[{"data":1,"prerenderedAt":245},["ShallowReactive",2],{"seo-verification":3,"blog-portainer-vs-dokploy-which-docker-management-interface-ma-en":6,"promo-bar-likely":244},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-portainer-vs-dokploy-which-docker-management-interface-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":32,"intro":35,"sections":36,"ctaTitle":176,"ctaBody":177,"ctaButton":178,"ctaUrl":179,"relatedPosts":180},104,"portainer-vs-dokploy-which-docker-management-interface",{"fr":12,"en":10,"ar":13,"es":14},"portainer-vs-dokploy","portainer-مقابل-dokploy-أي-واجهة-لإدارة-docker","portainer-vs-dokploy-interfaz-de-gestion-docker","Portainer vs Dokploy: which to deploy in 2026?","Full comparison of Portainer 2.x vs Dokploy on VPS: critical CVEs, end of CE with Portainer 3, step-by-step migration and decision criteria.",12,1,false,"2026-03-08T00:00:00+00:00","2026-11-08T01:13:15+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},5,"Comparison","comparatif","bg-info\u002F10 text-info",[28],{"id":23,"name":24,"slug":25,"color":26,"icon":25},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fportainer-vs-dokploy-poster.svg",{"categorySlug":33,"appSlug":34},"application-deployment-devops","dokploy","Portainer and Dokploy are two web interfaces for managing Docker containers on a VPS. Portainer is the established tool — stable, well-documented, but shaken in 2026 by the end of the Community Edition and by CVEs scoring 9.4. Dokploy is the open-source challenger, PaaS-ready, addressing exactly what Portainer CE no longer covers. This guide helps you decide: architecture, licenses, security, migration.",[37,41,51,54,57,60,63,71,90,94,149,152,170,173],{"type":38,"title":39,"body":40},"h2","Why self-host a deployment interface on a VPS","A bare VPS with Docker leaves you with one interface: the command line. That works for one machine, gets tedious for five, and becomes unmanageable for a team. A web interface centralises logs, image updates, environment variables and TLS certificates — without forcing you to maintain a full CI\u002FCD pipeline from day one.\n\nTwo families compete: **managers** (Portainer, Yacht) that expose Docker as-is, and **lightweight PaaS** (Dokploy, Coolify, CapRover) that add a deployment layer — Git branches, automatic domains, Let's Encrypt certificates. The difference is not cosmetic: it determines whether your developers can deploy on their own or need SSH access.",{"type":42,"title":43,"items":44},"ul","What you gain by deploying this template on your VPS",[45,46,47,48,49,50],"Deploy from Git or Docker Hub in a few clicks, no SSH required","Automatic TLS certificate management via Let's Encrypt","Versioned environment variables, isolated per project","Centralised logs and web terminal from your browser","Health dashboard: CPU, RAM, container status","Manage Docker volumes and networks without memorising commands",{"type":38,"title":52,"body":53},"Portainer in 2026: the end of the Community Edition","Portainer CE (Community Edition) was the reference tool for years. With Portainer 3, the vendor ended the Community Edition: **Portainer 3 has no CE edition, and CE 2.45 is the last Community release**. Portainer 3 ships as Business Edition (free for up to three nodes with the \"3 Nodes Free\" licence), puts Kubernetes first for new features and keeps Docker, Swarm and Podman. CE 2.45 instances keep running and receive the 2.45 LTS fixes until August 2027, but no new features.\n\nThis shift has several practical consequences. New installations looking for a free Docker interface have no CE roadmap. The `portainer\u002Fportainer-ce` images still exist and receive fixes from the 2.45 branch, but will not evolve further. And critically — **Portainer 2.x has accumulated critical flaws, including two CVEs scoring 9.4**, which remain exploitable on any unpatched installation.\n\nIf you are still running Portainer 2.x, the question is not whether to migrate on principle: it is **whether your instance is up to date and whether the risk is acceptable**.",{"type":38,"title":55,"body":56},"Critical Portainer 2.x CVEs: check and patch","Two CVEs affect every Portainer branch up to the fixed versions below (versions before 2.33.0 are end-of-life and will not be fixed):\n\n**CVE-2026-44848 (CVSS 9.4)** — The `\u002Fplugins\u002F*` endpoints of the Docker API proxied by Portainer bypass authorization checks. A standard (non-admin) user with access to a Docker environment can install and enable a Docker plugin, which runs as root on your host.