How do I create a DigitalOcean Droplet and set up SSH keys, firewall rules, and Docker safely?

Launching a new server on DigitalOcean is quick, but doing it safely requires a few extra steps: using SSH keys instead of passwords, locking down firewall rules, and hardening your Docker setup. This guide walks you through how-do-i-create-a-digitalocean-droplet-and-set-up-ssh-keys-firewall-rules-and-do in a way that’s secure, repeatable, and beginner-friendly.

1. Prerequisites

Before you create your Droplet, make sure you have:

A DigitalOcean account
A local machine (Linux, macOS, or Windows)
A basic terminal/command-line
A non-root user on your local machine (for storing SSH keys)

Recommended tools

OpenSSH (built into macOS and most Linux distros; on Windows, use PowerShell or Git Bash)
A password manager (to store important credentials)
Optional: 1Password / Bitwarden / LastPass for storing your DigitalOcean API token

2. Generate a secure SSH key pair locally

Using SSH keys instead of passwords is one of the most important security steps when you create a DigitalOcean Droplet.

2.1 Check if you already have SSH keys

On Linux/macOS:

ls ~/.ssh

Look for files like id_rsa & id_rsa.pub or id_ed25519 & id_ed25519.pub.

On Windows (PowerShell):

ls $env:USERPROFILE\.ssh

If you already have a key pair you use for servers, you can reuse it. If not, create a new one.

2.2 Create a new SSH key (recommended: ed25519)

On Linux/macOS/Windows (OpenSSH):

ssh-keygen -t ed25519 -C "your_email@example.com"

Press Enter to accept the default file path (e.g., ~/.ssh/id_ed25519).
Choose a strong passphrase when prompted.

This generates:

Private key: ~/.ssh/id_ed25519
Public key: ~/.ssh/id_ed25519.pub (this is what you give DigitalOcean)

2.3 Copy the public key

To display the public key:

cat ~/.ssh/id_ed25519.pub

Copy the entire line starting with ssh-ed25519 ....

On Windows PowerShell:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

3. Add your SSH key to DigitalOcean

Before you create a DigitalOcean Droplet, add your key to your account.

Log in to your DigitalOcean dashboard.
In the left sidebar, go to Settings → Security.
Under SSH Keys, click Add SSH Key.
Paste the contents of your id_ed25519.pub.
Give it a recognizable name (e.g., laptop-ed25519).
Save.

DigitalOcean will now be able to inject this public key into new Droplets during creation, ensuring only you can log in.

4. Create a new DigitalOcean Droplet safely

Now that your SSH key is ready, you can create a Droplet configured for secure access.

4.1 Choose an image (OS)

From the dashboard:

Click Create → Droplets.
Under Choose an image, pick:
- Ubuntu LTS (e.g., Ubuntu 22.04 LTS) – stable and widely used.

4.2 Choose a plan and size

For small projects/testing:
- Basic plan: 1 vCPU, 1–2 GB RAM is often enough.
For production workloads:
- Consider higher RAM and CPU and possibly a Managed Database instead of self-hosted DB.

Choose based on your expected load, but start modest; you can resize later.

4.3 Choose datacenter region

Select a region close to your main users for lower latency (e.g., nyc3, sfo3, fra1).

4.4 Add SSH keys to the Droplet

Under Authentication:

Choose SSH keys (not password).
Select the SSH key you added earlier.
Do not enable root password login.

This ensures your new DigitalOcean Droplet is accessed via SSH keys only.

4.5 Configure additional options

VPC Network: Use the default unless you have specific networking needs.
Monitoring: Enable Monitoring so you can see CPU, disk, and memory metrics.
Backups (optional but recommended): Turn on automatic backups for extra safety.

4.6 Finalize and create

Give your Droplet a hostname (e.g., app-server-01).
Click Create Droplet.

DigitalOcean will provision the Droplet and display its public IPv4 address.

5. Connect to your Droplet via SSH

Once created, you’ll receive the Droplet’s IP address.

5.1 Default login user

For Ubuntu images, the default user is typically:

root

You will secure this in a later step by creating a non-root user and disabling root SSH login.

