SecureAnyCloud
Deployment guide

Docker Engine 29

Overview

Docker Engine is the industry-standard container runtime. The SecureAnyCloud image installs the latest Docker CE 29.x from Docker Inc.'s official noble repository, alongside containerd 2.2, BuildKit 0.33 (buildx) and Compose v5 (docker compose).

The azureuser account is added to the docker group at first boot by a oneshot systemd unit, so you can run docker ps immediately after SSH without sudo.

What you get:

  • docker-ce 29.4 and docker-ce-cli 29.4 from download.docker.com/linux/ubuntu noble/stable
  • containerd.io 2.2.x as the default container runtime
  • docker-buildx-plugin 0.33 for BuildKit-powered multi-platform builds
  • docker-compose-plugin v5 for Compose-spec stack orchestration
  • docker-firstboot.service, which adds azureuser to the docker group on first boot
  • overlayfs storage driver, json-file logging and systemd cgroup driver
  • docker.service running, and docker.socket listening on /var/run/docker.sock
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, and a VNet with a subnet.

Standard_B2s (4 GB RAM) is sufficient for development workloads. Move up to D2s or D4s for image build farms or production container hosts.

Step 1-3: Deploy and connect with SSH

# Deploy from the Marketplace listing (or via az vm create from your gallery image).
ssh azureuser@<vm-ip>
4

Verify

sudo systemctl status docker.service --no-pager | head -15 sudo systemctl is-active docker.service containerd.service docker-firstboot.service
5

Versions and daemon info

sudo docker version --format 'Client: {{.Client.Version}} Server: {{.Server.Version}} containerd: {{(index .Server.Components 1).Version}} runc: {{(index .Server.Components 2).Version}}'
sudo docker compose version
sudo docker buildx version
sudo docker info --format 'Storage Driver: {{.Driver}} Logging Driver: {{.LoggingDriver}} Cgroup: {{.CgroupDriver}}/{{.CgroupVersion}} Containers: {{.Containers}} Images: {{.Images}}'
6

Run a container

sudo docker run --rm hello-world
7

Compose stack

mkdir -p /tmp/stack && cd /tmp/stack cat > compose.yaml <<'EOF' services: redis: image: redis:7-alpine ports: ['6379:6379'] EOF
sudo docker compose up -d sudo docker compose ps
sudo docker exec stack-redis-1 redis-cli SET hello sac
sudo docker exec stack-redis-1 redis-cli GET hello
sudo docker compose down
8

Components

These are the paths to the main components on the instance.

dockerd binary: /usr/bin/dockerd

docker CLI: /usr/bin/docker

containerd: /usr/bin/containerd

Compose plugin: /usr/libexec/docker/cli-plugins/docker-compose

Buildx plugin: /usr/libexec/docker/cli-plugins/docker-buildx

Docker socket: /var/run/docker.sock

Daemon config: /etc/docker/daemon.json (create as needed)

Image storage: /var/lib/docker

containerd state: /var/lib/containerd

First-boot script: /usr/local/sbin/docker-firstboot.sh

Group membership note: /stage/scripts/docker-credentials.log

9

Security

  • Restrict the NSG so the Docker socket is never exposed on the network. Keep dockerd on the local Unix socket only.
  • Use rootless mode for multi-tenant hosts: dockerd-rootless-setuptool.sh install
  • Pin image digests in production Compose files (image: nginx@sha256:...) instead of floating tags.
  • Patch monthly: apt-get update && apt-get upgrade && reboot. Docker publishes security advisories at https://docs.docker.com/engine/security/
  • Scan images: docker scout cves <image> (Scout is bundled in 29.x)

Licensing

Docker Engine (Moby project) is licensed under Apache 2.0 and is free to use commercially. Docker Desktop is a separate, paid product that is not included here. SecureAnyCloud provides commercial support for the Engine deployment separately. Email sales@secureanycloud.com.

Deploy on Azure

Launch Docker Engine 29 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure