Docker image
Portainer in Docker. Your Docker, in a browser.
Portainer CE is the web UI for Docker: containers, images, volumes, networks and stacks, managed from a browser instead of a terminal. The RemarkableCloud image packages it for production with the one thing a fresh Portainer must never be: claimable.
Prefer not to run it yourself? Managed Portainer from $5/mo
# Portainer in Docker, base pinned by digest docker pull ghcr.io/remarkablecloud/portainer:2.45.0-r2 docker compose up -d
- Current build
2.45.0-r2, updated Sep 12, 2026- Base
- Portainer CE official, digest-pinned
- What's inside
- Admin created before first request, trusted origins wired, socket-scoped host access
- Upstream license
- Portainer CE: zlib License.
The image
What our image adds.
What changes from upstream Portainer, and why it matters in production.
Admin created before first request
PORTAINER_ADMIN_PASSWORD is required by the stack, and the account exists before the port opens. A fresh install is never an open registration page.
Trusted origins wired
PORTAINER_TRUSTED_ORIGINS feeds Portainer's CSRF origin checks, so it serves cleanly behind a TLS-terminating reverse proxy on your real domain.
Digest-pinned base
Built from the upstream Portainer CE release, pinned by digest, rebuilt and promoted on our schedule with each build recorded in the changelog.
Socket-scoped by design
The compose mounts the host Docker socket, which is what lets Portainer manage this server's containers; nothing else of the host is exposed.
Run it yourself, or not
Same image either way.
Pull it and run it anywhere, or let us run Portainer for you on a managed server with updates, monitoring and snapshots.
Run Portainer yourself
- Pull it from GHCR and run it on any Docker host
- The guide below: compose, environment, backups, upgrades
- You patch, back up and watch it
Portainer on a managed server
- Installed for you from this same image, $0 for the app
- Updates with a snapshot first, monitoring and a managed firewall
- A 1 GB server from $5/mo billed annually, with room for more apps
The guide
Run it in production.
Compose file, environment reference, hardening, backups and upgrades, written by the people who build the image.
On this page
Architecture at a glance
One container. Portainer’s own state (users, endpoint settings, stack definitions) lives in the portainer-data volume; the containers it manages live on the host through the mounted Docker socket at /var/run/docker.sock. The UI serves on 9000 inside the network, behind your TLS proxy.
Docker Compose walkthrough
Set PORTAINER_ADMIN_PASSWORD to a strong value (the stack refuses to start without one) and PORTAINER_TRUSTED_ORIGINS to your public https origin, bring it up, and sign in as admin. From there, the local endpoint is pre-connected: your containers, stacks and volumes are already in the sidebar.
Environment variable reference
| Variable | Purpose |
|---|---|
| PORTAINER_ADMIN_PASSWORD | Required. Sets the admin account created before first request |
| PORTAINER_TRUSTED_ORIGINS | Your public https origin(s); drives CSRF origin validation behind a proxy |
Hardening notes
The Docker socket is root-equivalent on the host: anyone who can log in to this Portainer can run containers as root. Treat Portainer accounts accordingly, keep the UI behind TLS, use its role-based access when you add users, and never publish 9000 directly. The trusted-origins check is not decoration; set it to your real domain.
Backups
The portainer-data volume is the whole application state: users, registries, endpoint configuration, stack definitions. Back it as files. The containers Portainer manages are not inside it; they have their own volumes and their own backup story.
Upgrades
Pull the new tag and recreate; Portainer migrates its own database on boot. Ride our promoted -rN tags rather than upstream’s moving ones.
Changelog
Each build is pinned by digest and recorded here, so you can see what changed before you pull a new tag.
-
2.45.0-r2Current Sep 12, 2026 Bind the local Docker environment explicitly with-H unix:///var/run/docker.sockwhen the socket is present. -
2.45.0-r1Sep 12, 2026 Initial RemarkableCloud build. Base:portainer/portainer-ce:2.45.0(digest-pinned).
Portainer and other product names are trademarks of their respective owners. RemarkableCloud is not affiliated with or endorsed by them.
FAQ
Portainer in Docker, answered.
Short answers from the people who build and run this image.
Is this Portainer CE or Business Edition?
Community Edition, zlib-licensed, fully functional. A Business license drops onto the same install if you later buy one.
Why does the compose require an admin password instead of generating one?
Portainer's admin is created through its own bootstrap, and requiring the variable makes the credential explicit and yours from second zero. On the App Platform the password is generated for you and delivered once.
Can it manage other servers besides this one?
Yes. Add remote Docker endpoints (agent or socket) from the UI and this Portainer becomes the single pane for a fleet, including your other servers.
Is mounting the Docker socket safe?
It is the mechanism that makes Portainer work, and it is root-equivalent by nature. The mitigation is access discipline: strong admin credentials, TLS, roles for additional users, and no public 9000.
Pull it, or let us run it.
The same image runs Portainer on our managed servers, updates and monitoring included.