Portainer is a web interface for managing containers, images, volumes, networks and stacks across Docker, Docker Swarm and Kubernetes environments. It exists so you can see and restart things without SSH, and it connects to remote hosts through a small agent.
Our verdict on Portainer#
The confusing part of Portainer is that the free option most people should use is not the open source one. Community Edition is genuinely open source under the zlib license, no key, no telemetry, currently 2.45.0 LTS (August 2026). Business Edition is proprietary but free forever for up to three nodes, one free licence per company domain, renewed annually at no cost, and it includes RBAC, GitOps with scheduled polling, registry management and audit logs that CE does not have. For a homelab with one or two hosts, BE is strictly more software for the same zero dollars; choose CE if you want no licence key, no outbound validation, or an auditable build. Either way, understand what you are handing it: Portainer mounts /var/run/docker.sock, so anyone who reaches its UI can start a privileged container and own the host. Put it behind your VPN, not behind a port forward.
Who Portainer is for#
Choose it if
- Someone new to containers who wants to see logs, exec into a shell and restart a stack without learning docker CLI flags first
- A household admin who supports other people's services and needs a restart button that is not an SSH session
- A small team managing two or three Docker hosts, where the free three-node Business licence covers everything they run
Look elsewhere if
- You manage your stacks as files in git and deploy by pulling; Portainer's stack editor will fight your source of truth
- You cannot accept a web UI with root-equivalent access to the Docker socket on that host
What running it actually looks like#
One container with the Docker socket and a named volume: docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:lts. Use the :lts tag rather than :latest unless you want the short-support train. Port 9443 is HTTPS with a self-signed certificate, 8000 is the tunnel port for Edge agents and can be omitted if you have none. On first start Portainer prints a setup token to its logs, and you have five minutes from container start to create the admin account before it times out and you have to restart the container. For remote hosts, deploy the agent container on each node rather than exposing the Docker API over TCP.
Resource profile#
- Memory
- 90 MB idle, around 220 MB in ordinary use. The server is a single Go binary; memory tracks how many environments and containers it is polling, not user count.
- CPU and acceleration
- Near idle except during the periodic environment snapshot, which walks every container on every connected host and can be noticeable on a Pi managing several nodes.
- Storage growth
- `/data` stays under a few hundred megabytes; the database grows with edge stacks and stored images metadata, and old snapshots are pruned automatically.
- Operational load
- 1 of 5, Set and forget. One container, one BoltDB file, upgrades are a pull and recreate. It fits rubric level 1, with the caveat that a corrupt database file is unrecoverable without your backup.
Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.
Data and backup surface#
Everything is in the /data volume, and effectively everything in /data is portainer.db, a BoltDB file. It is not safe to copy while Portainer is writing; stop the container, copy /data, start it again. That file holds users, environment definitions, agent keys, stack definitions and registry credentials, so treat it as a secret. Portainer also writes /data/certs for its TLS material and /data/compose for stacks created through the UI, which are worth keeping if you edited them in the web editor rather than in git. Nothing in /data is large; snapshot it nightly.
Derived backup shape
Embedded key-value store. Stop the service and copy its data directory, or use the project's own export command. There is no dump utility to run against it while it is live.
Traps and surprises#
The setup token expires five minutes after first start
New instances print a setup_token= line in the container logs and require it to claim the admin account, and the docs state the user must be created within five minutes. If you install it and wander off, you come back to a timeout error and have to restart the container to get a new window. For automated installs use --admin-password-file, or --no-setup-token on an isolated network.
The free Business licence is three nodes, not five
Portainer's free Business Edition tier covers three nodes, down from the earlier five-node offer, and it is one licence per company as identified by web domain. The key is issued for a one year term and must be renewed, free, each year while you stay within three nodes. Instances that lapse fall back to reduced functionality, so put the renewal in your calendar rather than discovering it during an outage.
Mounting the Docker socket is root on the host
Portainer needs /var/run/docker.sock to do anything useful, and that socket is root-equivalent: a user with container-create permission can mount the host filesystem into a privileged container. There is no RBAC in Community Edition fine-grained enough to prevent this. Do not expose the UI to the internet, do not share the admin account, and prefer the agent over publishing the Docker API on TCP 2375.
Stacks edited in the UI drift from your compose files
A stack created through Portainer is stored inside /data/compose and edited in the browser. If you also keep that compose file in git and redeploy from the CLI, the two diverge silently and whichever one ran last wins. Pick one source of truth. Business Edition's GitOps mode reconciles from a repository on a schedule, which is the honest fix if you want both.
Specifications#
- Category
- Platforms and container management
- Licence
- zlib (Community Edition); Business Edition is proprietary (Permissive)
- Written in
- Go / TypeScript
- First release
- 2016
- Maturity
- Mature
- Datastore
- BoltDB key-value file at /data/portainer.db
- Default ports
8000,9000,9443- Ships as
- docker, docker swarm stack, helm chart, agent per node
- arm64 builds
- Yes
- Identity
- Native OIDC. CE supports LDAP and generic OAuth login; Active Directory, provider templates and group-to-team mapping are Business Edition only.
- Replaces
- Docker Desktop, Rancher, VMware vCenter
- Project site
- www.portainer.io
- Source
- github.com/portainer/portainer
- Documentation
- docs.portainer.io
Alternatives to Portainer#
Everything else in platforms and container management, closest in operational weight first.
| Tool | Ops load | Idle RAM | Licence |
|---|---|---|---|
| CasaOS | 2, Light | 300 MB | Apache-2.0 |
| Docker Engine | 2, Light | 120 MB | Apache-2.0 (Engine and Compose); Docker Desktop is proprietary |
| Podman | 2, Light | 40 MB | Apache-2.0 |
| Unraid | 2, Light | 2048 MB | Proprietary, perpetual per-device licence |
| Coolify | 3, Moderate | 1200 MB | Apache-2.0 |
| Dokploy | 3, Moderate | 900 MB | Apache-2.0, with DSAL 1.0 reserved for a /proprietary path |
Where Portainer comes up elsewhere#
Sources#
Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.
Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.