Home Server Docker Setup: Build a Self-Hosted Container Platform for 2026

# After first boot, update the system
sudo apt update && sudo apt upgrade -y

# Install essential tools
sudo apt install -y curl wget vim htop git ufw

# Remove old versions
for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt remove -y $pkg; done

# Add Docker's official GPG key
sudo apt update
sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Add user to docker group
sudo usermod -aG docker $USER
newgrp docker

# Verify
sudo docker run hello-world

# Create a directory structure for your homelab
mkdir -p ~/homelab/{stacks,backups,media,configs}

# For large media libraries, mount an external drive or NAS
# Example: mount a TrueNAS NFS share
sudo apt install -y nfs-common
sudo mkdir -p /mnt/nas-media
sudo mount -t nfs 192.168.1.10:/mnt/tank/media /mnt/nas-media

# Add to /etc/fstab for persistence
echo "192.168.1.10:/mnt/tank/media /mnt/nas-media nfs defaults 0 0" | sudo tee -a /etc/fstab

# For databases, use a fast local SSD
mkdir -p ~/homelab/stacks/db

# Configure UFW
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH
sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable

# Harden SSH
sudo sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# Enable automatic updates
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# Configure Docker daemon for security
sudo tee /etc/docker/daemon.json <<EOF
{
  "live-restore": true,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "no-new-privileges": true,
  "userland-proxy": false
}
EOF
sudo systemctl restart docker

version: "3.8"

services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: always
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "[email protected]"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`traefik.local`)"
      - "traefik.http.routers.traefik.service=api@internal"

  whoami:
    image: traefik/whoami
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.local`)"

  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    restart: always
    ports:
      - "9000:9000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`portainer.local`)"

volumes:
  portainer_data:

cd ~/homelab/stacks
docker compose up -d

cd ~/homelab
 git init
 git add .
 git commit -m "Initial homelab stack"

# Backup all named volumes
docker volume ls -q | while read vol; do
  docker run --rm -v "$vol":/data -v ~/homelab/backups:/backup alpine \
    tar czf "/backup/$vol-$(date +%F).tar.gz" -C /data .
done

sudo docker run --rm -ti \
  --name=ctop \
  --volume /var/run/docker.sock:/var/run/docker.sock:ro \
  quay.io/vektorlab/ctop:latest

# Check logs
sudo journalctl -u docker.service

# Verify daemon.json syntax
sudo python3 -m json.tool /etc/docker/daemon.json

# Check if Docker's iptables rules are present
sudo iptables -L -n -v | grep DOCKER

# Restart Docker to recreate rules
sudo systemctl restart docker

# Check container user ID
docker exec <container> id

# Fix host permissions
sudo chown -R 1000:1000 ~/homelab/stacks/<service>