How to Install Docker on Debian

Docker Engine runs containers on Linux through a daemon (dockerd), the docker CLI, and containerd. On Debian, most tutorials and vendor deployment notes expect Docker CE from Docker’s official APT repository—not the legacy standalone docker-compose binary and not packages built for Ubuntu URLs.

This guide covers install Docker on Debian for Debian 11 (Bullseye), 12 (Bookworm), and 13 (Trixie): add the official deb822 repository, install docker-ce with Compose V2 and Buildx, optionally use Debian’s docker.io package, run hello-world, add your user to the docker group, upgrade, and remove cleanly. I ran the repository setup and full docker-ce install on Debian 13; docker compose build worked locally. Pulling hello-world from Docker Hub failed on my test host behind an SSL-inspecting proxy—normal networks with outbound Hub access should see the standard success message.

Tested on: Debian 13 (trixie); kernel 6.12.94+deb13-amd64; amd64; Docker CE 29.6.1, Compose 5.2.0, containerd 2.2.5.

Choose an install method

Most readers should use the official Docker CE repository. Pick docker.io only when you deliberately want Debian-maintained packages and do not need Docker Inc’s current plugin set.

Prerequisites

• Debian 11, 12, or 13 on amd64, arm64, or another architecture Docker publishes for Debian—not i386.
• sudo and HTTPS access to download.docker.com (or HTTP only in broken-proxy edge cases—not recommended).
• cURL and ca-certificates for the repository key.
• Enough disk for images and container layers under /var/lib/docker/.

Check your codename and architecture before adding any repository:

. /etc/os-release && printf '%s (%s)\n' "$PRETTY_NAME" "$VERSION_CODENAME"
dpkg --print-architecture

On the test host:

Debian GNU/Linux 13 (trixie) (trixie)
amd64

Refresh APT metadata:

sudo apt update && sudo apt full-upgrade -y

Remove conflicting packages

Debian may already ship docker.io, podman-docker, or older containerd packages. Docker CE replaces them with Docker’s own stack. Remove conflicts before adding the Docker repository (official prerequisite step):

for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do
  sudo apt remove -y "$pkg" 2>/dev/null || true
done

Removing packages does not delete existing data under /var/lib/docker/ unless you purge volumes separately.

Method 1: Install Docker CE from the official repository

This mirrors Install Docker Engine on Debian using deb822 sources.

Add Docker’s signing key

sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

Inspect the key fingerprint when gpg is available:

gpg --show-keys --with-fingerprint /etc/apt/keyrings/docker.asc

Expected identity:

pub   rsa4096 2017-02-22 [SCEA]
      9DC8 5822 9FC7 DD38 854A  E2D8 8D81 803C 0EBF CD88
uid                      Docker Release (CE deb) <[email protected]>

Create the deb822 source file

The suite must match VERSION_CODENAME from /etc/os-release:

sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

On Debian 13 the file contains Suites: trixie and Architectures: amd64.

Update indexes and confirm docker-ce comes from Docker’s repository:

sudo apt update
apt-cache policy docker-ce

Healthy output on Debian 13:

docker-ce:
  Installed: (none)
  Candidate: 5:29.6.1-1~debian.13~trixie
  Version table:
     5:29.6.1-1~debian.13~trixie 500
        500 https://download.docker.com/linux/debian trixie/stable amd64 Packages

Install Engine, CLI, containerd, Buildx, and Compose V2

sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Installed versions on the test host:

containerd.io          2.2.5-1~debian.13~trixie
docker-buildx-plugin   0.35.0-1~debian.13~trixie
docker-ce              5:29.6.1-1~debian.13~trixie
docker-ce-cli          5:29.6.1-1~debian.13~trixie
docker-compose-plugin  5.2.0-1~debian.13~trixie

Check the client and service:

docker --version
docker compose version
systemctl status docker.service --no-pager

Docker version 29.6.1, build 8900f1d
Docker Compose version v5.2.0
● docker.service - Docker Application Container Engine
     Active: active (running)

Verify with hello-world

sudo docker run --rm hello-world

When Docker Hub is reachable, the tail of the output looks like:

Hello from Docker!
This message shows that your installation appears to be working correctly.

