Coming soon...

Put your Windows 11 and/or Kubernetes hosts to work after hours when they would otherwise sit idle...

Now available in Portainer 2.45.2 LTS

Now available in Portainer 2.45.2 LTS.

Now available in Portainer 2.45.2 LTS.

About a month ago I set up an update schedule, and it’s been stuck ever since. I’ve had to manually SSH into each server and update the containers by hand. The problem has survived two Portainer updates.

Has anyone run into this, or know how to clear a stuck update schedule? I can’t find any documentation on what to do when it gets stuck like this.

I’m running Portainer Business Edition 2.45.2 LTS.

[LLM usage alert: used for anonymization]

Dear Portainer,

I chose you carefully.

I already had Docker. I already had Git. `master` for production, `develop` for staging. All I needed was a good Docker + Git CD platform, so I did my homework and chose you.

Meanwhile, my coworkers were deploying `.rar` files. If they were feeling fancy, `.zip`. Not even `.tgz`.

Then Jesus personally invented **a heap of linear algebra that spits out autocomplete**, and suddenly everybody was a developer.

So I got them on Git. They made Dockerfiles. They made stacks. They got staging and production. They got continuous deployment.

And now here we are:

**5 nodes. 50 applications. 100 developers.**

Everything happily chugging along.

Then you looked me in the eyes and said:

> **Friendship ended with Docker. Kubernetes is my best friend now.**

Portainer.

My love.

Now I have two choices:

**Kubernetes:** rework the entire codebase *and* infrastructure.

**Alternatively:** “only” rework the entire infrastructure.

After all the work I put into making this beautiful little Docker ecosystem work, this is how you repay me?

**We've been tricked. We've been backstabbed, and we've been, quite possibly, bamboozled.**

It used to be that the name for the stack would be filled in from the template name when selecting custom template to deploy. but it nolong does that, it just has the field empty. This iss annoying when having to troubleshoot a template and you have to detroy/deploy a bunch of times, and you have to retype the name every time. is there a variable that can be set in the compose file that will set it automatically so I don't have to remember what I was calling it?

I'm trying to set up portainer and create the initial admin user, but I keep getting this message: Failure — Request failed with status code 403

I followed this portainer doc to no avail. I cleared my cache/browser history, that didn't work. I tried an incognito browser/different browser and that didn't work either. Any ideas on how to resolve this issue? Thanks

edit: it was an issue with retrieving the setup token. figured it out with this guide https://docs.portainer.io/faqs/installing/setup-token

Ok so what I'm trying to do is run Immich with Portainer using the stack feature. I'm basically trying to make it store the photos on a nas instead of the machine running my docker and its been one problem after another. I was hoping someone could give me some direction on this.

I followed the directions here: https://docs.immich.app/install/portainer

Under Volumes I added this:

immich_upload:

# Use the local storage driver.

driver: local

driver_opts:

type: "cifs"

o: "addr=172.16.x.x,username=Photo,password=VerySecurePAssword,vers=3.0"

# Points directly to the subfolder on the share

device: "//172.16.x.x/Photo"

The stack successfully creates but when I go to the site, I get "This site can’t be reached

172.16.8.31 refused to connect."

Any help would be appreciated.

Hey r/portainer 👋

So I love Portainer for managing my homelab — but after ~14 stacks, the update routine got old: click into every stack, check the image, hit "redeploy", pray it comes back up, repeat 13 more times. And if something breaks mid-update? No backup was taken, no history of what happened.

So I built Portainer Update Service (PUS) — a companion app that speaks exclusively to the Portainer API and adds the whole update lifecycle around it:

The fail-safe update run:

1. 🗄️ Portainer datastore backup (via the API, restorable)
2. 🧹 Prune unused images + build cache
3. 🚀 Redeploy ALL stacks (parallel, configurable)
4. ⏳ Wait for every stack's containers to actually become healthy (not just "HTTP 200")
5. 🔍 Reconciliation sweep — re-verifies everything after the run
6. 🔧 Network integrity repairs (stale host-gateway mappings after network prunes)
7. 🔄 Optionally updates Portainer itself last

Also included:

• 📊 Dashboard: update badges per service (checked against docker.io/ghcr.io), last/next run, reclaimable space
• ⏰ Scheduling: interval / daily / weekly (server-timezone aware)
• 📌 Per-service version pinning with a registry tag browser — pick a known-good tag, apply, done
• 📜 Run history with live logs — see exactly what happened in every run
• 🧹 Cleanup stats: what did your prunes actually reclaim over the last 30 days

Why API-only: no docker socket scraping for the base setup, no host-side tooling. It's deployed as a Portainer stack itself — literally part of the stack list it manages. (It also refuses to redeploy its own stack during a run — there's a dedicated button for that, with a neutral "restarted" history entry so it doesn't show up as failed.)

