SecureAnyCloud
Deployment guide

Docker Community Edition

Overview

Docker is a platform for developing, shipping and running applications inside lightweight, portable containers. This SecureAnyCloud AMI delivers Docker Community Edition (Docker CE) on Linux, ready to run from the AWS Marketplace.

What you get:

  • Docker Community Edition with a systemd service for automatic startup.
  • Docker CLI and Docker Compose.
  • A dedicated Docker storage volume at /var/lib/docker.
  • An OS package update script for keeping the system current.
  • AWS CLI v2 for AWS service integration.
  • Systems Manager Agent (SSM) for remote management.
  • CloudWatch Agent for monitoring.
  • Latest security patches applied at build time.
  • 24/7 SecureAnyCloud support with a guaranteed 24 hour response SLA.

Prerequisites

Before you launch this AMI, make sure you have:

  • An active AWS account.
  • An active subscription to the Docker Community Edition listing on AWS Marketplace.
  • An EC2 key pair for SSH access.
  • Familiarity with EC2 instance management and SSH.
  • The recommended instance type, t3.medium (2 vCPU, 4 GB RAM) or larger for running multiple containers. The minimum requirements are 1 vCPU, 1 GB RAM and 20 GB disk space.
1

Launch the AMI

  • Open the AWS Marketplace and search for "Docker CE SecureAnyCloud".
  • Click Continue to Subscribe, accept the terms, then click Continue to Configuration.
  • Select your preferred Region and Software Version.
  • Click Continue to Launch.
  • Choose Launch through EC2 for full control over instance configuration.
  • Select your instance type (t3.medium recommended).
  • Configure storage: 20 GB gp3 minimum for the root volume. Consider adding a larger volume for container images and data.
  • Configure your Security Group with an inbound rule that allows TCP port 22 from your IP address (SSH access).
  • Select your EC2 key pair, and launch the instance.

Note: Additional ports may be needed depending on the containers you run. Add rules as required for your application (for example, port 80/443 for web servers, port 8080 for application servers).

2

Connect via SSH

When your instance is running and has passed both status checks (2/2), connect with SSH:

ssh -i your-key.pem ec2-user@<public-ip-address>

Replace your-key.pem with the path to your EC2 key pair and <public-ip-address> with your instance's public IP.

Important: Wait for the EC2 instance to reach 2/2 successful status checks before you connect. If you connect too early, you may see an error such as:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

To switch to the root user:

sudo su -
3

Verify Docker is Running

Docker starts automatically on boot. Check that the service is running:

systemctl status docker

Check the Docker version:

docker --version

Run a test container to confirm that everything works:

docker run hello-world

A message confirms that Docker is installed and working correctly.

4

Run Your First Container

Run an NGINX web server:

docker run -d --name webserver -p 80:80 nginx

This command starts an NGINX container in the background and maps port 80 on the host to port 80 in the container. Open it at http://<public-ip-address>.

List running containers:

docker ps

Stop and remove a container:

docker stop webserver
docker rm webserver

Working with Docker Images

Pull an image from Docker Hub:

docker pull ubuntu:latest

List downloaded images:

docker images

Remove an image:

docker rmi ubuntu:latest

Build an image from a Dockerfile:

docker build -t my-app:latest .

Using Docker Compose

Docker Compose lets you define and run multi-container applications from a YAML file.

Example docker-compose.yml:

version: '3' services: web: image: nginx:latest ports: - "80:80" db: image: mysql:8 environment: MYSQL_ROOT_PASSWORD: <set-at-first-boot> volumes: - db-data:/var/lib/mysql volumes: db-data:

Start the stack:

docker compose up -d

Stop the stack:

docker compose down

Server Components

  • Docker Community Edition: install path /var/lib/docker.

Note: The automatic OS package update script may update component versions on first boot.

Filesystem Layout

The image uses these mount points:

  • / (38 GB): root filesystem.
  • /boot (2 GB): operating system kernel files.
  • /var/lib/docker (9.8 GB): Docker installation directory (images, containers, volumes).

Key Docker directories:

  • /var/lib/docker: Docker data root (images, containers, volumes, networks).
  • /var/lib/docker/volumes: named volumes for persistent container data.
  • /var/lib/docker/overlay2: container filesystem layers.
  • /etc/docker: Docker daemon configuration.

Managing the Docker Service

systemd manages Docker, and Docker starts automatically on boot.

Check service status:

systemctl status docker

Stop Docker:

systemctl stop docker

Start Docker:

systemctl start docker

Restart Docker:

systemctl restart docker

Enable Docker to start on boot (default):

systemctl enable docker

Scripts and Log Files

  • initial_boot_update.sh (in /stage/scripts): updates the OS with the latest packages on first boot.
  • initial_boot_update.log (in /stage/scripts): output log for the boot update script.

On Startup

An OS package update script runs on first boot to make sure the image is fully up to date. To disable it, remove the script and its crontab entry:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# Delete the following line, save and exit: @reboot /stage/scripts/initial_boot_update.sh

Troubleshooting

Docker service fails to start

  • Check the service status: systemctl status docker
  • Review the Docker logs: journalctl -u docker --no-pager -n 50
  • Check that disk space is available: df -h /var/lib/docker

Permission denied when running Docker commands

  • Run as root (sudo su -), or add your user to the docker group with sudo usermod -aG docker ec2-user.
  • Log out and log back in for the group change to take effect.

Container cannot access the internet

  • Check that the instance has a route to the internet (public subnet or NAT gateway).
  • Check Docker networking: docker network ls
  • Test DNS resolution inside a container: docker run --rm busybox nslookup google.com

Disk space full

  • Check Docker disk usage: docker system df
  • Remove unused images, containers and volumes: docker system prune -a
  • Consider increasing the /var/lib/docker volume size.

Security Recommendations

  • Restrict SSH access: Only allow port 22 from trusted IP addresses.
  • Use non-root users in containers: Add USER directives in your Dockerfiles.
  • Scan images for vulnerabilities: Use docker scout or third-party tools before deploying images.
  • Limit container resources: Use the --memory and --cpus flags to prevent resource exhaustion.
  • Keep Docker updated: Update regularly with yum update docker-ce.
  • Use trusted base images: Only pull images from official repositories or verified publishers.
  • Enable Docker Content Trust: Set export DOCKER_CONTENT_TRUST=1 to verify image signatures.
  • Do not expose the Docker socket: Never bind-mount /var/run/docker.sock into untrusted containers.

Support

If you encounter any issues with this product, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7 with a guaranteed 24 hour response SLA.

Deploy on AWS

Launch Docker Community Edition with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com