How to Install Portainer on a VPS with Docker

Portainer gives Docker a clean web interface for containers, images, volumes, networks and Compose stacks. It is especially useful when a server has moved beyond one or two containers but the team does not need a full orchestration platform. You still keep the portability of Compose files while gaining a quicker view of health, logs and deployments.

This guide installs Portainer Community Edition on a Linux VPS using the current long-term-support image. It also covers the part many quick tutorials miss: a Docker-published port can bypass the rules you expect UFW to enforce.

When Portainer Is the Right Tool

Portainer works well for a personal cloud, a small SaaS stack, internal tools, monitoring services and development environments. It is not a replacement for understanding Docker, but it reduces routine command-line work and gives less experienced operators a safer way to inspect a host.

• Good fit: one or several Docker hosts, Compose-based applications and a small operations team.
• Think twice: a publicly exposed dashboard with no access controls, or a host shared with untrusted users.
• Use another layer: large multi-node scheduling requirements may be better served by Kubernetes, Nomad or another orchestrator.

Choose and Prepare the VPS

Portainer itself is light, but the applications it manages are not. For a small host, 2 GB RAM is a workable starting point. Choose 4 GB or more when the server will run databases, monitoring, automation or several production services. HYEHOST Cloud VPS includes IPv4, IPv6, SSD storage, snapshots and the control-panel tools needed to rebuild or recover the VM.

Patch the server first, then install Docker from Docker's official repository. Avoid snap-packaged Docker for this deployment because Portainer's documentation notes compatibility issues with that route.

sudo apt update
sudo apt full-upgrade -y
docker version
docker compose version

If the final two commands fail, follow our Docker installation guide before continuing.

Install Portainer CE with Docker Compose

Create a dedicated project directory. Keeping the Compose file in /opt/portainer makes later updates and audits straightforward.

sudo mkdir -p /opt/portainer
cd /opt/portainer
sudo nano compose.yaml

Add the following configuration:

services:
  portainer:
    image: portainer/portainer-ce:lts
    container_name: portainer
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    ports:
      - "9443:9443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data

volumes:
  portainer_data:

Port 9443 serves the HTTPS interface. Portainer also documents port 8000, but it is only required for Edge Agents. Leave it unpublished unless you are actually using that feature. The old HTTP port 9000 is not needed for this setup.

Start the service and inspect its status:

docker compose up -d
docker compose ps
docker compose logs --tail=100 portainer

Complete the First Login

Open https://your-server-ip:9443. The initial certificate is self-signed, so the browser will warn until you place Portainer behind a trusted reverse proxy or install a trusted certificate. Confirm that the address is your server before proceeding.

Create a strong administrator password and complete initialization promptly. Select the local Docker environment when prompted. Once inside, confirm that Portainer can see the container it is running in, then deploy one low-risk test stack before moving production services.

Secure Portainer Before Adding Applications

The Docker socket gives Portainer extensive control over the host. A user who takes over the dashboard can create privileged containers, mount host paths and reach secrets stored by other workloads. Treat access to Portainer as effectively equivalent to root access.

• Restrict the dashboard to trusted source addresses, a private LAN or a VPN.
• Use a unique password and enable stronger authentication options available to your deployment.
• Keep Portainer and Docker patched.
• Give additional users only the access they need.
• Do not expose Edge Agent or legacy ports without a clear requirement.

A clean pattern is to bind Portainer to localhost and publish it through a reverse proxy on the same host:

ports:
  - "127.0.0.1:9443:9443"

Alternatively, bind it to a private interface and reach it over a VPN. If you need direct public access, use Docker's recommended firewall approach and test from an external network. Do not disable Docker's iptables handling as a shortcut; doing so can break container networking.

Deploy Applications as Reproducible Stacks

Portainer can create containers one field at a time, but Compose stacks are easier to review, back up and rebuild. Keep the source Compose file in version control with secrets excluded. Use Portainer to deploy it, inspect logs and handle routine restarts without making the dashboard the only copy of the configuration.

Before a stack goes live, document its domains, volumes, secrets, update process and restore steps. That small habit matters more than the choice of dashboard when a server must be rebuilt at short notice.

Back Up Portainer and the Workloads Separately

Portainer's own backup covers its configuration, users, environments and stack definitions. Portainer explicitly notes that this does not back up the data inside your containers or volumes. A successful Portainer backup is therefore only one part of the recovery plan.

1. Export a Portainer backup from its settings and store it away from the VPS.
2. Back up bind mounts, named volumes and databases with application-aware tools.
3. Keep Compose files and non-secret configuration in version control.
4. Test a restore on a separate host or disposable VM.

HYEHOST snapshots provide a useful server-level recovery point, but databases and irreplaceable files still need an independent backup schedule.

Update Portainer Safely

Take a Portainer backup and confirm application backups before changing the control plane. Then pull the current LTS image and recreate the container from the same Compose file:

cd /opt/portainer
docker compose pull
docker compose up -d
docker compose ps
docker compose logs --tail=100 portainer

Open the dashboard, confirm the local environment connects and inspect a few important stacks. Staying on the lts channel is the conservative choice for a production VPS; use the short-term channel only when you understand its release cadence and need those features.

Common Portainer Problems

Portainer VPS FAQ

Is Portainer free?

Portainer Community Edition is free to use. Portainer also offers commercial editions with additional management and support features.

Does Portainer need port 8000?

Not for a normal local Docker installation. Port 8000 is used for Edge Agent communication and should remain closed when that feature is not in use.

Can Portainer manage Docker Compose?

Yes. Portainer calls Compose applications stacks and can deploy them from its editor, uploaded files or supported repositories.

Is exposing Portainer to the internet safe?

It increases risk because Portainer controls the Docker host. Prefer private access through a VPN or trusted source restrictions. If public access is necessary, use trusted HTTPS, strong authentication, timely updates and tested firewall rules.

Does a Portainer backup include container data?

No. It protects Portainer configuration, not the contents of application volumes and databases. Back those up separately.

Keep the Convenience, Preserve the Escape Route

Portainer is at its best when it makes a well-documented Docker host easier to operate. Keep Compose files outside the dashboard, restrict management access, back up real application data and practise rebuilding the host. You then get the useful interface without making it a single point of failure.

Start with a HYEHOST Cloud VPS for a production Docker stack, or compare our self-hosting VPS options for smaller services and labs.

Official Resources

• Install Portainer CE with Docker on Linux
• Update Portainer on Docker
• Portainer backup settings
• Docker packet filtering and firewalls
• HYEHOST Docker installation guide