Install Docker on Amazon Linux 2023: dnf install docker, the Missing Compose Plugin, "permission denied" on docker.sock, and Why Containers Don't Start After a Reboot

To install Docker on Amazon Linux 2023, run sudo dnf install -y docker, then sudo systemctl enable --now docker, then sudo usermod -aG docker ec2-user and log out and back in. Docker is in AL2023's own repository, so there's no extra repository to add. The second command is the one people skip, and here's what it costs: installing the package only turns on docker.socket, not the Docker service, so after a reboot Docker isn't running, and containers set to --restart always stay down until someone happens to run a docker command. Two more things catch everyone: docker compose fails with "docker: 'compose' is not a docker command" because AL2023 doesn't package Compose (one curl command adds it), and docker ps without sudo fails with "permission denied while trying to connect to the Docker daemon socket" until you're in the docker group and in a new login session. This page covers each step and each error, plus a user data script that sets up a new instance in one go.

Ethan, a developer, moved the small booking app for his friend Jake's phone repair shop into containers on an Amazon Linux 2023 server. Everything ran. Then AWS rebooted the instance for maintenance one night, and the booking page was down until Ethan logged in the next morning and typed docker ps, at which point it came back by itself.

New to containers? Our guide to containers vs virtual machines explains what Docker does, and Amazon EC2 is the server it runs on here.

Install and start Docker on Amazon Linux 2023

On Amazon Linux 2 you needed amazon-linux-extras; on AL2023, Docker is an ordinary package. The whole setup, in order:

1. Install the package: sudo dnf install -y docker.
2. Start Docker now and at every boot: sudo systemctl enable --now docker.
3. Let your user run Docker without sudo: sudo usermod -aG docker ec2-user.
4. Log out and connect again, so your session picks up the new group.
5. Check it works: docker ps should print an empty table, with no error.

The first two as commands, with the version check:

sudo dnf install -y docker
sudo systemctl enable --now docker
docker --version

Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /usr/lib/systemd/system/docker.service.
Docker version 25.0.14, build 0bab007

The package installs Docker Engine 25 with containerd and runc, plus the buildx plugin for docker build. It doesn't include Docker Compose; more on that below. If you're on an Arm-based Graviton instance, the same commands work; the package is built for both.

Why your containers don't come back after a reboot

This is the part that bit Ethan. Installing the package enables docker.socket for future boots, but not docker.service:

systemctl is-enabled docker.service docker.socket

disabled
enabled

With only the socket enabled, systemd listens on Docker's socket at boot and starts the Docker daemon the first time a docker command connects to it. That's why everything seems fine while you're logged in and typing commands. But after a reboot, nothing connects, so the daemon never starts, and every container with a restart policy of always or unless-stopped stays down. Ethan's booking site came back only when his docker ps the next morning woke Docker up.

Enabling the service fixes it, because then Docker starts at boot and brings back the containers whose restart policy says so:

If your server is already running containers, check it in this order:

1. Run systemctl is-enabled docker. If it says disabled, your containers won't survive a reboot.
2. Run sudo systemctl enable --now docker. Your running containers aren't touched.
3. Check each container's restart policy with docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' web, using your container's name; you want always or unless-stopped.
4. Change one that says no with docker update --restart always web, or set restart: always in your compose.yaml.
5. Reboot once during a quiet hour and open your app without logging in. That's the only test that proves it.

Jake: "So Docker was asleep until someone knocked?"

Ethan: "Exactly that. The socket waits for a knock. The booking site needed Docker awake before any customer showed up."

"permission denied while trying to connect to the Docker daemon socket"

Run docker as ec2-user while Docker is running but before you've set up the group, and you get this:

permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.44/containers/json": dial unix /var/run/docker.sock: connect: permission denied

Docker's socket belongs to root and the docker group, so other users can't use it. Add yourself to the group:

sudo usermod -aG docker ec2-user

Then log out and connect again. Group changes apply to new login sessions only, so the terminal you ran the command in still doesn't have the group; a new SSH or Session Manager connection does. Check with id -nG, which should list docker. If you can't reconnect right now, newgrp docker starts a new shell with the group in the current terminal.

Avoid the shortcut some forum answers give, sudo chmod 666 /var/run/docker.sock. It lets every user on the server control Docker, and through Docker, the whole server, and it doesn't survive a restart anyway. Membership of the docker group is also effectively root access, so only add users you'd trust with sudo.

