.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
Updated and tested 31 October 2026
Portainer is the control panel Docker never shipped: containers, stacks, images, volumes and logs in a web UI instead of a terminal scroll. I resisted it for a year out of CLI pride and gave in the day I had to explain docker logs -f --tail 200 over the phone. Installing Portainer CE takes about five minutes on any machine that runs Docker, and this guide does it the official way on Ubuntu or Debian, with the two or three decisions that separate a clean install from a confusing one.
Requirements before installing
You need a Linux server with Docker Engine installed and root or docker-group access, and that's the whole list. Any small VPS handles Portainer itself; the app is light and your real resource budget belongs to the containers you'll manage with it. Docker missing? curl -fsSL https://get.docker.com | sh gets you current on Ubuntu 24.04 or Debian 12, or start from our Docker VPS template and skip that step. The commands below are identical on both distros, which is why this one guide covers the ubuntu and debian variants people search separately.
Step 1: create the data volume
docker volume create portainer_dataEverything Portainer knows (users, environments, stack definitions) lives in this volume. Name it exactly portainer_data unless you enjoy adjusting every maintenance command you'll ever copy from documentation, including the password-reset one you'll want someday.
Step 2: run the Portainer CE container
The official install command, straight from the Portainer CE docs:
docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart=always \
-v /var/run/docker.sock:/var/run/docker.sock \
-v portainer_data:/data \
portainer/portainer-ce:ltsThree lines deserve translation. The docker.sock mount is how Portainer sees and controls your Docker engine; forget it and you'll meet the environment errors covered in our local environment fix. The :lts tag pins you to the long-term support line (the 2.45 series, 2.45.3 when I last ran this install on 31 October 2026), which is the right home for a server you want boring; the alternative tags chase newer features and newer bugs. And --restart=always means Portainer outlives reboots, an option people notice missing only after the first kernel update.
Port-wise, 9443 serves the UI over HTTPS and 8000 exists for Edge agents you probably don't use yet; the full map, including the legacy 9000 question, is the Portainer ports guide.
Step 3: create the admin account inside 5 minutes
First, the setup token. Since version 2.43 a new Portainer instance won't create the admin account without it, and on my test server the API answered 403 "Invalid or missing setup token" until I supplied it. Run docker logs portainer and copy the value after setup_token= at the top of the log.
On my server the fresh install printed its one-time setup token at the top of the log; I hid the value.
Open https://YOUR_SERVER_IP:9443, accept the self-signed certificate warning (expected on a fresh install), paste the token into the setup screen and create the admin user. Do it promptly: Portainer disables itself if no admin exists within about five minutes of starting, a deliberate security measure against abandoned instances. Miss the window and you'll see the famous "timed out for security purposes" screen; the fix is a simple docker restart portainer (it prints a new setup token, so copy that one), and the details live in our restart guide. Use a real password here, this account can start and stop everything on the machine.
After the account, the setup wizard offers environments to manage. Pick "Get started" for the local Docker engine and you land on the dashboard with your containers listed, Portainer itself among them.
