Setup recipe: a Docker host

vps9 servers create --plan standard --image ubuntu-24.04 --hostname docker-1 --key key_… --setup-script ./docker-host.sh

#!/bin/bash
# VPSNine setup recipe: Docker host
# https://vpsnine.com/help/docker-host-setup-script
# Docker Engine with the Compose and Buildx plugins from Docker's own repository, container logs
# capped in size, and a user who can run docker without sudo.
set -euo pipefail
umask 022

# ---- settings: change these before you run it ----
DOCKER_USER=deploy   # added to the docker group if this user exists (the secure baseline makes it)

# Which family of distributions this is: Debian and Ubuntu, or AlmaLinux, Rocky Linux and Fedora.
. /etc/os-release
case " ${ID:-} ${ID_LIKE:-} " in
  *" debian "*|*" ubuntu "*) family=debian ;;
  *" rhel "*|*" fedora "*|*" centos "*) family=rhel ;;
  *) echo "This recipe supports Ubuntu, Debian, AlmaLinux, Rocky Linux and Fedora, not ${PRETTY_NAME:-this system}" >&2; exit 1 ;;
esac

echo "== Installing Docker"
if [ "$family" = debian ]; then
export DEBIAN_FRONTEND=noninteractive
apt-get -o DPkg::Lock::Timeout=300 update
apt-get -o DPkg::Lock::Timeout=300 install -y ca-certificates curl
. /etc/os-release
if ! command -v docker >/dev/null 2>&1; then
  if curl -fsSL -o /dev/null "https://download.docker.com/linux/${ID}/dists/${VERSION_CODENAME}/Release"; then
    install -m 0755 -d /etc/apt/keyrings
    curl -fsSL "https://download.docker.com/linux/${ID}/gpg" -o /etc/apt/keyrings/docker.asc
    chmod a+r /etc/apt/keyrings/docker.asc
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list
    apt-get -o DPkg::Lock::Timeout=300 update
    apt-get -o DPkg::Lock::Timeout=300 install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
  else
    echo "Docker's repository has no ${VERSION_CODENAME} yet: installing the distribution's docker.io"
    apt-get -o DPkg::Lock::Timeout=300 update
    apt-get -o DPkg::Lock::Timeout=300 install -y docker.io
    apt-get -o DPkg::Lock::Timeout=300 install -y docker-compose-v2 || apt-get -o DPkg::Lock::Timeout=300 install -y docker-compose || true
  fi
fi
systemctl enable --now docker
else
. /etc/os-release
if ! command -v docker >/dev/null 2>&1; then
  # Docker publishes a Fedora repository and a CentOS one, which AlmaLinux and Rocky Linux use (checked 2026-10-16:
  # centos/10 exists, so AlmaLinux 10 works). A release it doesn't carry yet: Fedora's own moby-engine, else stop.
  if [ "$ID" = fedora ]; then repo=fedora; rel=${VERSION_ID}; else repo=centos; rel=${VERSION_ID%%.*}; fi
  if curl -fsSL -o /dev/null "https://download.docker.com/linux/${repo}/${rel}/$(uname -m)/stable/repodata/repomd.xml"; then
    curl -fsSL "https://download.docker.com/linux/${repo}/docker-ce.repo" -o /etc/yum.repos.d/docker-ce.repo
    dnf -y remove podman-docker buildah runc >/dev/null 2>&1 || true
    dnf -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
  elif [ "$ID" = fedora ]; then
    echo "Docker's repository has no Fedora ${rel} yet: installing Fedora's moby-engine"
    dnf -y install moby-engine docker-compose
  else
    echo "Docker's repository has no ${PRETTY_NAME} yet" >&2
    exit 1
  fi
fi
systemctl enable --now docker
fi

echo "== Capping container logs at 3 files of 10 MB each"
# Only when there is no daemon.json yet, so a rerun never overwrites your own settings.
if [ ! -f /etc/docker/daemon.json ]; then
  install -d -m 0755 /etc/docker
  cat > /etc/docker/daemon.json <<'EOF'
{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" }
}
EOF
  systemctl restart docker
fi

if id "$DOCKER_USER" >/dev/null 2>&1; then
  echo "== Adding $DOCKER_USER to the docker group (log in again for it to apply)"
  usermod -aG docker "$DOCKER_USER"
else
  echo "== No user $DOCKER_USER: skipped the docker group. Run usermod -aG docker <user> later."
fi
docker version
echo "== Done"

tail -n 20 /var/log/vps9-setup.log
cat /var/lib/vps9-setup.exit
docker run --rm hello-world
docker compose version