Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 4

Installing Docker and Managing Non-Root Access

Recommended resources

Welcome back! In our last session, we dissected the Docker architecture, revealing the chain of command from the docker client, through the dockerd daemon, and down to the containerd and runc runtimes. You now have a solid theoretical model of how Docker works under the hood.

Today, we transition from theory to practice. This lesson is all about getting a working Docker environment set up on a Linux system. Our goal is to install the Docker Engine and perform the essential post-installation step of configuring it to be manageable by a non-root user. This is a foundational skill that ensures both security and convenience in your day-to-day Docker workflow.

Choosing an Installation Method

When it comes to installing software on Linux, you know there are often several paths. Docker is no exception. You could use your distribution's default package manager (like sudo apt install docker.io), but this often provides an older, less feature-rich version maintained by the distribution, not by Docker, Inc.

For a serious learner aiming for a deep dive, the best practice is to use Docker's official packages. This ensures you have the latest stable version. While the official documentation provides manual, step-by-step instructions for adding Docker's package repository, there is also a widely-used convenience script that automates this process. This script is a great starting point as it handles the detection of your OS and sets everything up correctly.

The following video from Docker expert Bret Fisher demonstrates this recommended installation approach on a Linux server.

Docker Engine for Linux Servers Setup and Tips

This video, "Docker Engine for Linux Servers Setup and Tips," provides a practical walkthrough of the installation process. We will focus on the segment covering the use of the convenience script.

Watch the section that demonstrates the installation, starting from the explanation of the script. The command shown, which typically looks like curl -fsSL https://get.docker.com -o get-docker.sh followed by sudo sh get-docker.sh, does the following: Downloads the official installation script from get.docker.com. Executes the script with root privileges (sudo). The script then intelligently detects your Linux distribution (like Ubuntu), adds Docker's official GPG key for security, sets up the correct apt repository, and installs the latest Docker Engine (docker-ce), CLI (docker-ce-cli), and containerd. This is the most reliable way to get a fresh, official installation.

Go ahead and perform this installation on your Linux system now.

Verification and the sudo Requirement

Once the installation script finishes, your first step should be to verify that the Docker Engine is running and accessible. You can do this with the docker version command. However, you will immediately notice something: you need to use sudo.

sudo docker version

Running this command will output information about both the Client and the Server (which is the Engine). Seeing both sections confirms that the client CLI can successfully communicate with the Docker daemon. This client-server interaction should sound familiar from our previous lesson.

The requirement to use sudo for every command stems from Docker's security model. The Docker daemon (dockerd) binds to a Unix socket (/var/run/docker.sock) which is, by default, owned by the root user. Therefore, only root (or users with sudo privileges) can access it.

While secure, this is inconvenient for development. Our next step is to fix this.

Post-Installation: Managing Docker as a Non-Root User

To avoid typing sudo for every command, the standard procedure is to create a Unix group named docker and add your user to it. When the Docker daemon starts, it checks for the existence of this group and makes the Unix socket accessible to its members.

It is critical to understand the security implication here: adding a user to the docker group is equivalent to granting them root access to the host. This is because they can use Docker to run containers that can, for example, mount the host's entire filesystem. For a development machine this is a common and acceptable trade-off for convenience, but in a multi-user production environment, you would need to consider more advanced security measures.

The official Docker documentation provides the definitive guide for this process.

Linux post-installation steps for Docker Engine | Docker Docs

This document covers the essential steps to perform after installing Docker. We will focus on the section for configuring a non-root user.

Read the section titled Manage Docker as a non-root user. Follow the instructions precisely: Create the docker group with sudo groupadd docker. (The installation script may have already done this for you, in which case you'll see a message that the group already exists). Add your user to the group with sudo usermod -aG docker $USER. This is the most important and often missed step: You must log out and log back in for your new group membership to take effect. Alternatively, for the current shell session, you can use the command newgrp docker. The document also provides important troubleshooting steps if you run into permission errors with the ~/.docker directory.

After completing these steps, you should be able to run Docker commands without sudo. Test this by running docker version again, this time without sudo. You should see the same client and server output as before.

Final Confirmation: Running Your First Container

The ultimate confirmation that your installation and configuration are correct is to run a container. The hello-world image is a tiny test image designed for exactly this purpose.

Run the following command in your terminal:

docker run hello-world

If everything is set up correctly, you will see a message similar to the one in the image below.

This terminal output shows the successful execution of `docker run hello-world`. Notice how Docker first attempts to find the image locally, then pulls it from the library, and finally runs the container to print the "Hello from Docker!" message.

Let's briefly break down what just happened:

  1. The Docker client told the Docker daemon to run a container from the hello-world image.
  2. The daemon checked for this image on your local system. It didn't find one.
  3. The daemon then pulled the image from the default public registry, Docker Hub.
  4. Once the image was downloaded, the daemon used it to create and start a new container.
  5. The container ran its pre-defined command, which was to print the message you see, and then it exited.

Congratulations, you have successfully installed and configured Docker Engine!

Conclusion

In this hands-on lesson, you've bridged the gap between architectural theory and a practical working environment.

Here are the key takeaways:

  • The recommended method for installing Docker on Linux is to use the official docker-ce packages, which can be easily set up using the convenience script from get.docker.com.
  • By default, interacting with the Docker daemon requires root privileges (sudo) because the daemon's Unix socket is owned by the root user.
  • You can grant non-root access by adding your user to the docker Unix group, but you must be aware that this has significant security implications.
  • The final test of a successful installation is running docker run hello-world without sudo.

You are now fully set up to explore the core functionalities of Docker. In our next lesson, we will take a much closer look at that docker run command. We'll explore what images and containers truly are, how they relate to registries like Docker Hub, and begin our journey into managing the container lifecycle.