How to Install Docker on Debian 13 (Trixie)

Docker is an open-source containerization platform for building, testing, and running applications in containers. On Debian 13, the safest way to install Docker Engine is to use Docker’s official APT repository instead of the older docker.io package from the Debian repositories.

This tutorial explains how to install Docker on Debian 13 (Trixie), verify the service, install the Docker Compose plugin, and fix the most common repository, keyring, and service errors.

Quick Reference #

Prerequisites #

Before you begin, make sure that:

• You are running Debian 13 on a supported architecture: amd64, arm64, armhf, or ppc64el.
• You have a user account with sudo privileges .
• Your system is connected to the internet and up to date.

Docker is available in the default Debian repositories, but those packages are often outdated. To get the latest stable version, install Docker from the official Docker repository.

Uninstall any old or conflicting Docker packages first:

sudo apt remove $(dpkg --get-selections docker.io docker-compose docker-doc docker-buildx podman-docker containerd runc | cut -f1)

The dpkg --get-selections part passes only the packages that are installed on your system to apt, so the command does not fail on names that are missing. It is fine if dpkg prints no packages found matching lines; they mean that those packages are not installed.

Installing Docker on Debian 13 #

The installation involves adding the Docker repository, importing the GPG key, and installing the Docker packages.

Step 1: Update the Package Index and Install Dependencies #

Update the package index and install the packages required to add repositories over HTTPS:

sudo apt update
sudo apt install ca-certificates curl

Step 2: Import Docker’s Official GPG Key #

Add Docker’s official GPG key so your system can verify package authenticity:

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

Step 3: Add the Docker APT Repository #

Add the Docker repository to your system:

sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

On Debian 13, $(. /etc/os-release && echo "$VERSION_CODENAME") returns trixie. If you are installing Docker on a Debian derivative, replace that value with the matching Debian codename.

Step 4: Install Docker Engine #

Update the package index and install Docker:

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Installing a Specific Docker Version (Optional) #

To install a specific Docker version instead of the latest one, first list the available versions:

sudo apt update
apt list --all-versions docker-ce

The available Docker versions are printed in the second column:

docker-ce/trixie 5:29.9.2-1~debian.13~trixie amd64
docker-ce/trixie 5:29.9.1-1~debian.13~trixie amd64
docker-ce/trixie 5:29.9.0-1~debian.13~trixie amd64
...

Install a specific version by adding =<VERSION> after the package name.

For example, to install Docker 29.9.1, set a variable to its full version string and pass it to apt:

DOCKER_VERSION="5:29.9.1-1~debian.13~trixie"
sudo apt install docker-ce=$DOCKER_VERSION docker-ce-cli=$DOCKER_VERSION containerd.io docker-buildx-plugin docker-compose-plugin

Use the full string from apt list --all-versions docker-ce, including the 5: epoch prefix and the ~debian.13~trixie suffix.

Verify the Docker Installation #

On most Debian systems, the Docker service starts automatically after installation. If it does not, start it manually:

sudo systemctl start docker

Check the service status:

sudo systemctl status docker

The output will look something like this:

● docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled)
   Active: active (running)
...

You can also confirm that the Docker client and daemon are responding:

sudo docker version

To verify that Docker can pull and run containers correctly, run the test image:

sudo docker run hello-world

If the image is not found locally, Docker will download it from Docker Hub, run the container, print a “Hello from Docker” message, and exit.

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
...
Hello from Docker!
This message shows that your installation appears to be working correctly.
...

The container stops after printing the message because it has no long-running process.

Run Docker Commands Without sudo #

By default, only root and users with sudo privileges can run Docker commands.

To allow a non-root user to execute Docker commands, add the user to the docker group:

sudo usermod -aG docker $USER

$USER is an environment variable that holds the currently logged-in username. To add a different user, replace $USER with the username.

Run newgrp docker or log out and log back in for the group membership change to take effect.

After the group membership is active, rerun the test container without sudo :

docker run hello-world

If the command works without sudo, your user has access to the Docker socket.

