These optional post-installation procedures describe how to configure yourLinux host machine to work better with Docker.

Manage Docker as a non-root user

The Docker daemon binds to a Unix socket, not a TCP port. By default it's theroot user that owns the Unix socket, and other users can only access it usingsudo. The Docker daemon always runs as theroot user.

If you don't want to preface thedocker command withsudo, create a Unixgroup calleddocker and add users to it. When the Docker daemon starts, itcreates a Unix socket accessible by members of thedocker group. On some Linuxdistributions, the system automatically creates this group when installingDocker Engine using a package manager. In that case, there is no need for you tomanually create the group.

Warning

Thedocker group grants root-level privileges to the user. Fordetails on how this impacts security in your system, seeDocker Daemon Attack Surface.

Note

To run Docker without root privileges, seeRun the Docker daemon as a non-root user (Rootless mode).

To create thedocker group and add your user:

1. Create thedocker group.

   $ sudo groupadd docker

2. Add your user to thedocker group.

   $ sudo usermod -aG docker$USER

3. Log out and log back in so that your group membership is re-evaluated.

   If you're running Linux in a virtual machine, it may be necessary torestart the virtual machine for changes to take effect.

   You can also run the following command to activate the changes to groups:

   $ newgrp docker

4. Verify that you can rundocker commands withoutsudo.

   $ docker run hello-world

   This command downloads a test image and runs it in a container. When thecontainer runs, it prints a message and exits.

   If you initially ran Docker CLI commands usingsudo before adding your userto thedocker group, you may see the following error:

   WARNING: Error loading config file: /home/user/.docker/config.json -stat /home/user/.docker/config.json: permission denied

   This error indicates that the permission settings for the~/.docker/directory are incorrect, due to having used thesudo command earlier.

   To fix this problem, either remove the~/.docker/ directory (it's recreatedautomatically, but any custom settings are lost), or change its ownership andpermissions using the following commands:

   $ sudo chown"$USER":"$USER" /home/"$USER"/.docker -R$ sudo chmod g+rwx"$HOME/.docker" -R

Configure Docker to start on boot with systemd

Many modern Linux distributions usesystemd tomanage which services start when the system boots. On Debian and Ubuntu, theDocker service starts on boot by default. To automatically start Docker andcontainerd on boot for other Linux distributions using systemd, run thefollowing commands:

$ sudo systemctlenable docker.service$ sudo systemctlenable containerd.service

To stop this behavior, usedisable instead.

$ sudo systemctl disable docker.service$ sudo systemctl disable containerd.service

You can use systemd unit files to configure the Docker service on startup,for example to add an HTTP proxy, set a different directory or partition for theDocker runtime files, or other customizations. For an example, seeConfigure the daemon to use a proxy.

Configure default logging driver

Docker provideslogging drivers forcollecting and viewing log data from all containers running on a host. Thedefault logging driver,json-file, writes log data to JSON-formatted files onthe host filesystem. Over time, these log files expand in size, leading topotential exhaustion of disk resources.

To avoid issues with overusing disk for log data, consider one of the followingoptions:

• Configure thejson-file logging driver to turn onlog rotation.
• Use analternative logging driversuch as the"local" logging driverthat performs log rotation by default.
• Use a logging driver that sends logs to a remote logging aggregator.

Next steps

• Take a look at theDocker workshop to learn how to build an image and run it as a containerized application.