\n\n**CVE-2026-44849 (CVSS 9.4)** — The Swarm restrictions mechanism can be bypassed: a Portainer user with reduced rights can perform actions normally reserved for administrators on a Swarm cluster.\n\nFixed versions: **2.33.8**, **2.39.2**, **2.41.0**. Further critical flaws have been published since, fixed in 2.45.2 and 2.45.3 and with no fix on the 2.39 branch: target **2.45.3** LTS, the latest release as of 7 November 2026.\n\nTo check your version:\n```bash\ndocker exec portainer \u002Fportainer --version\n```\n\nTo update:\n```bash\ndocker pull portainer\u002Fportainer-ce:lts\ndocker stop portainer\ndocker rm portainer\ndocker run -d \\\n  --name=portainer \\\n  --restart=always \\\n  -p 127.0.0.1:9443:9443 \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock \\\n  -v portainer_data:\u002Fdata \\\n  portainer\u002Fportainer-ce:lts\n```\n\nIf you are below 2.45.3, **update before continuing to use the instance**. This command publishes the interface on 127.0.0.1 only: reach it through an SSH tunnel (`ssh -L 9443:127.0.0.1:9443 user@your-vps`, then `https:\u002F\u002Flocalhost:9443`) or a reverse proxy. Add `-p 8000:8000` only if you use Edge agents. Portainer exposed on the internet without patches is a direct intrusion vector into your Docker host.",{"type":38,"title":58,"body":59},"Dokploy CVE: the hardcoded secret (\u003C 0.29.3)","Dokploy is not without vulnerabilities. **CVE-2026-45631 (CVSS 10.0)** affected default installations prior to 0.29.3: when the `BETTER_AUTH_SECRET` variable was not set — and the install script did not set it — the code fell back to a hardcoded value, identical on every instance. Anyone could forge a token and take over the administrator account, without authentication.\n\nThe fix landed in **0.29.3**, together with a migration script to run after updating. Many other critical flaws (command injections, missing access controls) were fixed up to **0.29.13**: do not stay below it, and target the latest release (**0.31.0** as of 7 November 2026). To check and update:\n\n```bash\n# Check the installed version (service image tag)\ndocker service inspect dokploy --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}'\n\n# Update via the official script\ncurl -sSL https:\u002F\u002Fdokploy.com\u002Finstall.sh | sh -s update\n```\n\nSince 0.29.3, Dokploy reads `BETTER_AUTH_SECRET` from a Docker secret (`BETTER_AUTH_SECRET_FILE` variable). After updating, check that the service uses it:\n\n```bash\ndocker service inspect dokploy --format '{{range .Spec.TaskTemplate.ContainerSpec.Env}}{{println .}}{{end}}' | grep BETTER_AUTH_SECRET_FILE\n```\n\nIf the line is missing, **run the official security script** published with 0.29.3: it generates a unique secret and updates the service.\n\n```bash\ncurl -sSL https:\u002F\u002Fdokploy.com\u002Fsecurity\u002F0.29.3.sh | bash\n```",{"type":38,"title":61,"body":62},"Prerequisites to host Portainer or Dokploy","Both tools run on Docker. Dokploy requires slightly more resources as it bundles a PostgreSQL database and a Traefik proxy alongside the main service.",{"type":42,"title":64,"items":65},"Minimum recommended resources",[66,67,68,69,70],"**Portainer 2.x**: the vendor publishes no hardware minimum; 2.45.3 is validated with Docker 28.5.1 and 29.8.1 — runs on a small VPS","**Dokploy**: at least 2 GB RAM and 30 GB disk according to the official documentation — PostgreSQL and Traefik run alongside the main service","A domain or subdomain pointing to your VPS (Dokploy needs it for automatic certificates)","Ports 80 and 443 open if you use Let's Encrypt via Traefik (Dokploy)","Root or sudo SSH access for initial installation",{"type":72,"title":73,"steps":74},"steps","Deploy Dokploy on a VPS (≥ 0.29.13)",[75,78,81,84,87],{"title":76,"body":77},"Install via the official script","The simplest and most up-to-date method:\n\n```bash\ncurl -sSL https:\u002F\u002Fdokploy.com\u002Finstall.sh | sh\n```\n\nThe script installs Docker if needed, initialises Docker Swarm, creates the `dokploy` and `dokploy-postgres` services plus the `dokploy-traefik` container (configuration in `\u002Fetc\u002Fdokploy\u002F`), generates a random `BETTER_AUTH_SECRET` stored in a Docker secret and starts everything.",{"title":79,"body":80},"Verify the BETTER_AUTH_SECRET","After installation, make sure the service reads its secret:\n\n```bash\ndocker service inspect dokploy --format '{{range .Spec.TaskTemplate.ContainerSpec.Env}}{{println .