# How to run a Docker container

Docker lets you run a custom, containerized application on an application. TurboStack runs the container
and **Nginx reverse-proxies public traffic to it**, so it gets HTTPS, caching and the security layers
like any other site. Use it for apps that ship as a container rather than as a standard PHP or runtime
app.

## 1. Enable Docker for the application

Turn on Docker under **Configure application > Technologies > Docker** (see
[Configure Docker](configure.md)). Every system user with Docker enabled is added to the `docker`
group and can run the `docker` commands over [SSH](../../platform/hosts/ssh.md).

## 2. Run the container

Connect over SSH and start your container. Bind its port to **localhost** so it is only reachable
through Nginx, and set a restart policy so it comes back after a reboot:

```bash
docker run -d \
  --name myapp \
  --restart unless-stopped \
  -p 127.0.0.1:8080:80 \
  your-image:1.2
```

- `-d` runs it in the background; `--name` gives it a stable name.
- `-p 127.0.0.1:8080:80` publishes the container's port `80` on host port `8080`, **localhost only**.
- `--restart unless-stopped` starts the container again automatically, for example after a reboot.
- Pin a specific image tag (`your-image:1.2`) rather than `latest`, so deployments are reproducible.

## 3. Publish it through TurboStack

Point the [reverse proxy](../reverse-proxy/configure.md) at the port you published, so Nginx serves
the app on your domain with HTTPS:

```yaml
docker_enabled: true
proxy_enabled: true
proxy_upstream_port: 8080   # the host port you published above
```

[Publish](../../platform/hosts/publishing.md) the change to apply it.

## Keep data in a volume

Anything written inside the container is lost when it is recreated. Store data you need to keep in a
**named volume**, mounted into the container:

```bash
docker run -d --name myapp -v myapp_data:/data your-image:1.2
```

## Manage the container

```bash
docker ps                 # running containers
docker ps -a              # all containers, including stopped ones
docker logs -n 100 myapp  # recent logs
docker stop myapp         # stop
docker start myapp        # start
docker rm myapp           # remove (stop it first)
```

> [!TIP]
> Run one main process per container and keep images small and purpose-built. For anything TurboStack
> manages for you - databases, cache, PHP - use the built-in [technologies](../index.md) instead of
> a container.

## Related

- [Configure Docker](configure.md)
- [Use Docker Compose](use-docker-compose.md)
- [Configure Reverse Proxy](../reverse-proxy/configure.md)
- [SSH access](../../platform/hosts/ssh.md)
- [What is Docker?](what-is.md)