Working Docker on a VPS provides you transportable, self-hosted apps with out the per-seat pricing of managed platform as a service (PaaS). Including Portainer places an online UI in entrance of Docker so that you don\u2019t should reside within the terminal.\u00a0<\/p>\n
A 4 GB VPS handles a small stack of side-project containers comfortably \u2014 Portainer itself runs on roughly 1 GB earlier than you load the rest. The official Portainer Neighborhood Version set up is one docker run line and is absolutely featured for private initiatives and homelab use.\u00a0<\/p>\n
The 2 actual gotchas each set up information skips are Portainer\u2019s five-minute initial-admin window and the truth that Docker bypasses UFW by default. This information walks by the set up, the sizing, the safety, and the place Portainer earns its carry on day two.<\/p>\n<\/p><\/div><\/div>\n
Have you ever ever heard of Dockerception<\/em>?<\/p>\n Properly, maintain onto your hat. We\u2019re taking place the rabbit gap.<\/p>\n Portainer, the net UI you\u2019re about to put in on prime of Docker, is itself a Docker container<\/em>.<\/p>\n It\u2019s a instrument that runs on the very factor it manages. You spin it up with one docker run line, and the very first thing it does is attain again by a small gap within the host (a socket file) and ask the Docker daemon to point out it each different container, together with itself. From inside that browser tab, you’ll be able to replace Portainer. Restart Portainer. And handle all your different Docker containers.<\/p>\n The UI you\u2019re looking at is one click on away from eradicating the UI you\u2019re looking at.<\/em><\/p>\n On a VPS the place you\u2019re already paying for the field and already snug with SSH, Portainer slots in cleanly on prime of Docker with out altering how something beneath works.<\/p>\n That\u2019s<\/em> the worth.<\/p>\n A 4 GB field runs Docker, Portainer, and a small fleet of self-hosted apps with out breaking a sweat. And it lands round the price of a few streaming subscriptions a month. Sufficient to run the house automation, the household photograph retailer, the AI assistant, and the publication you\u2019ve been threatening to launch \u2014 on one server you really personal.<\/p>\n Right here\u2019s find out how to get it operating, lock it down, and begin seeing worth.<\/p>\n Portainer is an online UI that runs as a Docker container and manages your different containers by the Docker socket.<\/strong><\/p>\n It\u2019s basically a browser-based entrance finish for a similar Docker instructions you\u2019d in any other case kind by hand, plus stack administration, role-based entry (in case you improve), and a dashboard view of CPU and reminiscence.<\/p>\n The socket connection is what makes it work. The bind seems like One factor to remember: any course of that may attain Deal with the socket bind as a privileged functionality, and audit each different container that wishes one.<\/p>\n Subscribe now to obtain all the newest updates, delivered on to your inbox.<\/p>\n<\/div>\n Nope. Docker<\/a> works high-quality from the terminal, and loads of folks run a few containers for years with out ever putting in a UI on prime.<\/p>\n You need Portainer if:<\/p>\n Skip Portainer if:<\/p>\n Docker itself is mainstream sufficient that this isn\u2019t a fringe determination. In line with the 2025 Stack Overflow Developer Survey<\/a>, Docker is essentially the most extensively adopted container platform amongst builders at over 70% utilization \u2014 the most important single-year bounce of any know-how the survey tracks. The Portainer venture has roughly 37,000 stars on GitHub<\/a>.<\/p>\n Different choices exist. Coolify pushes additional towards PaaS-style abstractions, and Dokploy lands in related territory with a lighter footprint \u2014 however Portainer is the one most set up guides attain for first.