Published
Portainer CE
Web UI and API for managing Docker, Swarm, Podman and Kubernetes environments: containers, images, volumes, networks and Compose stacks, with users and teams. Community Edition (zlib license). Fits a person or a small team that wants a GUI over the Docker hosts they already run.
Resources by load level
What the app itself needs at each level, next to what we recommend for a server that runs only this app.
| Level | What it means | App requirements | Recommended |
|---|---|---|---|
| LightEstimate | One environment (the local Docker host), up to 5 users, up to 50 containers and 10 stacks, no Edge Agents, no Git-deployed stacks. | 0.25 vCPU · 0.25 GiB RAM · 1.2 GiB disk | 0.42 vCPU · 1.8 GiB RAM · 10.695 GiB disk |
| MediumEstimate | Up to 10 environments (local plus Agents or Edge Agents), up to 20 users and teams, up to 300 containers, up to 30 stacks, some deployed from Git. | 0.5 vCPU · 0.5 GiB RAM · 5.2 GiB disk | 0.72 vCPU · 2.1 GiB RAM · 15.295 GiB disk |
| HeavyEstimate | Up to 50 environments, mostly Edge Agents, up to 100 users, up to 2,000 containers, up to 150 stacks with Git auto-update polling. | 1 vCPU · 1 GiB RAM · 10.2 GiB disk | 1.32 vCPU · 2.7 GiB RAM · 21.045 GiB disk |
Recommended = app requirements + system baseline + safety headroom, under sizing policy 2026.10.0. Options stay at their defaults. “Estimate” means the sources give no number for that case, so it is worked out from them by the method stated under Components. How the numbers are built
Ready-to-run files
Support level Official install
No Compose template from ANAROQ: install it the official way.
Why: Portainer manages the local Docker engine through a bind mount of /var/run/docker.sock. The Generator writes only named volumes and never mounts the socket, which the Analyzer flags as AQ-VOL-001 (high). Run the official Compose file as its own project next to a generated stack: it takes no 80/443, but drop port 8000 unless you use Edge Agents (it can collide with the 127.0.0.1:8000 of Paperless-ngx).
Components
What each component needs at each load level, before baseline and headroom.
| Component | Light | Medium | Heavy | Sources |
|---|---|---|---|---|
| Portainer Server (CE) (app) | 0.25 / 0.25 / 1.2 | 0.5 / 0.5 / 5.2 | 1 / 1 / 10.2 | [3][12][14][27][28][30][31] |
How the estimates are worked out
- Portainer Server (CE) · Light: No upstream CPU/RAM figure (the requirements page lists tested versions only; the Helm chart sets resources {}). RAM: the server binary layer, 106,047,488 B (0.099 GiB), + an assumed 0.15 GiB heap for one environment snapshotted every 5 minutes and a few sessions → 0.25 GiB; vCPU = RAM. Disk: image 44,841,545 B compressed (0.042 GiB) + 155,530,240 B unpacked (0.145 GiB), both kept by the containerd store = 0.187 GiB. 0.187 + 1 GiB for the BoltDB and stack files → 1.2.
- Portainer Server (CE) · Medium: RAM: light × 2 for 10 environments snapshotted every 5 minutes, Docker API calls proxied for 20 users and Edge tunnels → 0.5 GiB; vCPU = RAM. Disk: image 44,841,545 B compressed (0.042 GiB) + 155,530,240 B unpacked (0.145 GiB), both kept by the containerd store = 0.187 GiB. 0.187 + 5 GiB: Git stacks are cloned (working copy, one per stack) into /data/compose → 5.2.
- Portainer Server (CE) · Heavy: RAM: medium × 2 for 50 environment snapshots every 5 minutes, open Edge tunnels and Git polling → 1 GiB; vCPU = RAM, since one server instance serves every environment. Disk: image 44,841,545 B compressed (0.042 GiB) + 155,530,240 B unpacked (0.145 GiB), both kept by the containerd store = 0.187 GiB. 0.187 + 10 GiB, the official Helm chart's default data volume → 10.2. Fast SSD storage is advised for large installs.
