---
title: "Docker"
category: "Developer tools"
tagline: "Run apps and services in containers, with Docker Compose, a working firewall and no sudo."
source: "pacman"
package: "docker"
command: "docker"
website: "https://www.docker.com/"
code: "https://github.com/moby/moby"
links:
  - name: "Docker Compose"
    url: "https://docs.docker.com/compose/"
  - name: "ufw-docker"
    url: "https://github.com/chaifeng/ufw-docker"
---

## What it is

Docker runs software in containers: isolated packages that hold an app with everything it needs, from libraries to configuration. A container runs the same on your laptop as on a server, so you can start a database, a web app or a whole development stack with one command, and remove it without leaving anything behind.

Docker Compose describes a set of containers that work together, such as an app, its database and a cache, in one `compose.yaml` file, and starts them all with `docker compose up`.

## Why it's here

- **Clean installs.** Try or run services without installing them on the system.
- **The same everywhere.** What runs in a container here runs the same in production.
- **Whole stacks at once.** Compose brings up every service a project needs.

## On CoreDesktop

CoreDesktop installs Docker and Docker Compose from pacman, enables and starts the Docker service, and adds you to the `docker` group so you can run `docker` without sudo. The group takes effect at your next login. The aliases `d` for `docker` and `ld` for [lazydocker](/software/lazydocker/) are set up too.

Ports that Docker containers publish would normally get around the ufw firewall, so CoreDesktop also installs ufw-docker. To let a container's port through:

```
sudo ufw-docker allow <container> <port>
```

`audit` lists ports containers publish. The AI agents in the [AI sandbox](/ai-sandbox/) can't reach the Docker socket or your Docker credentials. `update` keeps Docker current with the rest of the pacman packages.