3.2 Install Docker Engine and Compose
On the VM, configure Docker's signed Ubuntu repository:
sudo apt-get update
sudo apt-get install -y ca-certificates curl git openssl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
-o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io \
docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world
sudo docker compose versionThe
docker group gives root-equivalent privileges. This guide keeps sudo docker explicit rather than silently granting that privilege to the login account.Sandbox requirements for the signed package
The core development walkthrough uses the Docker and Compose checks above. For the packaged profile, use the release-qualified gVisor runsc and register it as a Docker runtime on the VM. The packaged epmctl doctor checks that runsc is executable and registered. The host also needs the package's trusted openepm-sandbox-launcher.service for governed Python builds. Follow the matching package's host setup procedure and verify the required launcher service and its control socket during the Python environment checks.