How to Install Dokku on Debian 13, 12 and 11

Dokku turns a single Debian server into a small Git-driven application platform, but the install path matters because Dokku owns Docker, Nginx routing, SSH deploy access, and application data on the host. To install Dokku on Debian, use the official bootstrap script for a fresh server or the manual DEB822 APT method only when Docker Engine, Buildx, and Compose are already managed separately.

Dokku’s current packages support Debian 13 (Trixie), Debian 12 (Bookworm), and Debian 11 (Bullseye) on amd64 and arm64. The install flow follows the official Dokku getting started documentation, adds Debian-specific package-source checks, and includes the first setup tasks needed before a real deployment.

Install Dokku on Debian

Start on a fresh or dedicated Debian server when possible. Dokku configures Docker containers, Nginx virtual hosts, SSH-based Git deploys, and application directories under the dokku user, so shared web servers need extra planning before installation.

Confirm Debian Release, Architecture, and Hostname

Check the Debian codename, architecture, and fully qualified hostname before adding packages. Dokku’s bootstrap script requires a working hostname, and the package source must match the Debian release.

. /etc/os-release
printf '%s %s\n' "$PRETTY_NAME" "$VERSION_CODENAME"
dpkg --print-architecture
hostname -f

Supported Debian codenames for this workflow are trixie, bookworm, and bullseye. Supported architectures are amd64 and arm64. If hostname -f fails, set a proper hostname and matching /etc/hosts entry before running the installer.

Plan DNS, Memory, and Network Access

Dokku works best with at least 1 GB of memory for Docker-based builds. A real domain or wildcard DNS record is also strongly recommended because Dokku uses the app name and global domain to generate routes such as app.example.com.

Requirement	Recommended State	Why It Matters
Debian release	Debian 13, 12, or 11	Dokku’s current package script and packagecloud source support these Debian releases.
CPU architecture	amd64 or arm64	Dokku publishes current Debian package indexes for these architectures.
Memory	1 GB or more	Buildpacks and Docker image builds can fail or swap heavily on smaller servers.
DNS	Wildcard *.example.com or a single app domain	Wildcard DNS lets each app receive a predictable subdomain; single domains can still work with explicit app domains.
Ports	SSH, HTTP, and HTTPS reachable as needed	SSH receives Git pushes, while HTTP and HTTPS serve deployed applications.

For a wildcard setup, point *.apps.example.com and apps.example.com at the Debian server. For a lab host without DNS, an address such as 203.0.113.10.sslip.io can provide subdomain-style testing through the public sslip.io wildcard service.

Choose a Dokku Installation Method

The official bootstrap script is the practical default for a new Debian server because it installs Docker first, adds Dokku’s package repository, installs Dokku, and runs the core plugin dependency installer. The manual DEB822 APT method is better for automation or image builds that already provision Docker, Buildx, and Compose through a separate, audited workflow.

Method	Source or Channel	Update Behavior	Best For	Trade-offs
Official bootstrap script	Dokku installer plus Dokku packagecloud repository	APT-managed Dokku updates after installation	Fresh Debian servers and most first-time installs	Runs a root installer that also bootstraps Docker and writes its own APT source files.
Manual DEB822 APT setup	Same Dokku packagecloud repository with a scoped keyring	APT-managed Dokku updates	Configuration management, golden images, and servers where Docker is already installed	Requires Docker Engine plus Buildx and Compose packages before installing Dokku.

Use only one Dokku package-source setup. The bootstrap script writes a legacy /etc/apt/sources.list.d/dokku.list file and a key under /etc/apt/trusted.gpg.d/. The manual method writes a DEB822 dokku.sources file and a scoped keyring. Keeping both active can create duplicate source entries.

Method 1: Install Dokku with the Official Bootstrap Script

Install the small tools needed to resolve the latest release tag and download the script over HTTPS. These commands use sudo for package changes; if your account cannot run sudo, configure administrator access first with the Debian sudoers workflow in how to add a user to sudoers on Debian. The curl command guide explains the download flags used in the release lookup and script download.

sudo apt update
sudo apt install ca-certificates curl jq

Resolve the latest stable Dokku release from GitHub Releases, then download the matching bootstrap script. The script URL remains versioned, but the tag is resolved at run time so the command follows the current stable release instead of freezing the article to one Dokku version. Keep the same terminal session open because the installer command reuses DOKKU_VERSION.

