How to install Portainer and manage Docker containers from the web

Managing dozens of Docker containers from the command line gets friction-heavy fast: you forget the exact container name, you have to remember the right docker run flags, and auditing volumes or networks requires compound commands. Portainer solves this by offering a web interface that covers 90% of day-to-day operations — start, stop, logs, exec, creating docker-compose stacks, and managing named volumes and networks.

This tutorial is for anyone already running Docker on a Linux server (Ubuntu, Debian, or similar) who wants to add a visual management layer without reinstalling anything. We will install the Community Edition (CE), protect the interface with the self-signed HTTPS certificate that Portainer generates itself, create the admin user, and cover the most common operations. Estimated time: 15 to 25 minutes, depending on Docker familiarity.

The installation described here assumes a single Docker host — the most common scenario. If you operate multiple Docker servers and want a central panel, we mention at the end how to add remote agents later.

Prerequisites

Parameters used throughout the tutorial:

If you are putting this on a production server exposed to the internet, also consider having a domain pointing to the server IP — it makes it easier later to swap the self-signed certificate for a valid Let’s Encrypt one through a reverse proxy.

Installing Portainer Server

The recommended official install uses a dedicated Docker container with a named volume to persist configuration and data. There is no need to clone a repository or compile anything — the official image covers all cases.

docker volume create portainer_data

docker run -d \
  -p 9443:9443 \
  -p 8000:8000 \
  --name portainer \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest

docker ps --filter "name=portainer"

First access and admin creation

With the container running, open the browser and go to https://SERVER_IP:9443. The browser will warn about an untrusted certificate — that is expected; Portainer generates a self-signed certificate on first start. Accept the warning and proceed.

Day-to-day operations

The left side menu groups all functions. The three areas you will use most are Containers, Volumes, and Networks, all inside the local endpoint.

Managing existing containers

The container list shows name, state, base image, internal IP, and exposed ports. Each container has inline actions: start, stop, restart, kill, remove. Clicking the container name gives you access to:

• Logs — live log tail with filter and auto-scroll. Equivalent to docker logs -f.
• Stats — CPU, memory, network, and disk I/O charts refreshing every second.
• Console — interactive terminal inside the container, equivalent to docker exec -it. Lets you choose the shell (sh, bash) and the user.
• Inspect — full container JSON, useful for debugging configuration.

Creating containers from the interface

The Add container screen replaces docker run. The fields cover all the main flags:

• Image: the image to use (can be remote like nginx:latest or local)
• Always pull the image: equivalent to --pull=always
• Port mapping: list of host:container mappings
• Volumes: bind mounts or named volumes
• Network: which Docker network to connect to
• Restart policy: no, on-failure, unless-stopped, always
• Env variables: environment variables as key/value pairs
• Capabilities, runtime, devices: advanced parameters on separate tabs

Volumes and networks

The Volumes section lists all named volumes, shows the driver, consumed size, and which containers are using each one. You can create new volumes with specific drivers (local, NFS) and remove orphan volumes with one click — handy shortcut to free up disk space after removing test containers.

The Networks section shows the Docker networks (default bridge, host, none, plus any you create). Creation supports bridge and overlay drivers, with options to set a custom subnet and enable IPv6.

Verifying the installation

To confirm everything is working, run this end-to-end test:

docker run -d --name portainer-test nginx:alpine

Reload the Containers screen in Portainer. The portainer-test container should appear within 2 seconds. Click it, go to Logs, and confirm you see the nginx startup lines. Then use the Remove button in Portainer to delete it — confirm via terminal:

docker ps -a | grep portainer-test

The output should be empty. If the full cycle worked, the installation is validated.

Troubleshooting

Error “Cannot connect to the Docker daemon”

The Docker socket is not mounted correctly inside the Portainer container. Check that the -v /var/run/docker.sock:/var/run/docker.sock flag was used in docker run and that the socket exists on the host with ls -la /var/run/docker.sock. On systems with restrictive SELinux or AppArmor, you may need to add :z at the end of the bind (/var/run/docker.sock:/var/run/docker.sock:z).

Port 9443 already in use

Another service is listening on that port. Identify it with sudo ss -tlnp | grep 9443 and either stop the conflicting service or change Portainer’s port by recreating the container with -p 9444:9443 (or any free port). The internal mapping stays 9443 — only the host side changes.

Browser blocks access due to invalid certificate

Expected behavior on first install because of the self-signed certificate. For real-world use, place Portainer behind a reverse proxy (nginx or Caddy) with a Let’s Encrypt certificate — the proxy handles public TLS and Portainer responds with HTTP internally on the Docker network.

Next steps

With Portainer running, it is worth exploring:

1. Create a Stack with docker-compose to bring up coordinated multi-container applications
2. Configure your own Templates — pre-made recipes with variables to speed up repetitive deploys
3. Add an Agent on a second server to manage multiple hosts from the same panel
4. Enable private Registries (private Docker Hub, GitHub Container Registry) in the Registries section
5. Put a reverse proxy with Let’s Encrypt in front to have valid HTTPS on your own domain

If you are running Portainer in production to manage critical workloads, a Hostini VPS on a dedicated plan gives you dedicated CPU and fast snapshots — useful for testing Portainer upgrades or rolling back stacks that fail. See the options at /vps.