💡
Before you install Docker Engine for the first time on a new host machine, you need to set up the Docker repository by adding Docker's official GPG key. Afterward, you can install and update Docker from the repository.
1. Update the package database to get the latest versions of packages and their dependencies:
```bash
sudo apt-get update
```
2. Install packages that allow `apt` to use a repository over HTTPS:
```bash
sudo apt-get install ca-certificates curl gnupg
```
* [`ca-certificates`](https://askubuntu.com/questions/857476/what-is-the-use-purpose-of-the-ca-certificates-package) package contains a set of Certificate Authority (CA) certificates. These are essential for verifying the authenticity of SSL/TLS certificates - in other words, they are used to establish the trustworthiness of secure websites and downloaded packages.
* [`curl`](https://phoenixnap.com/kb/curl-command#:~:text=What%20Is%20the%20curl%20Command%3F): Curl is a command-line tool and library for transferring data with URLs. It's used for downloading files from the internet and can handle a variety of protocols, including HTTP, HTTPS, FTP, and more.
* [`gnupg`](https://www.gnupg.org/): Stands for GNU Privacy Guard; it's a package for encryption and signing data. It's used here primarily for handling the GPG key related to Docker.
![](https://i.imgur.com/wGJ6LOF.png align="center")
3. Create a new directory named `/etc/apt/keyrings` with read, write, and execute permissions for the owner, and read and execute permissions for group members and other users.
```bash
sudo install -m 0755 -d /etc/apt/keyrings
```
4. Download the GPG key for the Docker repository from its website and save it as a binary keyring file in `/etc/apt/keyrings`, which APT can then use to verify the authenticity of Docker packages downloaded from the repository:
```bash
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
```
* [`gpg --dearmor`](https://github.com/grafana/grafana/issues/72687#:~:text=gpg%20%2D%2Ddearmor%20creates%20the%20binary%20key.) is used to convert the armored GPG key (ASCII text format) into a binary format.
* `-o /etc/apt/keyrings/docker.gpg` specifies the output file where the converted key should be saved.
This is a security step: when APT is downloading packages from the Docker repository, it can use this GPG key to verify that the packages are authentic and haven't been tampered with. The GPG key mechanism explanation is provided in the next section.
5. Change the file permissions of the Docker GPG key to be readable by all users:
```bash
sudo chmod a+r /etc/apt/keyrings/docker.gpg
```
6. Verify that you now have the key with the fingerprint. Run:
```bash
sudo apt-key fingerprint
```
![](https://i.imgur.com/lCs53qh.png align="center")
7. Add the Docker Repository to APT sources:
```bash
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
```
The command above is used in Ubuntu-based systems to add Docker's official APT repository to the list of sources from which packages can be installed.
8. Update Package Database with Docker Packages.
```bash
sudo apt update
```
9. Now, install the latest version of Docker CE (Community Edition) using:
```bash
sudo apt install docker-ce
```
💡
We can install Docker either directly from Docker's official repository (docker-ce) and get the latest version of Docker or from Ubuntu's repository (docker.io) maintained by the Ubuntu community which might not always be the latest version of Docker. In this hands-on, we download docker-ce.
10. Check if Docker is running:
```bash
sudo systemctl status docker
```
If Docker is running, you'll see an active (running) status in the output.
11. Add Your User to the Docker Group (Optional). By default, running the `docker` command requires administrator privileges. To run Docker commands as your non-root user, add your user to the `docker` group:
```bash
sudo usermod -aG docker ${USER}
```
You'll need to log out and back in for this to take effect.
12. Test Docker. Run the `hello-world` image to test if Docker is correctly installed:
```bash
docker run hello-world
```
![](https://i.imgur.com/c1rjEfp.png align="center")
13. Configure Docker to Start on Boot (Optional). Enable Docker to start on boot with:
```bash
sudo systemctl enable docker
```
### **How GPG Works in Package Verification**
1. **Key Pair**: GPG operates using a pair of keys:
* **Private Key**: Known only to the key's owner, used for signing data.
* **Public Key**: Distributed openly, used for verifying signatures.
2. **Signing the Package**:
* The package maintainer (e.g., Docker) signs the package with their private GPG key before distributing it. This signature is a form of a digital fingerprint uniquely generated from the package content via a hashing algorithm.
* The signing process doesn't encrypt the whole package; it just generates a signature based on the package's content.
3. **Distributing the Public Key**:
* The maintainer also makes their public GPG key available, often on a website or in a public key server. This public key is what users will download and add to their keyring.
* This public key can verify signatures made by the corresponding private key but can't be used to generate those signatures.
4. **User Downloads the Package**:
* When a user downloads the package, they also receive the digital signature.
5. **Verification Process**:
* On the user's side, the GPG tool uses the maintainer's public key to verify the signature attached to the package.
* If the signature is valid, it ensures that the package hasn't been altered since it was signed - i.e., it's authentic and unmodified.
## References
1. [How to Install Docker on Ubuntu: A Step-By-Step Guide](https://www.youtube.com/watch?v=cqbh-RneBlk)
2. [Install Docker Engine on Ubuntu](https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository)
3. [What is PGP/GPG Encryption? In 3 Minutes - PGP/GPG Tutorial for Beginners](https://www.youtube.com/watch?v=1-MPcUHhXoc)
4. [Public and Private Keys - Signatures & Key Exchanges - Cryptography - Practical TLS](https://www.youtube.com/watch?v=_zyKvPvh808)
5. [Installing Docker on Ubuntu 20.04](https://www.youtube.com/watch?v=K03beiGemKQ)