Deployment guide

Portainer

Overview

Portainer CE (Community Edition) gives you a browser-based control panel for Docker. You deploy and manage containers, images, volumes, networks and stacks from a web console, with live logs, an in-browser console into any container, and a docker compose editor for multi-service stacks. The SecureAnyCloud image installs Docker CE from the official Docker repository and runs Portainer CE 2.39.4 as a container, so you can start managing Docker as soon as the VM boots.

What you get:

Portainer CE 2.39.4 running as a container managed by Docker with a restart policy, bound to the loopback connector 127.0.0.1:9000.
Docker CE preinstalled from the official Docker apt repository.
The Portainer web console on :80, fronted by an nginx reverse proxy that passes through the WebSocket upgrade Portainer needs for its container console and live stats.
The local Docker environment connected automatically, so you can deploy straight away.
A unique admin password generated on first boot of every VM and recorded in a root-only file (user name admin).
A dedicated Azure data disk at /var/lib/portainer holding Portainer's database and state.
docker.service and nginx.service as systemd units, enabled and active.
An unauthenticated /healthz endpoint for Azure Load Balancer health probes.
24/7 SecureAnyCloud support.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.
A VM size of Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point. Size up for heavier container workloads.
NSG inbound rules that allow 22/tcp from your management network and 80/tcp.

Portainer serves plain HTTP on port 80. Because the console gives full control of the Docker host, terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Portainer by SecureAnyCloud, and select Create. On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:portainer-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name portainer \
  --image sac1647283583153:portainer-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name portainer --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx.service

Both services report active. Docker manages the Portainer CE container, which is bound to the loopback connector 127.0.0.1:9000. nginx fronts the container on port 80 with the WebSocket upgrade the console requires. Portainer's database and state live on the dedicated Azure data disk mounted at /var/lib/portainer.

Step 5 - Retrieve your admin password

The Portainer admin password is generated uniquely on the first boot of your VM and written to a file that only root can read:

sudo cat /root/portainer-credentials.txt

This file contains PORTAINER_USERNAME (always admin), PORTAINER_PASSWORD and the URL to open. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so an Azure Load Balancer health probe can use it.

Step 7 - Verify authentication from the command line

Portainer issues a JWT for correct credentials and rejects a wrong password. Read the password from the credentials file, then post it to the auth endpoint. The command embeds your unique password, so run it interactively and not from a script. Substitute the value of PORTAINER_PASSWORD from Step 5 for <PORTAINER_PASSWORD>:

curl -s -X POST -H 'Content-Type: application/json' --data '{"Username":"admin","Password":"<PORTAINER_PASSWORD>"}' http://127.0.0.1/api/auth

A correct password returns a JSON body containing a jwt token. A wrong password returns a 4xx error with no token. The local Docker environment is already connected, so the console is ready to use.

Step 8 - Sign in to the console

Browse to http://<vm-public-ip>/. Portainer shows a sign-in page. Enter the user name admin and the password from Step 5.

After you sign in, the dashboard shows the local Docker environment, already connected, with the running containers, images, volumes and networks on the host.

Step 9 - Manage containers

Open Containers from the sidebar to see every container on the host. From here you can start, stop, restart and inspect containers, view logs, open an in-browser console, and deploy new containers with Add container.

Step 10 - Deploy a stack

Open Stacks, then Add stack, to deploy a multi-service application from a docker compose file. Paste your compose definition into the web editor (or point Portainer at a Git repository), give the stack a name and select Deploy the stack.

Step 11 - Confirm data lives on the dedicated disk

Portainer's database and state (users, environments, stacks and settings) are stored under /var/lib/portainer on the dedicated Azure data disk, which is bind-mounted into the container as /data. They survive OS changes, and you can resize the disk independently:

findmnt /var/lib/portainer

The mount is backed by a separate Azure data disk that is captured into the image and provisioned again on every VM.

Maintenance

Password: The admin password is set on first boot. To reset it, sign in and use My account, then Change password, in the console. You can also reset the admin from the CLI by following Portainer's documentation.
Upgrades: Portainer runs as the portainer container from the pinned portainer/portainer-ce:2.39.4 image. To upgrade, pull a newer tag, remove the container and run it again with the same -v /var/lib/portainer:/data mount so your data is preserved.
Storage: All Portainer state lives under /var/lib/portainer on the data disk. Back up that volume to protect your users, environments and stacks.
Docker: The host's Docker engine is managed by docker.service. Containers you deploy through Portainer run directly on this host.
TLS: Portainer serves plain HTTP on port 80. Put TLS in front of it (for example, certbot with your own domain), because the console gives full control of the Docker host.
Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Portainer CE on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Portainer CE, a lightweight management UI that lets you deploy and operate Docker from your web browser. You get a clear view of every container, image, volume, network and stack on the host, with controls to create, start, stop, inspect, exec into and remove them.

