Portainer is a web interface for Docker. It shows your containers, images, volumes and networks; lets you start, stop and inspect containers; read logs; open a console; and deploy Compose “stacks” by pasting YAML. For people new to Docker — or teams who want visibility without SSH — it’s a big convenience.

This guide installs Portainer Community Edition (free and open source) on a single Docker host.

Security first: Portainer is root access

Portainer talks to the Docker socket, and control over Docker means control over the host. Treat the Portainer login like a root password:

  • Don’t expose its port to the whole internet if you can avoid it — use an SSH tunnel, a VPN, or an IP allow-list.
  • Use a strong admin password and enable two-factor authentication where available.
  • Keep Portainer updated.

1. Install

Requires Docker (Ubuntu guide).

docker volume create portainer_data

docker run -d \
  --name portainer \
  --restart=always \
  -p 127.0.0.1:9443:9443 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:lts
  • Port 9443 serves the UI over HTTPS with a self-signed certificate.
  • Binding to 127.0.0.1 keeps it private. Access it through an SSH tunnel:
ssh -L 9443:127.0.0.1:9443 user@your-server

and open https://localhost:9443 (accept the self-signed certificate warning).

Or as a Compose file:

services:
  portainer:
    image: portainer/portainer-ce:lts
    restart: always
    ports:
      - "127.0.0.1:9443:9443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
volumes:
  portainer_data:

2. Create the admin user — quickly

On first visit, Portainer asks you to create the admin account. For security, it times out after a few minutes if you don’t; if that happens, restart the container (docker restart portainer) and try again.

Choose Get Started to manage the local Docker environment.

3. Find your way around

  • Containers — status, published ports, quick actions (start, stop, restart, kill, remove), logs, inspect, stats and an in-browser console (/bin/sh or /bin/bash).
  • Images — pull, remove unused images.
  • Volumes — see which volumes are in use; browse is a Business Edition feature.
  • Networks — create user-defined networks and attach containers.
  • Stacks — Docker Compose projects managed by Portainer.

4. Deploy a stack

Stacks → Add stack, give it a name, and paste a Compose file:

services:
  uptime-kuma:
    image: louislam/uptime-kuma:1
    restart: unless-stopped
    volumes:
      - uptime-kuma:/app/data
    ports:
      - "127.0.0.1:3001:3001"
volumes:
  uptime-kuma:

Click Deploy the stack. You can also deploy from a Git repository, so the Compose file lives in version control and Portainer can redeploy when it changes.

Environment variables can be set in the stack form instead of an .env file.

A caveat: stacks created in Portainer are managed by Portainer; stacks you started with docker compose on the command line appear as “limited” — you can see and control their containers, but not edit their Compose definition.

5. Update a container to a newer image

For a stack: open it, click Pull and redeploy (or update the image tag in the editor and click Update the stack).

For a single container: Recreate with “Pull latest image” enabled. Volumes are kept; anything written inside the container’s filesystem is lost — which is why data belongs in volumes.

6. Put the UI behind a reverse proxy (optional)

If you want https://portainer.example.com with a real certificate, publish the HTTP port 9000 to localhost (-p 127.0.0.1:9000:9000) and proxy it with Nginx, Caddy or Nginx Proxy Manager, enabling WebSocket support (needed for the console). Add an IP allow-list or extra authentication in front.

7. Managing several servers

Portainer can manage other Docker hosts through the lightweight Portainer Agent (or the Edge Agent for hosts behind NAT). Install the agent on each remote host and add it as an environment. Communication should travel over a private network or VPN.

Updating Portainer itself

docker stop portainer && docker rm portainer
docker pull portainer/portainer-ce:lts
# re-run the same docker run command as above

Your settings persist in the portainer_data volume. Back that volume up occasionally.

Portainer or the command line?

Portainer is great for visibility, quick restarts and log reading. The CLI and Compose files remain the source of truth for reproducible setups — and are what you’ll use in scripts and CI. Many people use both: Compose files in Git, Portainer for day-to-day observation. Keep the Docker commands cheat sheet and the Docker Compose tutorial handy.

Portainer itself uses little memory; a Docker VPS with 2 GB of RAM runs it alongside several small apps.

  • Docker
  • Portainer
  • Self-Hosting