Best Portainer Alternatives in 2026

Portainer is still the default answer when someone asks for a Docker management UI, and the search for Portainer alternatives keeps growing for one reason: every free path comes with strings. Community Edition is alive and free, but SSO, RBAC, audit logs, and registry management sit behind Business Edition. The free Business tiers (3 Nodes Free, the old 5 Nodes Free) bring annual renewal paperwork and commercial-use clauses. Paid starts at $155/yr, and that tier is non-commercial only.

I run Docker across VPS and homelab machines, and I use Arcane on my own servers for day-to-day management and deploys. For this update I re-tested the field: which tool matches how you work, what Portainer licensing actually costs a solo operator in 2026, and how to move your stacks off Portainer with a rollback plan.

Why people are leaving Portainer in 2026

Portainer CE is not dead. The repo shows 38,544 stars and an active push cadence (last push 2026-09-22), it ships under the Zlib license, and for a single-host homelab with no SSO needs it still works. That is not the problem.

The problem is where the feature line sits. RBAC, OIDC/SSO, registry management, audit logs, HA, and most edge features are Business Edition only (per docs.portainer.io and the CE-vs-BE post on portainer.io). Portainer’s own pitch is blunt: “Most people should install Business Edition. It is free for up to 3 nodes.” So the official funnel sends you to a licensed product, even at zero cost.

Portainer Business Edition pricing tiers as of September 2026

The licensing timeline is what pushed people to look for Portainer alternatives in the first place:

• 2024-07-10: the 5 Nodes Free (5NF) license changed at renewal. Home users kept it; business use was pushed to paid. The blog post from that date is still the reference.
• 3 Nodes Free (3NF): free forever up to 3 nodes, but you renew annually. Portainer emails a new key 14 days before expiry (per portainer.io/renew-3-nodes-free-license-key, fetched 2026-09-23).
• Home & Student: $155/yr, up to 15 nodes, strictly non-commercial. The pricing page says license keys will be revoked for any business use, any company size.
• Starter: from $1,045/yr ($105/mo), capped at 16 vCPUs per node, orgs under $50M revenue, community support.
• Scale: from $2,095/yr ($209/mo), 24 vCPUs per node, orgs under $100M revenue, 9x5 NBD support.

Community pain points line up with that. In r/selfhosted threads people call out the stagnant mobile UI, an API that falls behind what automation needs, and the missing volume/stack backups in CE. There is also a specific fear: leaving Portainer should not mean locking your stacks in yet another proprietary database.

The licensing math for solo operators and small teams

The honest annual comparison for 2026:

The dollars are only half of it. The real cost of the Portainer free paths is friction and revocation risk: a renewal you must remember, a node count you must not exceed (“we reserve the right to limit some or all of the product capability should the node count be exceeded” is the exact wording on the renewal page), and a home license that evaporates the moment you invoice anyone.

Rule of thumb I use: if you invoice anyone, Home & Student is not for you. If you need SSO today and do not want to pay, Portainer CE is not for you.

How this update was tested (September 2026)

Numbers in this article come from GitHub API pulls on 2026-09-23, release pages read the same day, and portainer.io pricing fetched 2026-09-23. Hands-on claims mean a real install on a throwaway €4-5/mo Hetzner CX-class VPS, not my production fleet. Twelve tools compared, seven covered in depth.

VPS prices jumped across the board in 2026 — if you’re rethinking a rented box, see what changed and when a mini PC wins.

The previous version of this article made two wrong claims about Arcane: that it had no vulnerability scanning and no auto-updates. Both are wrong as of September 2026.

Where I could not re-verify something before publish, I hedge inline instead of stating it as tested. That applies to a couple of vendor pricing tiers and to Portainer’s exact expiry behavior.

Best free Portainer alternatives at a glance

Decision-first. The table, then the tree, then the reviews.

Blank or “no built-in” cells mean exactly that. Stars are a community proxy, not a quality score. Last commit is the maintenance pulse; anything over about 90 days gets flagged in its section.