<\/p>\n For those who reside in tmux and run one app, shut this tab. You\u2019re high-quality.<\/em> For those who\u2019re operating 4 self-hosted apps and also you\u2019ve googled, \u201cWhat are Docker logs once more?\u201d twice this month, preserve studying.<\/p>\n A 4 GB VPS<\/a> handles Portainer plus a small stack of side-project containers comfortably.<\/p>\n Portainer recommends a number with at the least 2 GB of RAM and 1 CPU core, although the Portainer Server course of itself idles round 100 MB. The Docker daemon provides a couple of hundred MB of overhead earlier than any of your apps begin.<\/p>\n Right here\u2019s how that maps to actual workloads:<\/p>\n At DreamHost, our Self-Managed VPS<\/a> presents 4 RAM-based Stack tiers (Stack 4, 8, 16, and 32), with the entry-level Stack 4 sized for precisely this sort of small Docker host. (And yep, NVMe storage and full root entry are included.)<\/p>\n For those who\u2019re on the fence about whether or not self-hosting<\/a> is definitely worth the time, Stack 4 is the scale the place the maths begins working in your favor on day one.<\/p>\n One word on storage:<\/strong> Portainer\u2019s storage footprint is minimal \u2014 it shops solely its personal configuration database. Portainer\u2019s personal docs suggest SSD-level efficiency (\u22483.5 MB\/s sustained, 30,000+ IOPS, <10ms write latency), which any trendy NVMe drive clears comfortably. Disk solely turns into an actual concern in case you\u2019re operating database-heavy containers like Postgres or MySQL alongside it. In case your VPS is on spinning disk in 2026, the Portainer UI will really feel sluggish lengthy earlier than RAM does. Our recommendation: improve the disk earlier than the plan.<\/p>\n It takes six steps, and roughly half-hour, most of it ready for picture pulls.<\/p>\n Ubuntu 22.04 or 24.04 LTS is the trail of least resistance. Ubuntu is what DreamHost\u2019s Self-Managed VPS runs by default, and most Docker set up snippets and neighborhood assist threads assume it. Debian and AlmaLinux work too, although.<\/p>\n Undecided what model of Ubuntu you\u2019re operating? Study 5 methods to verify<\/a>.<\/p>\n Don\u2019t As an alternative, use Docker\u2019s personal apt repo per the official Docker set up docs<\/a>, which provides Docker\u2019s GPG key, the repo, and docker-ce<\/strong> plus the Compose plugin in a single go.<\/p>\n Run For those who don\u2019t get the \u201cHowdy from Docker!\u201d message, repair the daemon earlier than layering Portainer on prime.<\/p>\n Subsequent, run Protecting Portainer\u2019s database on a Docker quantity (not contained in the container) means a Portainer improve received\u2019t wipe your config.<\/p>\n Use the official set up command from Portainer\u2019s Linux set up doc<\/a>:<\/p>\n Let\u2019s break that down line by line:<\/p>\n Level your browser to https:\/\/YOUR_VPS_IP:9443<\/strong>.<\/p>\n Click on by the self-signed cert warning. You\u2019ll land on the \u201ccreate the preliminary administrator consumer\u201d display. Decide a username that isn\u2019t admin, set a powerful password, and put it aside someplace actual. And\u2026 you\u2019re in!<\/p>\n As a result of Portainer waits precisely 5 minutes for somebody to assert it on first set up. If no person does, it locks the door.<\/p>\n Verbatim from Portainer\u2019s personal FAQ<\/a>:<\/p>\n \u201cAs a safety precaution, when Portainer is first put in, it would wait for five minutes for an administrator consumer to be created. If a consumer isn’t created inside these 5 minutes, the Portainer Server will cease listening for requests.<\/em>\u201c<\/p>\n Translation: in case you spent Step 5 making a sandwich, your set up is now refusing to speak to you \u2014and also you didn\u2019t do something improper.