For a single VPS, install Portainer CE as a Docker container, keep its database in the named portainer_data volume, and open the web interface at https://<your-server>:9443. Port 8000 is only needed for Portainer Edge Agent tunnel features; it is not required to manage the Docker engine running on the same VPS.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
This guide covers the standalone installation, HTTPS and certificate choices, firewall exposure, upgrades that preserve stacks, and why Docker Swarm is a different deployment model.
As an Amazon Associate I earn from qualifying purchases.
What you are installing
Portainer CE is a web-based management server packaged as a Docker container. On a standalone VPS, the container talks to the VPS’s local Docker engine through /var/run/docker.sock. Portainer stores its users, endpoints, settings, and stack definitions in /data; mounting that directory to the named portainer_data volume is what lets you recreate or upgrade the container without starting over.
Portainer can also manage remote Docker environments through Agents. That is a separate topology: the local VPS installation still runs a Portainer Server, while an Agent runs on another environment. A one-server setup does not need an Agent.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the deployment model before you begin
| Model | Best for | Deployment command | Networking and agents | Operational cost |
|---|---|---|---|---|
| Standalone Docker | One VPS and its local Docker engine | docker run or Docker Compose |
No Swarm; port 9001 is not required. Port 8000 is optional and only serves Edge tunnel features. | Lowest complexity; one container and one persistent volume |
| Docker Swarm | A deliberately configured multi-node Swarm cluster | docker stack deploy with a stack manifest |
Requires Swarm mode, a manager node, manager-worker communication on port 9001, one Server service, and a global Agent service. | More moving parts, scheduling, and cluster maintenance |
If this VPS is not already part of a Swarm that you intend to operate, use the standalone procedure. Swarm is not an upgrade path you need merely because you have Docker installed.
Prerequisites and host checks
The official Linux installation requirements are a working, current Docker installation and sudo access on the machine that will host the Portainer Server. The procedure assumes Docker is accessed through its Unix socket and that the Docker daemon runs as root. Rootless Docker has limitations that can prevent features from behaving as they do with a rootful daemon. SELinux also needs to be disabled unless you deliberately run the Portainer container in privileged mode; evaluate that trade-off against your operating system’s security policy rather than enabling privileged mode by default.
- Log in to the VPS with an account that can run Docker commands through
sudo. - Confirm Docker responds before installing Portainer:
sudo docker versionandsudo docker ps. - Decide whether the web endpoint will be reached directly on port 9443 or through a DNS name and reverse proxy.
- Plan firewall rules so only the ports and source networks you actually need are reachable.
- Have a DNS record ready if you want a normal hostname instead of an IP address.
Installing Portainer does not configure your VPS firewall, DNS, reverse proxy, or cloud security group. Those controls remain your responsibility.
Install Portainer CE with Docker
1. Create persistent storage
Create the named volume before creating the container:
docker volume create portainer_dataThe volume is the durable copy of Portainer’s application data. Do not replace it with an anonymous volume or remove it when recreating the container.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
2. Create the Server container
Run the official standalone command:
docker run -d
-p 8000:8000
-p 9443:9443
--name portainer
--restart=always
-v /var/run/docker.sock:/var/run/docker.sock
-v portainer_data:/data
portainer/portainer-ce:stsIf your account does not have permission to run Docker directly, prefix the commands with sudo. The --restart=always policy brings the container back after a Docker or VPS restart. The socket mount gives Portainer access to the local engine, while the /data mount preserves its database.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The command publishes both documented ports. You may omit -p 8000:8000 when you know you will not use Edge Agent tunnel features; leaving it published does not make it necessary for ordinary local management. Keep -p 9443:9443 for the HTTPS interface.
3. Verify the container
docker psLook for a running container named portainer. If it exits, inspect its logs before changing the command:
docker logs portainerA running container is necessary but not sufficient: the VPS firewall and any provider-level security group must also allow your intended access path.
Install with Docker Compose instead
Compose is useful when you keep infrastructure definitions in a directory or expect to manage Portainer alongside other services. Portainer publishes a Compose file that maps 9443:9443, can map 8000:8000, mounts the Docker socket, and uses the named portainer_data volume.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
curl -L https://downloads.portainer.io/ce-sts/portainer-compose.yaml -o portainer-compose.yaml
docker compose -f portainer-compose.yaml up -dRun the commands from a directory you will retain as the deployment record. Check the resulting service with docker compose -f portainer-compose.yaml ps and view startup details with docker compose -f portainer-compose.yaml logs. Do not create a second deployment with the same container name while the docker run installation is still present.
Open the first-login page
Browse to:
https://<VPS-IP-or-FQDN>:9443Replace the placeholder with the VPS’s public IP address or DNS name; do not use localhost from your own computer. On the first visit, create the initial administrator account when prompted.
Portainer generates a self-signed certificate for port 9443 by default. Your browser will therefore show a certificate warning because the certificate is not issued by a public certificate authority and may not match a public DNS identity. On a new VPS, verify that you reached the correct address before proceeding past the warning. For a long-term internet-facing deployment, replace the certificate by supplying your own certificate during installation or configuring one through the Portainer UI after setup.
Port reference: which ports matter?
| Port | Purpose | Required for a single VPS? | Exposure guidance |
|---|---|---|---|
| 9443/TCP | Portainer HTTPS web interface | Yes, unless another local arrangement forwards the interface to it. | Expose only to administrators or to your reverse proxy. This is the normal secure endpoint. |
| 8000/TCP | Portainer TCP tunnel for Edge Agent features | No for local Docker management. | Publish it only when you use Edge compute or tunnel functionality, and restrict its network exposure appropriately. |
| 9000/TCP | Legacy HTTP interface | No. | HTTPS is the default for current CE releases; enable 9000 only for a specific legacy requirement and understand that it is plain HTTP. |
| 9001/TCP | Manager-worker communication in the documented Swarm deployment | No for standalone Docker. | Needed only when operating the relevant Swarm topology. |
Portainer’s documentation states that the Server exposes the UI on 9443 and a TCP tunnel on 8000. Since CE 2.9 and BE 2.10, HTTPS is enabled by default on 9443; port 9000 remains available for legacy reasons.
Direct 9443 access or a reverse proxy?
| Approach | Certificate ownership | Firewall exposure | Hostname experience | When it fits |
|---|---|---|---|---|
Direct access to :9443 |
Portainer starts with its self-signed certificate; you can later provide a personal certificate. | The VPS or provider firewall must allow 9443 from your administration networks. | Users must include the nonstandard port in the URL. | Small private VPS, trusted administration network, or quick initial setup. |
| DNS name plus reverse proxy | The proxy normally terminates TLS; certificate renewal and storage are managed at the proxy layer. Portainer can still retain its internal TLS endpoint. | You can keep 9443 private and expose only the proxy’s chosen listener. | Administrators use a normal HTTPS hostname without appending 9443. | Internet-facing services, centralized certificates, or an existing web gateway. |
DNS records, firewall policy, proxy configuration, and certificate issuance are deployment decisions outside the basic Portainer container command. Whichever design you choose, avoid exposing administrative interfaces to the entire internet when a narrower source policy is practical.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Update Portainer without losing stacks
Portainer releases include features and bug fixes, but an update changes the management server that controls your environments. Test the upgrade path on a non-critical system first. Where your edition provides backup and restore, take a backup before changing the image.
- Record the current deployment. Save the exact
docker runarguments or Compose file, the image tag, published ports, volume names, certificate settings, and any proxy configuration. - Check compatibility. Read the release notes for the Server image you intend to use. If you manage remote environments, plan the Agent update as a separate step.
- Back up Portainer data. Preserve the
portainer_datavolume and use Portainer’s backup capability when it is available for your edition. A VPS snapshot can provide an additional recovery point. - Fetch the replacement image.
docker pull portainer/portainer-ce:sts - Stop and remove only the container.
docker stop portainer docker rm portainerRemoving the container does not remove the named volume. Never add
docker volume rm portainer_datato an upgrade procedure. - Recreate the container with the same settings. Re-run the original command, including
-v portainer_data:/data, the socket mount, published ports, restart policy, and the image tag you selected. With Compose, rundocker compose -f portainer-compose.yaml up -dafter updating the file or image reference. - Validate the result. Use
docker ps, inspect logs, sign in, confirm that endpoints and stacks are present, and test a non-destructive operation before declaring the upgrade complete. - Update Agents afterward. Portainer recommends updating the Portainer Server before the Agents because release changes can affect Agent compatibility. Update only the Agents that belong to environments you still manage and verify each connection.