DOKKU_VERSION="$(curl -fsSL https://api.github.com/repos/dokku/dokku/releases/latest | jq -r '.tag_name')"

case "$DOKKU_VERSION" in
  v[0-9]*)
    curl -fsSLo bootstrap.sh "https://dokku.com/install/${DOKKU_VERSION}/bootstrap.sh"
    ;;
  *)
    printf 'Could not resolve the latest Dokku release tag.\n' >&2
    false
    ;;
esac

If Docker is already installed, confirm the Buildx and Compose plugins before running the bootstrap script. Dokku’s installer bootstraps Docker when the docker command is absent, but an older partial Docker install can still leave required plugin packages unresolved.

if command -v docker >/dev/null 2>&1; then
  docker --version
  docker buildx version
  docker compose version
fi

Inspect the script before running it as root:

less bootstrap.sh

Run the bootstrap installer with the same Dokku tag. The script installs Docker when the docker command is missing, adds Dokku’s packagecloud source, installs the dokku package, and runs core plugin dependency setup.

sudo DOKKU_TAG="$DOKKU_VERSION" bash bootstrap.sh

The bootstrap installer is best reserved for a dedicated server or a server where Dokku can manage Nginx. Current Dokku installers warn that first-time installation can remove files from Nginx’s sites-enabled directory, so back up custom virtual hosts before continuing on a shared web server.

Method 2: Install Dokku with a Manual DEB822 APT Source

Use the manual method when Docker Engine, Buildx, and Compose are already installed from Docker’s official Debian packages or another compatible package set. The source setup uses the same packagecloud repository and signing key as Dokku’s Debian package installation notes, but stores the source in DEB822 format with a scoped keyring. On Debian 12 and Debian 11, a Dokku-only packagecloud source does not provide a Buildx candidate, so verify Docker first or install Docker on Debian before continuing.

docker --version
docker buildx version
docker compose version

If any command is missing, install Docker’s official package set with Install Docker on Debian, then return to the Dokku source setup.

Install helper packages for HTTPS downloads and key inspection.

sudo apt update
sudo apt install ca-certificates curl gpg

Download Dokku’s packagecloud signing key, inspect the fingerprint, then install the key as a scoped APT keyring:

curl -fsSLo dokku.asc https://packagecloud.io/dokku/dokku/gpgkey
gpg --quiet --show-keys --with-fingerprint dokku.asc
sudo install -m 0644 dokku.asc /usr/share/keyrings/dokku-archive-keyring.asc
rm -f dokku.asc

The current key identifies the Dokku packagecloud repository and uses this fingerprint:

pub   rsa4096 2018-10-08 [SCEA]
      0027 A6FC E4DE B304 104D  2D13 F1FF 6851 288B 3315
uid                      https://packagecloud.io/dokku/dokku (https://packagecloud.io/docs#gpg_signing) <support@packagecloud.io>

Add Dokku’s APT source in DEB822 format. The command writes the source only for the supported Debian release and architecture combinations.

. /etc/os-release
codename="${VERSION_CODENAME:-}"
arch="$(dpkg --print-architecture)"

case "${codename}:${arch}" in
    trixie:amd64|trixie:arm64|bookworm:amd64|bookworm:arm64|bullseye:amd64|bullseye:arm64)
        printf '%s\n' \
        'Types: deb' \
        'URIs: https://packagecloud.io/dokku/dokku/debian/' \
        "Suites: ${codename}" \
        'Components: main' \
        "Architectures: ${arch}" \
        'Signed-By: /usr/share/keyrings/dokku-archive-keyring.asc' \
        | sudo tee /etc/apt/sources.list.d/dokku.sources > /dev/null
        ;;
    *)
        printf 'Dokku packages in this workflow are documented for Debian 13, 12, or 11 on amd64 or arm64. Detected %s on %s.\n' "$codename" "$arch" >&2
        ;;
esac

Stop if the unsupported-release message appears. Otherwise, refresh APT metadata and confirm that dokku comes from the packagecloud source for your Debian codename.

sudo apt update
apt-cache policy dokku

A valid candidate shows the Dokku packagecloud URL, the Debian codename, and the main component:

dokku:
  Installed: (none)
  Candidate: 0.38.5
  Version table:
     0.38.5 500
        500 https://packagecloud.io/dokku/dokku/debian trixie/main amd64 Packages

For unattended builds, preseed the debconf values before installing Dokku. Replace the hostname with the domain or wildcard base you plan to use.

sudo debconf-set-selections <<'EOF'
dokku dokku/vhost_enable boolean true
dokku dokku/hostname string apps.example.com
dokku dokku/nginx_enable boolean true
EOF

Install Dokku, then run the core plugin dependency installer. The plugin dependency step matches the official Debian package notes and ensures bundled Dokku plugins have their required packages.

sudo apt install dokku
sudo dokku plugin:install-dependencies --core

Verify Dokku on Debian

Verify the installed Dokku command, core plugins, Docker access, and the Nginx service that Dokku uses for HTTP routing.

dokku version
dokku plugin:list
docker --version
docker compose version
sudo systemctl is-active nginx

The version command should print the installed Dokku release, plugin:list should list core plugins, Docker should report an Engine and Compose version, and Nginx should report active. If Nginx is inactive, check its status before deploying applications:

sudo systemctl status nginx --no-pager

Configure Dokku After Installation

A fresh Dokku install still needs an SSH deploy key, a global domain or per-app domain plan, and open network paths for the services you want to expose.

