> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Install Portainer CE on a Linux Server

> Install Portainer CE with one docker run command, open https://your-server-ip:9443, enter the setup token from the logs and create the admin user in 5 minutes.

To install Portainer CE, create a volume with `docker volume create portainer_data`, then start the `portainer/portainer-ce:lts` container with the Docker socket mounted and port 9443 published. Open `https://your-server-ip:9443`, paste the setup token from `docker logs portainer` and create your admin user within 5 minutes.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 10 minutes | Ubuntu, Debian, AlmaLinux, Rocky Linux | [Docker Engine](https://help.freakhosting.com/portals/other/how-to-install-docker.md) running as root (not snap) |

## Before you start

* Portainer is a web interface for Docker. You can start, stop and update containers, read logs and deploy Compose stacks from your browser.
* Install Docker from Docker's official repository. Portainer advises against the Ubuntu snap package.
* Portainer manages Docker through `/var/run/docker.sock`. Anyone who logs in to Portainer as an admin controls every container on the server, so use a strong password.
* On AlmaLinux or Rocky Linux with SELinux enforcing, Portainer's docs say to add `--privileged` to the `docker run` command.

## How to install Portainer CE

**1. Create the data volume**

```bash theme={null}
docker volume create portainer_data
```

**2. Start Portainer**

```bash theme={null}
docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:lts
```

Port `9443` is the HTTPS web interface. Port `8000` is only for Edge agents; leave out `-p 8000:8000` if you don't use them.

**3. Get the setup token**

New Portainer installs ask for a one-time setup token. Find it in the log:

```bash theme={null}
docker logs portainer 2>&1 | grep setup_token
```

Copy the value after `setup_token=`.

**4. Create the admin user**

Open `https://203.0.113.10:9443` with your server's IP. Your browser warns about the self-signed certificate; accept it to continue. Paste the token into **Setup token**, choose a username and a password, and finish the wizard.

> [!WARNING]
>
> Create the admin user straight after starting the container. Portainer gives you 5 minutes. After that it refuses setup until you restart the container.

## How to check it worked

```bash theme={null}
docker ps --filter name=portainer
```

The `STATUS` column shows `Up`, and `PORTS` lists `0.0.0.0:9443->9443/tcp`. In the web interface, the **local** environment shows your server's containers.

## How to fix "Your Portainer instance has timed out for security purposes"

You didn't finish setup within 5 minutes. Restart the container to get a new 5-minute window, then check the log for the token again:

```bash theme={null}
docker stop portainer
docker start portainer
docker logs portainer 2>&1 | grep setup_token
```

## How to update Portainer

Back up your settings first under **Settings > General**. Then replace the container; your data stays in the `portainer_data` volume:

```bash theme={null}
docker stop portainer
docker rm portainer
docker pull portainer/portainer-ce:lts
docker run -d -p 8000:8000 -p 9443:9443 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:lts
```

Removing the Portainer container does not affect your other containers.

## How to restrict access to Portainer

Port 9443 is published by Docker, so `ufw` and `firewalld` rules don't block it. Choose one of these:

| Option | How |
| - | - |
| Localhost only, reach it over SSH | Use `-p 127.0.0.1:9443:9443`, then on your PC run `ssh -L 9443:127.0.0.1:9443 alex@203.0.113.10` and open `https://localhost:9443` |
| Behind a reverse proxy with a domain | Publish on `127.0.0.1` and proxy `https://127.0.0.1:9443` with [Nginx](https://help.freakhosting.com/portals/other/how-to-set-up-nginx-as-a-reverse-proxy.md) or [Caddy](https://help.freakhosting.com/portals/other/how-to-install-caddy-web-server.md) |
| Strong login | Use a long, unique password and keep Portainer updated |

## Frequently asked questions

### What is the difference between the lts and sts tags?

`lts` is the long-term support release, which Portainer recommends for production. `sts` gets new features sooner but is supported for a shorter time.

### Can I still use port 9000 over HTTP?

Yes, add `-p 9000:9000` to the `docker run` command. Portainer keeps it only for legacy setups, and it sends your password unencrypted, so prefer 9443.

### Can Portainer deploy Docker Compose files?

Yes. Open **Stacks**, choose **Add stack** and paste your `compose.yaml`. See the [Docker Compose tutorial](https://help.freakhosting.com/portals/other/how-to-use-docker-compose.md) for the file format.

### Can I skip the setup token?

Portainer supports `--admin-password` or `--admin-password-file` at first start, which sets the admin password and skips the token. `--no-setup-token` turns it off, but only use that on a network nobody else can reach.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Install Docker](https://help.freakhosting.com/portals/other/how-to-install-docker.md)
>
> Docker Engine from the official repository.

> [card] [Docker Compose tutorial](https://help.freakhosting.com/portals/other/how-to-use-docker-compose.md)
>
> Write compose.yaml stacks.

> [card] [Docker commands cheat sheet](https://help.freakhosting.com/portals/other/essential-docker-commands.md)
>
> The same tasks on the command line.

> [card] [Install Coolify](https://help.freakhosting.com/portals/other/how-to-install-coolify.md)
>
> A self-hosted app platform on Docker.

***

> [!NOTE]
>
> **Checked against the official [Portainer CE installation docs](https://docs.portainer.io/start/install-ce/server/docker/linux)** on 4 November 2026 (setup token introduced in Portainer 2.43 / 2.39.4). Commands can differ between Portainer releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.