It can also optionally add a chosen Linux user to the docker group so Docker commands can be run without sudo after the user logs out/in. If requested, it can install Portainer CE as a local Docker container too.

One-command install

Install Docker only:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/install-docker.sh | bash

Install Docker and add the current SSH/login user to the docker group:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/install-docker.sh | bash -s -- --current-user

Install Docker and add a specific user to the docker group:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/install-docker.sh | bash -s -- --user obin

Install Docker, add the current SSH/login user, and install Portainer CE:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/install-docker.sh | bash -s -- --current-user --portainer

Install Docker and Portainer CE only:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/install-docker.sh | bash -s -- --portainer

Non-interactive install without adding a docker user:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/install-docker.sh | bash -s -- --yes

Local usage

git clone https://gitea.wheelytho.com/Wheelz/Docker-Install.git
cd Docker-Install
chmod +x install-docker.sh
./install-docker.sh --current-user

The old Docker-Install.sh filename still exists as a compatibility wrapper.

PatchMon enrollment

Enroll a Linux host into PatchMon. By default this uses the PatchMon LXC at http://192.168.20.232:3000 and the direct-host enrollment type.

Recommended interactive one-liner. It prompts for the PatchMon auto-enrollment token key and secret:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/patchmon-enroll.sh | sudo bash

Non-interactive direct-host enrollment:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/patchmon-enroll.sh | sudo bash -s -- --token-key '<key>' --token-secret '<secret>' --type direct-host -y

Proxmox LXC enrollment:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/patchmon-enroll.sh | sudo bash -s -- --token-key '<key>' --token-secret '<secret>' --type proxmox-lxc -y

Useful options:

--server URL             PatchMon base URL. Default: http://192.168.20.232:3000
--type TYPE              direct-host or proxmox-lxc. Default: direct-host
--friendly-name NAME     Friendly name to report to PatchMon
--force                  Ask PatchMon's generated installer to force/reinstall when supported
--print-script           Download and print the generated PatchMon script instead of running it
-y, --yes                Non-interactive mode

Token note: keep the token secret out of Git. Store it in a password manager or a local .env and paste/use it at enrollment time only.

Options

--user USER        Add USER to the docker group after install.
--current-user     Add the invoking SSH/login user to the docker group.
--no-docker-user             Do not add anyone to the docker group.
--portainer                  Install or start Portainer CE after Docker install.
--portainer-port PORT        Host port for Portainer HTTPS UI. Default: 9443.
--portainer-edge-port PORT   Host port for Portainer Edge agent tunnel. Default: 8000.
--portainer-image IMAGE      Portainer image to run. Default: portainer/portainer-ce:lts.
-y, --yes                    Non-interactive defaults. Skips docker group unless --user/--current-user is supplied.
-h, --help                   Show help.

After adding a user to the docker group

Group membership does not apply to already-open shells. Log out and back in, or run:

newgrp docker

Then verify Docker works without sudo:

docker run --rm hello-world

Portainer

When --portainer is supplied, the installer creates a persistent Docker volume named portainer_data and starts Portainer CE with:

HTTPS UI: https://<server-ip>:9443
Edge agent tunnel: <server-ip>:8000
Container name: portainer
Restart policy: always

Portainer uses a self-signed certificate by default, so the browser warning is expected on first visit.

Custom Portainer UI port example:

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/install-docker.sh | bash -s -- --current-user --portainer --portainer-port 9444

Supported systems

Ubuntu
Debian

The installer uses Docker's official apt repository for the detected OS and codename.

Trust Wheelz Caddy local HTTPS CA

Use this on Linux hosts that need to trust internal *.wheelz.lab HTTPS services such as PatchMon. It installs the public Caddy local root CA and verifies the certificate SHA256.

curl -fsSL https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/install-caddy-local-ca.sh | sudo bash

Certificate SHA256:

d4b15cd45c797fd329df47b634d0fc7e9f858e9506ed572c64d00332ea5cf388