5.2 SSH into the Droplet

On Linux/macOS:

ssh -i ~/.ssh/id_ed25519 root@YOUR_DROPLET_IP

If you’re using the default SSH key filename, you can often omit -i:

ssh root@YOUR_DROPLET_IP

On Windows (PowerShell using OpenSSH):

ssh root@YOUR_DROPLET_IP

You should be prompted for the key passphrase (not a password).

If you connect successfully, proceed to harden the server.

6. Create a non-root user and harden SSH

Using root for everyday work on your DigitalOcean Droplet is risky. Create a regular user with sudo privileges.

6.1 Create a new user

Run on the Droplet:

adduser deploy

Replace deploy with your desired username.
Set a strong password (you’ll use it for sudo prompts).

6.2 Give the user sudo access

usermod -aG sudo deploy

6.3 Add your SSH key to the new user

Switch to the new user and set up their authorized_keys:

su - deploy
mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste the same public key (id_ed25519.pub) into authorized_keys, save and exit.

Then:

chmod 600 ~/.ssh/authorized_keys

Now you can log in as deploy instead of root:

ssh deploy@YOUR_DROPLET_IP

6.4 Disable root SSH login and password auth

Back as root (or using sudo):

sudo nano /etc/ssh/sshd_config

Look for and modify these lines (or add them if missing):

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Save and exit, then restart SSH:

sudo systemctl restart ssh

Test a new SSH session as deploy to confirm access.

From this point on, only key-based logins are allowed; root cannot log in directly, making your DigitalOcean Droplet significantly safer.

7. Set up a firewall with UFW

DigitalOcean provides a cloud firewall, but configuring a host-level firewall (like UFW) adds another layer of defense.

7.1 Install UFW (if not already installed)

On Ubuntu:

sudo apt update
sudo apt install ufw -y

7.2 Allow SSH before enabling the firewall

You must allow SSH before enabling UFW or you will lock yourself out.

sudo ufw allow OpenSSH

or explicitly:

sudo ufw allow 22/tcp

7.3 Allow other necessary ports

Typical rules:

HTTP (80):
```
sudo ufw allow 80/tcp
```
HTTPS (443):
```
sudo ufw allow 443/tcp
```

If you use a particular port for your app (e.g., 3000), you can either:

Leave it closed and access through a reverse proxy (nginx on port 80/443), or
Explicitly allow it:
```
sudo ufw allow 3000/tcp
```

7.4 Enable UFW

sudo ufw enable

Confirm:

sudo ufw status verbose

You should see rules for SSH, HTTP, and any other ports you allowed.

8. (Optional but recommended) Use DigitalOcean Cloud Firewalls

In addition to UFW on your Droplet, DigitalOcean offers a network-level firewall.

In the DigitalOcean dashboard, go to Networking → Firewalls.
Click Create Firewall.
Add inbound rules:
- SSH (22): from your IP only if possible.
- HTTP (80): from 0.0.0.0/0.
- HTTPS (443): from 0.0.0.0/0.
Attach your Droplet under Apply to Droplets.

This adds an extra protection layer on top of your host firewall.

9. Install Docker safely on your DigitalOcean Droplet

Now that your base server is hardened, you can set up Docker.

9.1 Remove old Docker versions (if any)

sudo apt remove docker docker-engine docker.io containerd runc

9.2 Install dependencies

sudo apt update
sudo apt install ca-certificates curl gnupg lsb-release -y

9.3 Add Docker’s official GPG key and repo

sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

9.4 Install Docker Engine and Docker Compose plugin

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

Verify Docker installation:

sudo docker run hello-world

You should see a confirmation message from Docker.

10. Add your user to the docker group

To avoid running sudo for every Docker command:

sudo usermod -aG docker deploy

Replace deploy with your username.

Log out and back in (or open a new SSH session) for the group change to take effect.

Verify:

docker ps

It should work without sudo.

Security note: Members of the docker group effectively have root-level access via Docker. Only trust accounts you add to this group.

