Ultimate Guide to Installing Portainer CE on Docker for Linux Users

Portainer CE is an open-source management layer that gives a Docker engine a polished, browser-based dashboard. From a single interface you can start and stop containers, read logs, pull and remove images, manage networks and volumes, and deploy multi-container applications from Docker Compose files — no memorized command chains required. For IT professionals, security practitioners, and small-business owners who run Docker on Linux, Portainer turns routine container administration into a few clicks.

Portainer does not replace Docker. It drives the Docker API through a web UI, so everything you do in Portainer is still executed by the Docker engine underneath, and it will not install Docker for you. If you are assembling a broader home lab and want to pair containerized services with a dedicated testing machine, our guide to installing Kali Linux in VMware Workstation covers the other half of that setup.

What Portainer CE Is — and What It Is Not

Portainer Community Edition (CE) is the free, open-source edition of Portainer. It provides a web interface for managing a Docker environment, including:

• Containers: start, stop, restart, remove, and inspect logs and resource usage.
• Images: pull, tag, and remove images from Docker Hub and private registries.
• Networks and volumes: create, inspect, and clean up Docker networking and storage resources.
• Stacks: deploy and update multi-container applications defined in Docker Compose files.

CE covers the core of day-to-day container management. The paid Business Edition adds enterprise features such as role-based access control, registry management, and vendor support; for a home lab, a small business, or a single-host deployment, CE is generally all you need.

Portainer is also not a container runtime: the host must already run a working Docker Engine, and any limits of that engine still apply.

Prerequisites

First, confirm Docker Engine is installed and the daemon is running on your Linux host. If you have not installed Docker yet, work through our guide to understanding and installing Docker first, then return here.

You will also need:

• A user account with sudo privileges on the host, or direct root access.
• TCP port 9443 available for the Portainer web UI.
• TCP port 8000 available only if you plan to use the Portainer Edge agent for remote environments.
• A few hundred megabytes of free disk space for the image and the persistent data volume.

Step 1: Create the Data Volume

Portainer stores its configuration — user accounts, environment connections, and settings — in a Docker volume. Create the named volume first so that data survives updates and container recreation:

docker volume create portainer_data

Confirm the volume exists with docker volume ls. Named volumes are managed by Docker and persist independently of any container’s lifecycle, which is exactly what you want for an administration tool you will update over time.

Step 2: Deploy the Portainer Container

With the volume in place, run the Portainer CE image:

docker run -d \
  -p 8000:8000 \
  -p 9443:9443 \
  --name portainer \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest

Each flag serves a specific purpose:

• -d runs the container detached, in the background.
• -p 8000:8000 exposes the Edge agent communication port. If you will only manage the local host, omit this mapping.
• -p 9443:9443 exposes the HTTPS web UI on port 9443.
• –name portainer gives the container a predictable name for later commands.
• –restart=always restarts Portainer automatically if it stops or the host reboots.
• -v /var/run/docker.sock:/var/run/docker.sock mounts the Docker API socket so Portainer can control the engine.
• -v portainer_data:/data mounts the volume created in Step 1.

Security note: mounting the Docker socket gives the Portainer container root-equivalent control over the Docker daemon, and therefore over the host. Treat this service as an administrative interface and protect it accordingly.

Step 3: Complete the Initial Setup

1. Browse to https://your-server-ip:9443, or https://localhost:9443 if you are on the host itself.
2. Accept the certificate warning. Portainer ships with a self-signed certificate; if you expose it beyond localhost, front it with a reverse proxy using a trusted certificate.
3. Create the administrator account. The password must be at least 12 characters.
4. Click Get Started and choose the local Docker environment to connect. Recent Portainer releases require you to connect an environment explicitly after account creation; the local environment is the Docker socket you mounted in Step 2.

Once connected, the home screen shows your environment with a live summary of running containers, images, volumes, and networks.

Managing Docker from the Dashboard

To deploy your first container through the UI:

1. Open Containers and click Add container.
2. Enter an image in the image field, such as nginx:alpine.
3. Under port mapping, publish host port 8080 to container port 80.
4. Click Deploy the container.

Test the result at http://your-server-ip:8080. The same form applies to any image: specify ports, volumes, environment variables, and restart policy, then deploy.

Beyond deployment, the dashboard covers the daily operations you would otherwise script with the CLI:

• View logs, resource statistics, and environment variables from the container list.
• Open an interactive console into a running container to troubleshoot issues directly.
• Create and prune images, networks, and volumes from their respective menus.
• Deploy stacks by pasting a Docker Compose file under Stacks and clicking Add stack.

Practical Guidance: Hardening and Maintenance

Restrict network exposure

By default, Portainer binds to all interfaces. If you only need access from the host, re-run the container with -p 127.0.0.1:9443:9443. On hosts with a firewall, allow only the required port — for example, sudo ufw allow 9443/tcp. For access across the internet, place Portainer behind a reverse proxy with a trusted HTTPS certificate instead of opening 9443 directly.

Protect credentials

Portainer credentials are a high-value target. Anyone who gains admin access effectively controls the Docker host, and that access is exactly the kind of foothold an attacker will exploit — the same techniques covered in our guide to maintaining system access within Linux. Enforce a strong admin password, and restrict the UI to your management network or a VPN wherever possible.

Keep Portainer updated

Because all state lives in the data volume, updates are safe and simple. Stop and remove the old container, pull the new image, then re-run the deployment command from Step 2:

docker stop portainer
docker rm portainer
docker pull portainer/portainer-ce:latest
# re-run the docker run command from Step 2

Back up the data volume

Portainer CE has no built-in backup feature, so back up the volume itself. The following command archives the volume to a compressed file in the current directory:

docker run --rm \
  -v portainer_data:/data \
  -v "$(pwd)":/backup \
  alpine tar czf /backup/portainer_backup.tar.gz -C /data .

Restore by extracting the archive into a freshly created volume, and keep backup copies off the host.

Consider the Portainer Agent

For remote Docker hosts, run the Portainer agent on each target and connect Portainer to the agents rather than exposing Docker sockets directly over the network. The agent gives Portainer the access it needs with a smaller exposed surface.

Conclusion

Portainer CE wraps a working Docker engine in a practical web dashboard. Installation is three steps: create a data volume, run the container, and complete the initial setup. Then harden network exposure, protect the admin account, update regularly, and back up the volume, and the dashboard will remain a reliable control plane for your containers.