You can run Portainer CE on Ubuntu 26.04 with its web interface reachable only from your own network. The standard installation, however, mounts the Docker socket into the Portainer container, which means Portainer can control the Docker daemon on that host. Keeping the interface off the public internet is one part of the job. Limiting who can reach Portainer and who can log in to it is the other.
What “without exposing the Docker host” actually means
The phrase covers two different risks, and the install steps address them differently.
As an Amazon Associate I earn from qualifying purchases.
- Network exposure. Portainer’s web interface listens on a port on the host. If that port is reachable from the internet, anyone who can reach it can attempt to log in. Binding the port to a private address, or filtering it, reduces this risk.
- Control exposure. Portainer’s documented local deployment mounts
/var/run/docker.sockinto the container. That socket is the control interface for the Docker daemon. Anyone who gets into Portainer with administrator rights can start containers, mount host paths, and act with root-level effect on the host. Network restrictions do not change this. The socket mount is a trust decision, not a network setting.
The rest of this guide covers the simple local deployment that Portainer documents, then shows how to narrow the network side, and finally explains what the socket mount means for access control.
Prerequisites
- Ubuntu 26.04 LTS, with a user that has
sudoaccess. - A working Docker Engine installation. Portainer’s documentation recommends Docker’s official installation instructions and advises against installing Docker through Snap on Ubuntu because compatibility problems can occur.
- A decision about who will reach the Portainer interface: a single administrator on the host, or a small set of clients on a private network.
Ubuntu 26.04 LTS is supported until April 2031, according to the Ubuntu 26.04 LTS release notes in Ubuntu Documentation.
#1 Best Overall
Step 1: Install Docker Engine from Docker’s repository
Docker’s “Install Docker Engine on Ubuntu” guide lists Ubuntu Resolute (26.04 LTS) among its supported releases, alongside Noble (24.04 LTS) and Jammy (22.04 LTS). Use the current guide rather than older snippets that hard-code a previous codename. Its repository setup reads the codename from /etc/os-release, and the key and package steps can change between releases.
Before installing the official packages, remove any conflicting unofficial packages. The Docker guide names these: docker.io, docker-compose, docker-compose-v2, docker-doc, docker-buildx, podman-docker, containerd, and runc. Then confirm the Docker service is running and run the test container described in the same guide.
Docker’s guide lists supported architectures as x86_64/amd64, armhf, arm64, s390x, and ppc64le/ppc64el. If your host is one of the others, check the guide before you continue.
Step 2: Deploy Portainer CE
Portainer’s documented Docker run command creates a named volume for its data, then starts the container with the socket and data mounts:
docker volume create portainer_data
docker run -d
--name portainer
--restart=always
-p 9443:9443
-v /var/run/docker.sock:/var/run/docker.sock
-v portainer_data:/data
portainer/portainer-ce:ltsPortainer’s examples have used more than one image tag. Its Compose example and current update guidance use lts, while one Linux installation example uses sts. Before you copy the command, check the official Portainer installation page for the channel you want, because tags move over time.
The named volume portainer_data keeps Portainer’s configuration when you replace the container. Portainer’s Compose example uses the same socket and data mounts and publishes port 9443. Use whichever form fits how you manage your host.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Confirm that the container is up:
docker psOn the host itself, open https://localhost:9443. Portainer generates a self-signed certificate by default, so your browser will show a warning on first use. Portainer’s documentation lets you supply your own certificate during installation or later from the web interface. Replace the self-signed certificate if clients outside the host will connect.
Step 3: Limit the network side
Publish only the ports you need
Portainer’s documentation describes the following ports. Only 9443 is needed for the standard web interface.
| Port | Purpose | When to publish it |
|---|---|---|
| 9443/TCP | HTTPS web interface | Required for the standard interface |
| 8000/TCP | Edge Agent communication | Only if you use Edge Agent features; otherwise omit -p 8000:8000 |
| 9000/TCP | Legacy HTTP interface | Not needed by default; publish only for a specific legacy HTTP requirement |
| 9001/TCP | Portainer Agent on a Docker Standalone host | Only when a remote Portainer Server connects to this host through the standalone Agent |
Restrict who can reach 9443
The sample command binds 9443 on all host addresses, because -p 9443:9443 does not specify an address. If only local administration is needed, bind the port to the loopback address instead:
Rank #4
-p 127.0.0.1:9443:9443With that binding, reach Portainer from another machine through an SSH tunnel, for example ssh -L 9443:localhost:9443 user@your-host, rather than opening the port. If other clients on a private network must connect directly, bind to that network’s address and allow only the source addresses you intend.
Do not rely on ufw or firewalld alone
Docker’s guide warns that ports published by containers bypass ufw and firewalld rules. A host firewall rule that blocks 9443 may not stop traffic to a port Docker has published. Use a binding such as the loopback address above, or configure filtering in a way you have confirmed works with Docker on your host. Then test from a machine outside your network. A rule that looks correct on the host is not evidence that the port is closed.
Choose who can log in, and who can use the socket
Treat every Portainer administrator as an operator of the Docker host. Docker’s post-installation documentation states that users in the docker group have root-level privileges. Portainer’s access to the socket gives it similar reach, whichever user logs in to the interface. Give administrator roles only to people who need them, use strong unique passwords, and keep the interface reachable only from clients you trust.
Best Value
Making the socket mount read-only is not a complete fix. Portainer still needs to change the daemon’s state to manage containers, so a read-only mount does not turn the arrangement into a limited one.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallManaging a separate Docker host with an Agent
If Portainer Server runs on a different machine from the Docker host you want to manage, Portainer’s documentation describes connecting a Docker Standalone environment through an Agent, a direct API connection, the socket, or an Edge Agent. The choice changes the trust boundary.
- Standalone Agent. The Server must reach the Agent on TCP 9001, and Server-to-Agent communication uses HTTPS. Portainer describes this as a legacy option that does not provide Edge features or policy management. Restrict 9001 to the Server’s address.
- Edge Agent. Portainer documents Edge features on TCP 8000. Check the current Edge documentation before choosing this path for a production host.
An Agent does not make the managed host safer by default. It still runs with access to the Docker daemon on that host, and its network path needs the same controls described above. Portainer’s host setup documentation also describes host-management features that can browse the host filesystem when the Agent has the host root mounted at /host. Those features are disabled by default. Leave them disabled unless you need them.
Verify the setup
- Run
docker psand confirm that theportainercontainer is running with only the ports you intended. - From the host, load
https://localhost:9443and create the administrator account. - From an outside network, confirm that 9443 does not respond. If it does, revisit the port binding and firewall configuration.
- From an authorized client, confirm that the certificate is trusted, or that you understand the browser warning.
If the Portainer container fails to start, check docker logs portainer first. If the interface loads but Portainer cannot list containers, check that the socket path in your run command matches /var/run/docker.sock on the host.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