What you get:

Portainer running as a container that manages the host's own Docker engine through the Docker socket at /var/run/docker.sock. It binds to 127.0.0.1:9000 on the loopback interface.
nginx as a reverse proxy on port 80 (and 443 once you add TLS), with the WebSocket upgrade that the container console and log streaming require already configured.
A dedicated EBS data volume mounted at /var/lib/portainer, separate from the operating system disk and independently resizable. It holds Portainer's database of users, environments, stacks and settings.
A one-shot service on the first boot of every instance. It creates the Portainer admin account with a per-instance password, connects the local Docker environment, and records the password in /root/portainer-credentials.txt with mode 0600.
No shared or default credentials in the image.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances.
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products.
An EC2 key pair in the target Region for SSH access to the instance.
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your operators will reach Portainer on.
The AWS CLI (version 2) installed locally if you plan to deploy from the command line.

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Portainer. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger. The image adds a separate data volume for the Portainer database automatically.

Select Launch instance. First boot initialisation takes under a minute after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Portainer CE Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=portainer-01}]'

On success, the command prints a JSON document. Note the instance ID, then retrieve the instance's public address once it is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and retrieve the admin password

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched:

Portainer CE 2.39 on Ubuntu 24.04: SSH login user ubuntu

The first-boot service runs before the SSH daemon is ready, so the credentials file is always in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/portainer-credentials.txt

The plain text file contains the Portainer URL, the admin user name and the per-instance admin password. From the same SSH session, you can confirm that the deployment is healthy. nginx serves the health endpoint, and it is open:

curl -fsS http://127.0.0.1/healthz

ok

An ok response confirms that nginx is fronting the application. You can also confirm that the services that make up the stack are running and that the Portainer container is up:

systemctl is-active docker nginx portainer-firstboot
sudo docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'

active active active NAMES IMAGE STATUS portainer portainer/portainer-ce:2.39.4 Up 12 minutes

First sign-in

Open a web browser and go to http://<public-ip>/. Portainer shows its sign-in page and prompts for the user name and password.

The Portainer CE sign-in page is served on first boot behind nginx. Sign in as admin with the per-instance password.

Enter admin and the password from /root/portainer-credentials.txt, then select Login. Portainer opens on the Home page, which lists the environments it manages. The local Docker environment is already connected and shown as Up.

The Home page lists the connected local Docker environment, with its running containers, images and resource summary.

Explore the environment dashboard

Select the local environment to open its dashboard. The dashboard summarises the connected Docker engine with the number of stacks, containers, images, volumes and networks, and quick links into each.

The environment dashboard for the connected local Docker engine summarises stacks, containers, images, volumes and networks.

Manage containers

Select Containers in the sidebar to see every container on the host with its state, image and published ports. From here you can start, stop, restart, pause, kill, remove and duplicate containers, open an in-browser console into a running container, or stream its live logs.

The container list shows each container with its state, image and published ports, and the quick-action controls for logs, inspect, stats and console.

Deploy a container

Select Containers, then + Add container. Give the container a Name, enter an Image (for example nginx:latest), map any ports you need under Network ports configuration, and set a restart policy under the advanced settings. Select Deploy the container, and Portainer pulls the image and starts it on the local engine.

The Create container view deploys a new container from an image with a name, registry and port mappings, straight from the browser.

For multi-container applications, select Stacks, then + Add stack, and paste a Docker Compose file or edit one in the web editor. Portainer deploys the whole stack in one action.

Enable HTTPS with Let's Encrypt

Serve Portainer over HTTPS so that your session, and the WebSocket that the console and log streams use, cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

The following steps assume that a DNS record points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d portainer.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

certbot obtains a certificate and rewrites the nginx server block to serve HTTPS and redirect HTTP. The WebSocket upgrade headers already in the site are preserved. The certbot systemd timer renews the certificate automatically.

Backups and maintenance

Portainer keeps its database of users, environments, stacks and settings under /var/lib/portainer on the dedicated data volume. Because that is a separate EBS volume, you can take an EBS snapshot of it for point-in-time backups, or archive the tree to object storage:

sudo docker stop portainer
sudo tar czf <backup-dir>/portainer-$(date +%F).tgz -C /var/lib portainer
sudo docker start portainer

Copy the archive to an Amazon S3 bucket or another object store. To reset the admin password, sign in to Portainer and use Settings, then Users. If you are locked out, follow Portainer's documented password-reset container procedure. The reverse proxy and engine run under systemd, and the Portainer container runs with a restart policy of always. Check their state at any time:

systemctl is-active docker nginx
sudo docker ps --filter name=portainer

Scaling and operations

Connect additional Docker or Kubernetes environments from Environment-related in the sidebar to manage more than one host from a single Portainer.
Put the web tier behind an Application Load Balancer and terminate TLS there. Forward the WebSocket upgrade so consoles and log streams connect.
Grow the Portainer database volume by extending the EBS data volume and running sudo resize2fs on /var/lib/portainer.
Add teams and users with scoped, role-based access control so operators see only the resources they own.
Pin the Portainer version for a fleet by controlling which AMI version you launch.

The official Portainer documentation is available at https://docs.portainer.io.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image. Support offers a response within 24 hours and a one-hour average for critical issues. Contact sales@secureanycloud.com.

For general Portainer questions, see the documentation at https://docs.portainer.io. Portainer is a trademark of Portainer.io Limited. It is used here to identify the product and does not imply affiliation or endorsement.

Deploy on AWS

Launch Portainer CE on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS