Moving Portainer to Docker Compose

[Telos]

In the past, I've updated Portainer via SSH using

sudo docker stop portainer
sudo docker rm portainer
sudo docker run -d -p 8000:8000 -p 9000:9000 --name=portainer --restart=always --pull=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ee

So I figured, why not just use docker compose...

So I dreamt up this docker-compose.yml...

version: "3"
services:
  portainer:
    image: portainer/portainer-ee:latest
    container_name: portainer
    ports:
     - "8000:8000"
     - "9000:9000"
    volumes:
     - /var/run/docker.sock:/var/run/docker.sock
     - portainer_data:/data
    restart: always
volumes:
  portainer_data:

But when I ran docker compose down it didn't find my running Portainer container. Ultimately I stopped and removed the Portainer container via SSH, and then ran docker compose up -d. Initially that seemed to work, however it created a new "out of the box" Portainer instance than did not pick up on my existing stacks, or my "ee" registration. Apparently my docker-compose.yml file isn't identical to the Portainer container which I ran using the docker run command.

Can you help me see my error in the docker-compose file?

After stopping and removing the Portainer instance that I has launched using docker compose, I ran the docker run command and regained my Portainer instance with its stacks, etc.

 

[one-eyed-king]

volumes: portainer_data:

Volumes created from a compose file are prefixed with the project name (which defaults to the folder name, if not provided).

You need to mark you volume as externally managed.

It should be something like this:

volumes:
  portainer_data:
    name: portainer_data
    external: true

Note: name might be unnecessary, if the volume name inside the compose file and the external volume name match.
From what I remember, the configuration from the official docs result in a warning, and the above should be the variation that works and doesn't throw a warning.

-- post merged: 9. Jul 2023 --

You missed out the pull policy on your compose file:

services:
  portainer:
    ...
    pull_policy: always

Every docker run argument has an equivalent compose file configuration element, and the other way around

 

[Telos]

Thanks. I'll give that a go. It took me awhile to get my Portainer stack aligned with my docker compose files, so I can update either way. But the logic for doing that with Portainer escapes me.

Another question @one-eyed-king (if I may). When I update a container with an updated image file using docker compose (pull, up -d), I noticed that in Portainer-ee, that the container update indicator changes from red to green (as expected), however the Portainer stack for that container remains with a red update indicator.

For example, after a docker compose update... The container status in Portainer changes to green.

Stack shows red:

I'm sure there's something I'm not understanding, but I expected the stack indicator to turn green as well. Stopping and restarting the Portainer stack has no effect.

 

[one-eyed-king]

I can't really say much about Portainer, as I am not using it. Though, I remember that Portainer prefers it, if the compose file is managed in Portainer as stack.

Personally, I do everything in the terminal using compose files. It's the most efficient way for me (and I really hate clickOps). If you run something like Gitlab + Runners, you can turn it easily into GitOps, so that you only update and push files and pipelines take care to execute the deployments.

 

[Telos]

I do everything in the terminal using compose files

That's where I am. I use Portainer-ee primarily to quickly see which images have updates. Thanks!

It should be something like this:

This worked perfectly. Thank you!

 

[ilbarone87]

I can't really say much about Portainer, as I am not using it. Though, I remember that Portainer prefers it, if the compose file is managed in Portainer as stack.

Personally, I do everything in the terminal using compose files. It's the most efficient way for me (and I really hate clickOps). If you run something like Gitlab + Runners, you can turn it easily into GitOps, so that you only update and push files and pipelines take care to execute the deployments.

You can do GitOps through Portainer. Just link up the repo to the stack and it will poll the config (you can set the time I do it every 12h) plus I have renovate bot set up in GitHub that lookup for images updates in docker registry and open a PR to change the image tag. Really suggested to have a look at it, saved me 2hrs of updates every month.
@Telos do you mind sharing the full stack for portainer since it was one of the last I was looking to automate but didn’t know that setting it in Stack would work for updating the container image.

 

[Telos]

@Telos do you mind sharing the full stack for portainer since it was one of the last I was looking to automate but didn’t know that setting it in Stack would work for updating the container image.

I'm not sure that this would work inside Portainer. I use docker-compose.

version: "3"
services:
  portainer:
    image: portainer/portainer-ee:latest
    container_name: portainer
    ports:
     - "8000:8000"
     - "9000:9000"
    volumes:
     - /var/run/docker.sock:/var/run/docker.sock
     - portainer_data:/data
    restart: always
    pull_policy: always
volumes:
  portainer_data:
    name: portainer_data
    external: true

Change the image to -ce, if that applies to you.

Alternately... If you want to include Portainer Agent...

version: "3"
services:
  agent:
    image: portainer/agent
    container_name: portainer_agent
    ports:
     - "9001:9001"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /volume1/@docker/volumes:/var/lib/docker/volumes
    restart: always
    pull_policy: always

  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    ports:
     - "8000:8000"
     - "9000:9000"
    volumes:
     - /var/run/docker.sock:/var/run/docker.sock
     - portainer_data:/data
    restart: always
    pull_policy: always

volumes:
  portainer_data:
    name: portainer_data
    external: true

 

[ilbarone87]

Thanks. I have -ee as well

 

[bc28]

You can do GitOps through Portainer. Just link up the repo to the stack and it will poll the config (you can set the time I do it every 12h) plus I have renovate bot set up in GitHub that lookup for images updates in docker registry and open a PR to change the image tag. Really suggested to have a look at it, saved me 2hrs of updates every month.
@Telos do you mind sharing the full stack for portainer since it was one of the last I was looking to automate but didn’t know that setting it in Stack would work for updating the container image.

I use Watchtower to automate image updating, I've configured to check (and update if needed) every night, it's been working good.

GitHub - containrrr/watchtower: A process for automating Docker container base image updates.

A process for automating Docker container base image updates. - GitHub - containrrr/watchtower: A process for automating Docker container base image updates.

github.com

 

[ilbarone87]

I use Watchtower to automate image updating, I've configured to check (and update if needed) every night, it's been working good.

GitHub - containrrr/watchtower: A process for automating Docker container base image updates.

A process for automating Docker container base image updates. - GitHub - containrrr/watchtower: A process for automating Docker container base image updates.

github.com

Heard about it, but also heard about hit and miss situations. Not sure if watchtower works also for Helm packages, something i need for my kubernetes cluster.

 

[bc28]

Heard about it, but also heard about hit and miss situations. Not sure if watchtower works also for Helm packages, something i need for my kubernetes cluster.

Can't speak to how it behaves with Kubernetes, however it's been stable for me and hasn't had any 'misses'. For critical services (ie - Traefik), I've configured to download image only and notify me so I can manually upgrade.

 

[Telos]

so I can manually upgrade.

This is key to using Watchtower.