Skip to main content
Welcome to Virtru's support portal. As we work to make this page more accessible to screen readers, please contact us at support@virtru.com for technical support.

Docker Engine: Production Installation Guide

  • Updated

Applies to: Linux hosts that run Virtru on-premise products (for example, the VPK for Google Workspace CSE, the VPK for Virtru Solutions, the Self-Hosted Gateway, and others).

Purpose

This guide explains how to install Docker Engine on a production host that runs Virtru on-premise components.

Docker provides a convenience script for quick installs:

curl -fsSL https://get.docker.com | sh

Use the script for development and staging. It is fast and needs little setup, so it suits test environments, proofs of concept, and short-lived servers.

Docker doesn't recommend the convenience script for production. It runs non-interactively, installs the latest version without a pin, and can't be reviewed or controlled through your configuration management or change process. A production host that holds key material needs a documented, repeatable install that fits your patching process.

  Convenience script This guide
Environment Development, staging, testing Production
Install method One command, non-interactive Step-by-step from Docker's official package repository
Version control Installs the latest version Lets you pin a version and choose when to upgrade
Patching Depends on the repository the script configures Updates through your normal OS patch process
Review and change control Hard to review before it runs Every step can be reviewed and automated

Run all commands as a user with sudo privileges.

Contents

Ubuntu

1. Remove conflicting packages. This does not delete existing images, containers, or volumes.

for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove -y $pkg; done

2. Add Docker's repository and install.

sudo apt-get update
sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

3. Check the repository entry. The output should show a real release name, such as jammy or noble, not a variable name.

cat /etc/apt/sources.list.d/docker.list

Debian

1. Remove conflicting packages. This does not delete existing images, containers, or volumes.

for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do sudo apt-get remove -y $pkg; done

2. Add Docker's repository and install. The steps match Ubuntu, with debian in place of ubuntu in both URLs.

sudo apt-get update
sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

3. Check the repository entry. The output should show a real release name, such as bookworm, not a variable name.

cat /etc/apt/sources.list.d/docker.list

RHEL 8 and 9

1. Remove conflicting packages.

sudo dnf remove -y docker docker-client docker-client-latest docker-common docker-latest docker-logrotate docker-engine podman runc

2. Add Docker's repository and install.

sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

CentOS Stream

sudo dnf remove -y docker docker-client docker-client-latest docker-common docker-latest docker-logrotate docker-engine podman runc
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Rocky Linux and AlmaLinux

Docker does not list these distributions as officially supported. The CentOS repository is the usual choice because both are binary-compatible with RHEL.

sudo dnf remove -y docker docker-client docker-client-latest docker-common docker-latest docker-logrotate docker-engine podman runc
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Fedora

Fedora 41 and later use dnf5, which has different syntax:

sudo dnf -y install dnf-plugins-core
sudo dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/fedora/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

On Fedora 40 and earlier, replace the second command with:

sudo dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo

After installation (all distributions)

Start Docker and enable it at boot.

sudo systemctl enable --now docker

Verify the installation.

docker --version
docker compose version
sudo docker run --rm hello-world

Confirm the package comes from Docker's repository. This is what allows the engine to be patched through your package manager.

apt-cache policy docker-ce          # Ubuntu and Debian
dnf info docker-ce | grep -i repo   # RHEL, CentOS, Rocky, Alma, Fedora

The output should show download.docker.com.

GPG key (RPM-based systems). On first install, dnf may ask you to accept Docker's GPG key. Check that the fingerprint matches the following before you accept it:

060A 61C5 1B55 8A7F 742B 77AA C52F EB6B 621E 9F35

Updating Docker Engine

Docker Engine updates arrive through your normal OS update process. To update it manually:

# Ubuntu and Debian
sudo apt-get update && sudo apt-get install --only-upgrade docker-ce docker-ce-cli containerd.io

# RHEL, CentOS, Rocky, Alma, Fedora
sudo dnf update docker-ce docker-ce-cli containerd.io

To apply updates on a schedule, include Docker's repository in your existing patching tools or maintenance windows.

These commands update Docker Engine only. They do not update application containers such as the Virtru Private Keystore. For container updates, follow the update instructions in the Virtru Private Keystore installation documentation.

Related articles