Docker CE

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Docker Engine.

Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger as a balanced default, and size it to the container workload you intend to run. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network. If you plan to publish a containerized service, also open the port that service listens on. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes only a few seconds after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Docker Engine Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, and <key-name> with your EC2 key pair name.

Replace <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens port 22 from your management network.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}' \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=docker-engine}]'

The image attaches a dedicated 20 GiB container storage volume automatically, mounted at the Docker data directory.

To start with more container storage, enlarge that volume on the Storage step in the console, or add a second block device mapping on the CLI.

Connect to the instance with SSH as the default login user for the operating system variant you launched. The login user differs by variant:

Operating system variant SSH login user

Ubuntu 24.04 ubuntu

Replace <key-file> with the path to your private key file and <instance-public-ip> with the public IP address or DNS name of the instance.

ssh -i <key-file> ubuntu@<instance-public-ip>

The login user is added to the docker group on the instance's first boot. If you connect during the first few seconds after launch, log out and reconnect once so that your shell session picks up the new group membership. After that, the docker commands below run without sudo.

Check the installed engine, the API version and the runtime components. The client and server versions match, and the server reports the containerd and runc runtime versions.

docker version

Confirm the Buildx and Compose plugins and the containerd runtime are present:

docker compose version
docker buildx version containerd --version

Read the information file. It records the installed engine version and how container access is granted, and it holds no secrets:

cat /stage/scripts/docker-info.log

Run the hello-world image. Docker pulls the image from Docker Hub, creates a container from it, runs it, and prints a confirmation message. This is the quickest end-to-end check that the engine works.

docker run hello-world

Run a longer-lived container in the background. The following command starts an nginx web server, names the container web, and publishes container port 80 on host port 8080:

docker run -d --name web -p 8080:80 nginx:alpine

List the running containers and confirm the port mapping:

docker ps

The Compose plugin runs multi-container applications from a single declarative file. Create a working directory and a compose.yaml file that describes the services. The example below defines one nginx web service that publishes host port 8080.

mkdir -p ~/web-demo && cd ~/web-demo cat > compose.yaml <<'EOF' services: web: image: nginx:alpine ports: - "8080:80" restart: unless-stopped EOF

Bring the application up in the background with docker compose up -d. Then list its services with docker compose ps. Compose creates a dedicated network for the application and starts each service as a container.

To stop the application and remove its containers and network, run docker compose down from the same directory.

Docker builds images from a Dockerfile. Create a small build context and a Dockerfile, then build a tagged image with docker build:

mkdir -p ~/build-demo && cd ~/build-demo cat > Dockerfile <<'EOF' FROM alpine:3 RUN echo "Built with Docker Engine on sac" > /message CMD ["cat", "/message"] EOF docker build -t my-app:1.0 . docker run --rm my-app:1.0

For advanced and multi-platform builds, use the Buildx plugin with docker buildx build. Buildx is preinstalled and ready to use.

The Docker daemon and the containerd runtime run as systemd services and start automatically at boot. Confirm their status with:

systemctl is-active docker.service containerd.service

Container image layers, container writable layers and named volumes are stored under the Docker data directory, which is a separate filesystem on its own EBS volume. Confirm the dedicated mount and check free space with:

findmnt /var/lib/docker df -h /var/lib/docker

Because the container store is on its own volume, you can grow it independently of the operating system disk. Modify the EBS volume in the AWS console or with the CLI.

Then extend the filesystem on the instance with resize2fs against the volume's device.

Keep the operating system patched with the standard package manager. The official Docker APT repository is already configured on the image, so engine upgrades arrive through the normal package update process.

Reclaim disk space by removing unused images, stopped containers and dangling build cache with docker system prune. Review what is using space with docker system df.

docker system df

To let another Linux user manage containers without sudo, add that user to the docker group. The user then starts a new login session.

sudo usermod -aG docker <username>