Knowledgebase

If your plan includes Docker, it is already running for you: your account has its own rootless Docker daemon, started and kept alive by the platform, so you can run containers under your own user with no sudo and nothing to set up first.

Use it straight away

Log in over SSH and use the normal Docker commands:

docker ps lists running containers
docker ps -a lists all containers, running and stopped
docker images lists downloaded images
docker pull image_name downloads an image
docker run -d --name my_app -p 127.0.0.1:18080:80 image_name starts a container in the background and makes its port 80 reachable on port 18080 of the server's local address (127.0.0.1), not the public internet
docker stop my_app, docker start my_app and docker restart my_app control a container
docker rm my_app and docker rmi image_name remove a stopped container or an image

Your shell already points Docker at your own daemon: ~/.bashrc sets DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock. Type docker-help for a short summary of how Docker works on your server.

Ready-made helpers

Your ~/bin includes docker-install-lsio, which sets up common LinuxServer.io apps (Jellyfin, qBittorrent, Transmission, Sonarr, Radarr, Prowlarr, MariaDB and phpMyAdmin) as containers bound to 127.0.0.1, and docker-install-wireguard.sh for a WireGuard container. Other accounts on the same server can still reach 127.0.0.1, so turn on the login in each app you install.

If Docker stops answering

If docker ps says it cannot connect to the Docker socket, give it a few minutes: a watchdog checks your daemon every five minutes and starts it again. If it is still down after that, start it yourself from an SSH login:

systemctl --user start docker

If that reports a bus or session error, log in over SSH directly as your own user and run it again.

If the Docker processes are running but docker ps still cannot connect, do not restart them with systemctl, because that clashes with the daemon the watchdog started. Stop your own Docker processes instead and the watchdog starts a fresh daemon within a few minutes:

pkill -x -u $(id -u) rootlesskit

Containers started with a restart policy, like the ones the helpers create, come back with the daemon. Start any others with docker start my_app.

More

Running Docker and custom apps on your seedbox covers ports and HTTPS for your own containers, and Docker on PMSS on our wiki has more detail. Docker's own page on rootless mode limitations lists what rootless Docker cannot do.