Add an SSH Deploy Key to Dokku

Dokku receives Git pushes through the dokku SSH user. Add a public key for the administrator account that will deploy applications. The name admin is conventional and gives that key permission to manage other Dokku keys.

sudo dokku ssh-keys:add admin < ~/.ssh/id_rsa.pub

If your public key uses another filename, replace the path with the correct .pub file. List configured keys after adding one:

dokku ssh-keys:list

Set the Global Dokku Domain

Set the global domain when most apps should use subdomains under the same base. Use a domain that already points at the Debian server, or use an sslip.io hostname for temporary testing with the server IP address.

dokku domains:set-global apps.example.com

For a temporary IP-based lab domain, replace the example address with your server’s public IP:

dokku domains:set-global 203.0.113.10.sslip.io

Check the current global domain configuration with Dokku’s domain report command:

dokku domains:report --global

Open Web Ports Through UFW When Enabled

Dokku serves HTTP and HTTPS traffic through Nginx. Check UFW’s state before changing rules, then allow SSH before opening web ports when UFW is active so remote administration remains reachable.

sudo ufw status verbose

If the status reports active, add the SSH, HTTP, and HTTPS rules. Adjust the SSH rule first if the server listens on a non-default SSH port.

sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status numbered

Skip these commands if UFW is not installed or if another firewall manager owns the server policy. For a full firewall setup, use Install UFW on Debian and review Docker’s firewall behavior before publishing container ports.

Deploy a First Dokku App on Debian

A basic deployment has two sides: create the app on the Dokku host, then push a Git repository from your workstation or another development shell. The application repository needs a supported buildpack app, a Dockerfile, or another Dokku-supported build path.

Create the App on the Dokku Host

Create an app and assign a domain before the first push. Replace sample-app and the domain with your real app name and DNS entry.

dokku apps:create sample-app
dokku domains:set sample-app sample-app.apps.example.com
dokku apps:list

Push Code to Dokku with Git

From the local application repository, add the Dokku Git remote and push the branch you want Dokku to build. Replace apps.example.com with the host that resolves to the Debian server.

git remote add dokku dokku@apps.example.com:sample-app
git push dokku main:master

If the deployment machine is also Debian and Git is missing, install it with Install Git on Debian. Repositories that use another default branch can either push branch-name:master or configure Dokku’s deploy branch after reviewing Dokku’s official Git deployment behavior.

Check App Status and Logs

After the first push, use Dokku’s app and log commands to confirm the process state and inspect startup errors.

dokku ps:report sample-app
dokku logs sample-app --tail

Use the logs output to fix application-level problems such as missing environment variables, failed package installs, bad Procfile commands, or an app listening on the wrong port.

Manage Dokku on Debian

Dokku is a command framework rather than a long-running Dokku daemon. Docker and Nginx provide the main runtime services, while Dokku commands manage apps, domains, plugins, and deployment configuration.

Command	Use
dokku apps:list	List applications on the host.
dokku apps:create APP	Create an application before deployment.
dokku domains:report APP	Show domain routing for an application.
dokku ps:report APP	Inspect process state for an application.
dokku logs APP --tail	Stream recent application logs.
dokku plugin:list	List installed Dokku plugins.
sudo systemctl status docker	Check the Docker daemon that runs app containers.
sudo systemctl status nginx	Check the Nginx service that routes app traffic.

Use app-specific commands whenever possible. Restarting Docker or Nginx affects all deployed applications on the host, while commands such as dokku ps:restart APP target a single app.

Update Dokku on Debian

Dokku installed from the bootstrap script or manual APT source updates through APT. Read Dokku’s official upgrade notes before major upgrades, especially when the update also changes Docker, Herokuish, or buildpack behavior.

For a normal package refresh, update APT metadata and install the Dokku package set used by Dokku’s official upgrade instructions:

sudo apt-get update
sudo apt-get --no-install-recommends install dokku herokuish sshcommand plugn gliderlabs-sigil dokku-update dokku-event-listener

When Docker or Herokuish changes during the same maintenance window, stop apps first and rebuild after the upgrade so containers use the refreshed base image and build tooling.

dokku ps:stop --all
sudo apt-get update
sudo apt-get --no-install-recommends install dokku herokuish sshcommand plugn gliderlabs-sigil dokku-update dokku-event-listener
dokku ps:rebuild --all

For unattended host security patches, configure Debian’s archive updates separately with unattended upgrades on Debian. Third-party repositories such as Dokku and Docker need explicit unattended-upgrades origin handling before you assume they update automatically.

