docker/docker-install

Home of the script that lives at get.docker.com and test.docker.com!

The purpose of the install script is for a convenience for quickly installing the latest Docker-CE releases on the supported linux distros. It is not recommended to depend on this script for deployment to production systems. For more thorough instructions for installing on the supported distros, see the install instructions.

This repository is solely maintained by Docker, Inc.

Usage:

From https://get.docker.com:

curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
rm get-docker.sh

From https://test.docker.com:

curl -fsSL https://test.docker.com -o test-docker.sh
sh test-docker.sh
rm test-docker.sh

From the source repo (This will install latest from the stable channel):

sh install.sh

Package mirrors

Use --mirror to select a Docker package mirror:

Mirror	Download URL
Aliyun	https://mirrors.aliyun.com/docker-ce
AzureChinaCloud	https://mirror.azure.cn/docker-ce
TencentCloud	https://mirrors.cloud.tencent.com/docker-ce

Tencent Cloud environment: use the TencentCloud preset on a Tencent Cloud VM through its VPC private-network route. Keep the default Tencent Cloud VPC DNS configuration and avoid external proxies for private-network validation. According to Tencent Cloud's software mirror documentation, mirrors.cloud.tencent.com is a unified public/private domain that preferentially resolves to the internal route with the default VPC DNS. This is not a claim that the domain can never be reached publicly. Public CI results are not evidence of Tencent Cloud intranet connectivity; live validation must run in that environment.

On a fresh Tencent Cloud VM running a supported Linux distribution, review the script and preview the installation before running it as root:

sh install.sh --mirror TencentCloud --dry-run
sudo sh install.sh --mirror TencentCloud

--dry-run only prints commands; it does not verify DNS, mirror reachability, package availability, or installation success, even when run on a Tencent Cloud VM.

To configure the package repository without installing Docker packages:

sudo sh install.sh --mirror TencentCloud --setup-repo

The DOWNLOAD_URL environment variable remains available for custom mirrors. For example, the following previews the same mirror selection:

sudo env DOWNLOAD_URL=https://mirrors.cloud.tencent.com/docker-ce \
  sh install.sh --dry-run

An explicit --mirror takes precedence over DOWNLOAD_URL. These options select Docker package repositories, not Docker Hub registry mirrors. Mirror selection does not change the supported distributions, and package availability depends on the selected mirror.

Testing:

To verify that the install script works amongst the supported operating systems run:

make shellcheck

APT dpkg lock waiting

APT prerequisite and Engine installations, and the rootless installer's suggested uidmap/iptables installation commands, use DPkg::Lock::Timeout=60. On APT 1.9.11 and later, this bounds waiting for the dpkg frontend and administration locks to 60 seconds; contention that outlasts the timeout still fails. Older APT versions do not provide this waiting behavior. This is a lock-acquisition timeout, not a timeout for the full installation. See the APT implementation history.

The option does not cover the lists lock used by apt-get update; those commands retain their existing behavior. See the APT lists-lock report.

Run the command-generation regression checks without installing packages:

python3 scripts/test-apt-lock-wait.py

The dedicated CI job also checks real fcntl locks in disposable Ubuntu 22.04, Ubuntu 24.04, and Debian 12 containers. To run the same live checks locally:

docker run --rm -v "$PWD:/v:ro" -w /v \
  -e DOCKER_INSTALL_LOCK_TEST_CONTAINER=1 ubuntu:24.04 sh -ec '
    apt-get -qq update
    DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 -y -qq install --no-install-recommends python3 >/dev/null
    python3 scripts/test-apt-lock-wait.py --live
  '

Live checks include a real 60-second timeout; total runtime also depends on APT processing and the container runtime. They verify a fail-fast control, successful waiting after lock release, a real 60-second timeout, CLI precedence over a zero-second configuration default, and the lists lock limitation. They pin the already-installed bash version with downloads disabled; they do not install Docker or validate package/service compatibility.

Offline mirror-option regression checks

Run on a supported Linux distribution, including ordinary GitHub-hosted runners:

sh scripts/test-mirrors.sh

This suite checks argument parsing and dry-run output for all mirror presets, including TencentCloud. It does not contact any mirror or install packages. Downloader, package-manager and service commands are guarded against accidental execution. Output is labelled PASS (offline) and must not be reported as live mirror validation. The separate CI job runs only these offline checks and syntax checks; it does not add Tencent Cloud network access to the installation matrix.

Offline APT version-selection regression checks

sh scripts/test-apt-version-selection.sh
TEST_SHELL=bash sh scripts/test-apt-version-selection.sh

These checks execute the installer's APT installation flow against package-list fixtures and assert the selected Engine and CLI installation arguments. Platform detection is fixed to Ubuntu noble and privileged commands are intercepted by a strict command allowlist, so the checks do not access repositories, change the host, or install packages. They cover version-field boundaries, literal matching, epochs, partial versions, historical -ce releases, pre-releases, and unavailable versions. CI runs the fixtures under both sh and bash. This does not establish live repository availability or installation success; --dry-run still does not resolve version pins.

Opt-in Tencent Cloud intranet smoke check

Run live checks only from a Tencent Cloud VM using the VPC private network. Check the VM's DNS and routing first; do not run this on ordinary GitHub-hosted runners or enable it automatically for untrusted pull requests on private runners. For example, inspect resolution from the VM:

getent ahostsv4 mirrors.cloud.tencent.com

The network script skips by default, before DNS lookup or any network request:

sh scripts/test-tencent-cloud-mirror.sh ubuntu resolute
# SKIP: Tencent Cloud network smoke check is disabled; no network requests made.

After confirming the Tencent Cloud private-network environment, explicitly enable it. The following checks the Ubuntu 26.04 (resolute) repository:

TENCENT_CLOUD_INTRANET=1 \
  sh scripts/test-tencent-cloud-mirror.sh ubuntu resolute

The switch is an operator confirmation, not automatic cloud or route detection. The script covers Ubuntu and Debian APT repositories; pass the target distribution and codename, for example debian trixie. It downloads only the GPG key and Release metadata to temporary files, with HTTPS verification, proxies disabled and bounded timeouts. It neither follows redirects nor silently falls back to another endpoint. It needs curl, not root privileges, and makes no package or service changes.

A disabled check reports SKIP and exits 0. Invalid arguments or opt-in values exit 2. After opting in, DNS/TLS/HTTP errors, timeouts and unexpected content fail with exit 1; they are never converted to a successful skip.

PASS (network smoke only) means the two endpoints returned expected content markers. It does not verify cryptographic signatures, architecture/channel package availability, package downloads, installation, or Docker service startup. For installation acceptance, use a fresh disposable Tencent Cloud VM in the same private-network environment, review the script, and run:

sudo sh install.sh --mirror TencentCloud
sudo docker version
sudo docker info
sudo docker compose version

Record the OS, architecture, commit, network environment and results separately from the offline and smoke checks. Docker Hub access is a separate service and is not part of this package-mirror test.

Offline RPM repository URL regression checks

Run the repository URL argument checks with Python 3:

python3 scripts/test-repository-url-quoting.py
TEST_SHELL=bash python3 scripts/test-repository-url-quoting.py

The suite executes the installer's generated shell commands against inert dnf5, dnf and yum mocks. It checks exact URL arguments, literal special characters, mirror precedence, staging defaults and both channels. It makes no network requests, installs no packages and never writes host repository files. These checks do not validate live RPM repositories or package-manager compatibility.

Legal

Brought to you courtesy of our legal counsel. For more context, please see the NOTICE document in this repo.

Use and transfer of Docker may be subject to certain restrictions by the United States and other governments.

It is your responsibility to ensure that your use and/or transfer does not violate applicable laws.

For more information, please see https://www.bis.doc.gov

Reporting security issues

The maintainers take security seriously. If you discover a security issue, please bring it to their attention right away!

Please DO NOT file a public issue, instead send your report privately to security@docker.com.

Security reports are greatly appreciated and we will publicly thank you for it. We also like to send gifts—if you're into Docker schwag, make sure to let us know. We currently do not offer a paid security bounty program, but are not ruling it out in the future.

Licensing

docker/docker-install is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.

Contributing

Make sure you have read and understood our contributing guidelines.

Make sure all your commits are signed off and include a signature generated with git commit -s.