Portainer CE

Last reviewed Aug 26, 2026 · 806 words

Start the Portainer container and set the admin password within 5 minutes, or it locks itself and you have to restart it. That timeout is the first thing to know because it catches nearly every first-timer, and the second thing to know is that the container you just handed /var/run/docker.sock to now holds root-equivalent access to the host. Portainer CE is the easiest way to see and manage every container on a box, and both of those facts follow directly from what makes it easy.

The install everyone runs

docker volume create portainer_data
docker run -d --name portainer --restart=always \
  -p 9443:9443 -p 8000:8000 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest

Open https://your-host:9443, accept the self-signed certificate, create the admin user inside the 5-minute window, and the local Docker environment is already connected. Port 8000 is the tunnel for Edge Agents on remote hosts; leave it unpublished if you only manage the one machine. Memory sits around the catalogue's 256 MB, which makes it one of the cheaper things on the host.

To manage a second machine, install the Portainer Agent there with the same socket mount on port 9001 and add it as an environment. That is where Portainer beats every single-host alternative: one login, 5 servers, all the containers.

What it actually does well

Three features carry the product. Stacks are docker compose files edited and deployed from the browser, with the option to pull them from a Git repository so the UI is not the only copy. Container details show logs, stats, an exec console and the full inspect output without a shell session. And the app templates give a beginner a curated one-click install for common services, which is how a lot of people ran their first Uptime Kuma.

Beyond Docker, the same UI drives Swarm and Kubernetes, with Helm charts available on the Kubernetes side. For a homelab with one Docker host that breadth is mostly unused, but the skills transfer if you later move to a small cluster.

Where CE stops and Business starts

The Business Edition holds back role-based access beyond the basic admin and user split, registry management features, activity logging, external authentication with fine-grained team mapping and several Kubernetes conveniences. Portainer hands out a free Business licence for a small number of nodes, at last check 3, which covers most homelabs if you are willing to register. CE is Zlib-licensed and fully functional for single-admin use; the paywall bites when you have several people with different permissions, which is exactly the case where a git-driven tool like Komodo deserves a look instead.

The socket is the security model

Anything that can talk to the Docker socket can start a privileged container with the host filesystem mounted, so Portainer's admin login is a root login in effect. Put it behind your reverse proxy with TLS, use a long password or your SSO proxy in front of it, and do not expose port 9443 to the internet. If you want a read-only view for a second person, run Dozzle for logs beside it rather than handing out Portainer accounts.

A related habit: do not let Portainer be the sole record of how a stack is configured. Keep compose files in a Git repository and point stacks at it, or at least export them. A Portainer volume that dies takes hand-edited stack definitions with it.

When a lighter tool is the better fit

Portainer is a management console, not a homepage. If what you want is a tidy landing page with links and status dots for your services, Homepage does that in well under 100 MB and the dashboards category lists the rest. If you only ever use the stacks feature, Dockge or Yacht give you a compose-focused UI with less surface area. And for the update problem specifically, the UI's pull-and-recreate button is fine for one container, but Watchtower or a scheduled compose pull is the approach that scales, as covered in container updates without fires.

What I'd do

Run Portainer CE on the main Docker host, behind the reverse proxy, port 8000 unpublished, and use it for what it is good at: looking at logs, stats and the odd exec into a misbehaving container. Keep every stack in Git and deploy from there so the UI is a window, not the source of truth. Claim the free Business licence only if you actually have a second admin. If you find yourself opening it once a month, replace it with Dozzle plus a compose alias and free the 256 MB.