}}{{end}}' | grep BETTER_AUTH_SECRET_FILE\n```\n\nYou should see a `BETTER_AUTH_SECRET_FILE=\u002Frun\u002Fsecrets\u002F...` line: the value (64 hex characters generated by `openssl rand -hex 32`) stays in the Docker secret and never appears in clear text. If the line is missing (older installation), run the official security script:\n\n```bash\ncurl -sSL https:\u002F\u002Fdokploy.com\u002Fsecurity\u002F0.29.3.sh | bash\n```",{"title":82,"body":83},"Access the interface and create the admin account","Dokploy listens on port **3000** by default. Open `http:\u002F\u002F\u003Cyour-vps-ip>:3000` in your browser. The first visit prompts you to create the administrator account. **Do this immediately** — the interface is public until this account exists.",{"title":85,"body":86},"Configure your domain and enable HTTPS","In **Settings** → **Web Server** → **Server Domain**, enter your FQDN (`dokploy.yourdomain.com`). Traefik automatically retrieves a Let's Encrypt certificate via ACME HTTP-01. Your DNS must point to the VPS before this step. Once the interface is served over HTTPS, close port 3000 to the internet, as Dokploy's hardening guide recommends: `ufw` alone does not filter Docker-published ports, so use `ufw-docker` or your provider's firewall.",{"title":88,"body":89},"Update Dokploy","Dokploy exposes an update button in **Settings** → **Web Server**, or use the script:\n\n```bash\ncurl -sSL https:\u002F\u002Fdokploy.com\u002Finstall.sh | sh -s update\n```\n\nWith the `update` argument, the script pulls the latest release image and updates the `dokploy` service without overwriting your configuration or projects. Without it, the script runs a full installation, which fails on a server where Dokploy is already installed (ports 80, 443 and 3000 in use).",{"type":91,"title":92,"body":93},"tip","Portainer as an alternative — quick installation","If you prefer to stay on Portainer (existing instance or deliberate choice), the reference command:\n\n```bash\ndocker run -d \\\n  --name=portainer \\\n  --restart=always \\\n  -p 127.0.0.1:9443:9443 \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock \\\n  -v portainer_data:\u002Fdata \\\n  portainer\u002Fportainer-ce:lts\n```\n\nAccess through an SSH tunnel (`ssh -L 9443:127.0.0.1:9443 user@your-vps`, then `https:\u002F\u002Flocalhost:9443`) or a reverse proxy. Replace `lts` with `2.45.3` to pin the version and avoid silent updates.",{"type":95,"title":96,"headers":97,"rows":101},"comparison","Portainer 2.x vs Dokploy — full comparison 2026",[98,99,100],"Criterion","Portainer 2.x","Dokploy",[102,106,110,114,118,122,126,130,133,137,141,145],[103,104,105],"Licence","CE free (zlib licence)","Apache 2.0 (except \u002Fproprietary folder)",[107,108,109],"CE future","CE stops at 2.45 (fixes until August 2027)","Active roadmap, growing community",[111,112,113],"Active CVEs","CVE-2026-44848 + 44849 (CVSS 9.4) and later advisories: target 2.45.3","CVE-2026-45631 (CVSS 10.0) if \u003C 0.29.3; target ≥ 0.29.13",[115,116,117],"Minimum RAM","Not published (lightweight tool)","2 GB (PostgreSQL + Traefik included)",[119,120,121],"Git deployment","Yes (Compose stacks from a Git repository)","Yes (GitHub, GitLab, Gitea, Bitbucket)",[123,124,125],"TLS certificates","Manual (external reverse proxy)","Automatic Let's Encrypt via Traefik",[127,128,129],"App templates","Yes (built-in library)","Yes (imported Docker Compose)",[131,132,132],"Private registry","Yes",[134,135,136],"Integrated CI\u002FCD","GitOps updates (polling or webhook)","Git webhooks + notifications",[138,139,140],"Kubernetes","Yes (CE and BE)","No (Docker Compose \u002F Swarm)",[142,143,144],"Multi-server","Yes (endpoints)","Yes (remote servers over SSH)",[146,147,148],"Interface","Mature, exhaustive","Modern, project-oriented",{"type":38,"title":150,"body":151},"When to stay on Portainer, when to move to Dokploy","**Staying on Portainer 2.x** makes sense in three situations: you already manage a Docker Swarm or Kubernetes cluster with complex configurations; you have teams that know the interface well with documented runbooks; or you need the level of detail on networks and volumes that Portainer exposes natively.