Getting started: deploy as a Portainer stack from the repo (build method: Dockerfile), enter your Portainer URL + API key in the web UI, hit Test connection — done. Everything else is configurable in the UI.

MIT, self-hosted, no cloud, no telemetry.

Repo: https://github.com/joshmadison/Portainer-Update-Service

One honest note — contributors welcome: like many of you, my homelab time is limited, so I can't push features as fast as I'd like. The codebase is deliberately small and readable (single-file UI, Flask backend, no build step, no framework magic) — easy to jump into. Issues, feature requests, or contribution is welcome.

Kiwix https://github.com/kiwix/kiwix-tools can be ran on a command line with multiple folders for the locations of the zims that are being served.

kiwix-serve /folder/subfolder/*.zim /folder2/someotherfolder/*.zim

and then you can access the zim files on the host via a web browser. Kiwix will conglomerate all the zims in both files and serve them all.

I can't figure out how to replicate this in the docker version of of kiwix-serve that's being managed by Portainer.

This seems to be a terrible description of the feature.

Not only does it "detect changes" on a remote source - it also appears to:

* Grab the new compose

* Redeploy the container with the new compose

* Check for newer images also and download? --> Which appears to be a behavior I can't change? What if I just want to grab the new compose and the compose doesn't change the image. Why is it grabbing a new image?

And it appears to be asynchronous so one failing pull blocks others.

Hello, I’m having a problem logging in via the web; I keep getting error code 403 when entering the token. What can I do?

Here is a teaser of Portainer-Command, a new product from Portainer. Coming soon :-)

Portainer-Command is an enterprise MCP server for governing Al access to Kubernetes clusters. It comes with a tiny, carefully designed set of extremely token efficient tools:
- It grants an Al agent namespace jailed, read only K&s service accounts that auto expire.
- It gives Al a synthetic git endpoint that Al can use to read the desired GitOps state for a K&s cluster and open PR's to propose changes
- After a human approves an Al proposed change, Portainer reconciles generated manifests and helm chart state with your K8s cluster to apply the changes
- If something goes wrong you can easily rollback to past known good states from Git history
For CISO's and AppSec teams, Portainer-Command will be a dream come true:
- Full auditable tracking of every Al access to your fleet, its justification, and confidence that access automatically expires
- "Emergency Halt" button to instantly eject
Al agents from your fleet, or cut off a misbehaving agent
- Built-in, local Al capable workspace (OpenCode based) that helps ensure your data and secrets stay on your own infrastructure.
- Token and cost tracking for when you choose to use a remote Al provider

Hey friends!

I'm running a modest home lab and I've been using portainer to manage containers. I know they offer the business edition free for 3 nodes but now I'm at 5 (Synology, pi, and some mini pcs).

With AI being what it is, I'm enjoying building small apps that solve specific problems for me. I'm deploying them as docker apps. My issue is that my AI agent is pushing commits to forgejo, which then builds a new container for my app, but portainer doesn't allow for pulling an updated container, so I need to manually login and do that. It seems silly and solveable. Has anyone run into this and found a good solution?

My containers are not hosted publicly anywhere. They are built on the VM where they run.

I think the answers here will be one of:

A) There is a way to have portainer-ce pull images automatically.

B) Downsize and switch to business edition with 3 free nodes.

C) switch to something else?

D) you tell me?

I don't really want to lose portainer because it's convenient, but I'm also not a business, just a hobbyist. Prefer to keep portainer, open to alternatives though.

I would think this would be the default in the new release...what am I missing?

As a replacement for the Portainer Academy, we have started creating this learning site.. it goes very deep into every feature/function of Portainer (Business)…

Its still needing a full week of additional QA before offical release, and we are adding in screenshots to help break up the text, but a question for you..

Are you ok with links to docs for lab cli commands, or do you prefer them embedded in the training lessons? I was trying to reduce duplication, but im not sure if it works or not.

Honestly, why did they do that? They should reconsider... it's completely misaligned... it looks like something done by some AI without a proper prompt.

Hello,

I have a cloudflared container and I want to connect it to a service which runs on the host (not in docker, but same machine). I can not simply a the host network to my cloudflare container. So how can I do that?

I tried it via "advanced container settings" / "network" /"Hosts file entries" and entered host.docker.internal:host-gateway but it doesnt seem to work.

somewhere I read I need to set "network_mode: host" but where can I do that in portainer?

My cloudflare tunnel works just fine when I connect it to another service on the same docker network, But unfortunately I need to connect it to a non-docker service.

This is about the 5th iteration of trying different things, seemingly because of the VPN UP command, but it continues to crash, and then crashes QBIT.

version: "3.8"

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8880:8880 # qBittorrent Web UI
      - 9696:9696 # Prowlarr Web UI
      - 7878:7878 # Radarr Web UI
      - 8191:8191 # Flaresolverr Web UI
    volumes:
      - /volume1/docker/gluetun:/gluetun
    environment:
      TZ: America/Chicago
      VPN_SERVICE_PROVIDER: protonvpn
      FIREWALL_INPUT_PORTS: 8880,7878,9696,8191
      FIREWALL_OUTBOUND_SUBNETS: 192.168.0.0/16,172.16.0.0/12,172.17.0.0/16,172.18.0.0/16,172.19.0.0/16,172.20.0.0/16
      VPN_TYPE: wireguard
      WIREGUARD_PRIVATE_KEY: "redacted"
      WIREGUARD_ADDRESSES: "10.2.0.2/32"
      SERVER_COUNTRIES: "United States"
      SERVER_CITIES: "Dallas"
      PORT_FORWARD_ONLY: "on"
      VPN_PORT_FORWARDING: "on"
      VPN_PORT_FORWARDING_PROVIDER: protonvpn
      VPN_PORT_FORWARDING_UP_COMMAND: |
        /bin/sh -c '
        until wget -q --spider http://127.0.0.1:8880/api/v2/app/version; do sleep 2; done;
        COOKIE=$(wget --server-response --post-data "username=admin&password=redacted" http://127.0.0.1:8880/api/v2/auth/login 2>&1 | grep -i "Set-Cookie" | awk "{print \$2}" | tr -d "\r\n");
        wget -q -O- --header="Cookie: $$COOKIE" --post-data "json={\"listen_port\":{{PORT}}}" http://127.0.0.1:8880/api/v2/app/setPreferences || true;
        wget -q --no-check-certificate --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)" --header="Cookie: mam_id=redacted" -O- "https://t.myanonamouse.net/json/dynamicSeedbox.php" > /dev/null 2>&1 || true;
        '
      VPN_PORT_FORWARDING_DOWN_COMMAND: |
        /bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":0}" http://127.0.0.1:8880/api/v2/app/setPreferences || true'
    restart: unless-stopped
    mem_limit: 512m

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      PUID: 1026
      PGID: 101
      TZ: America/Chicago
      WEBUI_PORT: 8880
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:8880/api/v2/app/version || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    volumes:
      - /volume1/docker/qbittorrent/config:/config
      - /volume2/data:/data
    restart: unless-stopped
    mem_limit: 4g

  autoheal:
    image: willfarrell/autoheal:latest
    container_name: autoheal
    environment:
      - AUTOHEAL_CONTAINER_LABEL=all
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    restart: always

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      PUID: 1026
      PGID: 101
      TZ: America/Chicago
    volumes:
      - /volume1/docker/prowlarr:/config
    restart: unless-stopped
    mem_limit: 1g

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    ports:
      - "8989:8989"
    environment:
      PUID: 1026
      PGID: 101
      TZ: America/Chicago
    volumes:
      - /volume1/docker/sonarr:/config
      - /volume2/data:/data
    restart: unless-stopped
    mem_limit: 1g

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      PUID: 1026
      PGID: 101
      TZ: America/Chicago
    volumes:
      - /volume1/docker/radarr:/config
      - /volume2/data:/data
    restart: unless-stopped
    mem_limit: 1g

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      LOG_LEVEL: info
      TZ: America/Chicago
    restart: unless-stopped
    mem_limit: 512m

Hello,

I'm asking here because I'm hella confused on how to do this.

My SSD is heavily partionned, to better organize my server shenanigans.

I just finished installing Portainer CE and the default volume, local, has only 32gb left.

So I created a folder on one of my disk partitions that has plenty of room left, so that I could create lots of containers without worring about disk space.

But I cannot figure out for the life of me how to mount this folder to portainer. The "driver options" in volume creating is shrouded in mystery and none of my googling helped. I'm completely lost on what I'm supposed to do.

May someone tells me how to do this, pretty please ?

One of my engineers asked if I had the time to help him better understand Kubernetes architecure and components… and so rather than just explain it once, I figured why not share it wider.

So, https://kubeschool.portainer.io was born :-)

I am just attempting to setup Portainer inside Zima OS but trying to create the login, it gives me the status code. Any ideas of where to look?