docudjeex/content/en/3.serveex/2.core/2.docker.md

title, description

title	description
Docker	Install Docker and Dockge on Debian to deploy and manage self-hosted services with simple container stacks.

:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

Every app in this guide, Jellyfin, Vaultwarden, Immich, to name a few, comes with its own list of dependencies, its own version of Python or Node, its own quirks. Installing all of that directly on Debian works for a while, until two apps want a different version of the same library, or removing one leaves files scattered across the system with no clean way back.

A container sidesteps the problem: it packages an app together with everything it needs to run, isolated from the rest of the system and from every other container. Starting one doesn't touch Debian's own packages, and removing it is a single command that leaves nothing behind. It's not a virtual machine either, there's no second operating system to boot or resources to pre-allocate: a container shares the host's kernel and starts in about a second, using only the RAM and CPU the app inside it actually needs.

Docker is the tool that builds, starts and manages these containers. Point it at an image, a ready-made snapshot of an app maintained by its developers, and it downloads it and runs it in one command. The rest of Serveex is built entirely on it: every app from here on is one Docker container, or a handful of them working together.

Install Docker

::steps{level="3"}

Add the Docker repository and GPG key

# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo   "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian   $(. /etc/os-release && echo "$VERSION_CODENAME") stable" |   sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

Install the packages

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Done !

::

More options: Install Docker for Debian 13

::note

From here on, we assume the stacks are installed in the /srv/docker folder, created using the command:

sudo mkdir /srv/docker

::

Install Dockge to manage and deploy containers

Dockge is a web tool to create, configure, launch, and manage Docker containers. It's a simple, intuitive interface that’s lighter and easier for beginners than using the CLI or Portainer.

Configuration

::file-tree

label: File structure we will create tree: /: - srv: - docker: - dockge: - compose.yaml

::

::steps{level="4"}

Create the stack folder

cd /srv/docker
sudo mkdir dockge

Create the compose file

cd /srv/docker/dockge
sudo nano compose.yaml

Paste the following:

---
services:
  dockge:
    image: louislam/dockge:1
    restart: unless-stopped
    container_name: dockge
    ports:
      - 3555:5001 # LAN-accessible port will be 3555
    environment:
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
      - DOCKGE_STACKS_DIR=/srv/docker
    volumes:
      - /srv/docker/dockge/data:/app/data
      - /srv/docker:/srv/docker
    networks:
      - dockge-internal
    depends_on:
      - docker-socket-proxy

  docker-socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: docker-socket-proxy-dockge
    security_opt:
      - no-new-privileges:true
    networks:
      - dockge-internal
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
      - EXEC=1
      - INFO=1
      - SYSTEM=1
      - POST=1
      - ALLOW_START=1
      - ALLOW_STOP=1
      - ALLOW_RESTARTS=1
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /run

networks:
  dockge-internal:
    name: dockge-internal

::warning Dockge needs access to the Docker API to manage every other stack on this server, which is effectively root access to your host. Instead of mounting /var/run/docker.sock directly, this config sits Docker Socket Proxy in front of it, only allowing the specific permissions Dockge needs (containers, images, networks, volumes, exec, lifecycle actions), on their own internal network. Dockge has no built-in login by default, so never expose port 3555 beyond your LAN without putting it behind TinyAuth or Authentik first. ::

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

Launch the container

cd /srv/docker/dockge
sudo docker compose up -d

Then go to http://yourserverip:3555 in your browser to access the login page.

More info on Dockge and how to use it

Done !

::

And there you go! Docker and a tool to easily manage your containers are ready!

Watchtower, to auto-update containers

Watchtower is a container that checks for updates and pulls new images automatically, just by adding a label in your containers’ compose.yaml files.

Configuration

::steps{level="4"}

Create the stack

• Open Dockge in your browser
• Click compose
• Name the stack watchtower
• Paste the config below into the default config area in Dockge

---
services:
  watchtower:
    container_name: watchtower
    image: ghcr.io/nicholas-fedor/watchtower:latest
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - TZ=Europe/Paris
      - WATCHTOWER_SCHEDULE=${SCHEDULE}
      - WATCHTOWER_LABEL_ENABLE=true
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_REMOVE_VOLUMES=true
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
      # Discord notifications - uncomment if used
      #- WATCHTOWER_NOTIFICATIONS=slack
      #- WATCHTOWER_NOTIFICATION_SLACK_IDENTIFIER=Watchtower
      #- WATCHTOWER_NOTIFICATION_SLACK_HOOK_URL=${WH_URL}
    networks:
      - watchtower-internal
    depends_on:
      - docker-socket-proxy

  docker-socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: docker-socket-proxy-watchtower
    security_opt:
      - no-new-privileges:true
    networks:
      - watchtower-internal
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
      - INFO=1
      - SYSTEM=1
      - POST=1
      - ALLOW_START=1
      - ALLOW_STOP=1
      - ALLOW_RESTARTS=1
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /run

networks:
  watchtower-internal:
    name: watchtower-internal

::warning

WATCHTOWER_REMOVE_VOLUMES=true deletes a container's anonymous volumes as soon as it's updated. Combined with a latest tag, an automatic update can silently wipe data for any app that still stores something in an anonymous (unnamed) volume instead of a bind mount. ::

::note This config sits Docker Socket Proxy in front of the Docker API instead of mounting /var/run/docker.sock directly, so Watchtower only gets the permissions it actually needs (list/pull images, recreate containers) rather than full root-equivalent access to the host. ::

Set your environment variables

Fill in the .env section in Dockge with the following:

SCHEDULE=
WH_URL=

Property	Value	Examples
SCHEDULE	Cron format	0 0 6 * * * (every day at 6 AM)
WH_URL	Your Discord webhook URL - append /slack at the end	https://yourdiscordserver/webhook/slack

Enable Watchtower on other containers

To have Watchtower monitor your other containers, add this to their compose.yaml:

---
services:
  yourapp:
    # ...
    labels:
      - com.centurylinklabs.watchtower.enable=true

Then restart the modified stacks.

Done !

::

And that's it! You now have a solid base to start deploying the services you want!