\n\nIn these cases, the non-negotiable requirement is being **on an up-to-date version** (2.45.3 as of 7 November 2026) and restricting access to the interface: never expose port 9000\u002F9443 directly on the internet, place Portainer behind a reverse proxy with additional authentication if non-admin users access it.\n\n**Migrating to Dokploy** is the right decision if: you are starting fresh on a new VPS; you want developers to deploy from Git without SSH; you manage multiple domains and do not want to maintain Nginx\u002FTraefik manually; or you are looking for an alternative after the end of CE (Portainer 3 has no Community Edition) for your Docker use case.",{"type":72,"title":153,"steps":154},"Migration from Portainer to Dokploy: concrete steps",[155,158,161,164,167],{"title":156,"body":157},"Export your Portainer inventory","Before migrating, list your active stacks and containers:\n\n```bash\ndocker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'\ndocker volume ls\ndocker network ls --filter driver=bridge\n```\n\nFor each Portainer stack, retrieve the `docker-compose.yml` from the interface (Stacks → your stack → Editor) or from the filesystem.",{"title":159,"body":160},"Back up data volumes","Named volumes contain your application data. Back them up before any operation:\n\n```bash\ndocker run --rm \\\n  -v \u003Cvolume_name>:\u002Fdata \\\n  -v $(pwd):\u002Fbackup \\\n  alpine tar czf \u002Fbackup\u002F\u003Cvolume_name>.tar.gz \u002Fdata\n```\n\nRepeat for each critical volume.",{"title":162,"body":163},"Install Dokploy on the same VPS or a dedicated VPS","If migrating on the same host, stop Portainer first to free the ports:\n\n```bash\ndocker stop portainer && docker rm portainer\n```\n\nThen run the Dokploy installation (see procedure above). Dokploy uses Traefik on ports 80\u002F443 — verify no other service occupies them.",{"title":165,"body":166},"Recreate your projects in Dokploy","In Dokploy, create a **Compose Project** for each Portainer stack:\n1. Projects → New project\n2. Add a **Docker Compose** type service\n3. Paste your `docker-compose.yml` or point to your Git repository\n4. Configure environment variables in the **Environment** tab\n5. Assign a domain — Dokploy configures Traefik automatically",{"title":168,"body":169},"Verify and switch DNS","Deploy first on a test subdomain (`test.yourdomain.com`). Once validated, update your DNS entries to point to Dokploy. Traefik issues certificates automatically once DNS propagates.",{"type":38,"title":171,"body":172},"Troubleshooting: common errors","**Portainer — interface unreachable after update**\nVerify that the `portainer_data` volume is properly mounted. An update without a named volume starts from an empty base and prompts for admin account creation again.\n\n**Portainer — `TLS handshake error` on port 9443**\nPortainer generates a self-signed certificate. Your browser warns you correctly. Place Portainer behind a reverse proxy (nginx, Caddy) with a real certificate for secure production access.\n\n**Dokploy — Traefik not generating a certificate**\nMost common cause: DNS has not yet propagated to the VPS. Check with `dig +short your-domain.com`. Traefik waits for a valid DNS response before starting the ACME challenge. If DNS is correct, verify port 80 is open (`ufw allow 80`).