Docker Hosting

Who is Docker hosting for?

Docker hosting suits developers who package applications as containers, small software teams, agencies and technical users who want to host their own services. Docker puts an application and all its dependencies into an image, and that image runs on the server exactly as it does on the developer’s computer. The “it worked on my machine” problem largely disappears.

Where a Docker server shines:

• Web applications: deploying Laravel, Django, Node.js or Go apps together with a database and cache from one Compose file.
• Self-hosted tools: installing open-source tools such as n8n, Nextcloud, Gitea, Uptime Kuma or Metabase in minutes from ready-made images.
• Test and staging environments: bringing up a copy of the live system on a separate server to try a new release.
• Agency projects: running client projects that need different PHP or Node.js versions on one server without them interfering.
• CI/CD target: automatically deploying images built by GitHub Actions or GitLab CI to the server.

If you only host one WordPress site, Docker can be an unnecessary layer; a managed hosting plan is simpler. Docker’s strength is keeping several services and different technology stacks together in an orderly way. Related pages: n8n hosting and Nextcloud hosting.

Why does Docker need KVM virtualisation?

Docker needs KVM virtualisation because containers share the host’s Linux kernel and want direct access to kernel features such as cgroups, namespaces, the overlay filesystem and network bridges. KVM gives every virtual server its own independent kernel, so Docker uses these features just as on a physical server.

With container-based virtualisation technologies such as OpenVZ or LXC, virtual servers share the host kernel. Docker either cannot be installed there at all or runs in a restricted way that depends on the provider’s special settings; loading kernel modules, using certain network drivers or moving to current Docker versions can cause trouble.

LIONFIN VPS plans run on KVM and offer together:

• Your own kernel: Docker, WireGuard and custom kernel modules work without issues.
• Full root rights: you manage the Docker daemon configuration, storage driver and firewall.
• Choice of OS: you choose Ubuntu, Debian or another distribution supported by Docker.
• NVMe storage: pulling image layers, starting containers and database writes all need a fast disk.

How many resources does a Docker server need?

The resources a Docker server needs are set by the containers you run, not by Docker itself; Docker Engine’s overhead is small. The way to find the right size is to measure the real consumption of each service, add them up and leave room for the operating system and load spikes. The table above is approximate; compare it with the current package table.

General trends by service type:

• Databases: PostgreSQL, MySQL and MariaDB use memory as cache, so they are the biggest RAM consumers.
• Search and analytics: JVM-based services such as Elasticsearch and OpenSearch need a lot of memory and must be tuned carefully on small VPS plans.
• Application servers: PHP-FPM, Node.js and Python apps grow in proportion to traffic.
• Build jobs: building images on the server (especially Node.js and Java projects) temporarily uses a lot of CPU and memory; building in CI and only pulling the finished image to the server eases the load.

The docker stats command shows each container’s live memory and CPU use. Define a memory limit in the Compose file so one container cannot consume all memory and affect the others. On the disk side, images, unused layers and log files take up a lot of space over time; choosing a disk slightly larger than you need avoids trouble later.

How do you install Docker and deploy your first project?

Install Docker from Docker’s official repository rather than the older version in the operating system’s package repository, then deploy your first project with a Compose file.

1. Prepare the server: connect with an SSH key, update the system and create a user with sudo rights instead of working as root.
2. Install Docker: install Docker Engine and the docker-compose-plugin package from the official repository; check with docker compose version.
3. Project folder: create compose.yaml and .env files in a folder such as /srv/app.
4. Start the services: docker compose up -d pulls the images and starts the containers in the background.
5. Check: watch status with docker compose ps and logs with docker compose logs -f.

A simple example:

services:
  app:
    image: ghcr.io/company/app:1.4.2
    restart: unless-stopped
    env_file: .env
    depends_on: [db]
  db:
    image: postgres:16
    restart: unless-stopped
    volumes:
      - db_data:/var/lib/postgresql/data
volumes:
  db_data:

Specifying images with a version tag instead of latest prevents an unexpected version change when the server restarts.

How do you manage domains and SSL with Docker?

On a Docker server, domains and SSL are managed by a single reverse proxy placed in front of all applications. The proxy listens on ports 80 and 443, routes each request to the right container by domain name and manages certificates centrally, so no application has to deal with HTTPS itself.

Common options:

Whichever you choose, the flow is the same: create an A record for your domain pointing to the server IP, let the reverse proxy obtain a free Let’s Encrypt certificate and keep application containers on the internal Docker network only. Not publishing application container ports both improves security and prevents port conflicts.

How do you secure a Docker server?

Docker server security rests on hardening SSH, opening only the ports you need, understanding Docker’s firewall behaviour and running containers with least privilege. Docker is convenient, but its defaults are not always the safest settings.

• Port publishing and UFW: Docker adds its own iptables rules for ports published with ports:, and these are evaluated before UFW. As a result, a database port you think is closed in UFW may be open to the internet. Do not publish services that must stay private, or bind them to the local address as 127.0.0.1:5432:5432.
• Firewall: open only SSH, 80 and 443 in UFW.
• SSH: disable password login, use keys and block brute-force attempts with Fail2ban.
• The docker group: every user in the docker group effectively has root rights; add only accounts you trust.
• Container user: in your own images, run the application as a non-root user and avoid unnecessary privileged settings.
• Image source: prefer images from official or verified publishers and update them regularly.

