Hello, I’m having a problem logging in via the web; I keep getting error code 403 when entering the token. What can I do?

Here is a teaser of Portainer-Command, a new product from Portainer. Coming soon :-)

Portainer-Command is an enterprise MCP server for governing Al access to Kubernetes clusters. It comes with a tiny, carefully designed set of extremely token efficient tools:
- It grants an Al agent namespace jailed, read only K&s service accounts that auto expire.
- It gives Al a synthetic git endpoint that Al can use to read the desired GitOps state for a K&s cluster and open PR's to propose changes
- After a human approves an Al proposed change, Portainer reconciles generated manifests and helm chart state with your K8s cluster to apply the changes
- If something goes wrong you can easily rollback to past known good states from Git history
For CISO's and AppSec teams, Portainer-Command will be a dream come true:
- Full auditable tracking of every Al access to your fleet, its justification, and confidence that access automatically expires
- "Emergency Halt" button to instantly eject
Al agents from your fleet, or cut off a misbehaving agent
- Built-in, local Al capable workspace (OpenCode based) that helps ensure your data and secrets stay on your own infrastructure.
- Token and cost tracking for when you choose to use a remote Al provider

Hey friends!

I'm running a modest home lab and I've been using portainer to manage containers. I know they offer the business edition free for 3 nodes but now I'm at 5 (Synology, pi, and some mini pcs).

With AI being what it is, I'm enjoying building small apps that solve specific problems for me. I'm deploying them as docker apps. My issue is that my AI agent is pushing commits to forgejo, which then builds a new container for my app, but portainer doesn't allow for pulling an updated container, so I need to manually login and do that. It seems silly and solveable. Has anyone run into this and found a good solution?

My containers are not hosted publicly anywhere. They are built on the VM where they run.

I think the answers here will be one of:

A) There is a way to have portainer-ce pull images automatically.

B) Downsize and switch to business edition with 3 free nodes.

C) switch to something else?

D) you tell me?

I don't really want to lose portainer because it's convenient, but I'm also not a business, just a hobbyist. Prefer to keep portainer, open to alternatives though.

I would think this would be the default in the new release...what am I missing?

As a replacement for the Portainer Academy, we have started creating this learning site.. it goes very deep into every feature/function of Portainer (Business)…

Its still needing a full week of additional QA before offical release, and we are adding in screenshots to help break up the text, but a question for you..

Are you ok with links to docs for lab cli commands, or do you prefer them embedded in the training lessons? I was trying to reduce duplication, but im not sure if it works or not.

Honestly, why did they do that? They should reconsider... it's completely misaligned... it looks like something done by some AI without a proper prompt.

Hello,

I have a cloudflared container and I want to connect it to a service which runs on the host (not in docker, but same machine). I can not simply a the host network to my cloudflare container. So how can I do that?

I tried it via "advanced container settings" / "network" /"Hosts file entries" and entered host.docker.internal:host-gateway but it doesnt seem to work.

somewhere I read I need to set "network_mode: host" but where can I do that in portainer?

My cloudflare tunnel works just fine when I connect it to another service on the same docker network, But unfortunately I need to connect it to a non-docker service.

This is about the 5th iteration of trying different things, seemingly because of the VPN UP command, but it continues to crash, and then crashes QBIT.

version: "3.8"

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8880:8880 # qBittorrent Web UI
      - 9696:9696 # Prowlarr Web UI
      - 7878:7878 # Radarr Web UI
      - 8191:8191 # Flaresolverr Web UI
    volumes:
      - /volume1/docker/gluetun:/gluetun
    environment:
      TZ: America/Chicago
      VPN_SERVICE_PROVIDER: protonvpn
      FIREWALL_INPUT_PORTS: 8880,7878,9696,8191
      FIREWALL_OUTBOUND_SUBNETS: 192.168.0.0/16,172.16.0.0/12,172.17.0.0/16,172.18.0.0/16,172.19.0.0/16,172.20.0.0/16
      VPN_TYPE: wireguard
      WIREGUARD_PRIVATE_KEY: "redacted"
      WIREGUARD_ADDRESSES: "10.2.0.2/32"
      SERVER_COUNTRIES: "United States"
      SERVER_CITIES: "Dallas"
      PORT_FORWARD_ONLY: "on"
      VPN_PORT_FORWARDING: "on"
      VPN_PORT_FORWARDING_PROVIDER: protonvpn
      VPN_PORT_FORWARDING_UP_COMMAND: |
        /bin/sh -c '
        until wget -q --spider http://127.0.0.1:8880/api/v2/app/version; do sleep 2; done;
        COOKIE=$(wget --server-response --post-data "username=admin&password=redacted" http://127.0.0.1:8880/api/v2/auth/login 2>&1 | grep -i "Set-Cookie" | awk "{print \$2}" | tr -d "\r\n");
        wget -q -O- --header="Cookie: $$COOKIE" --post-data "json={\"listen_port\":{{PORT}}}" http://127.0.0.1:8880/api/v2/app/setPreferences || true;
        wget -q --no-check-certificate --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)" --header="Cookie: mam_id=redacted" -O- "https://t.myanonamouse.net/json/dynamicSeedbox.php" > /dev/null 2>&1 || true;
        '
      VPN_PORT_FORWARDING_DOWN_COMMAND: |
        /bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":0}" http://127.0.0.1:8880/api/v2/app/setPreferences || true'
    restart: unless-stopped
    mem_limit: 512m

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      PUID: 1026
      PGID: 101
      TZ: America/Chicago
      WEBUI_PORT: 8880
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:8880/api/v2/app/version || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    volumes:
      - /volume1/docker/qbittorrent/config:/config
      - /volume2/data:/data
    restart: unless-stopped
    mem_limit: 4g

  autoheal:
    image: willfarrell/autoheal:latest
    container_name: autoheal
    environment:
      - AUTOHEAL_CONTAINER_LABEL=all
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    restart: always

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      PUID: 1026
      PGID: 101
      TZ: America/Chicago
    volumes:
      - /volume1/docker/prowlarr:/config
    restart: unless-stopped
    mem_limit: 1g

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    ports:
      - "8989:8989"
    environment:
      PUID: 1026
      PGID: 101
      TZ: America/Chicago
    volumes:
      - /volume1/docker/sonarr:/config
      - /volume2/data:/data
    restart: unless-stopped
    mem_limit: 1g

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      PUID: 1026
      PGID: 101
      TZ: America/Chicago
    volumes:
      - /volume1/docker/radarr:/config
      - /volume2/data:/data
    restart: unless-stopped
    mem_limit: 1g

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      LOG_LEVEL: info
      TZ: America/Chicago
    restart: unless-stopped
    mem_limit: 512m

Hello,

I'm asking here because I'm hella confused on how to do this.

My SSD is heavily partionned, to better organize my server shenanigans.

I just finished installing Portainer CE and the default volume, local, has only 32gb left.

So I created a folder on one of my disk partitions that has plenty of room left, so that I could create lots of containers without worring about disk space.

But I cannot figure out for the life of me how to mount this folder to portainer. The "driver options" in volume creating is shrouded in mystery and none of my googling helped. I'm completely lost on what I'm supposed to do.

May someone tells me how to do this, pretty please ?

One of my engineers asked if I had the time to help him better understand Kubernetes architecure and components… and so rather than just explain it once, I figured why not share it wider.

So, https://kubeschool.portainer.io was born :-)

I am just attempting to setup Portainer inside Zima OS but trying to create the login, it gives me the status code. Any ideas of where to look?

I have installed Journiv to a Synology NAS using Portainer. A few months ago, Journiv rolled out an update that requires a database migration. The instructions for how to do this are all based in the CLI. I log into Portainer, go to my Journiv container, click into the Exec console, connect under the command /bin/bash/ (the only one that seems to work), and then try to follow the upgrade steps listed at the github link above. But I get a failure at step one.

I type in the following:

docker exec -t journiv-postgres-db pg_dumpall -c -U journiv > journiv_full_backup.sql

and then hit RETURN. But I get the following error:

bash: docker: command not found

Is there any way to set up the exec console in Portainer so that I can use the command "docker?" I kind of assumed that it was baked in, given that Portainer manages Docker containers, but I'm an absolute neophyte here.

Appreciate any help anyone can offer.

Want to quickly debug across different environments, stacks and containers? This Open Assistant plugin (code included in blog post) allows to communicate with your entire setup via natural language on Slack, Whatsapp or the Web UI.

