Install Docker and Traefik on Ubuntu 26.04

This guide installs Docker Engine and its Compose plugin from Docker’s official repository on Ubuntu 26.04 LTS. It then runs Traefik and a small test service on a shared Docker network.

Prerequisites

• An Ubuntu 26.04 VPS with a non-root sudo user
• A tested SSH key and UFW allowing OpenSSH
• whoami.example.com pointing to the VPS
• TCP ports 80 and 443 reachable from the internet for HTTPS validation

Docker warns that published container ports can bypass UFW rules. Publish only ports 80 and 443 from Traefik. Do not publish backend ports.

Install Docker Engine

Remove conflicting distribution packages if they are installed, then add Docker’s current apt repository:

sudo apt remove $(dpkg --get-selections docker.io docker-doc docker-compose docker-compose-v2 docker-buildx podman-docker containerd runc | cut -f1)
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo \"${UBUNTU_CODENAME:-$VERSION_CODENAME}\") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo docker run --rm hello-world
sudo docker compose version

Use sudo docker unless you have deliberately chosen another access model. Membership in the docker group grants root-level privileges through the daemon. If you add a trusted administrator with sudo usermod -aG docker USERNAME, log out and back in before testing.

Configure Traefik

Create the shared network and working directory:

sudo docker network create proxy
sudo install -d -m 0750 /opt/traefik/letsencrypt
sudo touch /opt/traefik/letsencrypt/acme.json
sudo chmod 600 /opt/traefik/letsencrypt/acme.json
sudo chown -R "$USER":"$USER" /opt/traefik
cd /opt/traefik

Create traefik.yml and replace the email address:

entryPoints:
  web:
    address: :80
    http:
      redirections:
        entryPoint: { to: websecure, scheme: https }
  websecure:
    address: :443

certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@example.com
      storage: /letsencrypt/acme.json
      httpChallenge: { entryPoint: web }

providers:
  docker:
    exposedByDefault: false
    network: proxy

Create compose.yaml. Replace the two hostnames and pin reviewed image versions before production use:

services:
  traefik:
    image: traefik:v3.5
    restart: unless-stopped
    security_opt: [no-new-privileges:true]
    ports: ["80:80", "443:443"]
    networks: [proxy]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./letsencrypt:/letsencrypt

  whoami:
    image: traefik/whoami:v1.11
    restart: unless-stopped
    networks: [proxy]
    labels:
      - traefik.enable=true
      - traefik.http.routers.whoami.rule=Host(`whoami.example.com`)
      - traefik.http.routers.whoami.entrypoints=websecure
      - traefik.http.routers.whoami.tls.certresolver=letsencrypt
      - traefik.http.services.whoami.loadbalancer.server.port=80

networks:
  proxy:
    external: true

Mounting the Docker socket gives Traefik access to the Docker API. The :ro mount does not make Docker API access read-only. A compromised Traefik container with socket access could control the daemon and host. Keep the proxy patched and restrict who can access its container and configuration.

Start and verify

sudo docker compose config --quiet
sudo docker compose up -d
sudo docker compose ps
sudo docker compose logs --tail=100 traefik
curl --fail https://whoami.example.com
sudo ss -lntp

Only SSH, port 80, and port 443 should be publicly listening for this example. Check acme.json remains mode 600 and run sudo docker compose pull && sudo docker compose up -d during a planned update. Retain the previous image references for rollback.

See running Docker containers on a VPS for sizing and operating considerations beyond this setup.

Sources: Docker Engine on Ubuntu, Docker post-install security, Docker firewall behavior, and Traefik Docker provider.