Docker CE on Windows

Prerequisites

Before you launch the Docker CE on Windows AMI, make sure you have the following in place.

AWS account: You need an active AWS account with permissions to launch EC2 instances, manage security groups and access the AWS Marketplace.

EC2 key pair: Create a key pair, or identify an existing one, in the region where you plan to launch the instance. You need this key pair to decrypt the Windows Administrator password after launch.

Security group: Prepare a security group that allows inbound RDP access. Additional ports may be required, depending on the containers you run.

Protocol Type Port Description

RDP TCP 3389 Remote Desktop Access

If your containers expose services (for example, a web server on port 80 or 443), add the corresponding inbound rules to the security group. Restrict the source IP range for RDP access to your known IP addresses or corporate CIDR blocks.

Remote Desktop client: Install a Remote Desktop Protocol client on your local machine. Options include Microsoft Remote Desktop (available for Windows and macOS), Remmina (Linux) or any other RDP-compatible client.

Minimum Instance Requirements

Minimum CPU Minimum RAM Required Disk Space

1 vCPU 1 GB 30 GB

The minimum requirements above are enough for the instance to run, but use a t3.medium or larger instance type for Docker containers. Container workloads need CPU and memory beyond what the base operating system uses. For production container workloads, consider a t3.large or larger.

Step-by-step setup

Follow these steps to launch and connect to your Docker CE on Windows instance.

Step 1: Launch the instance

• Log in to your AWS account and go to the AWS Marketplace.
• Search for the SecureAnyCloud Docker CE on Windows AMI.
• Select your desired instance type (t3.medium or larger is recommended).
• Choose your preferred region and VPC configuration.
• Select the EC2 key pair you created in the prerequisites.
• Assign the security group with RDP access on port 3389 and any additional ports for your container services.
• Configure storage. Use 30 GB as the minimum for the root volume, and consider 50 GB or more for storing container images.
• Launch the instance.

Step 2: Wait for status checks

After you launch the instance, open the EC2 console and wait until the instance shows 2/2 status checks passing. This confirms that the instance has fully booted and that Windows has completed its initial setup. This typically takes between 3 and 10 minutes.

Step 3: Retrieve the Administrator password

• Open the EC2 console in the AWS region where you launched the instance.
• Select Instances from the left navigation panel.
• Locate and select your newly launched instance.
• Click Actions at the top of the page.
• Choose Security, then select Get Windows password.
• Click Browse and upload the private key file (.pem) from the key pair you selected during launch.
• Click Decrypt password.
• Copy the decrypted password and store it securely. This is your Administrator password.

Step 4: Connect through Remote Desktop

• Open your Remote Desktop client application.
• Create a new connection using the public IP address of your EC2 instance (or the private IP if connecting through a VPN or from within the same VPC).
• Enter these credentials when prompted: Username: Administrator, and Password: the decrypted value from Step 3.
• If a certificate warning appears, click Continue. This warning is expected for new connections.
• The Windows Server desktop opens.

Step 5: Verify that Docker is running

Open Command Prompt from the Start menu and run the following command to verify that Docker is installed and running:

docker --help

The command lists the available Docker commands, which confirms that the installation works. You can also check the Docker version:

docker version

Server components

The following software components are preinstalled on this AMI.

Component Version

Docker Community Edition Latest

The AMI is built on Windows Server and includes Docker CE preconfigured as a Windows service. The Docker Engine runs natively and supports Windows containers out of the box.

Filesystem layout

The instance uses a single volume configuration.

Drive Purpose Minimum Size

C:\ Operating system and application 30 GB

Key directory locations on the instance:

Path Description

C:\Program Files\Docker\ Docker installation directory

C:\ProgramData\Docker\ Docker daemon configuration and data

C:\ProgramData\Docker\config\daemon.json Docker daemon configuration file

C:\ProgramData\Docker\windowsfilter\ Container filesystem layers and images

C:\Users\Administrator\ User home directory for Dockerfiles

Container images and layers are stored under C:\ProgramData\Docker\ and can use a significant amount of disk space. If you plan to work with many container images, attach an additional EBS volume and configure Docker to use it as the data root directory.

Managing services

The Docker Engine is configured to start automatically when the instance boots. You can manage the Docker service in the Windows Services panel or from the command line.

Use the Windows Services panel

• Open the Start menu and search for Services.
• Click Services to open the Services management console.
• Locate Docker Engine in the services list.
• Double-click Docker Engine to view its properties.
• In the properties dialog, you can start, stop, pause or restart the service.
• The Startup type is set to Automatic by default, so Docker starts when the instance boots.

Use the command line

You can also manage the Docker service from an elevated Command Prompt or PowerShell window.

To check the status of the Docker service:

sc query docker

To stop the Docker service:

sc stop docker

To start the Docker service:

sc start docker

To restart the Docker service:

sc stop docker && sc start docker

To change the startup type to manual, so that Docker does not start on boot:

sc config docker start=demand

To change the startup type back to automatic:

sc config docker start=auto

Scripts and logs

Docker daemon logs

Docker daemon logs on Windows are integrated with the Windows Event Log system. To view Docker logs:

• Open the Start menu and search for Event Viewer.
• Go to Applications and Services Logs, then Docker Engine (if available). Otherwise, check the Application log under Windows Logs for Docker-related entries.

Alternatively, use PowerShell to retrieve Docker events:

Get-EventLog -LogName Application -Source Docker -Newest 50

Docker container logs

To view logs from a running or stopped container:

docker logs <container_name_or_id>

To follow logs in real time:

docker logs -f <container_name_or_id>

Docker daemon configuration

The Docker daemon configuration file is located at:

C:\ProgramData\Docker\config\daemon.json

You can edit this file to configure daemon settings such as storage drivers, logging options, registry mirrors, and network settings. After you modify the configuration, restart the Docker service for the changes to take effect.

Windows Event Logs

For system-level diagnostics, use the Windows Event Viewer. Press the Windows key, search for Event Viewer and open it to review application and system logs.

Troubleshooting

Cannot connect through RDP

• Verify that the instance has passed 2/2 status checks in the EC2 console.
• Confirm that your security group allows inbound TCP traffic on port 3389 from your IP address.
• Make sure you are using the correct public IP address. If you stopped and started the instance, the public IP address may have changed unless you use an Elastic IP.
• Check that your local firewall or corporate network is not blocking outbound RDP connections.

Password decryption fails

• Make sure you upload the .pem file that matches the key pair you selected during instance launch.
• The password can take up to 15 minutes to become available after the first launch. If the option is greyed out, wait and try again.

Docker service is not running

• Open the Services panel and check that the Docker Engine service is in the Running state.
• If the service is stopped, start it manually. If it fails to start, check Windows Event Viewer for error messages.
• Make sure the instance has enough disk space. Docker can fail to start if the system drive is full.

Docker commands return errors

• Verify that you are running Command Prompt as Administrator. Some Docker operations require elevated privileges.
• Run docker version to check that both the Docker client and server components are responding.
• If you see a "cannot connect to the Docker daemon" error, the Docker service may not be running. Start it with the methods described in the Managing services section.

Container cannot access the network

• Check that the security group allows outbound traffic on the ports your container needs.
• Verify the Windows Firewall is not blocking container network traffic.
• Use docker network ls to list available Docker networks and ensure your container is attached to the correct one.

Cannot pull images from Docker Hub

• Ensure the instance has outbound internet access on port 443 (HTTPS).
• If the instance is in a private subnet, configure a NAT gateway to allow outbound traffic.
• Verify that DNS resolution is working by running nslookup hub.docker.com from the Command Prompt.

Insufficient disk space for container images

• Docker stores images and container layers on the C: drive by default. Monitor disk usage regularly.
• Remove unused images with docker image prune and stopped containers with docker container prune.
• For a more thorough cleanup, run docker system prune to remove all unused images, containers, networks, and build cache.
• Attach an additional EBS volume and configure Docker to use it as the data root directory. Edit the daemon.json file and add a data-root setting.

Container performance is poor

• Consider upgrading to a larger instance type with more CPU and RAM.
• Monitor resource usage with docker stats to identify containers consuming excessive resources.
• Set resource limits when you start containers, with the --memory and --cpus flags.

RDP session disconnects frequently

• Check your network connection stability.
• Adjust the RDP client settings to reduce bandwidth requirements by lowering the display quality or disabling visual effects.
• Make sure the instance is not running out of memory because of container workloads.

Security recommendations

Change the Administrator password

After your first login, change the default Administrator password to a strong, unique password. Open Command Prompt or PowerShell and run:

net user Administrator YourNewStrongPassword

After you change the password, the original decrypted password from the AWS console is no longer valid.

Restrict RDP access

Limit the security group rule for port 3389 to your specific IP addresses or a trusted CIDR range. Avoid 0.0.0.0/0, which exposes the instance to RDP brute-force attacks from the entire internet.

Use trusted container images

Pull container images only from trusted sources. Use official images from Docker Hub or your own private registry. Scan images for vulnerabilities before you deploy them to production.

Use Amazon ECR for private images

Store your custom container images in Amazon Elastic Container Registry (ECR) instead of public registries. ECR provides encryption at rest and IAM-based access control, and it integrates with AWS services.

Limit container privileges

Avoid running containers with elevated privileges unless absolutely necessary. Use the --user flag to run containers as a non-root user when possible.

Restrict container network access

Configure Docker network settings to isolate containers from each other and from the host network. Use Docker networks to control which containers can communicate with each other.

Keep software updated

Update Docker CE and Windows Server regularly to get the latest security patches and bug fixes. Check your Docker version with docker version and compare it with the latest release.

Enable Windows Firewall rules

Review and configure Windows Firewall to restrict inbound and outbound traffic to only what your container workloads need.

Use an Elastic IP

Assign an Elastic IP to your instance to keep a consistent IP address across stop and start cycles. This matters most if your containers expose services that need a stable endpoint.

Enable CloudWatch monitoring

Configure Amazon CloudWatch to monitor instance metrics such as CPU utilisation, memory usage and disk space. Set up alarms that notify you when resources run low, which is critical for Docker workloads that can consume resources rapidly.

Rotate credentials regularly

If you authenticate to Docker Hub or Amazon ECR from this instance, rotate your credentials regularly. Use IAM roles for ECR authentication to avoid storing long-term credentials on the instance.

Support

If you hit an issue that this guide does not cover, the SecureAnyCloud support team can help.

• Email: sales@secureanycloud.com
• Phone: (+44) 02045382725
• Website: secureanycloud.com
• Address: 3rd Floor, 86 90 Paul Street, London, EC2A 4NE

Support covers any issue related to the AMI, including connectivity problems, Docker service configuration and general guidance on using the preconfigured environment.

When you contact support, include your EC2 instance ID, the AWS region, the output of docker version and docker info, and a description of the issue with any relevant error messages or screenshots.

Deploy on AWS

Launch Docker CE on Windows with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com