Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →To update Portainer on Docker Standalone, back up its data, stop and remove only the Portainer container, pull the image for the edition you already use, and recreate the container with the same persistent portainer_data volume, Docker socket, ports, and options. Your other Docker containers and stacks remain in place because removing a container does not remove their data or the Portainer data volume.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
The workflow is different on Docker Swarm, where Portainer runs as services and must be updated from a manager node. Agents also need to use a version compatible with the Portainer Server.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What the update changes
A Portainer update replaces the Portainer application container. The persistent data directory is mounted separately, normally through a Docker volume named portainer_data. When the replacement container starts with that same mount, Portainer reads the existing configuration and upgrades its database when required.
This means the safe Standalone pattern is:
- Back up the Portainer configuration and data.
- Record the current deployment details.
- Stop and remove the old Portainer container.
- Pull an image matching the installed edition.
- Run a replacement container with the same persistent mounts and settings.
- Sign in and verify the displayed version and your environments.
Do not remove the portainer_data volume as part of this process. Removing that volume would remove the data Portainer needs to retain its users, endpoints, settings, and stack definitions.
#1 Best Overall
Before you start: identify what is running
Confirm the edition
Community Edition uses the portainer/portainer-ce image. Business Edition uses portainer/portainer-ee. Pulling the other image is not a routine upgrade; it is an edition change that has separate migration and rollback considerations.
Record the existing container settings
The replacement must reproduce the settings that made the current container work. Before stopping it, record:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- The container name, normally
portainer. - The image name and tag.
- Published ports, including whether HTTP compatibility on port 9000 is retained.
- The Docker socket mount, usually
/var/run/docker.sock:/var/run/docker.sock. - The persistent data volume or bind mount, usually
portainer_data:/data. - Certificate or TLS flags.
- Environment variables, including a custom agent secret if one is used.
- Any additional mounts, labels, networks, or restart settings.
You can inspect the running container with Docker’s normal inspection and listing commands, but do not alter the configuration while collecting these details. If the original deployment used a bind mount rather than a named volume, use that exact host path again.
Choose a release tag deliberately
Portainer’s standard documentation uses the lts tag for both editions. That tag follows the current long-term-support line. A pinned version tag can provide more deterministic redeployments, but it must be selected intentionally and kept consistent with your upgrade plan. Do not replace an existing pinned deployment with lts accidentally, or replace an LTS deployment with an unverified tag.
Back up Portainer before changing the container
Portainer explicitly recommends backing up the current configuration before every update. Back up the Portainer data volume or bind-mounted data directory, and make sure the backup can actually be read before proceeding.
A volume backup is particularly important before a database-changing operation, such as an edition rollback. The update itself normally reuses the existing data, but a failed startup, incompatible image, or mistaken mount path can leave you needing to restore it.
The backup should cover the Portainer data directory, not merely the Docker image. Keep a copy outside the Docker volume so that deleting or recreating containers cannot affect the only backup.
Update Portainer on Docker Standalone
1. Stop the current container
With the usual container name, run:
docker stop portainerStopping Portainer does not stop the application containers it manages. Those containers continue running unless you explicitly stop them.
2. Remove only the old Portainer container
docker rm portainerThis removes the container definition, not the persistent portainer_data volume and not your other Docker applications. Do not append a volume-removal option, and do not run a command that deletes the named data volume.
If your container has a different name, substitute that name in both commands. The name is important because the replacement command below uses --name=portainer; Docker cannot create a second container with the same name until the old one is removed.
3. Pull the image for the installed edition
For Community Edition:
docker pull portainer/portainer-ce:ltsFor Business Edition:
docker pull portainer/portainer-ee:ltsUse one command, not both. The image must match the edition you identified before stopping the container.
4. Recreate the replacement container
The standard Community Edition command is:
docker run -d
-p 8000:8000 -p 9443:9443
--name=portainer --restart=always
-v /var/run/docker.sock:/var/run/docker.sock
-v portainer_data:/data
portainer/portainer-ce:ltsFor Business Edition, change only the image at the end:
docker run -d
-p 8000:8000 -p 9443:9443
--name=portainer --restart=always
-v /var/run/docker.sock:/var/run/docker.sock
-v portainer_data:/data
portainer/portainer-ee:ltsThese commands assume the standard named volume and ports. If your previous container used a bind mount, custom host ports, certificates, environment variables, a custom network, or other flags, add those same options to the replacement command. A replacement that omits a certificate flag or changes the data mount can appear to start while failing to provide the same access or configuration.
5. Understand the port choices
| Port | Purpose and update guidance |
|---|---|
| 9443 | Portainer’s default HTTPS web interface from Community Edition 2.9 and Business Edition 2.10. Publish it for normal secure access. |
| 9000 | Optional HTTP compatibility port. Add -p 9000:9000 only if an existing integration or browser workflow still requires HTTP. |
| 8000 | Used for Edge Agent communication. Omit -p 8000:8000 when Edge Agent communication is not needed. |
Do not expose a new port merely because it appears in an example. Preserve the ports that your deployment and firewall rules expect, and use HTTPS on 9443 for the normal web connection.
6. Verify the new container
Open https://your-server-address:9443 and sign in. Portainer should show your existing environments, users, stacks, and settings. Its update notification should disappear, and the displayed version should change to the version provided by the new image.
If the browser cannot connect, check the container status and logs first, then verify the host firewall and the published port. If Portainer starts with an empty setup wizard, stop immediately and check the data mount: the replacement may be using a new or incorrect volume instead of the original portainer_data volume.
Keeping custom deployment options intact
Certificates and HTTPS flags
Certificate files and certificate-related command-line flags are part of the deployment, not automatically carried by the new container definition. Re-add the same certificate mounts and flags, and ensure the host paths still contain the files the container expects.
Environment variables and agent secrets
Recreate every environment variable used by the old container. If your Server uses a custom AGENT_SECRET, keep that value unchanged when recreating the Agent and pass the corresponding value wherever the Server deployment requires it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Bind mounts and named volumes
A named volume is referenced by its volume name, while a bind mount is referenced by an absolute host path. These are not interchangeable. Record the output of the existing container’s mounts and reproduce the same source and destination paths.
Restart behavior and networking
The standard example uses --restart=always. If your previous deployment used a different restart policy, custom network, labels, or resource settings, carry those settings forward rather than silently reverting to the example defaults.
Do Portainer Agents need an update?
Portainer’s guidance is to match the Agent version to the Portainer Server version. Treat the Server and Agent as a versioned pair, especially when managing remote Docker environments.
Portainer also warns that a 1.x installation must first move to 2.0.0 before upgrading to a current release. Do not jump directly from a 1.x Agent or Server to a current version without following that transition requirement.
Updating an Agent container
- Record the Agent’s current mounts, published ports, network settings, and any custom secret.
- Back up the relevant Portainer configuration before changing the deployment.
- Stop and remove the old Agent container without deleting its required data volume.
- Pull the matching Agent image:
docker pull portainer/agent:lts- Recreate the Agent with the Docker socket, required volume mounts, ports, and the same
AGENT_SECRETvalue when one is configured. - Return to the Portainer Server and confirm that the endpoint reconnects.
The exact Agent run command depends on how that Agent was originally deployed. Reusing only the image name while omitting the original mounts, network, or secret can break the endpoint even though the container itself appears running.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Docker Swarm uses a different update procedure
Do not apply the Standalone docker stop, docker rm, and docker run sequence to a Swarm deployment. In Swarm, Portainer Server and Agent are services managed by the Swarm scheduler.
Run the update from a manager node. Update the Portainer Server service and Agent services with Docker service commands, using image versions that match each other. Keep the service definitions’ published ports, mounts, secrets, and placement settings intact, and take a configuration backup before changing the services.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The operational distinction is:
| Deployment | Where to update | What is recreated |
|---|---|---|
| Docker Standalone | The Docker host running the container | One Portainer container, reusing its persistent data mount |
| Docker Swarm | A Swarm manager node | Portainer Server and Agent services through Docker service updates |
If you are unsure whether Portainer is standalone or Swarm-based, inspect whether it is represented as a regular container or as a service before running any removal command.
LTS tags, pinned versions, and edition changes
LTS versus a pinned version
The lts tag is convenient for following Portainer’s long-term-support line. A pinned version is useful when you require repeatable deployments and want to schedule version changes explicitly. Whichever approach you use, document the selected tag and keep the rollback image available until verification is complete.
Community Edition versus Business Edition
CE and BE have different image names: portainer/portainer-ce and portainer/portainer-ee. A normal update stays within the same edition. Moving between editions is a migration decision, not a routine image refresh, and it should be preceded by a data-volume backup.
Rollback or edition migration
Portainer maintains separate upgrade and rollback guidance. Before a database-changing rollback, back up the Portainer data volume. The documented Business-to-Community path stops the instance, creates a tar backup of /data, runs the database rollback command, and redeploys Community Edition using the existing data. Do not improvise a downgrade by merely changing the image name; the database state may require the documented rollback command.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteTroubleshooting after the update
The replacement container will not start
- Check that the old container was removed and that the replacement name is not already in use.
- Confirm that the image name matches CE or BE.
- Review container logs for a bad flag, missing certificate file, or unavailable mount.
- Verify that published host ports are not already occupied by another process.
Portainer opens but shows no environments or stacks
Stop the replacement and inspect its mounts. The most common cause is an incorrect volume name or bind-mount path. Reattach the original portainer_data volume or data directory and start the container again. Do not initialize a new empty Portainer installation over the problem.
The web interface is unreachable
Use the URL and port actually published by Docker. The current default secure endpoint is HTTPS on 9443. If you intentionally retained HTTP compatibility, publish 9000 as well. Check host firewall rules and any reverse proxy configuration for the same port change.
An Agent endpoint is disconnected
Confirm that the Agent image version matches the Server, that its required Docker socket and volume mounts were restored, and that a custom AGENT_SECRET is identical on both sides. For very old 1.x installations, complete the required 2.0.0 transition before attempting a current release.
You removed the wrong volume
Stop further changes and restore the Portainer data from the backup. A container recreation can recover only when the original data volume remains available; deleting the volume requires a separate restore operation.
Quick Recap
Final verification checklist
- The image belongs to the same CE or BE edition as before.
- The replacement uses the original
portainer_datavolume or bind-mounted data directory. - The Docker socket mount is present.
- Certificate flags, environment variables, secrets, networks, and custom mounts were preserved.
- The expected ports are published: 9443 for HTTPS, optional 9000 for HTTP compatibility, and optional 8000 for Edge Agent communication.
- The Portainer login works and existing environments and stacks are visible.
- The displayed Portainer version changed and the update notification is gone.
- Agents reconnect and report a version compatible with the Server.
- A known-good backup remains available until the update has been fully verified.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