Remove Dokku from Debian

Back up applications, databases, volumes, environment variables, and uploaded files before removing Dokku. A package purge can remove Dokku packages, while application data and Docker resources need a separate decision.

Stop Apps and Clean Dokku Containers

Stop Dokku-managed apps and let Dokku clean unused containers and images before package removal:

dokku ps:stop --all
dokku cleanup

Purge Dokku Packages

Purge Dokku and Herokuish packages, matching Dokku’s Debian uninstall notes, then remove dependencies that no remaining package needs. Review the autoremove transaction before confirming on a shared server.

sudo apt-get purge dokku herokuish
sudo apt-get autoremove

Confirm the package records are gone or no longer installed. A clean purge should not leave ii or rc entries for Dokku or Herokuish:

dpkg-query -W -f='${db:Status-Abbrev} ${binary:Package}\n' dokku herokuish 2>/dev/null || true

Remove Dokku APT Source Files

Remove the Dokku source and trust files created by either install method, then refresh package metadata:

sudo rm -f /etc/apt/sources.list.d/dokku.list
sudo rm -f /etc/apt/sources.list.d/dokku.sources
sudo rm -f /etc/apt/trusted.gpg.d/dokku.asc
sudo rm -f /usr/share/keyrings/dokku-archive-keyring.asc
sudo apt update

Check that no Dokku source file remains under /etc/apt/sources.list.d/:

sudo find /etc/apt/sources.list.d -maxdepth 1 \( -name 'dokku.list' -o -name 'dokku.sources' \) -print

Confirm that the packagecloud source no longer provides a candidate:

apt-cache policy dokku

Delete Dokku Data Only When Finished

Delete Dokku data paths only when backups are complete and no app state needs to remain on the server. Inspect the candidate paths first, especially on servers that also store app uploads, bind mounts, or plugin data under Dokku-managed directories, then remove any path you need to keep from the deletion command.

The data-removal command permanently deletes Dokku application state, logs, and the Dokku user’s home directory. It does not safely export application databases, object storage, bind mounts, or Docker volumes for you.

sudo find /home/dokku /var/lib/dokku /var/log/dokku -maxdepth 0 -print 2>/dev/null

sudo rm -rf /home/dokku /var/lib/dokku /var/log/dokku

Remove Docker separately only when the server no longer runs any Docker workload. If Dokku’s bootstrap script installed Docker on a dedicated host, follow the cleanup path in the Docker on Debian article so images, containers, volumes, and repository files are handled intentionally.

Troubleshoot Dokku on Debian

Bootstrap Script Reports an Unsupported Linux Distribution

The bootstrap script checks /etc/os-release and supports Debian 11, 12, and 13. Confirm the host identity and avoid running the script from containers or derivatives that report a different release ID.

cat /etc/os-release

If the system is a Debian derivative, verify the upstream base release and architecture before adapting the source file. Do not point an unsupported release at another Debian codename only to force APT past the release check.

APT Cannot Install Dokku Dependencies

Dependency errors usually mean the enabled package sources do not provide a complete Docker, Buildx, and Compose set for the Dokku dependency chain. Check the Dokku candidate and the Docker package alternatives before retrying the install.

apt-cache policy dokku docker-buildx-plugin docker-buildx docker-compose-plugin docker-compose

On Debian 13, Debian’s docker-buildx and docker-compose packages can satisfy those alternatives. On Debian 12 and Debian 11, a missing Buildx candidate usually means Docker’s official Debian repository has not been added; add Docker with the Docker install workflow, then rerun sudo apt update and sudo apt install dokku.

SSH Pushes Fail with Permission Denied

Dokku Git deploys use the dokku SSH user and the keys stored by Dokku’s SSH key plugin. Check that the intended key is present, then add the correct public key if it is missing.

dokku ssh-keys:list
sudo dokku ssh-keys:add admin < ~/.ssh/id_rsa.pub

From the deployment machine, test the SSH route with the same hostname used in the Git remote:

ssh dokku@apps.example.com

App Domain Does Not Resolve or Load

Domain failures usually live in DNS, Dokku domain configuration, Nginx routing, or the host firewall. Check the app domain report and Nginx service before changing app code.

dokku domains:report sample-app
sudo systemctl is-active nginx
sudo ss -tulpn | grep -E ':(80|443)\b'

If the domain report is correct and Nginx is active, confirm DNS points to the server and that the firewall allows ports 80/tcp and 443/tcp.

Conclusion

Dokku is installed on Debian with Docker, Nginx routing, SSH deploy access, and APT-managed updates in place. Add production DNS, protect SSH with Fail2ban on Debian, and review Dokku’s deployment and SSL documentation before moving real traffic onto the host.