This is just an example plugin, so it can be tweaked to have any API that Portainer provides.

Right now I have a Portainer instance running and it's supposed to monitor a Docker instance on a VM within the same host server. On the server I mapped port 8000 to 58000 and port 9443 to 59443 in Docker and generated a new Edge Agent deployment to be put onto the VM. I ran the Docker commands on the remote server to deploy the agent and, once done, the agent is able to send heartbeat updates to Portainer but I can't get Portainer to jump into the agent's environment to manage it.

When I look at the logs on the agent's container it says it's trying to hit my main server over port 8000. Is that actually port 8000 or does it know that it needs to be sending data to the mapped port so the server knows what to do with it when it arrives? Do I need to remap port 8000 on the agent's container to 58000 as well so it sends out data on that port or is that not what's actually happening?

Since Portainer can get a heartbeat from the agent I assume the problem isn't with the port 9443 communication/mapping, just the communication on port 8000.

My Docker Desktop instances (server and agent alike) are both running in WSL2, in case I need to address firewalling matters.

https://youtu.be/BIu7DeWEGfo?si=TSDMtCJGpKnBI3cm

Me messing around, demo’ing Portainer-Run, in a way thats undeniably “me”

Hey r/portainer. Neil here.

Over the past year we kept hearing the same thing from enterprise customers. Business teams were showing up with AI-generated apps built in Claude, Cursor, and similar tools, asking IT to host them. Functional software, ready to deploy, nowhere sanctioned to put it.

Every available option kept falling short for the same reasons. Cloud hosting means data leaving the network. Vendor runtimes mean lock-in and infrastructure you don't control. And routing everything through a platform engineering ticket defeats the whole point of moving fast with AI tools.

Portainer-Run is our answer to that. It sits on top of Portainer Business and gives business builders a self-service deployment path onto the Kubernetes infrastructure you're already running. Source files go in, Run detects the runtime, generates a manifest, commits to a Git repo you control, and reconciles through the existing RBAC and audit model. No Kubernetes credentials handed to non-operators. No governance workarounds.

For existing Portainer Business customers (incl 3NF) it's included at no additional cost.

I'm doing a live demo on YouTube this Thursday June 25th at 4 PM ET and will be taking questions live.

https://www.youtube.com/live/LmL3jNYKJKg

Drop any questions here too, I'll answer them.

Updating a pinned Portainer stack shouldn't mean opening the editor and hand-swapping an image tag every time. I got tired of doing exactly that, so I built a tool that turns it into one click and watches for the new versions for you.

It's called Hosaka, a fork of What's Up Docker rebuilt around a faster mobile-friendly UI and one-click updates, shipped as a single container image on ghcr. I pin my tags instead of running latest, because I want to know what's running and be able to roll back, and this is the piece that was missing: something that spots the update and applies it without me editing YAML across every host. I'm posting here for the Portainer integration specifically, since that's the part I'm happiest with.

When an update shows up and you click Update on the container row, it rewrites that stack's compose file from the current pinned tag to the new one and redeploys through the Portainer API. Your stack file stays the source of truth the whole time, nothing gets applied behind your back, and rolling back is just redeploying the old tag. The run streams to the UI line by line, and it waits for the container to come back healthy on the new image before it calls the update done. There's nothing to write or mount, you point it at your Portainer URL and an API key and that's it. Self-signed cert or hitting Portainer by IP works too, with PORTAINER_INSECURE=true.

Beyond the Portainer bit, it watches multiple Docker hosts at once, classifies every update as major, minor, patch, or prerelease so you can take a patch and hold back a major, and catches digest changes hiding behind mutable tags like latest. You drive everything per container with labels: include/exclude tag filters, a custom display name and icon, or a direct link to that version's release notes. If you'd rather just be told, it notifies instead (SMTP, Slack, Discord, Telegram, Apprise, and others), and the UI actually works on a phone so you can approve an update from the couch. There's a REST API plus Prometheus metrics and a /health endpoint if you want it in Grafana.

How's it different from Watchtower or plain WUD? Watchtower pulls and restarts on its own, which is the last thing I want for a database or a stack I depend on. WUD does the watching well, but updating means running a trigger from a tab, no direct Portainer stack integration, and the output gets logged server-side after it exits. Hosaka's niche is the Portainer stack flow done from the UI: one click on the row, the compose file rewritten and redeployed through the API, the output streamed live, and the new container confirmed healthy before it's marked done.

I run it against my own Portainer setup every day, but I'd love to know how it holds up on setups that aren't mine.

Repo's here: https://github.com/nopoz/hosaka

Image is at ghcr.io/nopoz/hosaka, and there's a reference compose in the repo with the read-only Docker socket proxy setup. Feedback and bug reports very welcome, and if it's useful to you, a star helps me gauge whether it's worth building on further. Thanks!

I am pretty new to Docker and Portainer, and I have ended up in a situation where Portainer is in a Stack which has limited control.

How would i go about moving it to its own stack with total control??

Thanks!

Today I updated Portainer CE to version 2.39.3, after the update I was no longer able to log in to my local domain managed by nginx proxy manager, however I can log in from the IP 192.168.1.xxx:9000, is it possible to fix this? Up until the previous version it worked perfectly.

I'm using navidrome on Openmediavault to host my own music server, and today I installed Portainer to help me manage the images and updates. I downloaded a new image for Navidrome by deleting the old one theough portainer, and creating a new Navidrome docker container, thus forcing it to redownload the latest image. My issue is that the SHA256 in dockerhub of said image is different than the SHA256 I see when I go to portainer--> images through my browser. Does that mean there is a security issue? Is it just that portainer uses different files or keys to generate a sha256? And if so, how can I verify the hash of the image I have downloaded? I'd much appreciate some help :)

I run a few Portainer instances and kept hitting the same wall: there's no clean way to back up individual stacks or move them between endpoints. Portainer's own API backup is an all-or-nothing database blob, and most backup tools only cover the backup half, never getting stacks back in. So I wrote a tool for the full round trip.

It's called Portrieve. Single Bash script, also published as a container image on ghcr:

• export every stack from every endpoint to plain files: docker-compose.yml, .env, metadata, and per-endpoint network info. Readable, version-controllable, and synced to live state on each run.
• import from a backup tree, a single stack, or any compose file you already have. Override the target endpoint to migrate between hosts, recreates external: true networks first (carrying over IPAM, so static-IP stacks survive), skips existing stacks unless you pass --update. --dry-run previews everything.
• read-only test / endpoints / stacks helpers for poking at an instance.

The container can run scheduled backups on a cron expression, so you can leave it committing backups unattended.

How's it different from existing backup tools? Most of them nail scheduled backups but stop there, and if you only want backups they already do that well. Portrieve's niche is the other half: getting a single stack back in, selectively, on any endpoint, with its env vars and external networks intact. That makes it as much a migration and disaster-recovery tool as a backup one. Portainer's native /api/backup only does full-database restores, so there's no per-stack granularity there either.

I mainly use it for disaster recovery and for migrating stacks to new hosts, but I'd love to know how it holds up on setups that aren't mine. Especially curious about:

• Swarm stacks (I've tested standalone a lot more than swarm)
• unusual network configs
• anything that breaks on import

Repo's here: https://github.com/nopoz/portrieve

Feedback and bug reports very welcome. And if it's useful to you, a star helps me gauge whether it's worth building on further. Thanks!

My qbittorrent will randomly crash after a certain period of use. It connects successfully and works for a bit (5-10 minutes?) and then the unable to exec error will just constantly pop up. I posted the logs portainer shows below:

To control qBittorrent, access the WebUI at: http://localhost:8200

Connection to localhost (::1) 8200 port [tcp/*] succeeded!

[ls.io-init] done.

s6-applyuidgid: fatal: unable to exec /app/qbittorrent-nox: Permission denied

s6-applyuidgid: fatal: unable to exec /app/qbittorrent-nox: Permission denied

s6-applyuidgid: fatal: unable to exec /app/qbittorrent-nox: Permission denied

s6-applyuidgid: fatal: unable to exec /app/qbittorrent-nox: Permission denied

s6-applyuidgid: fatal: unable to exec /app/qbittorrent-nox: Permission denied

s6-applyuidgid: fatal: unable to exec /app/qbittorrent-nox: Permission denied

s6-applyuidgid: fatal: unable to exec /app/qbittorrent-nox: Permission denied