Install Portainer on a VPS

Arct Cloud provides an unmanaged Linux VPS. Portainer is not preinstalled or managed by Arct Cloud; you are responsible for installation, security, backups, updates, and the containers it controls. This guide installs Portainer Community Edition (CE) on Ubuntu 24.04 using Portainer’s supported Docker Compose method. Docker officially supports Ubuntu 24.04.

Requirements

Basis	CPU and memory	Software and storage
Portainer requirements	Portainer does not publish a numeric CPU or RAM minimum for Docker Standalone	A currently supported Docker version, `sudo` access, a supported architecture, and persistent storage for `/data`
Practical Arct recommendation	2 vCPUs and 4 GB RAM (`cvm.micro`)	40 GB NVMe for Portainer and a small number of light containers; size for the workloads Portainer will manage

Portainer validates specific Docker versions for each release. Check the current compatibility table before upgrading Docker or Portainer.

Install Portainer

Deploy Ubuntu 24.04

Deploy a server, select a plan that meets your workload requirements, and choose Ubuntu 24.04.

Connect over SSH

Find the server IP address in the Arct Cloud console, then connect:

ssh ubuntu@YOUR_SERVER_IP

See Connect via SSH for key and username help.

Point a domain to the server

Create an A record such as portainer.example.com that points to the server’s public IPv4 address. Add an AAAA record only if IPv6 is configured on the server. Wait until the record resolves before requesting a certificate:

getent ahostsv4 portainer.example.com

Install Docker Engine

Install Docker from Docker’s official Ubuntu repository. Do not install Docker through Snap; Portainer warns that the Snap package can cause compatibility issues.

sudo apt update
sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world

Create the Portainer Compose project

The lts tag follows Portainer’s supported long-term-support channel. The UI is bound to loopback so it is reachable only from the VPS or through an SSH tunnel until you explicitly enable the HTTPS reverse proxy. Port 8000 is intentionally omitted because a local Docker environment does not need the Edge Agent tunnel.

sudo install -d -m 750 -o "$USER" -g "$USER" /opt/portainer
cd /opt/portainer

tee compose.yaml >/dev/null <<'EOF'
services:
  portainer:
    container_name: portainer
    image: portainer/portainer-ce:lts
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    ports:
      - "127.0.0.1:9443:9443"

volumes:
  portainer_data:
    name: portainer_data
EOF

sudo docker compose config

Start Portainer and claim the admin account privately

Start the container only when you are ready to complete setup:

cd /opt/portainer
sudo docker compose up -d

From a second terminal on your local computer, open an SSH tunnel and leave it running:

ssh -N -L 9443:127.0.0.1:9443 ubuntu@YOUR_SERVER_IP

Open https://localhost:9443. The certificate warning is expected because Portainer uses a self-signed certificate on this private connection. Create the first administrator with a unique password of at least 12 characters, then select the automatically detected local Docker environment. Close the tunnel with Ctrl+C only after setup is complete.

Portainer allows five minutes to create the first administrator. If setup times out, run sudo docker restart portainer, reconnect the SSH tunnel, and complete setup within the next five minutes.

Configure the public reverse proxy and HTTPS

Replace portainer.example.com in both commands with your domain. Portainer serves a self-signed certificate on its loopback-only backend; Nginx terminates the public, trusted certificate.

sudo apt install -y nginx certbot python3-certbot-nginx

sudo tee /etc/nginx/sites-available/portainer >/dev/null <<'EOF'
server {
    listen 80;
    listen [::]:80;
    server_name portainer.example.com;

    location / {
        proxy_pass https://127.0.0.1:9443;
        proxy_ssl_verify off;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600;
    }
}
EOF

sudo ln -s /etc/nginx/sites-available/portainer \
  /etc/nginx/sites-enabled/portainer
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d portainer.example.com

If UFW is enabled, allow SSH before enabling only the public web ports:

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

Verify the deployment

Confirm that the container, loopback backend, and public endpoint respond:

cd /opt/portainer
sudo docker compose ps
curl -kI https://127.0.0.1:9443
curl -I https://portainer.example.com
sudo docker logs --tail 50 portainer

Persistent Data and Security

The portainer_data volume contains Portainer’s database and configuration. Registry credentials, endpoint configuration, and other sensitive settings stored by Portainer must be treated as secrets. Keep any downloaded backup encrypted and outside the VPS.

Mounting /var/run/docker.sock gives Portainer control equivalent to root over this Docker host. Limit administrator access, use a unique password, and never publish the Docker API on ports 2375 or 2376 for this setup.

Only ports 80 and 443 need to be publicly reachable. Port 9443 is bound to 127.0.0.1; legacy HTTP port 9000 is not enabled. Port 8000 is needed only for Portainer Edge Agents. If you later enable Edge features, follow Portainer’s current networking guidance and restrict exposure wherever possible. Docker-published ports can bypass UFW rules. Keeping the Portainer mapping on loopback prevents direct access even when Docker manages its own firewall rules.

Back Up and Restore

In Portainer, open Settings and find Back up Portainer.
Enable password protection, use a unique backup password, and download the tar.gz archive.
Store the archive and its password separately from the VPS.
Test restoration on a fresh Portainer instance with an empty data volume. On the initialization screen, expand Restore Portainer from backup and select the archive.

A Portainer configuration backup covers data in Portainer’s /data volume. It does not back up the containers, Compose files, application volumes, or databases that Portainer manages. Back up those workloads independently.

Update Safely

Use the LTS channel for routine production updates:

Read the release notes and compatibility matrix.
Download an encrypted Portainer configuration backup and back up every managed workload separately.

Record the current image digest:

sudo docker image inspect portainer/portainer-ce:lts \
  --format '{{index .RepoDigests 0}}'

Pull and recreate the container, preserving portainer_data:

cd /opt/portainer
sudo docker compose pull
sudo docker compose up -d
sudo docker compose ps
sudo docker logs --tail 100 portainer

Confirm login and local environment access before pruning old images.

Portainer can migrate its database during an update. Do not point an older image at a migrated portainer_data volume. To roll back, deploy the previous supported image against a fresh empty volume and restore the pre-update Portainer backup during initialization.

Troubleshooting

The public URL returns 502 Bad Gateway

Check sudo docker compose -f /opt/portainer/compose.yaml ps and sudo docker logs --tail 100 portainer. Confirm that curl -kI https://127.0.0.1:9443 succeeds, then run sudo nginx -t.

Portainer says the instance timed out

Restart it with sudo docker restart portainer, reload the page, and create the administrator within five minutes. Do not delete the data volume.

The browser reports a certificate or domain error

Verify that the DNS A record resolves to this VPS, ports 80 and 443 are reachable, and sudo certbot certificates lists the expected domain. Do not browse directly to port 9443; its backend certificate is self-signed.

The local Docker environment is unavailable

Confirm the socket mount with sudo docker inspect portainer --format '{{json .Mounts}}' and check that Docker is running with sudo systemctl status docker. Rootless Docker needs separate Portainer configuration and has limitations.

Official Resources

Portainer Documentation

Official Docker Standalone installation and networking guidance.

Portainer on GitHub

Source code, security policy, and issue tracker.

Portainer Releases

LTS releases, fixes, and upgrade notes.

Portainer is developed by Portainer.io. Arct Cloud is an independent infrastructure provider and is not affiliated with, sponsored by, or endorsed by Portainer.io.

Getting Started

Virtual Machines

Migrations

Billing & Payments

Account

Install Portainer on a VPS

Requirements

Install Portainer

Persistent Data and Security

Back Up and Restore

Update Safely

Troubleshooting

Official Resources

Portainer Documentation

Portainer on GitHub

Portainer Releases

​Requirements

​Install Portainer

​Persistent Data and Security

​Back Up and Restore

​Update Safely

​Troubleshooting

​Official Resources

Portainer Documentation

Portainer on GitHub

Portainer Releases

Requirements

Install Portainer

Persistent Data and Security

Back Up and Restore

Update Safely

Troubleshooting

Official Resources