Skip to content
Docker and Docker Compose with Portainer product logo
  • AWSAvailable on Amazon Web Services
  • Azure· nextMicrosoft Azure is next on the roadmap
  • GCP· nextGoogle Cloud is next on the roadmap
Available

Docker and Docker Compose with Portainer

Docker Engine 29.8 with Compose v5, Buildx and containerd, Portainer CE as a web console, nginx and Webmin - a container host usable from the command line and the browser the moment it boots. Container logs are rotated, Docker's network pool is kept clear of the default-VPC CIDR, and two Compose examples ship ready to run.

Version
v29.8.0
Operating system
Ubuntu 24.04 LTS
Architecture
x86_64
Support
Community

What's installed

Every package and version on the image. Nothing else is installed.

  • Docker Engine 29.8.0
  • Docker Compose v5.5.1
  • Buildx v0.37.1
  • containerd v2.3.5
  • Portainer CE 2.45.0
  • nginx 1.24.0
  • Webmin 2.660

Licensing — Docker Engine (Apache-2.0), Portainer CE (Zlib), no licence key required

Deploy anywhere

Docker and Docker Compose with Portainer on AWS.

Microsoft Azure and Google Cloud are next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS

    Amazon Web Services

    AMI · v29.8.0

    Available

    AWS AMI ID

    ami-0cc9a27dfa983c231
    Released
    September 15, 2026
    Root volume
    gp3 · 20 GiB

    Instance types

    • t3a.medium
    • t3.medium
    • t3a.large
    • m6a.large

    Regions

    • us-east-1
    AWS launch steps

Getting started

From launch to signed in, step by step.

  1. Launch in us-east-1 with TCP 22, 80, 8000 and 9000 open; wait five to ten minutes.

  2. Open http://<instance-public-ip>/ for links to both consoles. Portainer: port 9000. Webmin: port 8000. Both use username admin and your EC2 Instance ID as the password (for example i-0123456789abcdef0).

  3. SSH as ubuntu with your key pair. Docker works without sudo: docker run -d --name web -p 8080:80 nginx:alpine. Publish the port in your security group too.

  4. Compose examples: cd ~/examples/nginx-hello && docker compose up -d. The wordpress-mysql/ example carries a placeholder database password to change first.

  5. Change passwords with sudo bash /home/ubuntu/iscripts/pass_portainer.sh (12+ characters, Portainer's own rule) or pass_webmin.sh. Log rotation and the address pool are in /etc/docker/daemon.json.

Security posture

What this image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image: every component comes from its own official repository or release, nothing is copied from any third-party image, and the finished image was scanned for third-party vendor strings before capture.

  • No usable credential ships in the image; passwords are set on your instance at first boot from EC2 instance metadata (IMDSv2) and the scripts that set them delete themselves afterwards.

  • SSH is key-only, root login over SSH is refused, and build-time SSH keys, shell history and logs were removed before imaging.

  • Portainer keeps its users and its JWT signing secret in the same database, so first boot destroys and recreates the Portainer container and volume rather than merely changing the password - otherwise every instance from this image would share a signing secret.

  • The image it recreates from is already on disk, so first boot needs no network access. pass_portainer.sh requires 12 characters, matching Portainer's own API policy, and preserves stacks, registries and settings; lost-password recovery steps are in the script header.

  • Only ports 22, 80, 8000 and 9000 are served; anything you publish yourself must also be allowed in the security group.

  • The example WordPress stack carries a placeholder database password to change before real use.

  • The bundled password tools enforce at least 10 characters with upper- and lower-case letters, a number and a symbol, and verify the new credential with a real sign-in before reporting success.

  • The image is HTTP-only by design so it works at a bare IP with no certificate warnings: terminate TLS at a load balancer or add a certificate before exposing it publicly, and restrict port 22 and any admin ports to trusted IP ranges in your security group.