Base de Conhecimento

This guide covers installing Docker Engine on AlmaLinux or Rocky Linux, including the firewalld and SELinux adjustments specific to RHEL-family distributions.

Prerequisites

• AlmaLinux 9 or Rocky Linux 9 VPS
• Root or sudo access

Step 1 — Remove Any Conflicting Packages

sudo dnf remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine -y

Step 2 — Add the Docker Repository

sudo dnf install dnf-plugins-core -y
sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

The CentOS repository URL works for AlmaLinux/Rocky Linux due to their RHEL/CentOS binary compatibility.

Step 3 — Install Docker Engine

sudo dnf install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

Step 4 — Enable and Start Docker

sudo systemctl enable --now docker

Step 5 — Verify Installation

sudo docker run hello-world

Step 6 — Run Docker Without sudo (Optional)

sudo usermod -aG docker $USER
newgrp docker

Step 7 — Allow Docker's Default Bridge Network Through firewalld

Docker manages its own iptables rules, but ensure firewalld isn't blocking container-to-container or container-to-host communication unexpectedly:

sudo firewall-cmd --permanent --zone=trusted --add-interface=docker0
sudo firewall-cmd --reload

Step 8 — Allow Specific Published Ports

Just like any other service, ports published by containers need explicit firewalld rules:

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

SELinux Considerations for Docker

SELinux can interfere with bind mounts. When mounting a host directory into a container, add the :Z or :z suffix to automatically relabel the SELinux context:

docker run -v /host/path:/container/path:Z myimage

:Z is for private (single-container) use, :z for shared (multi-container) access to the same host directory.

In Docker Compose

services:
  web:
    volumes:
      - ./data:/data:Z

Verifying Docker Compose

docker compose version

Common Errors

"Permission denied" accessing bind-mounted files despite correct Linux permissions — SELinux is blocking the container's access; add :Z or :z to the volume mount as shown above.

sudo ausearch -m avc -ts recent | grep docker

Confirms whether SELinux is the actual cause.

Container can't reach the internet — verify firewalld isn't blocking the Docker bridge network; check the trusted zone configuration from Step 7.

Best Practices

• Always use :Z/:z suffixes on bind mounts to avoid SELinux permission issues
• Check ausearch -m avc whenever a container reports mysterious permission errors
• Follow the same Docker security practices covered generally in Docker Security Best Practices for Production Servers

Continue Reading

• Understanding SELinux Basics on AlmaLinux/Rocky Linux
• How to Configure firewalld on AlmaLinux/Rocky Linux
• Docker Security Best Practices for Production Servers

Browse more articles in AlmaLinux & Rocky Linux.