If the new container does not start, restore the previous image tag and recreate it with the unchanged portainer_data volume. This is why recording the old command and testing first matter.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Backups and recovery planning
The named volume protects against routine container replacement, not every failure. Disk loss, accidental volume deletion, filesystem corruption, or a compromised VPS can still destroy it. Keep a backup outside the container’s writable layer and protect that backup as carefully as the administrator credentials it contains.
- Document the volume name, image tag, port mappings, socket mount, and Compose or shell definition.
- Back up Portainer’s own data using the backup and restore feature available in your edition.
- Use VPS or storage snapshots when your provider offers them, and periodically verify that a restore is possible.
- Store recovery credentials securely; a backup that contains the management database is sensitive.
- After recovery, check that every endpoint, stack, registry credential, and certificate setting is present before resuming changes.
When the Swarm procedure is appropriate
The Swarm guide is for a Docker Swarm cluster. It assumes Swarm mode is enabled, a manager node is available, and manager-worker communication on port 9001 is allowed. The documented approach downloads a stack manifest and deploys it with docker stack deploy. That stack creates one Portainer Server service and a global Agent service across the cluster.
Do not apply the Swarm manifest to a normal single-host Docker installation merely because the command looks more “production” oriented. A standalone VPS has no scheduler or worker nodes to benefit from it, and the additional services and network requirements make diagnosis harder. Choose Swarm only when you have intentionally built and will maintain a cluster, including node roles, overlay networking, manager quorum, upgrades, and failure handling.
Troubleshooting common installation failures
The browser cannot connect
- Confirm the container is running with
docker ps. - Check startup output with
docker logs portainer. - Verify you used the VPS address, not your workstation’s
localhost. - Check the VPS firewall, cloud security group, and any reverse-proxy listener for TCP 9443 or the listener you selected.
- Test the exact URL, including
https://and:9443when connecting directly.
The page shows a certificate warning
This is expected with Portainer’s default self-signed certificate. Confirm the hostname or IP is correct, then replace the certificate with one appropriate for your DNS name or administrative policy. A warning is not evidence that the container is malfunctioning.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The container exits immediately
Read docker logs portainer and check the host assumptions: Docker must be available through the mounted Unix socket, the image must have been pulled successfully, and the host’s security controls must permit the container. SELinux and rootless-Docker differences are common reasons a procedure that works on a standard rootful Docker host behaves differently.
Stacks or settings disappeared after an upgrade
Check that the replacement container mounts portainer_data:/data with the same volume name. Recreating a container without that mount creates a fresh Portainer database. Do not delete the old volume while troubleshooting.
Remote Edge environments do not connect
Local management does not require port 8000, but Edge Agent tunnel features do. If you selected an Edge workflow, confirm that the required tunnel port is published and reachable according to your network policy, and that the Agent is configured for the same Portainer Server.
Security practices for a VPS-hosted Portainer
- Treat the Docker socket mount as highly privileged access: anyone who gains effective Portainer administrator control can manage containers on that Docker host.
- Use a strong, unique administrator password and limit who can reach the management endpoint.
- Prefer HTTPS and replace the self-signed certificate when administrators need a trusted hostname.
- Do not publish port 8000 or legacy port 9000 unless a documented feature or compatibility requirement justifies it.
- Keep Docker, the Portainer image, the host operating system, and any Agents maintained on a schedule appropriate to their risk.
- Test updates and recovery on a non-critical VPS before changing an important environment.
With a rootful Docker engine, the standalone container and persistent volume are all that a single VPS normally needs. Keep the deployment definition and the portainer_data backup together, and Portainer can be upgraded or restored without rebuilding every stack by hand.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
