Portainer 3.0 Is Kubernetes-First: What Changes If You Run Docker (and Which Alternative to Pick)

Portainer 3.0 will not break your Docker host at the end of the month. What ends is something else: there will be no Community Edition of the 3.x line. CEO Neil Cresswell said so himself in the official announcement on 11 September 2026: CE “will continue on the 2.x codebase” and “will not receive the 3.x changes.” 3.x stays free for the community only through the 3 Nodes Free program, which is a Business Edition license. And 3.x is, in his words, “a Kubernetes-first codebase.”

If you run Docker — not Kubernetes — with Portainer CE, the decision is not urgent, but it is real: stay on 2.x for as long as it lasts, take the free three-node license and accept a product built around Kubernetes, or leave. Below are the facts checked against primary sources, what breaks on each path, and which tool fits which setup. I run Coolify in production on two VPSes, so at the end I also share what has bitten me.

What the announcement actually says

The Reddit take: “CE is gone, and the only free option is Business up to 3 nodes”

That reading spread on r/selfhosted. It is correct for the 3.x line and incomplete about everything else. Here is what the primary sources confirm:

• True: there will be no CE edition of 3.x, and the free way to run 3.x is 3 Nodes Free. The program page says it is a Business Edition license key, sent after you fill in a form, and “limited to one license per organization.”
• Incomplete: CE does not vanish tomorrow. It stays on 2.x, the portainer/portainer repository keeps its zlib license, and the lifecycle policy gives 2.45 LTS maintenance until May 2027.
• The detail almost nobody mentions: the three-node license expires and has to be renewed. The docs say the new key is not sent until 14 days before the current one expires. CE needed no form and no renewal.
• What counts as a node: per the licensing FAQ, on Docker any server running the Portainer Server or the Agent counts. Three Docker hosts (one running the server, two running agents) are three nodes, so you have used up the free tier.

A warning about that May 2027 date: the same lifecycle page still lists a 2.46 STS for September and a 2.51 LTS for February 2027, which the announcement contradicts, since 2.45 is the last 2.x. The table has not been updated since the announcement, so treat May 2027 as the published date, not a guarantee. The announcement itself gives no end date for 2.x.

What breaks (and what doesn’t) on each path

Path 1: you stay on Portainer CE 2.45

Nothing breaks today. There are still two things worth doing this week.

Pin the exact image version. On Docker Hub, the lts, sts and latest tags of portainer/portainer-ce were last updated on 27 August, with 2.45.0. I found nothing documenting where those tags will point once 3.0 STS ships, so if you run Watchtower or anything similar, do not let a floating tag make the call:

services:
  portainer:
    image: portainer/portainer-ce:2.45.0   # not :latest or :sts

Make sure you are on 2.45.0 (or 2.39.7 if you are still on the previous LTS). The 2.45.0 release notes fix a critical authorization bypass in the Docker proxy: unrecognized API version prefixes such as /v1.47.0/ skipped access control entirely, letting non-admin users reach the Docker API directly. 2.39.7 LTS got the same fix on the same day.

To check which image you are running:

docker ps --filter name=portainer --format '{{.Image}}'

Staying costs you new features and buys you time to decide.

Path 2: you move to 3.x on the 3-node license

Your native Docker environments keep working; the announcement is explicit about that. What changes are the terms: a Business license that expires, a three-node cap, a product whose roadmap no longer includes Docker, and a 3.0 that ships as STS (the LTS arrives in December with 3.3.0). If you manage more than three hosts, this path is a paid one.

There is an upside if several people share your Portainer: role-based access control is a Business Edition feature per the roles documentation, so 3 Nodes Free gives you RBAC.

Path 3: you follow Portainer’s advice and move to D2K

This is where things do break, by design rather than by bug. D2K (MIT licensed) exposes the Docker Engine API and translates every call into Kubernetes objects inside one namespace. Its own README lists what it does not support and says it “will not be added”:

If your compose file builds its image on the same server, if you isolate your database on an internal network, or if anything runs with network_mode: host, D2K is not a migration. It is a redesign, and there is still a Kubernetes cluster underneath to operate.

The alternatives, verified

I checked the repository, license and latest release of each one on 13 September 2026.

Coolify: if what you do in Portainer is deploy your own apps

• License: Apache-2.0. About 61,700 GitHub stars.
• Maturity: stable v4.0.0 shipped on 27 April 2026, and the latest release is v4.3.19, from 10 September. It shipped four releases between 3 and 10 September.
• What it is: a self-hosted PaaS, not a container UI. It deploys from git (Nixpacks, Railpack, Dockerfile, Docker Compose or static site), runs the reverse proxy (Traefik or Caddy) with certificates, schedules database backups, ships 280+ one-click services and manages multiple servers over SSH.
• Users: teams, 2FA, and OAuth with Azure, Bitbucket, Clerk, Discord, GitHub, GitLab, Google, Authentik, Infomaniak and Zitadel (the list comes from the source code).
• Requirements: 2 cores, 2 GB of RAM and 10 GB of disk per its documentation, which also recommends a fresh server to avoid conflicts with whatever is already running.
• What it is not: a dashboard for containers you started by hand. Its model is that Coolify does the deploying.
• Swarm: deprecated. The notice in its own code says Swarm will be removed in Coolify v5 and that new Swarm deployments are not recommended.

Komodo: the most direct Portainer replacement across many servers

• License: GPL-3.0. About 12,200 stars. Latest release: v2.3.3, from 1 September 2026; v2.0.0 shipped on 24 March.
• What it does: connects servers (with an agent called Periphery on each), deploys containers and Compose stacks defined in the UI, on the host or in a git repo, with auto-redeploy on push through webhooks. It also builds images, runs scheduled automations and records who changed what and when.
• Swarm: supported since v2.0.0 (clusters, nodes, services, stacks, configs and secrets).
• Users: username and password with 2FA, OAuth with GitHub, Google and generic OIDC, and granular role-based permissions.
• Server limit: none, “and there never will be,” per its README.
• Requirements: Docker, plus MongoDB or FerretDB (on Postgres) for Core. It asks for the most infrastructure on this list, and its docs assume you bring your own reverse proxy.

Dockge: if all you want is to edit compose.yaml files in a browser

• License: MIT. About 24,300 stars. Same author as Uptime Kuma.
• Maturity: latest release 1.5.0, from 30 March 2025; the latest commit on master is from April 2026. Maintenance is slow.
• What it does: creates, edits, starts and updates Compose stacks with a web terminal, and converts docker run commands to compose. Your files stay on disk (/opt/stacks by default) and keep working with plain docker compose. Since 1.4.0 it manages multiple hosts through agents.
• What it doesn’t: it has a single account. Setup refuses to create a second user, and the pull request that added users and groups (#891) was closed unmerged in July 2026. No SSO, no roles, and the README does not mention deploying from git.

Dockhand: the most complete UI, with fine print in the license

• It exists and moves fast: the Finsys/dockhand repository was created in December 2025, has about 6,200 stars, and its latest release is v1.0.47, from 12 September 2026.
• What it does: containers, Compose stacks with a visual editor, git deployments with webhooks, multiple hosts (over the socket, TCP with TLS, or Hawser, its MIT-licensed agent that connects outbound with no open ports), vulnerability scanning with Grype and Trivy, backups (in beta) and free OIDC/SSO. SQLite by default or PostgreSQL, and they say it runs on a Raspberry Pi 4.
• What it doesn’t: Swarm; there is an open issue asking for it. RBAC, LDAP/Active Directory and compliance audit logging are Enterprise features ($1,499 per host per year).
• The license contradicts itself. The repository’s LICENSE.txt is the Business Source License 1.1 with an additional use grant that explicitly permits “internal business use” in production, as long as you do not offer it as a Docker management SaaS; it converts to Apache-2.0 on 1 January 2029. The license terms on its website, however, say commercial users need a paid license for production environments or shared instances, and the pricing table places the “commercial usage license” in the SMB plan ($499 per host per year). For a homelab there is no ambiguity. If you are a company, get clarification in writing before you put it in production.

Lazydocker and Yacht, for completeness

• Lazydocker (MIT, about 52,800 stars, v0.25.2 from April 2026) is a terminal UI, not a web server: no users, no agents, nothing to expose. If you only used Portainer to read logs and restart containers, it is enough.
• Yacht published again in September 2026 (release 1.1) after years without releases; the previous one, v0.0.7-alpha, dates from 2021. Too early to trust with production.

The decision table

What I have learned running Coolify on two VPSes

I run Coolify in production on two servers: one hosting this site and client apps, the other running internal tools. Three things no comparison page tells you, and they apply to any tool that talks to the Docker socket, Portainer, Dockge and Dockhand included.

1. After upgrading docker-ce, restart the containers that mount the socket. In May 2026 I upgraded Docker from 29.5.0 to 29.5.2 with live-restore enabled. The apps stayed up, but Coolify’s proxy (Traefik with the Docker provider) got stuck in a reconnect loop against /var/run/docker.sock. The result: HTTP 502 on every app routed through Docker, while the dashboard, which is routed through a config file, kept responding, which makes it easy to misdiagnose. live-restore protects the containers, not the connections they held open to the socket. Since then, after every upgrade I run:

docker restart coolify-proxy coolify-sentinel

Or, more generally, I restart every container that mounts the socket:

for c in $(docker ps --format '{{.Names}}'); do
  docker inspect -f '{{range .Mounts}}{{if eq .Source "/var/run/docker.sock"}}{{$.Name}}{{end}}{{end}}' "$c" | grep -v '^$'
done | xargs -r -n1 docker restart

Note that since v4.3.19 Sentinel is mandatory on regular Coolify servers, so restarting coolify-sentinel now applies to every install.