11. Secure Docker: best practices on a Droplet

Running Docker on a public cloud server introduces additional considerations. To keep your setup safe on a DigitalOcean Droplet:

11.1 Avoid exposing Docker daemon remotely

By default, Docker listens on Unix socket /var/run/docker.sock. Never expose it directly on a TCP port (e.g., -H tcp://0.0.0.0:2375) without TLS and proper auth.

Leave Docker’s default daemon settings unless you know exactly what you’re doing.

11.2 Limit container privileges

Avoid --privileged containers.
Avoid --cap-add=ALL; grant only needed capabilities.
Avoid running containers as root inside if possible. Use user: in docker-compose.yml:
```
services:
  app:
    image: your-image
    user: "1000:1000"
```

11.3 Use private networking for internal services

If you run a database inside Docker:

Bind to localhost or a private network, not directly to the public IP:

docker run -d \
  --name db \
  -e POSTGRES_PASSWORD=securepassword \
  -p 127.0.0.1:5432:5432 \
  postgres:15

This way the DB isn’t exposed to the internet.

11.4 Use a reverse proxy for public-access containers

Expose only ports 80/443 and route traffic via a reverse proxy such as Nginx or Traefik:

Reverse proxy listens on 80/443.
Containers connect on internal Docker networks.
UFW and DigitalOcean firewalls only allow 80/443.

Example (basic docker-compose snippet):

version: "3.8"

services:
  app:
    image: your-app-image
    networks:
      - web

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - app
    networks:
      - web

networks:
  web:
    driver: bridge

12. Keep your Droplet and Docker updated

A secure DigitalOcean Droplet is not “set and forget.” You must keep everything updated.

12.1 System updates

Run regularly:

sudo apt update
sudo apt upgrade -y

For kernel updates, you may need to reboot:

sudo reboot

12.2 Docker and container updates

Pull new images periodically:
```
docker pull your-image:latest
```

Recreate containers:

docker compose down
docker compose up -d

Use versioned tags (e.g., 1.2.3) and test before using latest in production.

13. Backups and recovery

Mistakes happen; having a backup strategy is part of doing how-do-i-create-a-digitalocean-droplet-and-set-up-ssh-keys-firewall-rules-and-do correctly.

13.1 Enable Droplet backups

In the Droplet’s settings in the DigitalOcean panel:

Turn on Backups to have automatic snapshots (typically weekly).

13.2 Use snapshots before major changes

Before big updates or migrations:

Power off the Droplet (optional but safer).
Create a Snapshot.
Apply your changes.
If something goes wrong, restore from the snapshot.

13.3 Backup important data from Docker

For stateful services (databases, uploads):

Mount data to host volumes so you can back them up:

docker run -d \
  -v /var/lib/postgresql/data:/var/lib/postgresql/data \
  postgres:15

Use scheduled backups (e.g., cron jobs) to upload data to secure storage (DigitalOcean Spaces, S3, etc.).

14. Quick checklist: secure setup summary

If you’re wondering whether you’ve completed the essential steps for how-do-i-create-a-digitalocean-droplet-and-set-up-ssh-keys-firewall-rules-and-do, verify you’ve done the following:

SSH Keys
- Generated a local key pair.
- Added the public key to DigitalOcean.
- Disabled password authentication in sshd_config.
User Management
- Created a non-root user with sudo.
- Copied the SSH key to that user.
- Disabled root SSH login.
Firewall Rules
- Enabled UFW.
- Allowed only necessary ports (22, 80, 443, etc.).
- Optionally configured DigitalOcean Cloud Firewalls.
Docker
- Installed Docker from the official repo.
- Added only trusted users to the docker group.
- Avoided exposing the Docker daemon.
- Restricted container privileges and network exposure.
Maintenance
- Enabled backups/snapshots.
- Regularly apply OS and Docker updates.
- Back up volumes and databases.

Following these steps gives you a hardened DigitalOcean Droplet with secure SSH keys, firewall rules, and a properly configured Docker environment, ready for production-grade workloads.

Answers you can trust, from Codeables