How to Install MongoDB on Ubuntu 22.04

Ubuntu does not ship a current MongoDB. Install it from MongoDB's own APT repository, which gives you the mongodb-org packages, the mongod systemd service and the mongosh shell. The steps below are for Ubuntu 22.04 (jammy) and work the same on 24.04 (noble) with one word changed. Out of the box MongoDB has no authentication, so the second half of this post turns it on before anything else connects.

Before you start

• CPU. On x86_64, MongoDB 5.0 and later need a CPU with AVX. Old hardware and some virtual CPU models lack it, and mongod then dies with Illegal instruction. Check with grep -m1 -o avx /proc/cpuinfo. ARM64 is supported too.
• Old packages. If an old mongodb package from Ubuntu is installed, remove it first. It is not maintained by MongoDB and conflicts with mongodb-org.
• Version. This post installs the 9.0 series, current at the time of writing. If your application or driver needs 8.0, replace 9.0 with 8.0 in the repository line and use server-8.0.asc as the key.

Install

Import the signing key into its own keyring:

sudo apt-get install -y gnupg curl
curl -fsSL https://pgp.mongodb.com/server-9.asc | \
  sudo gpg -o /usr/share/keyrings/mongodb-server-9.gpg --dearmor

Add the repository. The signed-by option means this key is trusted only for this repository, not for every source on the system:

echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-9.gpg ] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/9.0 multiverse" | \
  sudo tee /etc/apt/sources.list.d/mongodb-org-9.0.list

On Ubuntu 24.04 use noble instead of jammy. Then install:

sudo apt-get update
sudo apt-get install -y mongodb-org

mongodb-org pulls in the server, mongos, mongosh and the database tools (mongodump, mongorestore and friends). Because the repository line names a series, apt upgrade brings patch releases within 9.0 but never jumps to the next major version on its own.

Start and check

sudo systemctl enable --now mongod
systemctl status mongod
mongosh --eval 'db.runCommand({ ping: 1 })'

If systemd says Unit mongod.service not found, run sudo systemctl daemon-reload and try again.

Useful paths:

• Config: /etc/mongod.conf
• Data: /var/lib/mongodb
• Log: /var/log/mongodb/mongod.log

The service runs as the mongodb user, and the packaged unit already raises open file and process limits to 64000. You only need to deal with ulimits if you start mongod some other way. Read the startup warnings that mongosh prints on connect: they flag things like the filesystem (XFS is recommended for the WiredTiger engine) and missing access control.

Turn on authentication

With no users and no authorization setting, anyone who can reach the port has full access. Create an admin user first, while you can still connect without credentials:

mongosh

use admin
db.createUser({
  user: "admin",
  pwd: passwordPrompt(),
  roles: [
    { role: "userAdminAnyDatabase", db: "admin" },
    { role: "readWriteAnyDatabase", db: "admin" }
  ]
})

passwordPrompt() asks for the password interactively, so it does not end up in shell history. Then enable access control in /etc/mongod.conf:

security:
  authorization: enabled

sudo systemctl restart mongod
mongosh -u admin -p --authenticationDatabase admin

An unauthenticated mongosh session still connects, but any real command now fails with an authorization error. That is how you know it worked.

Give each application its own user with access to one database:

use myapp
db.createUser({
  user: "myapp",
  pwd: passwordPrompt(),
  roles: [ { role: "readWrite", db: "myapp" } ]
})

The application connects with:

mongodb://myapp:PASSWORD@10.0.0.5:27017/myapp?authSource=myapp

Allow remote connections

By default mongod listens only on 127.0.0.1. To reach it from application servers, add the server's private address in /etc/mongod.conf:

net:
  port: 27017
  bindIp: 127.0.0.1,10.0.0.5

Do this only after authentication is on, and restrict the port to the networks that need it:

sudo systemctl restart mongod
sudo ufw allow from 10.0.0.0/24 to any port 27017 proto tcp

Avoid bindIp: 0.0.0.0 on a host with a public address. Exposed MongoDB instances without auth are found and wiped by automated scanners. For traffic that leaves a private network, configure TLS (net.tls in the config) as well.

Backups

mongodump writes a consistent dump of a standalone server, good enough for small and medium databases:

mongodump --uri "mongodb://admin@localhost:27017/?authSource=admin" \
  --out /var/backups/mongodb/$(date +%F)

Restore with mongorestore. Copy the dumps off the server, and test a restore at least once. For large data sets or point-in-time recovery, run a replica set and use filesystem snapshots or a dedicated backup tool.

Quick reference

curl -fsSL https://pgp.mongodb.com/server-9.asc | sudo gpg -o /usr/share/keyrings/mongodb-server-9.gpg --dearmor
# repo: https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/9.0 multiverse (noble on 24.04)
sudo apt-get install -y mongodb-org
sudo systemctl enable --now mongod
mongosh                                         # create admin user, then
# /etc/mongod.conf: security.authorization: enabled, net.bindIp
sudo systemctl restart mongod
mongosh -u admin -p --authenticationDatabase admin
sudo tail -f /var/log/mongodb/mongod.log