container. I will use a simple example to make this guide short.

Consider creating an Apache web server. With Docker, you will deploy a Docker Container. With Docker as Rootless Mode, you will create containers as you would in the privileged Docker setup.

Go ahead and Use docker run as such:

docker run --name apache-container -p 8080:80 -d httpd:latest

Your Rootless Docker will create your container without touching root privileges. Check if the container is running:

docker ps
  • Inspect container details by the container name or ID:
docker inspect apache-container

Now, you can access the running Docker container or Rootless mode using port 8080 (http://server_ip:8080/):

How to Manage Docker Container Running on Rootless Mode

If you have worked with Docker before, any Docker command should work on this container. The only difference here is root privileges.

This means any Docker command will work while you manage your Rootless container, for example:

  • Stopping and removing a container:
# To stop the container
docker stop apache-container
# To remove the container  
docker rm apache-container
  • List all available Docker containers:
docker ps -a
  • Inspect container details by the container name or ID:
docker inspect apache-container

Configuring Rootless Docker container

Sometimes you need to spice up your Rootless containers. For example, a Rootless Docker Engine can't create and Expose Privileged Ports (any port below 1024). This means, Docker will always Expose ports above 1024.

Let's check some management commands:

  • Run a rootless Docker inside the root Docker. Consider you have a regular Docker running on your system. You will need:
  1. Runs a Docker container with the name dind-rootless using the docker:-dind-rootless image.
  2. Use the --privileged flag to give extended privileges to the container. This way, the container will run in Rootless mode and perform tasks that would otherwise be restricted.
docker run -d --name dind-rootless --privileged docker:20.10-dind-rootless
  • If you want to send Ping Packet Routing to a Rootless Docker container, you will need:
  1. Add configuration to allow ping packet routing within the Docker containers:
  2. In this case, you will Open the /etc/sysctl.conf file:
nano /etc/sysctl.conf
  1. Add the following line:
net.ipv4.ping_group_range = 0 2147483647
  1. Apply the changed file to allow ping packet routing:
sudo sysctl --system
  • Exposing Privileged Ports with Rootless Docker. You can bind to privileged ports (ports below 1024) even when running as a non-root user. However, you need to:
  1. Set the CAP_NET_BIND_SERVICE capability on the Rootlesskit binary:
sudo setcap cap_net_bind_service=ep $(which rootlesskit)
  1. Restart the Docker service to apply the changes:
systemctl --user restart docker

How to Uninstall Rootlesskit and remove Docker Rootless Mode

If you do want to Uninstall the Rootlesskit for this Rootless Mode, check the following steps:

  • Stop the running Docker instance:
systemctl --user stop docker
  • Remove the installed Rootlesskit kit file:
rm -f /home/ubuntu/bin/dockerd
  • Check the Docker status, and it should be dead:
systemctl --user status docker
  • Check and Identify all installed Docker packages
dpkg -l | grep -i docker
  • Next, remove all the above Docker-related packages and Purge them:
# Remove Docker-related packages
sudo apt purge -y docker-engine docker docker.io docker-ce docker-ce-cli containerd.io docker.io docker-compose-plugin docker-ce-rootless-extras docker-buildx-plugin
# Purge Docker-related packages and dependencies
sudo apt autoremove -y --purge docker-engine docker docker.io docker-ce docker-ce-cli containerd.io docker.io docker-compose-plugin docker-ce-rootless-extras docker-buildx-plugin
  • Now, delete all images, containers, and volume files available in your Docker setup:
# Remove Docker data directory
sudo rm -rf /var/lib/docker
# Docker configuration directory
sudo rm -rf /etc/docker
# Docker socket file
sudo rm -rf /var/run/docker.sock
# Docker usr local
sudo rm -rf /usr/local/lib/docker
# Images, containers, volumes, or custom configuration files on your host aren't automatically removed. To delete all images, containers, and volumes
sudo rm -rf /var/lib/docker
sudo rm -rf /var/lib/containerd
# Remove source list and keyrings
sudo rm /etc/apt/sources.list.d/docker.list
sudo rm /etc/apt/keyrings/docker.asc
  • Finally, confirm Docker Rootless and Docker Engine are completely removed:
sudo apt remove docker docker-engine docker.io docker-ce containerd runc
  • Open .bashrc and remove your added files:
nano ~/.bashrc
export PATH=/home/ubuntu/bin:$PATH
export DOCKER_HOST=unix:///run/user/1000/docker.sock

Use Cases for Running Rootless Docker Containers

Where is this Rootless setup helpful? Well

  • Rootless Docker creates a Shared Development Environments. This way, users create containers on shared servers with no impact on shared users.
  • You don’t need to host multiple users on the same server. Rootless Docker containers don’t need user privileges. This means you won’t run separate server instances for each user. That is a cost-saving approach.
  • Rootless Docker Containers
  • If your Host plan needs, root access, rootless Docker doesn’t need root access and you will overcome this hosting limitation.

The Limitations of Using Rootless Docker Container Mode

  • Rootlesskit doesn’t support features like AppArmor, SCTP ports, and overlay network, just to name a few.
  • You can’t use Cgroup. It’s only available if Docker is running with systemd that need root access.
  • without Cgroup and systemd you won’t be able to use options such as –pids-limit, –memory, and –cpus.
  • Storage Drivers like fuse-overlayfs, overlay2, and vfs get limited.
  • You can run a Rootless container on privileged ports (ports below 1024).

Conclusion

This guide taught you how to perfectly use Docker and Rootlesskit to Install Rootless Docker and run a container on Rootless mode. You have learned:

  • How to use rootlesskit to install rootless Docker Daemon.
  • When you need to use Docker Rootless Mode.
  • The advantages and limitations of Docker Rootless containers.
  • How to use the installed rootlesskit and run Docker containers on Rootless Mode.
  • How to Expose Privileged Ports with Rootless Docker (ports below 1024).
  • Use Cases for Running Rootless Docker Containers.
  • How to Uninstall rootlesskit and remove Docker Rootless Mode.

For advanced configuration, check the official post-install guide

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment