How to Use Portainer: The Beginner's Guide (First Install, First Stack, and the Docker-Socket Rule)

CodexFuse Team · 2026-10-30T13:07:34.858Z · 13 min read

Learning how to use Portainer is the fastest way to stop managing Docker containers over SSH. Portainer is a lightweight web dashboard that puts every Docker action — starting containers, reading logs, editing networks, deploying multi-container stacks — behind a point-and-click interface in your browser. If you can run Docker, you can run Portainer, because Portainer itself is just one more Docker container.

This beginner guide walks you through the full journey in one sitting: installing Portainer on Docker, creating your admin account inside the five-minute setup window, deploying your first container and your first stack, and following the one security rule every beginner misses — the Docker-socket rule. It assumes you already know what Docker is; if not, start with our Docker beginner guide first.

What Is Portainer?

Portainer is an open-source container management platform — a web UI that connects to the Docker Engine API and lets you create, start, stop, inspect, and delete containers, images, networks, and volumes without typing Docker commands. It was first released in 2016 and has grown into the de-facto visual interface for self-hosted Docker setups, according to the 2026 CloudPicked Portainer guide.

Portainer supports Docker (standalone and Swarm), Kubernetes, and Podman environments through a single dashboard, per the RoseHosting Ubuntu 26.04 Portainer tutorial. Beginners use it to replace repetitive SSH sessions: instead of logging into a server to check why a container crashed, you open a browser tab, click the container, and read its logs and resource stats in seconds.

What Do You Need Before Installing Portainer?

You need a Linux server with Docker already installed. That is genuinely the only requirement — Portainer has no installer of its own.

Most beginners run Portainer on a VPS. If you are renting one for the first time, our VPS hosting guide explains what you are actually buying. Some providers remove the Docker-install step entirely: Hostinger offers an Ubuntu 24.04 VPS template with Portainer Community Edition pre-installed, and Bluehost offers an AlmaLinux 9 self-managed VPS template with Portainer CE pre-installed, per those providers' official template guides.

On a self-managed server, install Docker first (the official convenience script, curl -fsSL https://get.docker.com | sh, is the path the CloudPicked guide uses), then move on to Portainer itself.

How Do You Install Portainer with Docker?

Installing Portainer means running its own container with access to the Docker daemon. As of this writing, the current Community Edition release is 2.45.2 LTS, published on October 8, 2026 (per the dev.to guide "Portainer CE on Docker: Install, Stacks and Git Updates"). For a stable install, use the lts tag rather than pinning a moving version — the FitServers dedicated-server tutorial recommends exactly that.

1. Create a persistent data volume. This volume holds Portainer's database, so your users, stacks, and settings survive container recreation:

   docker volume create portainer_data

2. Start the Portainer container. This is the one command:

   docker run -d \
     --name portainer \
     --restart=always \
     -p 9443:9443 \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v portainer_data:/data \
     portainer/portainer-ce:lts

   The RoseHosting, FitServers, and Hostinger guides all converge on this shape: the Docker socket mount, the data volume, and port 9443. (Many guides also publish port 8000 — you only need that if you plan to connect remote Edge Agents, as the next section explains.)

3. Open the dashboard. In your browser, go to https://YOUR_SERVER_IP:9443. Your browser will show a certificate warning because Portainer generates its own self-signed certificate on first start (the dev.to install guide notes the generated certificate is valid for five years) — click Advanced and proceed.

How Do You Create the Admin Account Before the 5-Minute Timeout?

The first time Portainer starts, it gives you five minutes to create the admin user — and since version 2.43 it also requires a setup token from the container's logs before it lets you do it, according to the dev.to "Install Portainer CE on Ubuntu 26.04" guide.

1. Grab the setup token from the logs (required on 2.43 and newer):

   docker logs portainer 2>&1 | grep -i "setup token"

2. Create the admin user on the setup page: enter your username, a strong password, and the token when prompted.

3. Connect the local environment: on the environment screen, choose Docker and click Get Started to attach to the Docker engine running on the same machine (the Hostinger template guide describes this screen).

If the five-minute window expires, Portainer locks the setup page for security. The Hostinger guide gives the official recovery: stop and restart the Portainer container — the timer restarts, and nothing is lost because your data lives in the portainer_data volume.

What Is the Docker-Socket Security Rule?

Here is the rule most beginner guides never teach: Portainer is not a dashboard sitting beside Docker — it is a web login in front of /var/run/docker.sock (the phrasing comes from the dev.to Ubuntu 26.04 install guide). The socket mount gives Portainer the same power as root on the host — it can start, stop, and create containers with host mounts, which means anyone who can reach Portainer's login page is one weak password away from owning the server.

That makes two hardening steps non-negotiable:

• Bind the UI to localhost, not to every interface. The stock install command publishes 9443 on all addresses (0.0.0.0), and Docker writes its own firewall rules, so your firewall never gets a say — this is the central finding of the dev.to guide, which demonstrates the bypass on a Hetzner server. Publish the port on localhost only:

docker run -d \
  --name portainer \
  --restart=always \
  -p 127.0.0.1:9443:9443 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:lts

• Reach it through an SSH tunnel, not the open internet. From your laptop: ssh -L 9443:localhost:9443 your-user@your-server, then open https://localhost:9443. Add a reverse proxy with a real certificate (Nginx or Traefik, as the CloudPicked guide suggests) only when you need multi-user access, and never without authentication.
• Do not publish port 8000 on a single host. Port 8000 exists for Portainer Edge Agents connecting remote machines; it serves no purpose on a standalone server and is just extra attack surface (dev.to install guide).

How Do You Deploy Your First Container?

With the environment connected, deploying a container is three clicks and a form. The Hostinger and Bluehost template guides describe the same flow:

1. Click Containers in the left sidebar, then Add container.
2. Give it a name, pick an image (for example nginx), and map any ports or volumes it needs.
3. Click Deploy the container.

The container now appears in the list with its status, published ports, and quick actions. Clicking it reveals everything beginners used to grep through SSH for: live logs, the in-browser console, resource statistics (CPU, memory, network I/O), and the full inspect output — the ByteGoblin guide walks through exactly this view.

What Are Portainer Stacks and When Should You Use Them?

Portainer stacks are multi-container applications deployed from a Docker Compose file through the UI. A stack is simply a Compose YAML file plus a name — Portainer runs it exactly like docker compose up would, but the stack, its containers, networks, and volumes all become manageable from the dashboard.

There are three ways to create one:

• Web editor: paste your Compose file into the built-in editor under Stacks → Add stack.
• Upload: upload a compose file from your machine.
• Git repository: point the stack at a Git repo, which is the professional choice — the dev.to stacks guide shows that enabling polling (or a webhook) on the Git source makes the stack redeploy itself when you push, a pattern unchanged in CE 2.45.

Two gotchas to know up front. First, containers you started with plain docker compose show up in Portainer as "Limited" — Portainer can see them but not fully manage them. The dev.to guide's fix: run docker compose down (without -v, so data volumes survive), then deploy the same Compose file as a Portainer stack with the same name — the stack gains full control and your data is untouched.

Second, if you run your Docker host inside a virtual machine on your own hardware, many beginners use Proxmox for the host layer and Portainer for the container layer; our Proxmox beginner guide covers that side.

Portainer vs Docker Compose: Which Should You Use?

This is the comparison beginners actually search for, so here is the honest answer in one table:

How Do You Update and Back Up Portainer?

Portainer updates like any container: download a backup first, then recreate the container with the new image — never delete the data volume.

1. Back up from the UI: go to Settings → Backup and download the backup file. (The dev.to stacks guide's standing rule: back up before every upgrade.)

2. Recreate the container with the new tag:

   docker stop portainer
   docker rm portainer
   docker pull portainer/portainer-ce:lts
   docker run -d \
     --name portainer \
     --restart=always \
     -p 127.0.0.1:9443:9443 \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v portainer_data:/data \
     portainer/portainer-ce:lts

   On first start after an upgrade, Portainer copies the database to /data/backups/portainer.db.bak and migrates it automatically — the dev.to guide watched this happen live upgrading from 2.45.1 to 2.45.2.

Backups only matter if you monitor the thing you back up. Point a monitor at the dashboard: our Uptime Kuma beginner guide shows how to get alerted the minute Portainer (or anything it manages) goes down.

Portainer Community vs Business Edition: What's Free?

Portainer ships in two editions, and the naming confuses beginners:

Beginners should install CE with the lts tag — it is the edition every beginner guide in this article's sources uses, and it covers everything in this guide.

Beginner Problems and Fixes

Sources

• deploylark, "Portainer CE on Docker: Install, Stacks and Git Updates" (dev.to, Oct 2026) — CE 2.45.2 LTS published Oct 8, 2026; localhost-bound Compose install; setup token; Git stacks; backup before upgrade.
• peculiarengineer, "Install Portainer CE on Ubuntu 26.04 (without exposing my Docker host)" (dev.to, Sep 2026) — ufw bypass by stock command; 127.0.0.1 binding; SSH tunnel; setup token since 2.43; port 8000 is Edge-Agent-only.
• CloudPicked, "Portainer Guide 2026 — Docker VPS Management via Web UI" (cloudpicked.com) — BE free for up to 3 nodes; reverse proxy recommendation; dashboard features.
• Hostinger, "How to use the Portainer VPS template at Hostinger" (hostinger.com) — Ubuntu 24.04 template with Portainer CE; 5-minute admin timeout; restart-container recovery; Add container flow.
• Bluehost, "Bluehost Self-Managed VPS: How to Use Portainer Template" (bluehost.com) — AlmaLinux 9 template with Portainer CE; dashboard access steps.
• RoseHosting, "Docker Container Management on Ubuntu 26.04 using Portainer" (rosehosting.com) — Docker-first prerequisites; socket-mount install; environment support (Docker, Swarm, Kubernetes).
• ByteGoblin, "Manage Your Containers With Portainer" (bytegoblin.io) — dashboard walkthrough; container actions, logs, console, stats.
• FitServers, "How to Install Portainer on a Dedicated Server" (fitservers.com) — lts tag recommendation; backup before upgrade; update procedure.
• CopyProgramming, "Portainer Reset-Password & Reinstall Guide" (copyprogramming.com) — portainer/helper-reset-password official method.

Frequently Asked Questions

Is Portainer free for beginners?

Yes. The Community Edition is free and open-source with no node limits, and it covers everything in this guide. The Business Edition is free for up to 3 nodes with no time limits, according to the CloudPicked 2026 guide — you do not need it to learn.

Do I still need to learn Docker commands to use Portainer?

It helps, but far less than before. The dashboard handles daily work — starting, stopping, updating, reading logs. You still need basic commands for the install itself and for emergencies when the dashboard is down, so keep the Docker beginner guide handy.

Can Portainer manage Kubernetes, not just Docker?

Yes — Portainer supports Docker, Docker Swarm, Kubernetes, and Podman environments through the same dashboard (per the RoseHosting tutorial). This guide covers the Docker path, which is where every beginner should start.

How do I reset the Portainer admin password?

Stop the Portainer container, then run docker run --rm -v portainer_data:/data portainer/helper-reset-password and log in with the generated password, per the CopyProgramming 2026 guide. Your stacks and data are untouched.

Should I expose Portainer's port to the internet?

No — not directly. Portainer sits in front of the Docker socket with root-equivalent power, so bind it to 127.0.0.1 and reach it through an SSH tunnel. If teammates need access, put a reverse proxy with a real certificate in front of it instead of exposing 9443 raw.