Install Portainer CE with private administrative access

Portainer manages Docker resources; it is not a full web hosting panel. This example covers one Linux host with rootful Docker.

1. Check Docker

Install Docker Engine and Compose using the official guide if needed:

bashsudo docker version
sudo docker compose version
sudo docker ps

Review the Portainer prerequisites for rootless or SELinux environments instead of applying this example unchanged.

2. Start with persistent storage

bashsudo docker volume create portainer_data
sudo docker run -d --name portainer --restart=always -p 127.0.0.1:9443:9443 -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:lts

The UI binds only to localhost. No Edge Agent port is needed here. The Docker socket grants extensive host control, so protect the administrator account accordingly.

The lts tag moves over time. Record the deployed image and review release notes during planned upgrades.

3. Open an SSH tunnel

From your own computer:

bashssh -N -L 9443:127.0.0.1:9443 root@SERVER_IP

Visit https://localhost:9443. Confirm you are using the intended tunnel when evaluating the initial self-signed certificate.

If prompted for a setup token, retrieve it from:

bashsudo docker logs portainer

Find the setup_token= entry. Keep it private. If initial registration times out, restart the container and inspect the current logs. See the setup token documentation.

4. Inspect before changing

Select the local environment and identify each container's image, ports and mounts. Use a disposable workload to learn operations. Keep Compose definitions in version control when using stacks; panel-only edits can disappear on the next deployment.

5. Troubleshoot deliberately

bashsudo docker ps --filter name=portainer
sudo docker logs --tail 50 portainer

An unreachable UI may simply mean the SSH tunnel closed. A missing environment requires checking the socket mount and Docker daemon. A name conflict requires inspecting the existing container before deleting anything.

6. Protect application data separately

A Portainer backup is not a substitute for backing up every application database and volume. Prove a restore for each workload. Continue with Docker deployment and backup planning.