Updating Docker #

When a new Docker version is released, update it using standard system commands:

sudo apt update
sudo apt upgrade

To prevent Docker from being updated automatically, mark it as held:

sudo apt-mark hold docker-ce

Uninstalling Docker #

Uninstalling Docker does not automatically remove your containers, images, or volumes. You can keep that data for a later reinstallation.

If you want to clean up unused Docker data before uninstalling, stop only the containers you intend to remove.

Run the optional cleanup command and review the confirmation prompt before continuing:

docker system prune -a --volumes

Remove Docker packages:

sudo apt purge docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-ce-rootless-extras
sudo apt autoremove

If you also want to permanently delete the remaining data in Docker’s default data directories, including named volumes, first back it up and make sure Docker and containerd are stopped. Then delete the directories:

sudo rm -rf /var/lib/{docker,containerd}

Remove the Docker repository and keyring if you do not plan to install Docker again:

sudo rm -f /etc/apt/sources.list.d/docker.sources
sudo rm -f /etc/apt/keyrings/docker.asc

Troubleshooting #

Package 'docker-ce' has no installation candidate
The Docker repository is missing, the Debian codename is wrong, or sudo apt update was not run after adding the repository. Check /etc/apt/sources.list.d/docker.sources, confirm that Suites: is set to trixie, and run sudo apt update again.

The repository ... does not have a Release file
This usually happens when the repository URL or codename is wrong. For Debian 13, URIs: must be https://download.docker.com/linux/debian and Suites: must be trixie. Do not use the Ubuntu Docker repository on Debian.

GPG or NO_PUBKEY errors during apt update
Recreate the keyring file and make it readable:

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
sudo apt update

Cannot connect to the Docker daemon
The Docker service is not running, or your user does not have access to the Docker socket. Start the service with sudo systemctl start docker, then check it with sudo systemctl status docker.

permission denied while trying to connect to the Docker daemon socket
Your user is not in the docker group, or the group change has not taken effect. Run sudo usermod -aG docker $USER, then log out and back in or run newgrp docker.

Docker and nftables firewall rules do not behave as expected
Docker uses the iptables firewall backend by default, which works with iptables-nft or iptables-legacy. If you manage firewall rules manually, check Docker’s firewall backend before changing networking rules. Docker 29.0.0 introduced an experimental native nftables backend, enabled with "firewall-backend": "nftables" in the daemon configuration. It requires migration checks and cannot be used in Swarm mode; follow the Docker nftables documentation before enabling it.

FAQ #

Can I install Docker from the default Debian repositories?
Yes, but the version in the Debian repositories is often outdated. The official Docker repository provides the latest stable release with security updates.

Does Docker support Debian 12 (Bookworm) and Debian 11 (Bullseye)?
Docker officially supports Debian 13 (Trixie) and Debian 12 (Bookworm). On Debian 12, the installation steps are the same; only the codename in the repository configuration changes. Debian 11 (Bullseye) is no longer on Docker’s supported list, and its free security support ended in August 2026, so upgrade to Debian 12 first.

What is the difference between docker-ce and docker.io?
docker-ce (Community Edition) is the official package from Docker, Inc. maintained in their own repository. docker.io is the package maintained by the Debian project. docker-ce is updated more frequently and is the recommended choice.

How do I check which Docker version is installed?
Run docker version to see both the client and server versions.

Is Docker Compose included?
Yes. The docker-compose-plugin package is installed alongside Docker Engine. Use docker compose (without the hyphen) to run Compose commands, and run docker compose version to confirm it is installed.

Is this the same as Docker Desktop for Debian?
No. This guide installs Docker Engine for servers and command-line use. Docker Desktop is a separate desktop application with its own requirements and installer.

Conclusion #

Installing Docker on Debian 13 from Docker’s official repository gives you current Docker Engine, CLI, Buildx, containerd, and Compose plugin packages through APT. After installation, verify the service with docker version and hello-world, then add your user to the docker group if you want to run Docker without sudo.

For advanced configuration, check the official Docker post-install guide .

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page