At network level, LIONFIN infrastructure filters DDoS traffic with the RouteFence firewall; configuration inside the server is your responsibility.

How do you back up Docker volumes and databases?

The data to back up in Docker lives not inside containers but in persistent volumes and bind-mounted folders; a container itself can be recreated from its image at any time. A proper backup routine covers this persistent data together with the Compose file and configuration.

1. Logical backups for databases: copying the files of a running database can produce an inconsistent backup. Take a consistent dump instead with a command such as docker compose exec db pg_dump -U user database > backup.sql.
2. File volumes: for uploads, media and configuration volumes, create an archive with a temporary container, or bind the volume to a folder and archive it directly.
3. Project files: keep compose.yaml and the source code in Git, and secrets such as .env in an encrypted location.
4. Scheduling: combine these steps in a script, run it nightly with a cron job and send backups to storage off the server.

A VPS snapshot gives you an instant copy of the whole server. It is very valuable as a quick rollback point before a big update, but it does not replace application-level database backups. Verify your backups by restoring them regularly in a separate test environment.

How do you set up automatic deployment (CI/CD) to a Docker server?

Automatic deployment works like this: on every push to the repository the image is built in CI, uploaded to an image registry, and the server pulls the new image and refreshes the container. This removes manual commands on the server and reduces human error.

A typical flow:

1. The developer pushes code to the main branch.
2. GitHub Actions or GitLab CI runs the tests and builds the Docker image.
3. The image is pushed with a version tag to a registry such as GitHub Container Registry, GitLab Registry or Docker Hub.
4. The CI job connects to the server over SSH as a restricted deployment user and runs docker compose pull and docker compose up -d.
5. If the health check fails, it rolls back to the previous version tag.

For security, the SSH key given to CI should be used only for deployment and, if possible, be command-restricted. Configure registry credentials on the server with a read-only access token.

Tools such as Watchtower can apply image updates automatically, but in production a CI flow where you control when updates happen is more predictable.

Docker or Kubernetes on a single server?

Docker Compose is enough for projects made up of a few services on one server; Kubernetes makes sense for large systems spread over several servers that need autoscaling and self-healing. For a small team, Kubernetes’ learning and operating overhead often outweighs its benefits.

As a middle ground, lightweight Kubernetes distributions such as k3s can run on a single VPS; they are a good start for learning Kubernetes or preparing a project that will later move to a cluster. Docker Swarm is a simpler way to manage several servers with syntax close to Compose files.

Practical advice: start with Compose and consider orchestration when you truly need several servers.

What is the difference between Docker Engine, Docker Desktop and Portainer?

Docker Engine is the open-source core component that runs containers on a server; Docker Desktop is a desktop application for Windows and macOS developer machines; Portainer is a separate tool for managing Docker from a web interface. On a Linux server you need Docker Engine and the Compose plugin; Docker Desktop is not installed on servers.

• Docker Engine: open-source licensed and free to use on a Linux server. This is the component you install on a LIONFIN VPS.
• Docker Desktop: provides a local environment on a developer machine. For commercial use, companies above a certain size need a paid subscription; check Docker’s current licence page for the terms.
• Portainer: lets you view and manage containers, images, volumes and Compose stacks from a browser. Useful for team members not used to the command line, but a strong password and HTTPS are essential when exposing the admin interface, and ideally it should be reachable only over a VPN.

Command-line management on its own is enough and offers the smallest attack surface. If you use a web interface, run it as a container behind the reverse proxy and restrict access by IP or through a private VPN server.

What are the most common Docker server problems?

The most common problems are a full disk, growing log files, port conflicts, DNS issues inside containers and containers restarting because of insufficient memory.

The disk is full

Old images, stopped containers and the build cache grow over time. Check usage with docker system df and clean up with docker image prune and docker builder prune. Make sure you have a backup before using commands that delete volumes.

Log files grow without limit

The default json-file log driver can grow files indefinitely. Define log rotation with the max-size and max-file options in /etc/docker/daemon.json.

“port is already allocated” error

Two containers, or a service on the host, are using the same port. Find the owner with ss -tulpn; where possible, do not publish application ports at all and reach them through the reverse proxy.

A container keeps restarting

Read the error with docker compose logs. If the exit code indicates out-of-memory, raise the container’s memory limit or the server’s resources.

A container cannot reach external addresses

Changes to firewall rules may have broken Docker’s network rules. Restarting the Docker service recreates them.

What should you look for when renting a Docker server?

The main points are virtualisation type, root rights, disk speed and size, memory, traffic allowance and flexibility to add resources. If any of these is missing, Docker either will not run or will not perform as expected.

1. KVM virtualisation: remember that Docker needs its own kernel; LIONFIN VPS plans are KVM-based.
2. Full root: the Docker daemon and network settings need root rights.
3. Disk type and space: choose NVMe storage and leave room for images and databases to grow.
4. Memory: in stacks that include a database, memory is the deciding resource.
5. Traffic: image pulls, backup transfers and user traffic make up total data transfer; check the traffic value in the package table.
6. Network protection and monitoring: network-level DDoS filtering with the RouteFence firewall and 24/7 NOC monitoring help keep the server reachable.
7. Scalability: being able to add resources as the project grows, or move to a VDS server with dedicated resources, matters.

For the operating system, a current Ubuntu LTS or Debian release officially supported by Docker works with the fewest surprises.