Introduction

Installing Docker on Amazon Linux 2 is straightforward, but a production-usable host needs more than just package installation. You need service persistence, safe user access, daemon configuration, and post-install verification. This guide focuses on a stable setup path for EC2 or similar Amazon Linux 2 hosts.

Install Docker from Amazon Linux Extras

Start by updating packages and installing Docker through the Amazon-managed channel.

sudo yum update -y
sudo amazon-linux-extras install docker -y

Check installation:

docker --version

If the command is not found, reopen the shell and confirm package output. Package installation sometimes succeeds while path state in current shell is stale.

Start and Enable the Docker Daemon

Installation does not guarantee daemon startup. Explicitly start service and enable it on boot.

sudo systemctl start docker
sudo systemctl enable docker
sudo systemctl status docker --no-pager

If status shows failure, inspect recent service logs:

sudo journalctl -u docker -n 100 --no-pager

Always resolve daemon health before attempting image pulls.

Verify Runtime with a Test Container

Run a known image to validate pull, create, and run flow.

sudo docker run --rm hello-world

This confirms:

• daemon accepts API requests
• host can reach container registry
• container runtime works end to end

If pull fails, check security group egress, route table, proxy config, and DNS resolution.

Configure Non-Root Access Carefully

By default, Docker commands require sudo. To allow a user to run Docker directly, add user to docker group.

sudo usermod -aG docker ec2-user

Apply membership in a new shell session:

newgrp docker
docker ps

Important security note: membership in docker group effectively grants high host privileges. Add only trusted operators.

Configure Daemon Log Rotation

Without log rotation, container logs can fill disk and break workloads. Add a daemon config file.

/etc/docker/daemon.json:

1{
2  "log-driver": "json-file",
3  "log-opts": {
4    "max-size": "10m",
5    "max-file": "5"
6  }
7}

Restart and verify:

sudo systemctl restart docker
sudo systemctl status docker --no-pager

Invalid JSON prevents daemon startup, so verify status immediately after changes.

Install Compose Plugin if Needed

For Compose workflows, install the plugin package and use current command syntax.

sudo yum install docker-compose-plugin -y
docker compose version

Prefer docker compose over legacy standalone docker-compose in new setups.

Add a Minimal Hardening Baseline

Before running real workloads, apply host and runtime hygiene:

• patch host regularly
• keep exposed ports minimal with security groups
• avoid opening Docker remote API publicly
• pin image tags to known versions
• keep secrets out of image layers and command history

Installation success is not the same as secure runtime posture.

Reboot and Persistence Validation

Confirm that daemon remains healthy across host restart.

sudo reboot

After reconnect:

systemctl is-active docker
docker ps

Also check runtime storage usage:

docker system df

Set periodic cleanup policies for dangling images and stopped containers on long-lived hosts.

Useful Post-Install Validation Script

A repeatable script helps verify host state after patches or AMI changes.

1#!/usr/bin/env bash
2set -euo pipefail
3
4echo "Docker version:"
5docker --version
6
7echo "Daemon status:"
8systemctl is-active docker
9
10echo "Runtime check:"
11docker run --rm hello-world >/dev/null
12
13echo "Server details:"
14docker info --format '{{.ServerVersion}}'

Store this script with your infrastructure documentation to reduce drift.

Common Pitfalls

A frequent issue is installing Docker but forgetting systemctl enable, then finding Docker unavailable after reboot.

Another issue is broad docker group assignment. This creates unnecessary privilege exposure.

Many teams skip log rotation and discover disk exhaustion during incidents. Set log limits early.

Daemon config edits are another failure point. Bad JSON in daemon.json can stop Docker from starting.

Finally, a single hello-world run does not prove production readiness. Keep ongoing checks for patching, resource pressure, and security posture.

Summary

• Install Docker on Amazon Linux 2 using amazon-linux-extras.
• Start and enable daemon explicitly, then validate runtime behavior.
• Grant non-root Docker access only to trusted users.
• Configure daemon log rotation to prevent disk-related outages.
• Add post-install validation and hardening steps before real workloads.