Decision tree for choosing a Portainer alternative in 2026

All picks are $0 to self-host. Dockhand is free under BSL 1.1 for personal and internal business use. A management UI adds no hosting cost when it runs on a VPS you already pay for; a dedicated small box is about €4-5/mo.

Arcane: the closest like-for-like Docker management UI

Arcane is my default recommendation when someone wants Portainer-shaped features without Portainer licensing, and it is what I run on my own servers. As of 2026-09-23: 7,537 stars, BSD-3-Clause (true OSS), Go backend with a SvelteKit frontend, current release v2.13.1 (2026-09-22). The repo lives at getarcaneapp/arcane now; old ofkm/arcane links redirect.

What you get on the free tier: container/stack/image/network/volume management, OIDC, passkeys and MFA, per-permission API gating, and remote hosts via arcane-agent binaries (linux/darwin across amd64/arm64/armv7/riscv64) with an edge tunnel and agent self-upgrade. Single container plus a volume, no database to babysit. The official image is ghcr.io/getarcaneapp/manager and the web UI listens on port 3552 by default.

For install, follow our Arcane Docker install guide (with socket proxy setup) instead of copy-pasting from here. That guide already uses the hardened pattern this article recommends: socket proxy in front of docker.sock, reverse proxy with auth in front of the UI.

One install detail that bites people adopting existing compose projects: the project folder path must match inside and outside the container. If your stacks live at /opt/docker on the host, mount /opt/docker:/opt/docker and set PROJECTS_DIRECTORY=/opt/docker. Mapping that path to something else breaks relative mounts.

What’s new in Arcane 2.x: scanning, patching, backups

The corrections, itemized with release dates from the Arcane releases page (fetched 2026-09-23):

• v2.9.0 (2026-08-25): automated S3 backups, standalone container editing, batched update notifications, CLI coverage for vulnerabilities/activities/webhooks.
• v2.10.0 (2026-08-31): scheduled volume backups, selective system restores, Copacetic (Copa) direct image patching for OS-level CVEs, “Convert to Compose” for running containers, Swarm read access, ML-DSA-87 signing for sessions/OIDC/edge mTLS.
• v2.11.0 (2026-09-12): durable job execution with offline recovery, Docker event streaming, tag-based container updates, label filtering. v2.11.1 added a toggle to disable scans per environment.
• v2.12.0 (2026-09-16): Trivy vulnerability scanning in the UI with CSV export, a “Fix available” filter, per-image CVE counts, Trivy config and ignore-file support. Also “Back up to Git” sync mode and IPv6 network visibility.

Cadence check: v2.8.1 to v2.13.1 landed in about five weeks (2026-08-19 to 2026-09-22). That is a healthy release pulse. Dockge below is the contrast.

Two of these features mutate running containers: bulk update and Copa patching. Same rule as any auto-updater. Point them at a canary stack first and snapshot the volume before the first scheduled run. If you want a dedicated updater with rollback as a complement or instead, see how Tugtainer handles Docker auto-updates vs Watchtower.

Dockhand: security-first alternative with scanning and rollbacks

Dockhand is the pick when the security workflow matters more than OSI licensing. As of 2026-09-23: 6,343 stars, TypeScript on Bun, v1.0.48 (2026-09-14), roughly weekly releases from v1.0.39 to v1.0.48.

The security story is concrete:

• safe-pull scans before it swaps: image updates run through Grype/Trivy first, with rollback if the new container fails.
• The maintainer flagged v1.0.45 (2026-08-27) as an “important security upgrade with a number of API hardenings”. A useful reminder that these UIs have CVEs too.
• Secret providers cover 1Password, HashiCorp Vault, Infisical, Doppler, Bitwarden Secrets, Proton Pass, KeePassXC, and Azure Key Vault.
• Auth covers MFA, LDAP, and OIDC/SSO.
• Stack backups are restic-based, with retention and bulk delete.
• A Compose Validate linter runs as preflight before you deploy.
• On the ops side: docker load for air-gapped hosts, notifications to MQTT/Zabbix/Pushover/Teams, OpenAPI docs at /api/docs (opt-in via FEAT_API_DOCS), the Hawser agent for remote hosts, and Podman compatibility fixes.

