How to Install Portainer to Manage Docker

Portainer is a lightweight web dashboard for Docker. Instead of memorising CLI flags, you get containers, images, volumes, networks, and Compose stacks in a clean browser interface — with live logs and a console into any container. This guide installs Portainer Community Edition on Ubuntu 24.04 and secures it behind HTTPS.

Prerequisite: Docker

Portainer runs as a container, so you need Docker first. If you have not installed it, follow installing Docker on Ubuntu 24.04. Verify:

docker --version

Install Portainer

Portainer needs a persistent volume for its own data, and access to the Docker socket so it can manage the engine:

docker volume create portainer_data

docker run -d \
  -p 127.0.0.1:9000:9000 \
  --name portainer \
  --restart=unless-stopped \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest

We bind to 127.0.0.1:9000 deliberately — Portainer controls your whole Docker engine, so it must not be exposed directly to the internet. We will reach it through an authenticated, TLS-protected reverse proxy.

Create the admin account

Because Portainer is bound to localhost, open an SSH tunnel from your own machine to reach the setup screen:

ssh -L 9000:127.0.0.1:9000 youruser@YOUR_SERVER_IP

Now browse to http://localhost:9000 on your laptop. Set a strong admin password on first load — do this promptly, as the initial admin setup window closes for security after a short time. Choose the local Docker environment when prompted.

Expose it safely with Nginx

For day-to-day access without a tunnel, put Nginx in front on a subdomain. Create /etc/nginx/sites-available/portainer.example.com:

server {
    listen 80;
    server_name portainer.example.com;

    location / {
        proxy_pass http://127.0.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

The WebSocket headers are required — Portainer's container console and log streaming use them. Enable the site and add HTTPS:

sudo ln -s /etc/nginx/sites-available/portainer.example.com /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d portainer.example.com

The full reverse-proxy detail is in our Nginx reverse proxy guide, and TLS in the Certbot guide.

What you can do in Portainer

• Containers: start, stop, restart, inspect, and open a console — no SSH needed.
• Logs: live-stream any container's output.
• Stacks: paste a Compose file and deploy it from the UI — a friendly front end for Docker Compose.
• Images & volumes: pull, prune, and inspect.
• App templates: one-click deploy common apps.

Keeping it updated

Portainer is just a container, so updates are a pull-and-recreate:

docker pull portainer/portainer-ce:latest
docker stop portainer && docker rm portainer
# re-run the docker run command above

Your settings persist because they live in the portainer_data volume.

Deploy your first stack from the UI

Portainer's real power is deploying apps without touching the CLI. In the sidebar choose Stacks → Add stack, give it a name, and paste a Compose file straight into the web editor — the same YAML you would run with docker compose up. Click Deploy the stack and Portainer creates the containers, network, and volumes for you.

From then on the stack has its own page where you can:

• Edit the Compose file and redeploy in place.
• Pull updated images and recreate containers.
• Stop, start, or remove the whole stack together.

Watch resources at a glance

Each container's page shows live CPU, memory, and network graphs, plus a Stats view and one-click access to logs and a console. For a small VPS this is an easy way to spot a container using more memory than expected before it causes trouble — the visual equivalent of docker stats without remembering the flags.

FAQ

Is it safe to give Portainer the Docker socket?

The Docker socket is root-equivalent, so treat Portainer as a privileged admin tool: never expose it publicly without HTTPS and authentication, use a strong admin password, and consider restricting access by IP. Bound to localhost behind an authenticated proxy, it is reasonable.

Portainer CE vs Business Edition — do I need to pay?

Community Edition is free and fully capable for managing a single Docker host, which is what most VPS users need. Business Edition adds team features and support that matter mostly at organisational scale.

Can Portainer manage Docker Compose stacks?

Yes — its "Stacks" feature deploys and manages Compose files, giving you a UI over the same YAML you would run with docker compose up.

Why can't I reach Portainer in my browser?

Because it is bound to 127.0.0.1 by design. Reach it through the SSH tunnel or the Nginx reverse proxy above — do not rebind it to 0.0.0.0 and open the port publicly.

Nxeon Docker hosting gives you a full-root VPS ready for Docker and Portainer on fast NVMe — manage your containers from a browser, with free migration help to bring an existing setup across.