Tech Digest

Platforms

Portainer

Web UI for Docker, Swarm and Kubernetes, with a free tier that is not the open source one

Platformszlib (Community Edition); Business Edition is proprietaryMaturearm64 buildsNative OIDC
Last reviewed Profile maintained against the project's own documentation
Operational load
1 / 5
Set and forget
Idle memory
90 MB
typical use ~220 MB
Moving parts
1
containers in a normal deployment
Backup shape
Embedded key-value store
needs a dump or a stop

Portainer is a web interface for managing containers, images, volumes, networks and stacks across Docker, Docker Swarm and Kubernetes environments. It exists so you can see and restart things without SSH, and it connects to remote hosts through a small agent.

Our verdict on Portainer#

The confusing part of Portainer is that the free option most people should use is not the open source one. Community Edition is genuinely open source under the zlib license, no key, no telemetry, currently 2.45.0 LTS (August 2026). Business Edition is proprietary but free forever for up to three nodes, one free licence per company domain, renewed annually at no cost, and it includes RBAC, GitOps with scheduled polling, registry management and audit logs that CE does not have. For a homelab with one or two hosts, BE is strictly more software for the same zero dollars; choose CE if you want no licence key, no outbound validation, or an auditable build. Either way, understand what you are handing it: Portainer mounts /var/run/docker.sock, so anyone who reaches its UI can start a privileged container and own the host. Put it behind your VPN, not behind a port forward.

Who Portainer is for#

Choose it if

  • Someone new to containers who wants to see logs, exec into a shell and restart a stack without learning docker CLI flags first
  • A household admin who supports other people's services and needs a restart button that is not an SSH session
  • A small team managing two or three Docker hosts, where the free three-node Business licence covers everything they run

Look elsewhere if

  • You manage your stacks as files in git and deploy by pulling; Portainer's stack editor will fight your source of truth
  • You cannot accept a web UI with root-equivalent access to the Docker socket on that host

What running it actually looks like#

One container with the Docker socket and a named volume: docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:lts. Use the :lts tag rather than :latest unless you want the short-support train. Port 9443 is HTTPS with a self-signed certificate, 8000 is the tunnel port for Edge agents and can be omitted if you have none. On first start Portainer prints a setup token to its logs, and you have five minutes from container start to create the admin account before it times out and you have to restart the container. For remote hosts, deploy the agent container on each node rather than exposing the Docker API over TCP.

Resource profile#

Memory
90 MB idle, around 220 MB in ordinary use. The server is a single Go binary; memory tracks how many environments and containers it is polling, not user count.
CPU and acceleration
Near idle except during the periodic environment snapshot, which walks every container on every connected host and can be noticeable on a Pi managing several nodes.
Storage growth
`/data` stays under a few hundred megabytes; the database grows with edge stacks and stored images metadata, and old snapshots are pruned automatically.
Operational load
1 of 5, Set and forget. One container, one BoltDB file, upgrades are a pull and recreate. It fits rubric level 1, with the caveat that a corrupt database file is unrecoverable without your backup.

Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.

Data and backup surface#

Everything is in the /data volume, and effectively everything in /data is portainer.db, a BoltDB file. It is not safe to copy while Portainer is writing; stop the container, copy /data, start it again. That file holds users, environment definitions, agent keys, stack definitions and registry credentials, so treat it as a secret. Portainer also writes /data/certs for its TLS material and /data/compose for stacks created through the UI, which are worth keeping if you edited them in the web editor rather than in git. Nothing in /data is large; snapshot it nightly.

Derived backup shape

Embedded key-value store. Stop the service and copy its data directory, or use the project's own export command. There is no dump utility to run against it while it is live.

Traps and surprises#

The setup token expires five minutes after first start

New instances print a setup_token= line in the container logs and require it to claim the admin account, and the docs state the user must be created within five minutes. If you install it and wander off, you come back to a timeout error and have to restart the container to get a new window. For automated installs use --admin-password-file, or --no-setup-token on an isolated network.

The free Business licence is three nodes, not five

Portainer's free Business Edition tier covers three nodes, down from the earlier five-node offer, and it is one licence per company as identified by web domain. The key is issued for a one year term and must be renewed, free, each year while you stay within three nodes. Instances that lapse fall back to reduced functionality, so put the renewal in your calendar rather than discovering it during an outage.

Mounting the Docker socket is root on the host

Portainer needs /var/run/docker.sock to do anything useful, and that socket is root-equivalent: a user with container-create permission can mount the host filesystem into a privileged container. There is no RBAC in Community Edition fine-grained enough to prevent this. Do not expose the UI to the internet, do not share the admin account, and prefer the agent over publishing the Docker API on TCP 2375.

Stacks edited in the UI drift from your compose files

A stack created through Portainer is stored inside /data/compose and edited in the browser. If you also keep that compose file in git and redeploy from the CLI, the two diverge silently and whichever one ran last wins. Pick one source of truth. Business Edition's GitOps mode reconciles from a repository on a schedule, which is the honest fix if you want both.

Specifications#

Category
Platforms and container management
Licence
zlib (Community Edition); Business Edition is proprietary (Permissive)
Written in
Go / TypeScript
First release
2016
Maturity
Mature
Datastore
BoltDB key-value file at /data/portainer.db
Default ports
8000, 9000, 9443
Ships as
docker, docker swarm stack, helm chart, agent per node
arm64 builds
Yes
Identity
Native OIDC. CE supports LDAP and generic OAuth login; Active Directory, provider templates and group-to-team mapping are Business Edition only.
Replaces
Docker Desktop, Rancher, VMware vCenter
Project site
www.portainer.io
Source
github.com/portainer/portainer
Documentation
docs.portainer.io

Alternatives to Portainer#

Everything else in platforms and container management, closest in operational weight first.

ToolOps loadIdle RAMLicence
CasaOS2, Light300 MBApache-2.0
Docker Engine2, Light120 MBApache-2.0 (Engine and Compose); Docker Desktop is proprietary
Podman2, Light40 MBApache-2.0
Unraid2, Light2048 MBProprietary, perpetual per-device licence
Coolify3, Moderate1200 MBApache-2.0
Dokploy3, Moderate900 MBApache-2.0, with DSAL 1.0 reserved for a /proprietary path

Where Portainer comes up elsewhere#

Sources#

Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.

  1. Portainer CE repository and zlib licence
  2. Install Portainer CE with Docker on Linux
  3. Setup token FAQ
  4. Free three-node Business licence terms
  5. CE versus BE feature comparison

Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.