Skip to main content
To install Portainer CE, create a volume with docker volume create portainer_data, then start the portainer/portainer-ce:lts container with the Docker socket mounted and port 9443 published. Open https://your-server-ip:9443, paste the setup token from docker logs portainer and create your admin user within 5 minutes.

​
Before you start

  • Portainer is a web interface for Docker. You can start, stop and update containers, read logs and deploy Compose stacks from your browser.
  • Install Docker from Docker’s official repository. Portainer advises against the Ubuntu snap package.
  • Portainer manages Docker through /var/run/docker.sock. Anyone who logs in to Portainer as an admin controls every container on the server, so use a strong password.
  • On AlmaLinux or Rocky Linux with SELinux enforcing, Portainer’s docs say to add --privileged to the docker run command.

​
How to install Portainer CE

1

Create the data volume

2

Start Portainer

Port 9443 is the HTTPS web interface. Port 8000 is only for Edge agents; leave out -p 8000:8000 if you don’t use them.
3

Get the setup token

New Portainer installs ask for a one-time setup token. Find it in the log:
Copy the value after setup_token=.
4

Create the admin user

Open https://203.0.113.10:9443 with your server’s IP. Your browser warns about the self-signed certificate; accept it to continue. Paste the token into Setup token, choose a username and a password, and finish the wizard.
Create the admin user straight after starting the container. Portainer gives you 5 minutes. After that it refuses setup until you restart the container.

​
How to check it worked

The STATUS column shows Up, and PORTS lists 0.0.0.0:9443->9443/tcp. In the web interface, the local environment shows your server’s containers.

​
How to fix “Your Portainer instance has timed out for security purposes”

You didn’t finish setup within 5 minutes. Restart the container to get a new 5-minute window, then check the log for the token again:

​
How to update Portainer

Back up your settings first under Settings > General. Then replace the container; your data stays in the portainer_data volume:
Removing the Portainer container does not affect your other containers.

​
How to restrict access to Portainer

Port 9443 is published by Docker, so ufw and firewalld rules don’t block it. Choose one of these:

​
Frequently asked questions

​
What is the difference between the lts and sts tags?

lts is the long-term support release, which Portainer recommends for production. sts gets new features sooner but is supported for a shorter time.

​
Can I still use port 9000 over HTTP?

Yes, add -p 9000:9000 to the docker run command. Portainer keeps it only for legacy setups, and it sends your password unencrypted, so prefer 9443.

​
Can Portainer deploy Docker Compose files?

Yes. Open Stacks, choose Add stack and paste your compose.yaml. See the Docker Compose tutorial for the file format.

​
Can I skip the setup token?

Portainer supports --admin-password or --admin-password-file at first start, which sets the admin password and skips the token. --no-setup-token turns it off, but only use that on a network nobody else can reach.

VPS and dedicated server guides

Every guide in this section.

Install Docker

Docker Engine from the official repository.

Docker Compose tutorial

Write compose.yaml stacks.

Docker commands cheat sheet

The same tasks on the command line.

Install Coolify

A self-hosted app platform on Docker.
Checked against the official Portainer CE installation docs on 4 November 2026 (setup token introduced in Portainer 2.43 / 2.39.4). Commands can differ between Portainer releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026