Image reference straight from the release notes:

docker pull fnsys/dockhand:v1.0.48   # or :latest, but pin in prod

For the full walkthrough (SQLite and PostgreSQL backends, OIDC/SSO, Hawser agents), use the Dockhand Docker install walkthrough.

Failure mode to know: safe-pull reduces auto-update risk but does not eliminate it. Snapshot volumes before the first scheduled run.

Dockhand vs Arcane: which should you install?

Direct answer, not a feature dump.

My default is Arcane. Pick Dockhand when scan-before-swap rollbacks, LDAP, or enterprise secret managers are the deciding features. If you are genuinely torn, run both on one box during evaluation on different ports. They can coexist.

Sencho: Compose control plane with fleet features

Sencho is the newest entry here, and for Compose shops it fills the same slot Portainer does: a single container (saelix/sencho, UI on port 1852) that manages Compose stacks on one machine or a fleet. As of 2026-09-23: 460 stars, AGPL-3.0, TypeScript, still pre-1.0 (latest release v0.97.1, 2026-08-09) with commits landing the same day I checked.

The pitch is compose-on-disk plus a real ops layer. Your files stay the source of truth on the host, and Sencho adds the things Dockge never had: atomic deployments with automatic rollback, a Monaco editor with diff preview and one-click rollback to any prior deploy, health-gated updates, drift detection against running containers, Git-sourced stacks, and a Compose Doctor preflight that catches problems before you deploy. There is even an app store that accepts any Portainer-compatible template registry, with LinuxServer.io templates by default.

The multi-node model differs from Komodo’s Periphery or Arcane’s agents: every node runs a full Sencho instance and the primary proxies authenticated HTTP/WebSocket to it. No SSH, no Docker socket exposed on the network. For a two or three box setup it is pleasantly simple.

Two caveats. Pre-1.0 means what it says: the repo ships a KNOWN_LIMITATIONS.md and tells you to validate against your own setup before trusting it with critical infrastructure. And the community is small, 460 stars against Arcane’s 7,500 and Dockge’s 24,000. There is a paid “Admiral” plan (hardened builds, managed off-site recovery vault, LDAP/AD, audit export, priority support), but the Community tier is the real product: unlimited nodes, unlimited users, everything above included.

Install note: the same 1:1 path rule as Arcane applies. If stacks live at /opt/docker, mount /opt/docker:/opt/docker and set COMPOSE_DIR=/opt/docker. And like everything else on this list, Sencho mounts /var/run/docker.sock, so read the security baseline section before exposing the UI.

Dockge: still the best pure compose UI, but check the pulse

This is the “Portainer vs Dockge” answer for compose-only users. Dockge has 24,427 stars (the biggest of any compose UI), MIT license, TypeScript. The design is the selling point: your stacks are plain compose files on disk, with no proprietary database holding your deployments hostage. That is exactly what people fear losing when they leave Portainer.

You point it at a stacks directory with DOCKGE_STACKS_DIR (default /opt/stacks) and it picks up compose.yaml plus .env per folder. See how to install Dockge with Docker Compose for the full setup, including the pin-a-version caveat.

Now the caveat, because I would not hang a fleet on hope.

Dockge 1.5.x is still the nicest pure compose UI to use on a single host. Set your expectations before betting more than one box on it, and remember multi-host via agents gets clumsy around 8 hosts and 90 containers (a complaint that shows up repeatedly in r/selfhosted). At that size, look at Komodo, Arcane agents, or Sencho’s node-link model.

Komodo: fleet management for multi-server homelabs

Komodo is the fleet answer: 12,449 stars, GPL-3.0, Rust, actively pushed (last commit 2026-09-21). It builds, deploys, and manages across many servers through Periphery agents, and it has a strong API for automation. If your complaint about Portainer is “the API is falling short,” this is usually where people land.

