Install & Host Portainer on a VPS with Docker

This guide walks you through installing Docker on a VPS, deploying Portainer CE (Community Edition) as a container, accessing it securely over HTTPS, and keeping both Docker and Portainer up to date. By the end, you’ll have a web-based dashboard to manage containers, images, volumes, and networks from any browser.

What You’ll Need

A VPS running a recent Linux distribution (Ubuntu 22.04/24.04, Debian 12, or similar) with root or sudo access.
A domain name pointing to your VPS’s IP address (for free HTTPS via Let’s Encrypt). If you don’t have one, you can use a self-signed certificate or skip HTTPS for testing.
Open ports 80 and 443 in your firewall (if enabled) for web traffic.
SSH client (like PuTTY on Windows, or Terminal on macOS/Linux) to connect to your server.
Basic comfort with the command line.

Step-by-Step

Connect to your VPS via SSH: ssh user@your-server-ip.
Update the system: run sudo apt update && sudo apt upgrade -y (for Debian/Ubuntu). Reboot if the kernel was updated.
Install Docker using the official convenience script (recommended for beginners): curl -fsSL https://get.docker.com -o get-docker.sh then sudo sh get-docker.sh. Verify with docker --version.
Enable Docker to start on boot: sudo systemctl enable docker.
Create a persistent volume for Portainer data: sudo docker volume create portainer_data. This ensures your configuration survives container updates and restarts.
Install Portainer CE (the free version) by running the following command. Replace your-domain.com with your actual domain (or your VPS IP if you’re not using a domain):
sudo docker run -d --name portainer --restart=always -p 8000:8000 -p 9443:9443 -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest
This maps port 8000 (for Edge agent connections) and port 9443 (for the HTTPS web UI).
Verify the container is running: sudo docker ps should show portainer with status Up.
Access the web UI: open https://your-server-ip:9443 in your browser. You’ll see a security warning because the default certificate is self-signed. Click through to proceed (this is expected at this stage).
Complete the initial setup: create a strong admin username and password (at least 12 characters). Choose “Get Started” to manage the local Docker environment.
Set up HTTPS with a trusted certificate (recommended):
1. Stop the Portainer container: sudo docker stop portainer.
2. Install Nginx as a reverse proxy: sudo apt install nginx.
3. Create an Nginx config file: sudo nano /etc/nginx/sites-available/portainer and paste the following (replace your-domain.com):
```
server {
    listen 80;
    server_name your-domain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name your-domain.com;
    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
    location / {
        proxy_pass https://localhost:9443;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
```
4. Enable the site: sudo ln -s /etc/nginx/sites-available/portainer /etc/nginx/sites-enabled/ and remove the default: sudo rm /etc/nginx/sites-enabled/default.
5. Install Certbot for Let’s Encrypt: sudo apt install certbot python3-certbot-nginx.
6. Obtain a certificate: sudo certbot --nginx -d your-domain.com. Follow the prompts.
7. Test the Nginx config: sudo nginx -t, then reload: sudo systemctl reload nginx.
8. Start Portainer again: sudo docker start portainer.
Access Portainer via your domain: now visit https://your-domain.com â€“ you should see the login page with a valid lock icon.

Keep Docker and Portainer updated:

Update Docker Engine: sudo apt update && sudo apt upgrade -y (this updates Docker along with other system packages).

Update Portainer: pull the latest image and recreate the container:

sudo docker stop portainer
sudo docker rm portainer
sudo docker pull portainer/portainer-ce:latest
sudo docker run -d --name portainer --restart=always -p 8000:8000 -p 9443:9443 -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest

Enable automatic updates (optional but recommended): use a tool like Watchtower to keep Portainer (and other containers) updated automatically. Install with: sudo docker run -d --name watchtower --restart=always -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtower. This checks for updates daily and recreates containers with the same settings.

Common Mistakes

Forgetting to mount the Docker socket: without -v /var/run/docker.sock:/var/run/docker.sock, Portainer cannot communicate with Docker and will show “Unable to connect to Docker”.
Using the wrong data volume: if you don’t create and reuse a named volume, Portainer loses its configuration when you update the container.
Opening the wrong ports: the web UI runs on 9443 (HTTPS) and 8000 (Edge). If you only open port 9000 (the old HTTP port), you won’t reach the UI.
Skipping the firewall: if you have UFW or another firewall, you must allow ports 80, 443, 8000, and 9443: sudo ufw allow 80,443,8000,9443/tcp.
Not setting a strong admin password: Portainer is a powerful admin tool; a weak password can compromise your entire server.
Leaving the default self-signed certificate: browsers will keep showing warnings; using a reverse proxy with Let’s Encrypt solves this cleanly.

Tips

Use a dedicated subdomain like portainer.example.com so you can later add other services without conflicts.
Back up the portainer_data volume regularly: sudo tar -czf portainer_backup.tar.gz -C /var/lib/docker/volumes/portainer_data/_data .
Enable two-factor authentication (2FA) in Portainer’s settings for extra security.
Restrict access to Portainer by IP address using Nginx’s allow and deny directives if you’re the only user.
Use the Portainer API for automation â€“ it’s well-documented and can integrate with CI/CD pipelines.
For production, consider running Portainer itself in a Docker Swarm or Kubernetes cluster for high availability.

Troubleshooting

Can’t access the web UI: check that the container is running (sudo docker ps), that ports 9443 and 8000 are listening (sudo ss -tulpn | grep -E '9443|8000'), and that your firewall allows them.
Browser shows “This site can’t be reached”: verify your VPS IP and that the domain resolves correctly (if using one). Try accessing via IP first.
Security warning persists: if you used the reverse proxy, make sure Nginx is actually serving the certificate. Check with sudo certbot certificates and that the Nginx config paths match.
Portainer says “Unable to connect to Docker”: ensure the Docker socket is mounted correctly. Recreate the container with the exact -v /var/run/docker.sock:/var/run/docker.sock flag.
Portainer won’t start after update: check logs with sudo docker logs portainer. If the data volume is corrupted, restore from backup.
Nginx returns 502 Bad Gateway: the proxy can’t reach Portainer. Make sure Portainer is running and that proxy_pass points to https://localhost:9443 (not http).

Frequently Asked Questions

Is Portainer free?

Yes, Portainer Community Edition (CE) is free and open-source. There’s also a Business Edition with extra features like RBAC and registry management, but CE is sufficient for most personal and small-team use.

Do I need to install Docker separately?

Yes, Portainer runs as a Docker container, so Docker must be installed first. The steps above cover installing Docker on a Linux VPS.

Can I use Portainer to manage multiple servers?

Yes, you can add remote environments in Portainer using the Edge agent or by exposing the Docker API over TLS. The free CE version supports multiple environments, but some advanced features require Business Edition.

How do I update Portainer without losing my settings?

As long as you use the same named volume (portainer_data), your settings and configurations persist. Just pull the new image and recreate the container with the same volume.

Is it safe to expose Portainer to the internet?

It’s risky if you don’t secure it properly. Always use HTTPS, a strong password, and consider enabling 2FA. For extra safety, restrict access by IP or use a VPN.

What is the default port for Portainer?

Portainer CE uses port 9443 for the HTTPS web UI and port 8000 for Edge agent connections. Older versions used port 9000 for HTTP, but that is deprecated.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →