Step 1 – Sign In to Portainer

Portainer is the web interface for managing your containers. It is ready immediately – there is no setup wizard and no token to look up. Your server’s IP address is shown in the Server Information section on the Overview tab of your server in the client portal. The application settings you entered when ordering, passwords included, are shown in the Docker Credentials card on the same tab. Portainer is accessible by IP address, open your browser and go to:

https://your.server.ip:9443

HTTPS without a domain. Since January 2026 Let’s Encrypt issues certificates for IP addresses (official announcement), so your server gets a real, browser-trusted certificate on first boot – before you connect any domain. Certificates of this kind are short-lived, about six days.

Why renewal is not automatic here. Renewing requires port 80 for a few seconds, and on a Docker server that port is usually yours – your own containers use it. We do not take it from you. Renew when it suits you:

/opt/setup/renew-cert.sh

If you do not plan to use port 80 for your containers, turn automatic renewal on:

/opt/setup/enable-cert-renewal.sh

If you do nothing, the certificate simply expires and the panel falls back to a self-signed one: access is never lost, the browser just shows its usual warning again.

Sign in with:

From the dashboard you can manage containers, deploy stacks, inspect logs and monitor your Docker environment.

Step 2 – Connect via SSH

If you placed the server behind a VyOS router on a private network, the server has only a private address, so it does not get the IP certificate. Reach the server on the private address through a VPN on the router (WireGuard or OpenVPN, on the router’s Configuration tab), or forward port 22 for SSH, port 9443 for Portainer and the ports your containers expose to the server on the router’s Configuration tab (Port forwarding). Portainer then uses its own certificate, and the browser shows a warning – click “Advanced” and proceed.

Firewall. If you turn on the Firewall for this server in the client portal, allow incoming TCP port 80 in its rules, along with 9443 (Portainer) and the ports your containers expose. Renewing the IP certificate needs port 80 reachable from the internet, and without that rule renewal fails.

For command-line Docker management, connect to your server:

ssh root@your.server.ip

Verify Docker is running:

docker --version
docker compose version
docker run hello-world

If you see “Hello from Docker!” – everything works.

Step 3 – Running Containers

Start a container from any image on Docker Hub:

# Run an Nginx web server on port 80
docker run -d --name webserver -p 80:80 nginx

# View running containers
docker ps

# Stop and remove the container
docker stop webserver
docker rm webserver

Step 4 – Docker Compose

Compose lets you define multi-container apps in a YAML file. Example – Nginx plus MySQL:

mkdir ~/myapp && cd ~/myapp

cat > docker-compose.yml <<'EOF'
services:
  web:
    image: nginx:alpine
    ports:
      - "80:80"
    volumes:
      - ./html:/usr/share/nginx/html
    depends_on:
      - db

  db:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: changeme
      MYSQL_DATABASE: myapp
    volumes:
      - db_data:/var/lib/mysql

volumes:
  db_data:
EOF

docker compose up -d

Useful Compose commands:

# View logs
docker compose logs -f

# Stop services
docker compose down

# Stop and remove volumes (deletes data!)
docker compose down -v

Disk Space

Docker images can use up disk space quickly. Keep an eye on it:

# Check overall disk usage
df -h /

# Check Docker-specific disk usage
docker system df

# Clean up unused images, containers and networks
docker system prune -a

Updates

To update Docker, Portainer and system packages:

# Update system packages and Docker
apt update && apt upgrade -y

# Update Portainer to the latest version
docker pull portainer/portainer-ce:latest
/usr/local/sbin/portainer-start.sh le

The second command recreates the Portainer container from the new image and keeps your settings, users and environments (they live in the portainer_data volume). It also keeps the panel’s Let’s Encrypt certificate; if there is no valid certificate, Portainer starts with its self-signed one.

Firewall

SSH (port 22) and Portainer (port 9443) are open by default. When you publish container ports (like -p 80:80), they become accessible from the internet.

Check which ports your containers expose:

docker ps --format "table {{.Names}}\t{{.Ports}}"

Fail2Ban – Brute-Force Protection

Your server comes with Fail2Ban pre-configured to protect SSH from brute-force attacks.

Useful commands:

# Check banned IPs
fail2ban-client status sshd

# Unban an IP
fail2ban-client set sshd unbanip 1.2.3.4

If you accidentally lock yourself out, open the Console on your server’s Overview tab in the client portal and unban your IP.

Service Management

Docker runs as a systemd service. Common commands:

# Check service status
systemctl status docker

# Restart Docker
systemctl restart docker

# View Docker logs
journalctl -u docker -f

Server Credentials

The Portainer admin password is the one you chose when ordering the server; you can change it inside Portainer at any time. Docker itself has no separate credentials – access is controlled by the root user on the server.

Software Included

• Docker Documentation: docs.docker.com
• Portainer Documentation: docs.portainer.io