Configuration

NebulaImage Docker is designed to work out of the box. Customization can be done at launch time using EC2 user data (cloud-init), or after launch by connecting over SSH.

Using cloud-init user data

You can pass a shell script as EC2 user data when launching the instance. This script runs once on first boot.

#!/bin/bash
# Example: pull and start your application container on first boot

docker pull your-registry/your-app:latest
docker run -d \
  --name my-app \
  --restart unless-stopped \
  -p 80:8080 \
  your-registry/your-app:latest

Security: Never embed credentials, API keys, or passwords in user data. User data is accessible via the instance metadata service at http://169.254.169.254. Use AWS Secrets Manager, Parameter Store, or IAM instance profiles instead.

Firewall configuration (UFW)

UFW is enabled by default with only SSH (port 22) allowed inbound. To open additional ports:

# Allow HTTP
sudo ufw allow 80/tcp

# Allow HTTPS
sudo ufw allow 443/tcp

# Check current rules
sudo ufw status verbose

Docker daemon configuration

The Docker daemon is configured to use the Unix socket only (no TCP exposure). If you need to adjust daemon settings, edit /etc/docker/daemon.json:

sudo nano /etc/docker/daemon.json
sudo systemctl restart docker

Using Docker Compose

Docker Compose v2 is installed as a plugin. Create a docker-compose.yml in any directory and run:

docker compose up -d
docker compose ps
docker compose logs -f

Environment variables and secrets

For passing configuration to containers, use Docker's --env-file or environment variables in your Compose file. For production secrets, use AWS Secrets Manager and retrieve them at runtime rather than storing them in compose files.