Install Portainer to manage Docker containers from a web UI

Portainer is a free web interface for Docker. Instead of typing every docker command over SSH, you can see all containers, read their logs, restart them and deploy compose stacks from your browser. This guide installs Portainer Community Edition (CE) as a container and locks it down properly.

Before you start

• A Linux VPS with Docker and the Compose plugin installed (see Install Docker and Docker Compose).
• SSH access as root or a user in the docker group.
• Optional: a domain or subdomain (for example portainer.example.com) pointing to the server if you want HTTPS through a reverse proxy.

Create the Portainer volume and container

1. Connect to the server over SSH.
2. Create a named volume so Portainer keeps its settings across updates:
   Copy

   docker volume create portainer_data

3. Start Portainer CE. Port 9443 serves the UI over HTTPS with a self-signed certificate:
   Copy

   docker run -d --name portainer --restart=always \
     -p 9443:9443 \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v portainer_data:/data \
     portainer/portainer-ce:lts

4. Check that it is running with docker ps --filter name=portainer.

Create the admin account

1. Open https://YOUR-SERVER-IP:9443 in your browser and accept the self-signed certificate warning.
2. Create the admin user with a long, unique password. You must do this within a few minutes of starting the container, otherwise Portainer locks setup for security; run docker restart portainer if that happens.
3. Choose Get Started to manage the local Docker environment.

Day-to-day tasks in Portainer

Secure Portainer

• Restrict the port: allow 9443 only from your own IP in the firewall, or don't publish it at all and put Portainer behind a reverse proxy with SSL, such as Nginx Proxy Manager or Traefik.
• Mind UFW: Docker publishes ports past UFW rules by default. Read UFW and Docker bypass fix before relying on the firewall.
• Turn on two-factor: in My account, enable 2FA for the admin user.

Update Portainer

Settings live in the portainer_data volume, so updating is safe:

docker pull portainer/portainer-ce:lts
docker stop portainer && docker rm portainer

Then run the same docker run command from above again.

Troubleshooting

• Page does not load: confirm the container is up, port 9443 is open in your firewall and you used https://, not http://.
• "New Portainer installation timed out": restart the container and create the admin user straight away.
• Permission denied on docker.sock: see Docker permission denied on the socket.

Next steps

• Docker Compose files explained
• Update containers automatically with Watchtower
• Common Docker errors and how to fix them