How to Install Portainer on a Dedicated Server: Ubuntu 24.04 Guide

Portainer provides a web-based interface for managing container environments. It allows administrators to perform many common Docker management tasks through a browser instead of relying exclusively on terminal commands.

Installing Portainer on a dedicated server gives you a centralized interface for managing containers, images, volumes, and networks on that server. It can be useful for application deployments, development environments, testing systems, and services running on dedicated infrastructure.

This tutorial explains how to install Portainer Community Edition (CE) on an Ubuntu 24.04 LTS dedicated server using Docker Engine. It also covers initial configuration, network security, troubleshooting, and routine maintenance.

What Is Portainer?

Portainer is a container management platform that provides a graphical interface for working with container infrastructure. Its server component runs as a container and communicates with the underlying container engine.

With Portainer, administrators can:

• View running and stopped containers.
• Deploy and manage containerized applications.
• Inspect container logs and resource information.
• Manage Docker images, volumes, and networks.
• Start, stop, restart, and remove containers.
• Organize and manage supported container environments.

Portainer supports several environment types, including Docker Standalone, Docker Swarm, and Kubernetes, subject to the relevant edition and configuration requirements.

For this tutorial, the focus is Docker Standalone on a single Linux server.

Prerequisites

Before installing Portainer, prepare the server and verify that you have the required access.

The commands below assume a fresh Ubuntu installation without a conflicting Docker package configuration. If Docker is already installed, verify that it is working before proceeding.

1Connect to Your Dedicated Server

Connect to the server through SSH from your local terminal:

ssh username@YOUR_SERVER_IP

Replace username with your server's Linux username and YOUR_SERVER_IP with the server's public or reachable IP address.

Check the operating system:

cat /etc/os-release

Check available disk space:

df -h

Update the existing package lists and installed packages:

sudo apt update
sudo apt upgrade -y

If the upgrade installs a new kernel or other components that require a restart, schedule a reboot when appropriate for your environment.

2Install Docker Engine

Portainer runs as a container, so Docker Engine must be installed and operational first.

Docker recommends installing Docker Engine from its official APT repository on supported Ubuntu releases.

Install the required packages

Run:

sudo apt install -y ca-certificates curl

Create a directory for APT repository keys:

sudo install -m 0755 -d /etc/apt/keyrings

Download Docker's official repository signing key:

sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc

Set the key permissions:

sudo chmod a+r /etc/apt/keyrings/docker.asc

Configure the Docker repository

Create the repository configuration file:

sudo tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

Refresh the package lists:

sudo apt update

Install Docker Engine and supporting components

Install Docker Engine, the command-line interface, container runtime, Buildx plugin, and Docker Compose plugin:

sudo apt install -y \
  docker-ce \
  docker-ce-cli \
  containerd.io \
  docker-buildx-plugin \
  docker-compose-plugin

Enable Docker and start the service:

sudo systemctl enable --now docker

Verify the service status:

sudo systemctl status docker --no-pager

Check the installed versions:

docker --version
docker compose version

Finally, run Docker's test container:

sudo docker run --rm hello-world

The command should download the test image if necessary, execute it, and display a confirmation message.

If Docker is already installed from another source, review the existing package configuration before replacing or removing anything. Do not remove Docker data directories as part of routine installation troubleshooting.

3Create a Persistent Volume for Portainer

Portainer stores its configuration and application data in a directory mounted at /data. A named Docker volume allows this data to persist when the Portainer container is replaced or recreated.

Create the volume:

sudo docker volume create portainer_data

Confirm that Docker recognizes it:

sudo docker volume inspect portainer_data

The volume stores Portainer's application data, but it is not a substitute for an independent backup.

4Install Portainer Community Edition

Pulling and running the official Portainer CE image deploys the management interface.

For a stable installation, use Portainer's documented lts image tag:

sudo docker pull portainer/portainer-ce:lts

Create and start the Portainer container:

sudo docker run -d \
  --name portainer \
  --restart=always \
  -p 9443:9443 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:lts

This command performs several operations:

• -d runs the container in the background.
• --name portainer assigns the container a recognizable name.
• --restart=always configures Docker to restart the container automatically.
• -p 9443:9443 publishes the HTTPS management interface.
• /var/run/docker.sock provides access to the local Docker API.
• portainer_data:/data preserves Portainer's application data.
• portainer/portainer-ce:lts specifies the official Portainer CE long-term support image tag.

This basic setup does not publish the optional Edge Agent tunnel port, 8000, because it is not required for managing the local Docker environment.

5Verify the Portainer Container

Check whether the container is running:

sudo docker ps --filter name=portainer

You should see a container named portainer with a running status.

Review the container logs:

sudo docker logs --tail 100 portainer

To follow the logs while troubleshooting, run:

sudo docker logs -f portainer

Press Ctrl+C to stop following the logs. This does not stop the container.

You can also check whether Docker is listening on the expected HTTPS port:

sudo docker port portainer

The output should include a mapping for container port 9443.

If the container is not running, inspect its logs before attempting to recreate it.

6Configure Firewall Access

Portainer's HTTPS interface uses TCP port 9443 in this configuration.

For a dedicated server exposed to the internet, avoid opening the management interface to every IP address unless there is a specific, justified requirement.

A safer approach is to allow access from a trusted administrative IP address or use a VPN or SSH tunnel.

Option A: Restrict access using UFW

If UFW is enabled and is the firewall you use to manage access, create a rule for your trusted administrative IP:

sudo ufw allow from YOUR_ADMIN_IP to any port 9443 proto tcp

Replace YOUR_ADMIN_IP with the actual public IP address from which you administer the server.

Check the firewall rules:

sudo ufw status verbose

Before enabling UFW on a remote server, ensure that SSH access is permitted so you do not lock yourself out.

Option B: Use an SSH tunnel

If you do not need the Portainer interface to be publicly reachable, an SSH tunnel can provide an alternative.

From your local computer, run:

ssh -L 9443:127.0.0.1:9443 username@YOUR_SERVER_IP

Keep the SSH session open and visit:

https://localhost:9443

This approach forwards local port 9443 through SSH to the server's loopback address. It assumes the SSH connection is permitted and that the Portainer service is reachable through that address on the server.

For a production environment, choose a consistent access method and verify that the management port is not unintentionally exposed through another network path.

7Open Portainer in Your Browser

Once the container is running and network access is configured, open the following URL:

https://YOUR_SERVER_IP:9443

Replace YOUR_SERVER_IP with the server's reachable IP address. If you are using the SSH tunnel described above, use https://localhost:9443 instead.

Portainer may initially present a browser certificate warning because its default certificate is self-signed. This is expected for the default installation, but it does not mean the connection should automatically be trusted when accessed over an untrusted network.

For a production deployment, configure a certificate that your clients can validate, and ensure that the certificate matches the hostname used to access the service.

Complete the initial setup

Follow the setup screen to initialize the administrator account. Choose a strong, unique password and store it securely.

If the initial setup page is not available, check the Portainer container logs and verify that the container is running. Avoid disabling security checks or exposing the interface broadly just to get past an initialization problem.

8Connect to the Local Docker Environment

After completing the initial setup, open the environment selection or management screen.

The local Docker environment should be available because the installation mounted the host's Docker socket into the Portainer container.

Select the local environment to view its resources.

Depending on your Portainer version and environment configuration, the interface provides access to sections for containers, images, volumes, networks, and other supported Docker resources.

You can now use the interface to inspect containers, review logs, and manage common container operations.

Portainer can also manage additional environments, but remote environments require their own connection configuration and security considerations.

9Test Container Management

To verify that Docker and Portainer can manage containers, create a temporary test container from the command line:

sudo docker run -d \
  --name portainer-test \
  --restart=no \
  nginx:alpine

Open Portainer and select the local Docker environment. Find portainer-test in the container list.

You can inspect its status, view logs, stop it, or remove it through the interface.

To remove the test container from the terminal afterward:

sudo docker rm -f portainer-test

This removes only the test container. It does not remove Portainer or the persistent portainer_data volume.

10Maintain and Update Portainer

A successful installation is only the first part of operating a container management platform. Updates, backups, and access reviews are also important.

Check the installed image

Inspect the image used by the running container:

sudo docker inspect \
  --format '{{.Config.Image}}' portainer

The lts tag identifies the long-term support channel; it does not pin the installation to a specific immutable image digest.

Update Portainer

Before updating, review the official release notes and confirm that the new version supports your Docker environment. Back up Portainer's data before changing the running instance.

Pull the latest image available through the LTS tag:

sudo docker pull portainer/portainer-ce:lts

Stop and remove the existing container:

sudo docker stop portainer
sudo docker rm portainer

Recreate it with the same persistent volume and configuration:

sudo docker run -d \
  --name portainer \
  --restart=always \
  -p 9443:9443 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:lts

Verify that the new container is running:

sudo docker ps --filter name=portainer
sudo docker logs --tail 100 portainer

Back up Portainer data

The portainer_data volume contains important application state, including configuration and management data. A backup should be stored separately from the live Docker volume.

One possible approach is to stop Portainer briefly and create a compressed archive of the volume:

sudo docker stop portainer

sudo docker run --rm \
  -v portainer_data:/data:ro \
  -v "$PWD":/backup \
  alpine:3.22 \
  tar -czf /backup/portainer-data-backup.tar.gz -C /data .

Restart Portainer:

sudo docker start portainer

The archive is written to the current working directory of the shell that executes the Docker command. Move it to a protected, separate backup location and test the restoration procedure.

The Alpine image tag shown here is an example for the backup utility, not a requirement for Portainer itself. For repeatable production backups, select and maintain an approved utility image according to your organization's image-management policy.

Troubleshooting Common Portainer Installation Problems

1. Portainer container exits immediately

Check the logs:

sudo docker logs portainer

Confirm that Docker is running:

sudo systemctl status docker --no-pager

Look for configuration errors, permission problems, incompatible image versions, or storage issues before recreating the container.

2. The browser cannot connect to Portainer

Verify the container status:

sudo docker ps --filter name=portainer

Check the port mapping:

sudo docker port portainer

Confirm that TCP port 9443 is reachable through the server's firewall and any provider-level firewall. If you use an SSH tunnel, verify that the SSH session is active and that you are using the correct local port.

3. The browser displays a certificate warning

The default installation uses a self-signed certificate. Configure a trusted certificate for production access and verify the hostname and certificate chain.

Do not treat a certificate warning as harmless if you cannot independently verify that you are connecting to the correct server.

4. Portainer cannot manage the local Docker environment

Check that the Docker socket was mounted when the container was created:

sudo docker inspect portainer

Review the Mounts section for /var/run/docker.sock and inspect the Portainer logs for connection errors.

If the socket mount is missing or the environment uses a nonstandard Docker configuration, review the official Portainer installation instructions before changing the deployment.

5. The initial setup screen is unavailable

Check the logs and container status. A newly deployed Portainer instance may require administrator initialization before normal use.

If setup was previously completed, confirm that you are connecting to the correct instance and that its persistent data volume is intact. Avoid deleting the volume as a first troubleshooting step because that can remove application state.

Security Best Practices for Portainer on a Dedicated Server

Portainer is an administrative interface, so securing it is as important as securing SSH or other privileged management services.

Follow these practices:

• Restrict access: Permit the management interface only from trusted networks, VPNs, or approved administrative IP addresses.
• Use HTTPS: Configure a certificate that clients can validate for production access.
• Protect administrator credentials: Use a strong, unique password and appropriate account controls.
• Limit privileged access: Grant access only to people who need to manage containers.
• Keep software updated: Monitor Docker and Portainer releases, review security advisories, and apply updates deliberately.
• Maintain backups: Back up Portainer data and other critical application data to a separate location.
• Review network exposure: Confirm that published Docker ports are not unintentionally reachable from the public internet.
• Monitor logs and resources: Investigate unusual access patterns, container restarts, and resource consumption.

Frequently Asked Questions

Conclusion

Installing Portainer on an Ubuntu dedicated server provides a practical way to manage Docker containers through a browser-based interface. By installing Docker Engine from its official repository, deploying Portainer CE with persistent storage, verifying the service, and restricting network access, administrators can establish a useful foundation for container management.

For long-term operation, keep Portainer and Docker updated, protect the management interface, and maintain tested backups. These practices help make container administration more manageable while reducing avoidable operational and security risks.