On my proxy-filtered test VM, Hub pulls failed with a TLS certificate error. The daemon itself was healthy—docker info reported Server Version: 29.6.1, and a local docker build completed successfully. If you hit the same TLS error, fix corporate CA trust on the host or test from a network without SSL interception before assuming the Engine install failed.

Smoke-test Compose with a local build

This avoids Docker Hub while proving docker compose works:

mkdir -p ~/docker-compose-demo && cd ~/docker-compose-demo
cat > Dockerfile <<'EOF'
FROM scratch
COPY msg /msg
EOF
echo -n 'compose works' > msg
cat > compose.yaml <<'EOF'
services:
  app:
    build: .
    image: compose-local:latest
EOF
sudo docker compose build

Near the end of the build:

Image compose-local:latest Built

Remove the demo directory when finished: cd ~ && rm -rf ~/docker-compose-demo.

Method 2: Install Debian docker.io from main archives

When you want Docker from Debian’s own repositories without adding Docker Inc’s source:

sudo apt install -y docker.io

Package availability on Debian 13:

docker.io:
  Candidate: 26.1.5+dfsg1-9+b13

docker.io follows Debian’s security and release policy. It does not install the same docker-compose-plugin and docker-buildx-plugin package names from Docker’s repository. Use this path for simple container workflows; use Method 1 when a project’s README says docker compose and current Engine features.

Method 3: Enable Docker CE with extrepo

extrepo can manage the Docker CE source for you:

sudo apt install -y extrepo
sudo extrepo enable docker-ce
sudo apt update
apt-cache policy docker-ce

Use either extrepo or the manual docker.sources file from Method 1—not both. If you switch, remove the other source before sudo apt update:

sudo rm -f /etc/apt/sources.list.d/docker.sources /etc/apt/keyrings/docker.asc
# or, when moving away from extrepo:
sudo extrepo disable docker-ce

Run Docker without sudo

The install creates a docker group. Members can talk to the rootful daemon socket:

sudo usermod -aG docker "$USER"
newgrp docker
docker ps

Log out and back in on graphical sessions so the group change applies everywhere.

Daily commands worth knowing

For container lifecycle patterns, see manage Docker containers with examples.

Optional: log rotation in daemon.json

On busy hosts, cap JSON log growth:

sudo install -m 0755 -d /etc/docker
sudo tee /etc/docker/daemon.json <<'EOF'
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}
EOF
python3 -m json.tool /etc/docker/daemon.json
sudo systemctl restart docker.service

Upgrade Docker CE

Routine upgrades through APT:

sudo apt update
sudo apt install --only-upgrade docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

List available versions before pinning:

apt list --all-versions docker-ce | head

Uninstall Docker CE

Stop the daemon and remove packages (similar workflow on Ubuntu):

sudo systemctl stop docker.service docker.socket 2>/dev/null || true
sudo apt purge -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-ce-rootless-extras
sudo apt autoremove -y

Remove repository configuration:

sudo rm -f /etc/apt/sources.list.d/docker.sources
sudo rm -f /etc/apt/keyrings/docker.asc
sudo apt update

Confirm removal with list installed packages on Debian:

dpkg-query -W 'docker-ce*' 'containerd.io' 'docker-compose-plugin' 2>/dev/null || echo 'Docker CE packages removed'
command -v docker || echo 'docker command not found'

Troubleshooting

Wrong repository URL example

If a guide uses Ubuntu’s path with a Debian codename, APT reports:

E: The repository 'https://download.docker.com/linux/ubuntu trixie Release' does not have a Release file.

Remove that source and recreate docker.sources with linux/debian.

References

• Install Docker Engine on Debian — official repository and package list
• Docker Compose plugin — V2 via docker-compose-plugin
• Docker rootless mode — user-namespace daemon
• APT command in Linux — update, install, and upgrade
• Install curl on Debian — fetch repository keys
• Manage Docker containers — next steps after install

Summary

For current Docker Engine, Buildx, and Compose V2 on Debian, add Docker’s deb822 source with the correct codename, install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin, and run sudo docker run --rm hello-world. Use docker.io only when you want Debian’s packaged engine without Docker Inc’s repository. Match trixie, bookworm, or bullseye to your release, remove conflicting packages first, and add trusted users to the docker group only when you accept the security trade-off. I installed Docker CE 29.6.1 on Debian 13 from the official repository; verify Hub pulls on your network if a proxy sits between you and registry-1.docker.io.