How to Run Docker at Home

What containers are

A container packages an application and its dependencies, but it still uses the host kernel. It is useful isolation, not a complete security boundary or a replacement for backups. Docker Engine runs containers; Compose describes several related services in one YAML file.

What you need

Use a supported 64-bit Linux host, storage for images and persistent data, and a reserved LAN address. You do not need privileged containers, host networking or a public IP for a first service.

Install on Linux

Assume Ubuntu or Debian. Follow Docker’s current official repository instructions rather than copying an old repository key. After installation, test the engine:

sudo systemctl enable --now docker
sudo docker run --rm hello-world

Adding yourself to the docker group avoids typing sudo, but membership is effectively root-level access. Use it only for trusted users and keep a normal account for everyday work.

A small Compose project

Create a directory and save this as compose.yaml. The example publishes a local-only web service and keeps its data in a named volume:

mkdir -p ~/services/whoami
cd ~/services/whoami
cat > compose.yaml <<'EOF'
services:
  whoami:
    image: traefik/whoami:v1.10
    restart: unless-stopped
    ports:
      - "127.0.0.1:8080:80"
EOF
docker compose up -d

The example heredoc is intended for a shell. Review image names and versions before production use. A port bound to 127.0.0.1 is not reachable from other LAN devices; change that deliberately only when you understand the exposure.

Volumes, ports and environment

Put databases and configuration in named volumes or explicit host directories, not only in the writable container layer. Treat environment files as sensitive: do not commit passwords or tokens. Publish only the ports users need. Compose’s private network lets services talk without publishing every port.

Logs, updates and backups

docker compose ps
docker compose logs --tail=100 whoami
docker compose pull
docker compose up -d
docker system df

Read release notes before updating. Back up volumes and Compose files, and practise a restore. Avoid --privileged, mounting /var/run/docker.sock, broad host paths and unnecessary host networking.

Troubleshooting and next steps

If a service is down, check docker compose ps, logs, port conflicts and file permissions. If a container restarts, inspect its exit reason before repeatedly restarting it. Continue with Home lab basics, Pi-hole or authorised torrents.

Check it worked

docker compose ps
curl --fail http://127.0.0.1:8080
docker compose logs --tail=50

You should see the container as running, a successful local HTTP response and logs without a repeating crash loop. If you bind a service to the LAN later, test from one known client and record the port.

Security and recovery

Anyone with Docker group or Docker socket access can usually control the host, so treat that as administrative access. Avoid privileged containers, mounting the Docker socket and broad host paths unless you understand the consequence. Keep secrets in a protected environment file, not in a public Compose file. Back up Compose files and named volumes, then practise rebuilding one service from those copies.

What next?

Once one container is boring and repeatable, try Pi-hole or Home Assistant. Use backup guidance before storing important application data.

Build a Docker host Plan backups