Install Docker on Ubuntu 24.04: 18 s, 388 MB

For a server you intend to keep, the official apt repository is the path to use: the commands below installed the daemon, the CLI, Buildx and the Compose plugin in a median of 17.8 s (range 15.7 to 19.1 s) on a 4 vCPU, 3 GB VM, and docker info answered 0.7 to 0.8 s after that. The VM shared a busy host (load average 7.7 at the end of the run) and the six repetitions ran in a fixed order, Docker’s repo first, so treat the seconds as indicative. Our recommendation to use the official repository rests on the newer Engine, not on these timings. Ubuntu’s own docker.io package is the alternative if you prefer distribution packaging, and the numbers show its cost is similar.

Steps, as tested

These follow the current Docker instructions for Ubuntu, using the docker.sources file format they now give. The test VM image already had Docker, so the script purged it (apt purge, then removed /var/lib/docker, /var/lib/containerd, /etc/docker, the Docker apt source and the key) before every repetition. ca-certificates and curl were already present on the image.

# 1. Remove conflicting packages (a no-op on the test VM after the purge)
sudo apt remove $(dpkg --get-selections docker.io docker-compose docker-compose-v2 docker-doc docker-buildx podman-docker containerd runc | cut -f1)

# 2. Add Docker's apt repository
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources <<EOS
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOS
sudo apt update

# 3. Install
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# 4. Check
sudo systemctl status docker
sudo docker run hello-world

hello-world printed its greeting in all three repetitions. Running docker without sudo needs a docker group membership step that the test did not use; the Docker post-install page covers it and warns that the docker group grants root-level privileges to the user.

What it cost

Metric	Docker apt repo	Ubuntu docker.io
Package version	5:29.9.2-1~ubuntu.24.04~noble	29.1.3-0ubuntu3~24.04.2
Engine / Compose plugin	29.9.2 / 5.6.1	29.1.3 / 2.40.3+ds1-0ubuntu1~24.04.1
containerd / runc	v2.4.2 / runc version 1.5.2	2.2.1 / runc version 1.3.4-0ubuntu1~24.04.1
Repo setup + apt update (s)	3.8 (3.6-4.8)	0.0 (0.0-0.0)
Package install (s)	14.0 (12.1-14.3)	11.4 (11.0-15.2)
Total, start to packages installed (s)	17.8 (15.7-19.1)	11.4 (11.0-15.2)
Downloaded .deb files (MB)	101.6 (101.6-101.6)	88.6 (88.6-88.6)
Installed-Size of new packages (MB, dpkg KiB x 1024 / 1e6)	387.9 (387.9-387.9)	345.4 (345.4-345.4)
df used delta, incl. dependencies (MB)	491.4 (491.4-491.4)	435.1 (435.1-461.9)
New packages (count)	7	9
dockerd + containerd RSS, idle (MiB)	146.5 (145.2-148.0)	139.7 (139.4-141.6)
docker.service + containerd.service cgroup, idle (MiB)	50.3 (48.5-52.6)	49.2 (48.3-50.6)
hello-world ran (3 reps)	1/1/1	1/1/1

Median of 3 installs, range in parentheses. VM 4 vCPU, 3 GB. Base image had Docker purged before each rep. Idle = median of 5 samples taken 30 s after the hello-world run and `docker system prune -af`, no containers running. Total ends when the packages are installed and does not include enabling the service and waiting for `docker info` (daemon ready took 0.7 to 0.8 s for the Docker repo and 0.2 to 0.4 s for docker.io). The df delta includes the downloaded .deb files left in /var/cache/apt/archives. The docker.io timing excludes apt update (the package lists were refreshed before the timer; the Docker-repo timing includes two apt update runs and the key download).

Three points from the table (idle memory was read after a hello-world run and an image prune, 30 s later):

• Time. Docker’s repo took 3.8 s (median) for the setup steps (the old-package removal, key download, source file and two apt update runs) and 14.0 s for the package install. The docker.io timing leaves out apt update, because the lists were refreshed before its timer started, so the 17.8 s against 11.4 s gap overstates the real difference; the like-for-like figures are 14.0 s against 11.4 s for the package install.
• Disk. Docker’s seven packages are 387.9 MB installed (dpkg’s Installed-Size, 369.9 MiB), with a 101.6 MB download. Ubuntu’s nine packages are 345.4 MB installed with an 88.6 MB download; they include docker-compose-v2, which the script installed explicitly, and dnsmasq-base, bridge-utils and ubuntu-fan as dependencies. The df delta (491.4 MB and 435.1 MB median) is larger than the package sizes mainly because the downloaded .deb files were still in the apt cache when it was read: 387.9 + 101.6 = 489.5 MB, and 345.4 + 88.6 = 434.0 MB.
• Idle memory. With no containers, dockerd plus containerd had a summed resident set of 146.5 MiB (Docker repo) and 139.7 MiB (docker.io). The cgroup counters for docker.service and containerd.service read 50.3 and 49.2 MiB. The two measures disagree by about 3x on the same processes; the resident-set figure probably includes file-backed pages of the large binaries, but the test did not check that.

The versions are the other difference. Docker’s repo gave Engine 29.9.2 with containerd v2.4.2 and runc 1.5.2. Ubuntu’s package gave Engine 29.1.3 with containerd 2.2.1 and runc 1.3.4. Both ran with the containerd image store (overlayfs, io.containerd.snapshotter.v1).

What went wrong

The first run of the script recorded a clean Docker-repo result but nothing for the second and third docker.io repetitions: the purge step listed a package that no longer existed once the Docker repo was removed, so apt purged nothing and the install was a no-op. That run, which also used a 4 GB VM, was discarded. The version here purges only the packages that are actually installed.

What this test did not cover

#!/usr/bin/env bash
# install-docker: time and footprint of Docker Engine from Docker's apt repo vs Ubuntu's docker.io.
# Method: boots the lab base image, purges its pre-installed Docker, then installs three times per variant.
set -uo pipefail
source "$(dirname "$0")/../_lib.sh"
T=install-docker; OUT="$ROOT/evidence/tests/$T"; RAW="$OUT/raw"; rm -rf "$OUT"; mkdir -p "$RAW"
start_vm a-$T
gx 'bc --version >/dev/null 2>&1 || sudo apt-get install -y -qq bc >/dev/null 2>&1; true'
vm scp-to "$ROOT/lab/tests/$T/guest.sh" guest.sh
gx 'bash guest.sh' > "$RAW/guest-stdout.txt" 2>&1
vm scp-from out "$RAW/"; mv "$RAW/out"/* "$RAW/"; rmdir "$RAW/out"
collect_env "$OUT"
python3 "$ROOT/lab/tests/$T/summarize.py" "$RAW" "$OUT"