Ports
Public ports are meant to be reached from outside the stack, usually through a reverse proxy; internal ones stay on the stack's own network.
| Component | Port | Exposure | Purpose | Sources |
|---|---|---|---|---|
| Portainer Server (CE) | 9443/tcp | Public, through a proxy | UI and API over HTTPS (self-signed certificate by default); keep it on a VPN or a restricted network | [1][3][25] |
| Portainer Server (CE) | 8000/tcp | Public, through a proxy | TCP tunnel server for Edge Agents; publish only when Edge Agents are used | [1][3][25] |
| Portainer Server (CE) | 9000/tcp | Internal only | Legacy plain-HTTP UI and API; listens by default but is not published; turn off with --http-disabled | [1][17][25][26] |
User and permissions (UID/GID)
The user each container's process runs as, and the paths it writes to. A bind mount for one of these paths must be writable by that UID:GID.
- Portainer Server (CE): The image sets no USER, so /portainer runs as root and needs no chown of the volume. Running as root inside the container matters less than the Docker socket mount, which gives control of the host regardless of the user.
Storage growth
How much each component's data grows per month at each load level, on top of the disk in the profile. A value marked Assumption is ANAROQ's stated assumption, not a figure from the sources; the notes say what it rests on.
What the growth figures rest on
- Portainer Server (CE): No source states a growth rate. /data holds the BoltDB (settings, users, stacks, snapshot data), a working copy of every Git-deployed stack in /data/compose, and backups/portainer.db.bak from each update. CE has no scheduled backup into /data. Assumed: 10 MB, 100 MB and 500 MB a month, mostly new Git stacks.
Upgrade and rollback
How to move to a new version safely, and how to go back if it fails.
Back up first
Settings > Back up Portainer > Download backup file (tar.gz, password optional): the database and stack files. With the container stopped, a copy of the whole portainer_data volume also works. [10][12][13]
Upgrade steps
- Download a backup (Settings > Back up Portainer) and read the release notes. Stay on the LTS line; coming from 1.x, update to 2.0.0 first. [4][9][10]
- docker stop portainer, docker rm portainer, docker pull portainer/portainer-ce:<new tag>, then the same docker run with the same portainer_data volume (with Compose: change the tag, docker compose pull, docker compose up -d). The database is migrated at start. [2][10]
- Log in on https://<host>:9443 and check the version, then update every Agent and Edge Agent to the same version: the server goes first. [9][10]
Roll back
A newer database does not run on an older version. Restore the pre-update backup into a fresh instance of the old tag, or stop and remove the container, copy backups/portainer.db.bak over portainer.db in the volume, and start the previous tag. [11][12]
Known breaking changes
- In 2.43.0: New instances need a one-time setup token from the server log (setup_token=) to create the admin; also in 2.39.4 LTS. Existing installs are not affected; --admin-password-file or --setup-token suits scripted installs. [6][7]
- In 2.42.0: The legacy-csrf feature flag was removed as scheduled; CSRF problems from 2.41 must be fixed before upgrading. [5]DerivedFrom the Business Edition release notes; the CE release page on GitHub was not reachable from the research environment. CSRF protection is part of the shared server and is described for both editions in the reverse proxy guide.
- In 2.41.0: New CSRF protection: every --trusted-origins entry must be a full URL with scheme (https://portainer.example.com), or Portainer does not start; a proxy must forward the browser's Host, or changes fail with 403. [5][15]DerivedFrom the Business Edition release notes and the reverse proxy guide, which covers both editions; the CE release page on GitHub was not reachable from the research environment.
Limits
- These figures cover only the Portainer Server container. The containers it manages, and the Agent or Edge Agent on each remote host, are sized separately. [3][21]
- The profile pins 2.45.2, the LTS line (maintained until May 2027); STS releases come monthly with lighter testing. In-app updates are Business Edition only, so CE is always updated by hand. [4][9]
- Community Edition lacks Business Edition features such as scheduled, S3 and Azure backups and shared credentials; Portainer does not recommend CE for business-critical apps. One server instance per set of environments: no high availability. [12][21][22]
Security
- The install mounts /var/run/docker.sock: whoever controls Portainer controls the Docker daemon, which runs as root, so it is root-equivalent control of the host (a container can mount the host's /). ANAROQ's Analyzer reports this mount as AQ-VOL-001 (high); for Portainer it is intended, since managing Docker is its job. [1][18][32]
- Create the admin right after starting: setup needs the one-time token from docker logs (setup_token=) and must finish within 5 minutes, or the instance stops for security; restart it to retry. The password needs at least 12 characters. [6][7][8]
- Keep 9443 off the public internet: reach it over a VPN or allow only known addresses in the firewall. Replace the self-signed certificate (--sslcert, --sslkey) or put an HTTPS reverse proxy in front with --trusted-origins, and turn off plain HTTP on 9000 with --http-disabled. [15][16][17][18][26]
- For other hosts prefer the Edge Agent: it connects out to the server, so remote hosts open no port (the classic Agent listens on 9001). Publish 8000 only for Edge Agents, give admin rights sparingly, and consider encrypting the database (not reversible). [3][18][19][20]
Backup
- CE backup: Settings > Back up Portainer > Download backup file (tar.gz, optionally password-protected). It holds the database and stack files, not containers, images, volumes or application data: back those up separately. [12][13]
- A backup is restored only into a fresh instance, from the initial setup page (Restore Portainer from backup). Git-deployed stacks are cloned into /data/compose and inflate the backup. [12][14]
Latest release
- This profile was checked against
Portainer CE 2.45.2
This profile was checked against the newest release.
- Checked on
- 14 Oct 2026
- State
- Checked within the last 90 days
- Where releases are published
- GitHub Releases
Checked 2026-10-14: 2.45.2 is the newest Community release and the current LTS (lts and sts tags share its digest). The next LTS, 3.3, is planned for December 2026 after 3.0 to 3.2 STS.
Version
- Profile status
- Published
- Checked against release
- Portainer CE 2.45.2
- Profile version
- 1.0.0
- Figures verified
- 14 Oct 2026
- Catalog release
- 2026.10.10
- Sizing policy
- 2026.10.0
- Compose file
- Not available yet
Project and alternatives
- Official site
- www.portainer.io
- Source code
- github.com/portainer/portainer
Sources
- Portainer docs: Install Portainer CE with Docker on Linux (docker.sock and portainer_data mounts, 9443 HTTPS self-signed, 8000 only for Edge, 9000 legacy HTTP) (Official docs · read 14 Oct 2026)
- Portainer CE LTS portainer-compose.yaml (portainer-ce:lts, docker.sock bind mount, portainer_data volume, 9443 and 8000, network portainer_network) (Official Compose · read 14 Oct 2026)
- Portainer docs: Requirements and prerequisites (Community 2.45.2 LTS tested with Docker 28.5.1 and 29.8.1; ports 9443, 8000, agent 9001; Git stacks cloned to the data volume) (Official docs · read 14 Oct 2026)
- Portainer docs: Lifecycle policy (LTS recommended for production; 2.45 LTS maintained until May 2027, 2.39 LTS until Nov 2026; 3.3 LTS planned Dec 2026) (Official docs · read 14 Oct 2026)
- Portainer docs: Release Notes (Business Edition; 2.45.2 LTS on 2026-10-08, breaking changes of 2.41.0 and 2.42.0 STS; CE notes are on GitHub releases) (Release notes · read 14 Oct 2026)
- Portainer docs: Initial setup (first user is an administrator, password of at least 12 characters, setup token from the setup_token= log line) (Official docs · read 14 Oct 2026)
- Portainer FAQ: setup token (since 2.43 / 2.39.4; --setup-token, --no-setup-token, --admin-password-file; user must be created within 5 minutes) (Official docs · read 14 Oct 2026)
- Portainer FAQ: 'Your Portainer instance has timed out for security purposes' (initial setup must finish within 5 minutes; restart to retry) (Official docs · read 14 Oct 2026)
- Portainer docs: Updating Portainer (back up first, update the server before the agents, in-app update is LTS and Business Edition only) (Official docs · read 14 Oct 2026)
- Portainer docs: Updating on Docker Standalone (docker stop, docker rm, docker pull, docker run with the same portainer_data volume; agents on the same version) (Official docs · read 14 Oct 2026)
- Portainer FAQ: roll back to a previous version (schema bump; restore a backup, or backups/portainer.db.bak written during the update) (Official docs · read 14 Oct 2026)
- Portainer docs: Settings > General (snapshot every 5 minutes; Force HTTPS only; Download backup file; S3, Azure and scheduled backups are Business Edition only; restore on a fresh instance) (Official docs · read 14 Oct 2026)
- Portainer FAQ: What does Portainer's backup include? (database and stack files; no containers, images, volumes or application data) (Official docs · read 14 Oct 2026)
- Portainer FAQ: Why is my Portainer backup so large? (Git stacks are shallow-cloned into /data/compose/<stack-id>, once per stack) (Official docs · read 14 Oct 2026)
- Portainer docs: Using Portainer with reverse proxies (Secure cookies and X-Forwarded-Proto, CSRF and Host forwarding, --trusted-origins with full URLs) (Official docs · read 14 Oct 2026)
- Portainer docs: Using your own SSL certificate with Portainer (--sslcert, --sslkey) (Official docs · read 14 Oct 2026)
- Portainer docs: CLI configuration options (--bind default :9000, --bind-https :9443, --http-disabled, --tunnel-port, --snapshot-interval, --data /data) (Official docs · read 14 Oct 2026)
- Portainer docs: Security and compliance (shared responsibility; exposure, plaintext HTTP and no VPN are the operator's risk; hardening guidance) (Official docs · read 14 Oct 2026)
- Portainer docs: Encrypting the Portainer database (BoltDB in portainer_data, secret at /run/secrets/portainer, not reversible) (Official docs · read 14 Oct 2026)
- Portainer FAQ: why the Edge Agent is recommended over the traditional Agent (outbound connection from the agent, no listening port on remote hosts) (Official docs · read 14 Oct 2026)
- Portainer docs: Portainer architecture (one server with persistent data, stateless agents; multiple server instances for the same clusters not supported) (Official docs · read 14 Oct 2026)
- Portainer FAQ: Can I use Portainer CE in a production environment? (yes, but not recommended for business-critical apps) (Official docs · read 14 Oct 2026)
- portainer/portainer LICENSE at 2.45.2: zlib license (Copyright (c) 2018 Portainer.io) (Official repository · read 14 Oct 2026)
- portainer/portainer build/linux/Dockerfile at 2.45.2 (FROM portainer/base, VOLUME /data, EXPOSE 9000 9443 8000, ENTRYPOINT /portainer, no USER) (Official repository · read 14 Oct 2026)
- portainer/portainer api/cli/defaults.go at 2.45.2 (bind :9000, bind-https :9443, tunnel port 8000, data /data) (Official repository · read 14 Oct 2026)
- portainer/portainer api/datastore/init.go at 2.45.2 (new database: SSL settings with HTTPEnabled true, so HTTP on 9000 listens until disabled) (Official repository · read 14 Oct 2026)
- Image config of portainer/portainer-ce:2.45.2 (linux/amd64): no User (root), ExposedPorts 8000 9000 9443, Volumes /data, Entrypoint /portainer, no Healthcheck (Measurement · read 14 Oct 2026)
- Docker Hub tag portainer/portainer-ce:2.45.2 (linux/amd64): 44,841,545 B compressed; 7 layers decompressed and counted: 155,530,240 B (server binary layer 106,047,488 B) (Measurement · read 14 Oct 2026)
- Docker Hub tags of portainer/portainer-ce (2.45.2 pushed 2026-10-08; lts, sts and latest share its digest; 2.39.8 is the newest 2.39 LTS patch) (Official repository · read 14 Oct 2026)
- portainer/k8s Helm chart values.yaml (chart 245.2.0: resources {} with no requests or limits, persistence size 10Gi) (Official repository · read 14 Oct 2026)
- Docker: containerd image store is the default on fresh Engine 29+ installs and keeps images compressed and uncompressed (Official docs · read 14 Oct 2026)
- Docker Engine security: Docker daemon attack surface (the daemon runs as root; only trusted users should control it; a container can mount the host's /) (Official docs · read 14 Oct 2026)