It is compose-on-disk friendly, and community migration write-ups exist for exactly this move (FoxxMD’s Portainer/Dockge to Komodo guide is the reference people link in r/selfhosted). I am citing it, not copying it.

Ops reality check before you commit:

• Komodo is stateful. It wants a MongoDB-compatible database: either MongoDB or FerretDB (FerretDB v2 is the supported combo as of Komodo 1.18.0; the older SQLite/Postgres-via-FerretDB-v1 path is gone). Budget roughly 300-500 MB extra RAM on top of the core. I do not run Komodo on a 1 GB box by choice.
• That database is one more stateful thing to back up. Arcane, Dockhand, Sencho, and Dockge are effectively single-container plus volume shapes; Komodo is not.
• Agent version skew is a real ops task. After a core upgrade, upgrade Periphery agents next, then re-run the fleet check.

If you are building a 3-5 node homelab fleet for this kind of tooling, quiet nodes like a compact mini PC such as the GMKtec M5 Ultra beat a tower of old laptops on noise and power draw.

The socket-proxy pattern from our Arcane Docker install guide (with socket proxy setup) applies to Komodo’s Periphery agents too. Do not hand a raw docker.sock to anything with a network listener.

Coolify and Dokploy: when the real answer is a PaaS, not a UI

Category correction. If what you do is “push code, deploy app, get HTTPS”, a container management UI is the wrong shape of tool. You want a PaaS. Two serious options:

License note: the GitHub API reported NOASSERTION for both repos on 2026-09-23; historically both are Apache-2.0, but check the license file in the repo before you make a legal call.

Both replace Portainer-style deploy workflows, not the low-level Docker poking. Keep lazydocker or the Docker CLI on the box for the 3 a.m. work. And plan for weight: a PaaS adds Traefik plus build workers, so 2 GB RAM is a realistic floor.

If you cannot choose between the PaaS options, Coolify vs Dokploy vs Kamal 2 compared walks the tradeoffs properly.

No dashboard needed: lazydocker, Dozzle and plain Docker CLI

The honest baseline, and the section most roundups skip. Before adopting any Docker management UI, try two weeks of terminal work. Many people do not go back.

• lazydocker (52,921 stars, MIT, Go TUI, last push 2026-04-19): containers, logs, and stats in your terminal. Zero server footprint, nothing listening on a port, nothing to patch on the VPS.
• Dozzle (14,456 stars, MIT, Go, last push 2026-09-23): a real-time log viewer in the browser for Docker, Swarm, and Kubernetes. Tiny and single-purpose.
• Plain Docker CLI + compose: covers the majority of what people open Portainer for. Honorable mention for the VS Code Docker extension over SSH.

Cost is zero and the attack surface does not grow. Nothing runs on the VPS to patch. That is a better default than most people admit.

1Panel, CapRover, Rancher and UsulNet: the adjacent options

Short mentions so nobody searching for these feels stranded.

1Panel (37,003 stars, GPL-3.0, Go) is a full Linux server panel with a Docker UI bolted on: firewalls, files, apps store, the works. FIT2CLOUD-backed. Heavier than a pure Docker management UI, and the default branch is currently dev-v2, so check the release channel before assuming stable behavior. Choose it when you want a whole-server panel, not just containers.

CapRover (15,166 stars, TypeScript, mature since 2017) is a Docker Swarm PaaS with one-click apps. The GitHub API showed NOASSERTION for the license on 2026-09-23 (historically Apache-2.0, verify the file). Still a reasonable choice if you are already committed to Swarm.

Rancher is for readers who moved to Kubernetes. It is a full K8s management plane from Suse, a different animal from everything above. I do not review it hands-on here, and current Community vs Prime packaging changes often enough that you should read their docs before planning around licensing.

UsulNet was covered in depth in the previous version of this article as an all-in-one container management platform (PostgreSQL, Redis, NATS, multi-node). The repo has since moved to fran-olivares/usulnet with 131 stars and a last push in May 2026. It is a solo-dev beta product and those move or die fast; re-verify current status and limits on their site before committing. Install instructions from the earlier test are in the UsulNet install guide.

When Portainer is still the right choice

No tribalism here. Four cases where I would stay on Portainer:

1. 3 Nodes Free is genuinely free if 3 nodes cover you and an annual renewal email is acceptable friction. Just read the terms: one license per company domain, node-count enforcement is reserved as a right.
2. Kubernetes management. Arcane is read-only Swarm at best. Dockge, Dockhand, Sencho, and Komodo are Docker/Compose tools. Portainer BE and Rancher are the K8s plays in this neighborhood.
3. Edge/IIoT fleets. The Portainer Edge Agent is still the product nobody has fully matched for large numbers of unreliable uplinks.
4. You already paid. If migration cost exceeds renewal cost this year, renew and migrate later with a plan.

Also fine: Portainer CE on a single homelab host when none of the gated features matter to you.

If none of those four cases apply, the feature gating plus renewal paperwork is your reason to move.

How to migrate from Portainer without downtime

You can migrate from Portainer to any compose-on-disk tool without dropping traffic. The honest framing: this is per-stack sequencing, not magic. Do one stack at a time, keep the old path working until the new one is verified.

Portainer to compose-on-disk migration flow with rollback branch

1. Inventory. List every stack in Portainer: name, images, env vars, volumes, networks, published ports. A spreadsheet is fine.
2. Export. Pull each stack’s compose file and env from the Portainer UI. Stacks also live inside the portainer_data volume under numbered compose/ directories, but the exact layout varies by version. Do not trust a path you have not seen; look in a throwaway VM on your version first.
3. Recreate on disk. One directory per stack, for example /opt/stacks/<name>/compose.yaml plus .env. Then prove parity by hand before any UI sees it:

mkdir -p /opt/stacks/myapp
cd /opt/stacks/myapp
# copy compose.yaml and .env from the Portainer export
docker compose up -d
docker compose ps
curl -I http://127.0.0.1:8080/health   # hit the real health endpoint

4. Point the new tool at the stacks directory:

services:
  dockge:
    image: louislam/dockge:1.5
    environment:
      - DOCKGE_STACKS_DIR=/opt/stacks
    volumes:
      - /opt/stacks:/opt/stacks
      - /var/run/docker.sock:/var/run/docker.sock

    volumes:
      - /opt/docker:/opt/docker
    environment:
      - PROJECTS_DIRECTORY=/opt/docker

    volumes:
      - /opt/docker:/opt/docker
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data:/app/data
    environment:
      - COMPOSE_DIR=/opt/docker

5. Move backup config. If you adopt in-UI backups (Arcane S3, Dockhand restic, Sencho archives), configure them and run one manual backup plus one restore test before you trust the schedule.
6. Verify with the checklist below.
7. Rollback plan. Stop Portainer, do not delete it, and leave portainer_data intact for one release cycle. If the new tool fails you, start Portainer again and re-point. Decommission only after the verification checklist passes on a host reboot.

Verify and failure modes, in order of how often they bite:

• Parity comes first: docker compose ps should show the same services and health as Portainer did. Broken looks like a service silently absent because the env file did not come along in the export.
• Then curl -I each health endpoint. DNS and TLS stay the same, but upstream container names change with the compose project name. Traefik labels that matched the old project name will 502.
• Reboot with sudo reboot and confirm every stack returns. Tools that read files on disk (Dockge, Arcane projects, Komodo stacks, Sencho stacks) recover; anything you only clicked together in a UI will not.
• In a scratch VM, remove the management UI and confirm your stacks keep running. Files-on-disk tools leave them intact; database-backed tools can take the definition with them.
• If you read stacks out of portainer_data and the directory layout surprises you, stop and inspect the live volume instead of guessing. Env files forgotten in the export are the single most common broken deploy.
• Portainer-created networks and stale volumes outlive the container. Prune carefully, and use the overlay2 cleanup guide above for the disk space side.