\n\n**Dokploy — Git deployment failing silently**\nCheck the service logs in the interface (Deployments → Logs tab). On a private repository, a frequent cause is a missing SSH key, or one not authorised on the repository. Dokploy lets you create one in **Settings** → **SSH Keys** (**Create SSH Key** button), to add as a deploy key on the repository; for GitHub, GitLab, Gitea or Bitbucket, you can also connect the provider in Dokploy's **Git** settings.",{"type":91,"title":174,"body":175},"The two tools are not always mutually exclusive","Portainer can manage multiple remote Docker endpoints from a single interface — including a VPS where Dokploy is installed. Some teams keep Portainer as an observation tool and Dokploy as a deployment tool. This is not an antipattern if roles are clearly separated. The cost: two surfaces to patch. If you have chosen this architecture, make sure **both tools are up to date** — see the CVEs at the start of the article.\n\nTo go further: \u003Ca href=\"\u002Fen\u002Fblog\u002Fportainer-3-drops-ce-three-open-source-alternatives\">alternatives to Portainer CE\u003C\u002Fa>, \u003Ca href=\"\u002Fen\u002Fblog\u002Fdeploy-your-applications-with-dokploy-on-a-vps\">complete Dokploy deployment guide\u003C\u002Fa> and \u003Ca href=\"\u002Fen\u002Fblog\u002Fdokploy-cve-2026-critical-update-0-29-13\">the critical Dokploy CVE 2026 update\u003C\u002Fa>.","Deploy Dokploy on your VPS in minutes","On a ServOrbit VPS with root access, Dokploy installs manually and sets up Docker, Traefik and TLS certificates. Install a version ≥ 0.29.13, patched and production-ready.","Deploy Dokploy","\u002Fvps-cloud",[181,204,222],{"id":182,"slug":183,"slugs":184,"title":188,"excerpt":189,"readTime":190,"views":191,"isPinned":19,"noindex":19,"publishedAt":192,"updatedAt":193,"category":194,"categories":199,"featuredImage":29,"bgImage":30,"posterImage":201,"relatedSolution":202},367,"portainer-3-drops-ce-three-open-source-alternatives",{"fr":185,"en":183,"ar":186,"es":187},"portainer-3-alternative-self-hosted-vps","بورتينر-30-يلغي-النسخة-المجانية-ثلاثة-بدايل-مفتوحة-المصدر","portainer-3-elimina-ce-tres-alternativas-open-source","Portainer 3.0 Drops CE: Three Open Source Alternatives","Portainer 3.0 ends the free Community Edition. Three open source alternatives — Dockge, Coolify, Komodo — you can deploy on your VPS today.",7,23,"2026-09-20T00:00:00+00:00","2026-11-04T16:30:27+00:00",{"id":195,"name":196,"slug":197,"color":198,"icon":197},3,"Deployment","deploiement","bg-success\u002F10 text-success",[200],{"id":195,"name":196,"slug":197,"color":198,"icon":197},"\u002Fblog\u002Fcovers\u002Fportainer-3-alternative-self-hosted-vps-poster.svg",{"categorySlug":33,"appSlug":203},"komodo",{"id":205,"slug":206,"slugs":207,"title":211,"excerpt":212,"readTime":213,"views":214,"isPinned":19,"noindex":19,"publishedAt":215,"updatedAt":216,"category":217,"categories":218,"featuredImage":29,"bgImage":30,"posterImage":220,"relatedSolution":221},42,"deploy-your-applications-with-dokploy-on-a-vps",{"fr":208,"en":206,"ar":209,"es":210},"deployer-avec-dokploy","نشر-تطبيقاتك-باستخدام-dokploy-على-vps","desplegar-aplicaciones-con-dokploy-en-un-vps","Deploy Your Applications with Dokploy on a VPS","Deploy your applications with Dokploy on a VPS: an open source PaaS with built-in Traefik, Docker Compose, databases, and Git deployments.",9,2,"2026-05-09T00:00:00+00:00","2026-09-21T15:22:03+00:00",{"id":195,"name":196,"slug":197,"color":198,"icon":197},[219],{"id":195,"name":196,"slug":197,"color":198,"icon":197},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-dokploy-poster.svg",{"categorySlug":33,"appSlug":34},{"id":223,"slug":224,"slugs":225,"title":229,"excerpt":230,"readTime":231,"views":18,"isPinned":19,"noindex":19,"publishedAt":232,"updatedAt":233,"category":234,"categories":240,"featuredImage":29,"bgImage":30,"posterImage":242,"relatedSolution":243},379,"dokploy-cve-2026-critical-update-0-29-13",{"fr":226,"en":224,"ar":227,"es":228},"dokploy-cves-2026-mise-a-jour-critique","dokploy-cve-2026-تحديث-عاجل-إلى-0-29-13","dokploy-cve-2026-actualizacion-critica-a-0-29-13","Dokploy CVE-2026: Critical Update to 0.29.13","Two CVSS 10.0 and 9.9 CVEs in Dokploy chain together: forgeable admin JWT without an account + root shell via WebSocket. Patch guide to ≥ 0.29.13.",11,"2026-09-25T00:00:00+00:00","2026-10-21T15:21:30+00:00",{"id":235,"name":236,"slug":237,"color":238,"icon":239},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[241],{"id":235,"name":236,"slug":237,"color":238,"icon":239},"\u002Fblog\u002Fcovers\u002Fdokploy-cves-2026-mise-a-jour-critique-poster.svg",{"categorySlug":33,"appSlug":34},true,1794270470287]