Apps / Docker Images
Portainer in Docker.
Your Docker, in a browser.
Portainer CE is the web UI for Docker: containers, images, volumes, networks and stacks, managed from a browser instead of a terminal. The RemarkableCloud image packages it for production with the one thing a fresh Portainer must never be: claimable.
docker pull ghcr.io/remarkablecloud/portainer Current build
2.45.0-r2
Updated Sep 12, 2026
Base
Portainer CE official, digest-pinned
What's inside
Admin created before first request, trusted origins wired, socket-scoped host access
Upstream license
Portainer CE: zlib License.
Free to pull and run anywhere. Digest-pinned, updated deliberately; each build is recorded in the changelog.
The image
What our image adds.
Portainer CE is the web UI for Docker: containers, images, volumes, networks and stacks, managed from a browser instead of a terminal. The RemarkableCloud image packages it for production with the one thing a fresh Portainer must never be: claimable.
Admin created before first request
`PORTAINER_ADMIN_PASSWORD` is required by the stack, and the account exists before the port opens. A fresh install is never an open registration page.
Trusted origins wired
`PORTAINER_TRUSTED_ORIGINS` feeds Portainer's CSRF origin checks, so it serves cleanly behind a TLS-terminating reverse proxy on your real domain.
Digest-pinned base
Built from the upstream Portainer CE release, pinned by digest, rebuilt and promoted on our schedule with each build recorded in the changelog.
Socket-scoped by design
The compose mounts the host Docker socket, which is what lets Portainer manage this server's containers; nothing else of the host is exposed.
Rather skip the compose file? Deploy Portainer with one click on your own VPS: TLS, domain and database already wired.
Deploy Portainer in one clickThe guide
Run it in production.
Architecture at a glance
One container. Portainer’s own state (users, endpoint settings, stack definitions) lives in the portainer-data volume; the containers it manages live on the host through the mounted Docker socket at /var/run/docker.sock. The UI serves on 9000 inside the network, behind your TLS proxy.
Docker Compose walkthrough
Set PORTAINER_ADMIN_PASSWORD to a strong value (the stack refuses to start without one) and PORTAINER_TRUSTED_ORIGINS to your public https origin, bring it up, and sign in as admin. From there, the local endpoint is pre-connected: your containers, stacks and volumes are already in the sidebar.
Environment variable reference
| Variable | Purpose |
|---|---|
| PORTAINER_ADMIN_PASSWORD | Required. Sets the admin account created before first request |
| PORTAINER_TRUSTED_ORIGINS | Your public https origin(s); drives CSRF origin validation behind a proxy |
Hardening notes
The Docker socket is root-equivalent on the host: anyone who can log in to this Portainer can run containers as root. Treat Portainer accounts accordingly, keep the UI behind TLS, use its role-based access when you add users, and never publish 9000 directly. The trusted-origins check is not decoration; set it to your real domain.
Backups
The portainer-data volume is the whole application state: users, registries, endpoint configuration, stack definitions. Back it as files. The containers Portainer manages are not inside it; they have their own volumes and their own backup story.
Upgrades
Pull the new tag and recreate; Portainer migrates its own database on boot. Ride our promoted -rN tags rather than upstream’s moving ones.
Updates
Recent builds.
2.45.0-r2
Sep 12, 2026- Bind the local Docker environment explicitly with `-H unix:///var/run/docker.sock` when the socket is present. With a pre-seeded admin, Portainer skips the setup wizard that would otherwise connect
2.45.0-r1
Sep 12, 2026- Initial RemarkableCloud build. Base: `portainer/portainer-ce:2.45.0` (digest-pinned). - Generated super administrator created on first boot via `--admin-password-file`, fed from the `PORTAINER_ADMIN
Or skip the ops
Host Portainer on your own private VPS.
One click installs this exact image on a VPS that is yours alone, domain and TLS wizard included. The same server runs as many apps as fit, with no per-app charge.
FAQ
Questions we get.
Is this Portainer CE or Business Edition?
Community Edition, zlib-licensed, fully functional. A Business license drops onto the same install if you later buy one.
Why does the compose require an admin password instead of generating one?
Portainer's admin is created through its own bootstrap, and requiring the variable makes the credential explicit and yours from second zero. On the App Platform the password is generated for you and delivered once.
Can it manage other servers besides this one?
Yes. Add remote Docker endpoints (agent or socket) from the UI and this Portainer becomes the single pane for a fleet, including other Cloud Cubes.
Is mounting the Docker socket safe?
It is the mechanism that makes Portainer work, and it is root-equivalent by nature. The mitigation is access discipline: strong admin credentials, TLS, roles for additional users, and no public 9000.
Your server runs. You sleep.
Fully managed hosting from people who have been doing this since 2001.