"Cannot connect to the Docker daemon"

This error means nothing is listening on Docker's socket at all:

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

It appears when Docker is installed but not running: right after dnf install docker, before you start it (the socket is only enabled for the next boot), or after someone stopped both the service and the socket. sudo systemctl enable --now docker starts it and keeps it on. If it still fails, sudo systemctl status docker and sudo journalctl -u docker show why the daemon didn't start, such as a full disk.

"docker: 'compose' is not a docker command"

Docker Compose, the tool that starts several containers from one compose.yaml file, isn't part of AL2023's Docker package, and there's no package for it under any of the usual names:

docker compose version

docker: 'compose' is not a docker command.
See 'docker --help'

Compose is a single program that Docker loads as a plugin from a known folder. Docker publishes it on GitHub, and its documentation gives the folder for an install that every user on the server can use. This downloads the latest release for your server's processor, so it works on both x86 and Graviton instances:

sudo mkdir -p /usr/local/lib/docker/cli-plugins
sudo curl -sSL "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-$(uname -m)" \
  -o /usr/local/lib/docker/cli-plugins/docker-compose
sudo chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
docker compose version

Docker Compose version v5.6.0

The $(uname -m) part prints x86_64 or aarch64, which match the names of Compose's download files. To pin a version instead of taking the latest, replace latest/download with download/v5.6.0. Compose doesn't update itself, so repeat the commands when you want a newer one.

Run an app with Compose

With the plugin in place, Compose works as it does anywhere else. A minimal compose.yaml for a web server:

services:
  web:
    image: nginx:alpine
    ports:
      - "8080:80"
    restart: always

Start it, check it and stop it from the folder that holds the file:

docker compose up -d
docker compose ps --format '{{.Name}} {{.State}}'
docker compose down

The restart: always line is what brings the container back after a reboot, and it only works when docker.service is enabled, as above. To reach the app from a browser, the instance's security group must allow the port, 8080 here.

Jake: "So Compose was a missing piece, not a broken one?"

Ethan: "Missing on purpose. Amazon Linux ships Docker itself; Compose is one download from Docker's own site."

Set up a new instance in one go: user data

To have new EC2 instances come up with Docker running and Compose installed, put the steps in the instance's user data. It runs as root on the first boot, so there's no sudo:

#!/bin/bash
dnf install -y docker
systemctl enable --now docker
usermod -aG docker ec2-user
mkdir -p /usr/local/lib/docker/cli-plugins
curl -sSL "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-$(uname -m)" \
  -o /usr/local/lib/docker/cli-plugins/docker-compose
chmod +x /usr/local/lib/docker/cli-plugins/docker-compose

Because this runs before you ever log in, ec2-user's first session already has the docker group. If the instance comes up without Docker, our user data troubleshooting guide shows the log to read. For images you build on the server, Amazon ECR is where you store them for other servers.

Coming from Amazon Linux 2

Most Docker guides online were written for Amazon Linux 2, and a few of their commands don't exist on AL2023. The translations:

Compose v1, the separate docker-compose command written in Python, is retired; the plugin is its replacement, and the command is now two words. If you're still moving servers from Amazon Linux 2, our AL2 guide covers the rest of the move.

Troubleshooting by symptom

Containers are down after a reboot

docker.service isn't enabled, only the socket. Run sudo systemctl enable --now docker.

permission denied while trying to connect to the Docker daemon socket

Your user isn't in the docker group, or the session predates it. Run usermod -aG docker, then log in again.

Cannot connect to the Docker daemon at unix:///var/run/docker.sock

Docker isn't running. Run sudo systemctl enable --now docker, and check journalctl -u docker if it fails.

docker: 'compose' is not a docker command

AL2023 doesn't package Compose. Install the plugin into /usr/local/lib/docker/cli-plugins.

No match for argument: docker-compose-plugin

That's the package name from Docker's own repository for other distributions. On AL2023, download the plugin instead.

amazon-linux-extras: command not found

That tool exists only on Amazon Linux 2. On AL2023, run sudo dnf install -y docker.

Docker on Amazon Linux 2023: frequently asked questions

Ethan ran sudo systemctl enable --now docker on the booking server and added it to the user data for the next one. He tested it the honest way: rebooted the instance and opened the booking page from his phone without logging in. It loaded. Jake's only comment was that he'd like maintenance nights to stay boring from now on.

Revision note. Written October 13, 2026, on Amazon Linux 2023 release 2023.12.20261012 with Docker 25 and Compose v5.6.0. "Well begun is half done," as the old saying goes; a Docker server that starts itself after a reboot is the half that matters.