<\/p>\n The repair is easy. Run That spins the container again up, provides you one other five-minute window, and drops you on the create-admin display. Repeat as wanted. Welcome to self-hosting<\/a>.<\/p>\n For those who\u2019re scripting the set up for a fleet (Ansible, Terraform, a deploy pipeline), Portainer accepts an This one surprises folks in manufacturing, not simply in dev \u2014 so pay attention up.<\/p>\n If you UFW isn\u2019t damaged. It\u2019s simply standing within the improper hallway.<\/p>\n The repair Docker itself recommends is the DOCKER-USER<\/strong> iptables chain, reserved for administrator guidelines so Docker received\u2019t overwrite them on restart. (The principles don\u2019t survive a full host reboot on their very own \u2014 persist them with iptables-persistent or a systemd service; ufw-docker handles this for you.) The community-standard instrument for wiring UFW into DOCKER-USER<\/strong> is chaifeng\/ufw-docker<\/a>, which automates the rule technology.<\/p>\n Set up it, then confirm with a port scan from exterior your VPS that the ports you suppose are closed are literally closed.<\/p>\n I\u2019ve watched this catch a pointy engineer twice in the identical week, first on a private field, then on a buyer\u2019s. UFW mentioned one factor, the general public web mentioned one other, and the reality was in iptables.<\/p>\n For Portainer particularly, port 9443 is revealed, which implies the admin UI is reachable from anyplace on the general public web the second the container begins. Two cheap paths: prohibit 9443 by DOCKER-USER<\/strong> guidelines (enable solely your own home or workplace IP), or entrance it with a VPN tunnel<\/a> like WireGuard so the UI by no means has a public IP in any respect.<\/p>\n You\u2019re in. 5 issues price doing earlier than you shut that browser tab, per Portainer\u2019s personal safety information<\/a>:<\/p>\n The payoff for putting in Portainer is the day you cease SSH\u2019ing in to restart a misbehaving container, and begin clicking a button as an alternative. The larger payoff is stack administration.<\/p>\n A Portainer stack is a multi-container app outlined by a Docker Compose file. Something you’ll be able to specific as a docker-compose.yml<\/strong> you’ll be able to deploy as a stack, with three most important routes (excluding customized templates) per the official stacks docs<\/a>:<\/p>\n The Git path is the one which issues. You level Portainer at a public or authenticated repo and a path to docker-compose.yml<\/strong>. Portainer both polls the repo on a schedule (the default is 5 minutes) or waits for a webhook from GitHub. When the Compose file modifications upstream, Portainer pulls and redeploys mechanically.<\/p>\n That\u2019s the self-hosted model of \u201cdeploy on push\u201d with out paying a PaaS for the privilege.<\/p>\n The smaller each day wins add up too. Assume logs in a panel as an alternative of docker logs -f<\/strong>, one-click restarts, rebuilding a stack from a button, and useful resource graphs you’ll be able to scan in three seconds as an alternative of operating Docker stats.<\/p>\n Portainer additionally helps distant Docker hosts by its Edge Agent, which is how a self-hosted AI assistant or media server lands throughout a number of containers.<\/p>\n Portainer Neighborhood Version is free and limitless, interval. The set up you simply walked by is absolutely featured for one host with as many containers as your VPS can match. No node cap, no expiry, no nag screens.<\/p>\nWhat Is Portainer, Precisely?<\/h2>\n
-v \/var\/run\/docker.sock:\/var\/run\/docker.sock<\/strong><\/code> within the set up command, and that one line is doing all of the heavy lifting. With out it, Portainer is a UI for an empty Docker host. With it, Portainer is the Docker host\u2019s distant management.<\/p>\n\/var\/run\/docker.sock<\/code><\/strong> can successfully run something as root on the host. That\u2019s a characteristic<\/em> when it\u2019s Portainer doing the asking and a downside<\/em> when it\u2019s some container you spun up final week and forgot you\u2019d given socket entry to.<\/p>\nGet Content material Delivered Straight to Your Inbox<\/h2>\n
Do You Want Portainer If You Already Have Docker?<\/h2>\n
\n
\n
How Huge a VPS Do You Want To Run Docker and Portainer?<\/h2>\n
![\"Table](\"https:\/\/www.dreamhost.com\/blog\/wp-content\/uploads\/2026\/06\/02-VPS-Size-and-Workload.webp\")
<\/figure>\nHow Do You Set up Docker and Portainer on a VPS?<\/h2>\n
![\"Portainer.io](\"https:\/\/www.dreamhost.com\/blog\/wp-content\/uploads\/2026\/06\/03-Protainer.io-new-installer_1x.webp\")
<\/figure>\n1. Decide a Linux distribution<\/h3>\n
2. Set up Docker from the official repository<\/h3>\n
apt set up docker.io<\/code><\/strong>. That pulls an older Docker from the Ubuntu archive.<\/p>\n3. Confirm Docker is operating<\/h3>\n
docker run hello-world<\/code><\/strong>.<\/p>\n4. Create a persistent quantity for Portainer\u2019s knowledge<\/h3>\n
docker quantity create portainer_data<\/code><\/strong>.<\/p>\n docker run -d \n -p 8000:8000 \n -p 9443:9443 \n --name portainer \n --restart=at all times \n -v \/var\/run\/docker.sock:\/var\/run\/docker.sock \n -v portainer_data:\/knowledge \n portainer\/portainer-ce:lts<\/code><\/pre>\n\n
-d<\/code> <\/strong>runs it indifferent.<\/li>\n-p 9443:9443<\/code><\/strong> is the Portainer net UI on HTTPS.\u00a0<\/li>\n-p 8000:8000<\/code> <\/strong>is the Edge Agent tunnel; you solely want it in case you\u2019re going to attach distant environments (Docker, Swarm, or Kubernetes) through Edge Brokers later, so drop it on a single-host set up.ker hosts later, so drop it on a single-host set up.\u00a0<\/li>\n--restart=at all times<\/code><\/strong> brings Portainer again up after a reboot.<\/li>\n-v<\/code><\/strong> flags are the socket bind and the persistent quantity from step 4.\u00a0<\/li>\n:lts<\/code><\/strong> tag is Portainer\u2019s Lengthy Time period Help launch channel \u2014 the secure, production-recommended construct.<\/li>\n<\/ul>\n6. Open the UI and create your admin account<\/h3>\n
Why Did Portainer Simply Time Out on Me?<\/h2>\n
docker restart portainer<\/code><\/strong>.<\/p>\n--admin-password-file<\/code><\/strong> flag at startup that bypasses the timer solely by creating the admin consumer from a file at first run. The set up doc<\/a> covers the syntax. For a one-off VPS set up, the restart trick is ok.<\/p>\nHow Do You Cease Docker From Bypassing Your Firewall?<\/h2>\n
![\"Docker](\"https:\/\/www.dreamhost.com\/blog\/wp-content\/uploads\/2026\/06\/04-Docker-Firewall.webp\")
<\/figure>\ndocker run -p 80:80<\/code><\/strong>, the revealed port is reachable from the general public web even when ufw standing <\/strong>exhibits port 80 as denied. Docker routes container site visitors within the NAT desk, which signifies that packets are diverted earlier than they attain the INPUT<\/strong> and OUTPUT<\/strong> chains that UFW makes use of.<\/p>\nWhat Ought to You Lock Down Proper After the First Login?<\/h2>\n
\n
\/var\/run\/docker.sock<\/code><\/strong> can run something as root on the host. Don’t<\/em> mount the socket casually into different containers. Each further bind is a brand new path to the host. If a container claims it wants the socket, ask why \u2014 and take into account a socket proxy if the reply is \u201cfor monitoring.\u201d<\/li>\n<\/ul>\nHow Do You Truly Use Portainer Day-to-Day?<\/h2>\n
\n
![\"Portainer.io](\"https:\/\/www.dreamhost.com\/blog\/wp-content\/uploads\/2026\/06\/05-How-Do-You-Actually-Use-Portainer-Day-to-Day_-scaled.gif\")
<\/figure>\nWhat Does Portainer Price? (And When Does Free Cease Being Free?)<\/h2>\n
![](\"https:\/\/www.dreamhost.com\/blog\/wp-content\/uploads\/2026\/06\/cta_image_a-877x522.webp)
<\/div>\n