Security baseline for any Docker management UI

This applies to Arcane, Dockhand, Sencho, Dockge, Komodo, 1Panel, Portainer, and anything else that can start containers.

Security baseline architecture: reverse proxy with auth in front of the UI, Docker management UI, socket proxy with a minimal allowlist, Docker socket

Four non-negotiables:

The socket proxy pattern, using the env-var names from the current tecnativa/docker-socket-proxy README (double-check them against the repo before you deploy, the semantics have shifted over the years):

services:
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: socket-proxy
    environment:
      - EVENTS=1
      - PING=1
      - VERSION=1
      - AUTH=0
      - SECRETS=0
      - POST=1
      - BUILD=0
      - CONTAINERS=1
      - EXEC=1
      - IMAGES=1
      - INFO=1
      - NETWORKS=1
      - NODES=0
      - PLUGINS=0
      - SERVICES=0
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=0
      - VOLUMES=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  arcane:
    image: ghcr.io/getarcaneapp/manager:latest
    environment:
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
    # no /var/run/docker.sock mount here

Then put the UI behind a Traefik reverse proxy with auth (forward auth, basic auth plus strong TLS, or your SSO layer). Verify after setup: from outside the host, confirm the UI port does not answer directly (curl -v https://host:3552 should time out or refuse), and from the UI confirm it cannot reach API verbs you did not allow. If a terminal feature is enabled, that is the test surface.

Failure modes here are boring and severe: a port accidentally bound to 0.0.0.0, an allowlist so broad that POST=1 plus CONTAINERS=1 is effectively “create root container”, a terminal left enabled after an eval, and agent version skew after core upgrades (core, then agents, then a fleet check).

Ops notes for small boxes: Trivy and Grype scans burst CPU and RAM during image scan. On 1 GB, schedule scans off-peak or disable them per environment (Arcane v2.11.1 has that toggle). And if you want the UI and socket proxy isolated from production workloads, even a budget Hostinger VPS is enough for a management plane of one.

FAQ

Verdict: which Portainer alternative should you pick?

Restating the tree in prose, because this is the decision:

• Arcane if you want a like-for-like Portainer replacement. Single Go container, BSD-3, free OIDC and passkeys, and since v2.9-v2.12 it scans, patches, and backs up. This is the default, and what I run on my own servers.
• Dockhand when scan-before-swap rollbacks, LDAP, or enterprise secret managers matter more than OSI licensing. Accept BSL 1.1 with eyes open.
• Sencho if you want compose-on-disk with fleet features, free RBAC/SSO, and Trivy policies that can block a deploy, and you can live with pre-1.0 software and a small community.
• Dockge for single-host pure compose simplicity, with the pulse caveat and a pinned tag.
• Komodo for multi-server fleets and API-driven automation. Budget RAM and a database backup.
• Dokploy or Coolify when the real job is deploying apps. I run Dokploy on my fleet; Coolify if you want the bigger template catalog.
• lazydocker, Dozzle, or the plain CLI when you did not need a dashboard at all. Try this first.
• Portainer if you need Kubernetes, Edge/IIoT at scale, or the 3 Nodes Free renewal is friction you accept.

Whatever the tool, keep the boring ops basics: stack definitions as files on disk, config in Git (without secrets), volumes backed up to S3-compatible storage. Tools come and go, including the ones I just recommended. Those habits make any of them replaceable.

Cost close-out: every tool in the verdict is $0 in license fees. Run it on the VPS you already have, or spend about €4-5/mo on a small dedicated box.

Related articles

• Install Arcane - full setup guide with socket proxy and OIDC
• Install Dockhand - security-focused Docker manager
• Arcane vs Dockhand - side-by-side comparison
• Install UsulNet - all-in-one Docker management platform
• Install Dockge - lightweight compose management UI
• Best Docker containers for home server - what to run once your manager is set up
• Best self-hosted panels - server management panels compared
• Traefik reverse proxy for Docker - proper reverse proxy setup