Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Portainer’s built-in backup protects Portainer itself, not the applications running through it. In Settings > Back up Portainer, an administrator can download a password-protected tar.gz archive of Portainer’s /data volume. That archive contains Portainer’s database and stack files deployed through Portainer, but it does not contain Docker volumes, bind-mounted application data, running containers, services, or Docker and Kubernetes configuration stored outside Portainer’s database.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
A dependable recovery plan therefore has three separate layers: the Portainer configuration archive, independently preserved stack definitions, and application-data backups for every named volume and bind-mounted path. Restore those layers in that order on a fresh Portainer installation, then reconnect environments and redeploy workloads.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe three backup layers you need
Think of a Portainer backup as configuration recovery rather than a complete server image. Portainer remembers how its own control plane is configured and can preserve stack records, but the files and databases used by your applications live elsewhere. A complete plan must protect each layer independently.
| Layer | What it protects | How it is recovered |
|---|---|---|
| Portainer configuration | Portainer’s database, access-control records, environment metadata and stack files deployed through Portainer | Restore the downloaded archive while initializing a fresh Portainer instance |
| Stack definitions | Compose or Kubernetes definitions, non-secret variables and the source used to redeploy services | Retrieve from a controlled repository or export, then redeploy after environments are connected |
| Application data | Database files, uploads, certificates and other state in named volumes or bind-mounted paths | Restore with a data-backup method appropriate to each application, then start the stack |
Leaving out any one layer creates a different kind of failure. A Portainer archive without application data can recreate the management interface but not a database’s records. Volume archives without stack definitions may contain data that no one knows how to mount. A repository without Portainer’s own configuration means access control, environment records and other administrative settings must be rebuilt manually.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
What Portainer’s built-in archive includes
Included in the archive
- The Portainer database.
- Portainer access-control information and environment metadata stored in that database.
- Stack files that were deployed using Portainer.
- The contents of Portainer’s
/datavolume, packaged as a downloadabletar.gzfile.
This makes the built-in feature useful for moving Portainer’s configuration to another host or recovering the management plane after a failure. It is also a convenient snapshot to take after material changes such as adding an environment, changing users or permissions, or editing a Portainer-managed stack.
Not included
- Contents of Docker named volumes.
- Files in bind mounts on the host.
- Application databases, uploaded files, certificates or other workload state stored in those locations.
- Running containers, services or other deployed runtime objects as restorable instances.
- Docker or Kubernetes configuration that is outside Portainer’s database.
Portainer describes the archive as a backup of Portainer configuration only. Treating it as a full Docker backup is the most common design error: the download can preserve a stack record while leaving the data that stack needs on the failed host.
Inventory the environment before choosing a schedule
Start with an inventory that another administrator could use during an outage. Record the name and type of every environment connected to Portainer, the stacks deployed there, and where each stack obtains its definition.
Record environments and deployment type
- List every Docker Standalone, Docker Swarm or Kubernetes environment shown in Portainer.
- Identify which host or cluster each environment represents and how Portainer connects to it.
- For Swarm, note the node on which Portainer’s persistent data resides or the storage service that makes that data available to the service.
- Record external networks, because a stack may depend on a network that is not created by the stack itself.
Record each stack’s source
For every stack, note whether it was entered in the Web Editor, uploaded as a Compose file, or deployed from Git. A stack’s source determines what must be preserved independently of the Portainer archive.
- For Web Editor stacks, export or copy the complete definition and its non-secret variables into a controlled location.
- For uploaded files, retain the original Compose or Kubernetes file, including any companion files referenced by it.
- For Git-based stacks, record the repository, branch or tag, deploy key and the location of environment-variable material. Protect the repository and credentials as carefully as the production host.
Map state to storage
Inspect every stack definition and list its named volumes and bind mounts. For each one, record the host path or volume name, the service that uses it, the data it contains and any ownership or permission requirements. Mark databases, user uploads, TLS certificates and other irreplaceable state so they receive application-aware protection rather than a casual file copy.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Document secrets and dependencies
List the secrets required to deploy and operate each stack without putting their values in a public repository. Include registry credentials, Git deploy keys, environment-variable files, TLS keys and passwords stored in an external secret system. Also record external DNS, identity or storage dependencies that a restored application will need.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDownload and protect a Portainer configuration backup
The following procedure creates the Portainer-specific layer. It does not replace volume or bind-mount backups.
- Sign in to Portainer with an administrator account.
- Open Settings.
- Select Back up Portainer.
- Choose password protection when the archive could leave the host, be copied to shared storage or be handled by more than one administrator.
- Start the backup and save the downloaded
tar.gzfile with a date and an unambiguous environment name. - Store the archive in at least one location separate from the Portainer host. Keep the password in a secure secrets system rather than beside the archive.
Take a fresh archive after significant Portainer changes. Examples include adding or removing an environment, changing access-control settings, updating a Portainer-managed stack, or changing the way Portainer is deployed. Keep several dated copies so a corrupted or accidentally altered archive does not become the only recovery point.
Protect the archive itself
- Limit access to the archive and its password to the people who need to perform recovery.
- Use storage with its own access controls and audit trail when possible.
- Copy local downloads to separate media, such as a USB external hard drive, and maintain an off-site or S3-compatible copy when your recovery plan requires geographic separation.
- Do not assume password protection substitutes for access control on the storage location; use both.
Preserve stack definitions as an independent source of truth
The archive can preserve stack files deployed through Portainer, but an independently maintained definition is easier to inspect, review and redeploy if Portainer’s database is damaged or a stack must move to a different environment.
Web Editor and uploaded Compose files
Copy the complete text of each Web Editor definition into a controlled repository. Keep uploaded Compose files and any referenced files together. Include comments that explain host paths, required networks, expected volume names and startup dependencies. Store non-secret variables with the definition when they are safe to do so; keep passwords, tokens and private keys in a secure secrets system and document how the restored host obtains them.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Git-deployed stacks
Protect more than the repository URL. A recovery operator needs the repository, the branch or tag that was deployed, the deploy key, and the environment-variable material. Portainer supports inspecting, editing, migrating and duplicating stacks, but a Git-managed Compose file is edited in the repository. Backing up only the Portainer record while losing repository access leaves the deployment process incomplete.
Version and label releases
Use commits or release tags to identify the definition that was running when a data backup was taken. Keep the stack name, target environment and backup date in the recovery notes. This avoids restoring a database into a definition that has changed its volume names, paths or schema expectations.
Back up named volumes and bind-mounted paths
Named Docker volumes
Docker defines named volumes as persistent data stores. Their contents remain separate from Portainer’s configuration archive, even when a stack record names those volumes. A volume may contain a database, media library, application configuration or certificates, and several services may share it through Compose declarations.
For each named volume, create a backup that preserves the complete directory tree, file contents, ownership, permissions and relevant timestamps. Record the volume name exactly as declared in the stack. If a restored stack uses a different name, Docker will create a new empty volume instead of attaching the data you intended.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Bind-mounted paths
A bind mount stores data in a host directory rather than in Docker’s volume store. Back up the actual host path, not just the Compose file that references it. Include hidden files and subdirectories, and document whether the path is local to one node or provided by shared storage. In a Swarm deployment, a bind mount available on only one node can make a rescheduled service start without its data.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Database consistency comes first
Copying database files while the database is actively writing can produce an unusable or internally inconsistent backup. Follow the database vendor’s backup guidance: use its native dump or snapshot mechanism, or stop or quiesce the database when that is required. Coordinate the resulting dump or snapshot with the volume backup so the stack definition, application files and database state correspond to the same recovery point.
Verify that data archives can be read
A successful copy operation does not prove that a backup is restorable. Periodically open archives, list their contents and perform a test restore of representative files. For databases, restore into an isolated instance and run the application’s integrity checks. Record the result and the date; an untested archive is only an assumption of recoverability.
Choose storage and retention deliberately
Keep at least one copy away from the host that runs Portainer. Local storage protects against accidental deletion or a short outage, but it will not help if the host and its attached disks are lost together. An off-site or S3-compatible destination adds separation for Business Edition administrators who configure that capability, while removable storage provides a simple offline copy for downloaded archives.
Define retention around change frequency and the cost of losing data. Keep recent copies for fast rollback and older copies for discovering corruption that was not noticed immediately. Apply the same retention thinking to Portainer archives, stack repositories and application data; retaining only one layer does not create a complete restore point.
Restore Portainer on a new server
Portainer documents a fresh-instance requirement for archive restoration. Do not attempt to merge the archive into an already configured installation and expect existing data to be reconciled automatically.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
- Prepare the replacement host and install a fresh Portainer instance with an empty data volume.
- Confirm that the new instance is reachable and that you can sign in as an administrator.
- During initialization, choose the option to restore Portainer from the saved archive and provide its password when prompted.
- Allow the restore to complete, then verify that Portainer’s users, settings, environment records and Portainer-managed stack files are present.
- Reconnect each Docker or Kubernetes environment. Check endpoint addresses, credentials, certificates and permissions rather than assuming an old connection will work unchanged.
- Confirm that required external networks, registries, Git repositories and secret sources are available on the replacement infrastructure.
- Redeploy stacks from the restored Portainer records or the independently preserved definitions. Use the intended branch or tag and supply the documented non-secret and secret variables.
- Restore named volumes and bind-mounted application data separately. Verify ownership, permissions, paths and volume names before starting stateful services.
- Start databases and dependent services in the order required by the application, then check logs and health indicators.
- Validate application data, certificates, scheduled jobs and external integrations before declaring the recovery complete.
The restored Portainer interface is not proof that workloads are healthy. Recovery is complete only after the applications can read their restored state and users can perform the functions that matter to them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Swarm placement and persistent Portainer data
In Docker Swarm, Portainer itself is a service. Its portainer_data volume must remain available wherever the service can run. Constrain the service to a node with that persistent data, or use storage that is available to every eligible node. If Swarm reschedules Portainer onto a node that lacks the volume, the service can appear to be a fresh installation even though the old data still exists elsewhere.
Apply the same reasoning to application volumes and bind mounts. A stack may deploy successfully on a different node while presenting empty directories or newly created volumes. Record placement constraints and storage requirements in the stack definition and recovery notes so redeployment does not silently move state away from its data.
Rehearse the complete recovery
Schedule a restore rehearsal on an isolated host. Use a fresh Portainer installation and an empty data volume, then follow the same sequence required during an outage. The exercise should cover the archive password, environment reconnection, repository access, secret retrieval, volume restoration and application validation.
- Measure how long each manual step takes and note which credentials or files were missing.
- Check that the restored Portainer database shows the expected users, environments and stack records.
- Confirm that every stack definition can be obtained without relying on the failed host.
- Restore at least one representative database and one bind-mounted data set, then exercise the application.
- Record corrections in the runbook and repeat the rehearsal after major architectural changes.
A rehearsal exposes failures that a backup listing cannot: an expired deploy key, a missing environment variable, an incorrect volume name, a path that exists on only one node, or a database dump that cannot be opened.
Common failure modes and fixes
| Symptom | Likely cause | Corrective action |
|---|---|---|
| Portainer opens with no old users, environments or stacks | The service started with a new or empty data volume | Stop it, attach the intended persistent portainer_data storage or initialize a fresh instance and restore the archive |
| Stacks appear in Portainer but applications have empty data | Named volumes or bind-mounted paths were not backed up | Restore the corresponding application-data backups and verify names, paths and permissions |
| A Git stack cannot be redeployed | The repository, branch, deploy key or variable material is unavailable | Recover those independent dependencies and select the documented revision |
| A database starts but reports corruption | Files were copied while writes were in progress or the dump was incomplete | Use an application-consistent dump or snapshot and restore it into an isolated database before production use |
| A Swarm service starts on another node without its files | The bind mount or local volume exists only on the original node | Restore shared storage or constrain placement to a node that has the data |
| The archive cannot be opened | It is damaged, incomplete or its password is unavailable | Use another dated copy, verify downloads after creation and keep the password in the designated secrets system |
Security and operational safeguards
- Limit administrator access to Portainer and to backup storage.
- Encrypt archives in transit and at rest when they contain access-control records or other sensitive configuration.
- Store archive passwords separately from the files they unlock.
- Keep deploy keys, registry credentials and environment-variable secrets out of public repositories.
- Document who is authorized to perform a restore and where the current runbook is stored.
- After recovery, rotate credentials that may have been exposed during the incident or copied to temporary systems.
A practical runbook for routine operations
- Inventory environments, stacks, volumes, bind mounts, networks and secrets.
- Commit or export every stack definition and record its revision.
- Back up databases with an application-consistent method.
- Back up all named volumes and bind-mounted paths that contain state.
- Download a password-protected Portainer archive after material configuration changes.
- Copy local backups to separate storage and, when required, to an off-site or S3-compatible destination.
- Verify archive readability and representative data restores.
- Run a full isolated-host rehearsal at a planned interval and update the runbook from what you learn.
This sequence keeps the management plane, deployment intent and application state recoverable as separate but coordinated assets. It also makes the boundary of Portainer’s built-in feature explicit: the archive restores Portainer configuration; your volume and bind-mount procedures restore what the applications actually know.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