2. Docker bypasses UFW. When I installed Coolify on the second VPS, the dashboard and realtime ports ended up open to the internet even though UFW did not allow them: ports published by a container go through iptables rules that Docker manages before UFW ever sees the traffic. I fixed it with DROP rules in the DOCKER-USER chain, matching on the connection’s original destination port (conntrack --ctorigdstport, because by the time a packet reaches that chain, DNAT has already rewritten the port), and left only 80 and 443 public. If you install any of these UIs with a published port, check from outside the server; do not trust ufw status.

3. Firewall rules pinned to a container IP break on reboot. On the production server, after a reboot, every domain timed out even though Traefik was healthy. The ufw-docker rules pointed at the proxy’s old internal IP, and the proxy came back with a different one. The fix that holds was allowing 80 and 443 to Docker’s network range instead of to a specific IP. Restarting Docker does not fix it, because the rules belong to UFW.

And one that comes straight from Coolify’s own documentation, which I can confirm: create the admin account as soon as the install finishes. Whoever reaches the registration page first gets control of the server.

If you are copying your stacks out of Portainer into another tool, validate each compose.yaml against the official schema before the first deploy:

Verdict

If you run Portainer CE on Docker, do not migrate this month. 2.45 LTS is still maintained, 3.0 ships as STS, and the first 3.x LTS does not arrive until December. Pin the image to 2.45.0 and use the next few months to trial your alternative on a server that is not production.

But do not wait for a CE 3.x, because it is not coming. The Portainer you knew — free, no sign-up, no node cap, Docker as a first-class citizen — is frozen on 2.x.

To choose, ask what you really do in Portainer. If you deploy your own apps, the natural move is Coolify, and it is what I use. If you manage stacks across several servers with a team, Komodo is the closest thing to what Portainer used to be, with no node cap and no commercial license. If it is just you and a homelab, Dockge if the minimum is enough, or Dockhand if you want everything. And if you were already heading to Kubernetes, Portainer 3.x is built for you; D2K only makes sense if your stacks neither build images nor rely on special networking.

Keep reading:

• The complete Docker guide for 2026: Compose v5, Engine 29 and how Compose, Swarm and Kubernetes compare for production.
• Kubernetes 1.37: what breaks on upgrade day: if you do end up on Kubernetes, with or without D2K, this is what blocks an upgrade right now.

Frequently asked questions

Is Portainer Community Edition going away with 3.0?

Not immediately, but there will be no CE 3.x. According to the official announcement on 11 September 2026, CE continues on the 2.x codebase and will not receive the 3.x changes. Portainer is not cutting a separate CE build of 3.x: the free way to run 3.x is the 3 Nodes Free program, which is a Business Edition license. Portainer's lifecycle policy gives 2.45 LTS maintenance until May 2027.

What is Portainer 3 Nodes Free and what does it limit?

It is a free Portainer Business Edition license for up to three nodes, limited to one license per organization and requested through a form. The license expires and must be renewed: the new key is sent no earlier than 14 days before expiry. On Docker, any server running the Portainer Server or the Portainer Agent counts as a node, so three Docker hosts already use up the free tier.

Will my Docker environments stop working if I upgrade to Portainer 3.x?

No. The announcement says native Docker, Swarm and Podman environments can still be added and still work from the UI. What changes is that they are ordered second in the product and will not receive new capabilities from the policy engine, GitOps engine or observability layer. The new products, Portainer-Run, IDP, Command and AiGrid, are Kubernetes-only.

How long will Portainer 2.45 LTS get patches?

The lifecycle policy in Portainer's documentation lists May 2027 as the end of support and maintenance for 2.45 LTS. The 3.0 announcement says the 2.x line will keep receiving security updates, bug fixes and selective back-ports, without giving an end date. That lifecycle table still lists 2.46 to 2.51 releases that the announcement contradicts, so treat May 2027 as the published date rather than a guarantee.

What is Portainer D2K and what does it not support?

D2K is an MIT-licensed Docker-to-Kubernetes translator: it exposes the Docker Engine API and turns each call into Kubernetes objects inside one namespace. Per its README, it ignores the Compose build directive, does not support docker build, load, save or buildx, does not support macvlan or ipvlan networks, has no equivalent for host networking or static IP and MAC addresses, does not enforce network isolation between stacks, and turns bind mounts into hostPath volumes that are unreliable in multi-node clusters.

What is the best free Portainer alternative for Docker?

It depends on what you use it for. For several servers and several people, Komodo (GPL-3.0) has no server limit and includes roles and OIDC, although it needs MongoDB or FerretDB. For one person editing compose files, Dockge (MIT) is the simplest, but it supports a single account. For deploying your own apps from git with a proxy and certificates, Coolify (Apache-2.0). Dockhand is the most complete UI, but its commercial licensing is ambiguous.

Can Coolify replace Portainer?

Only if what you do in Portainer is deploy your own applications. Coolify is a self-hosted PaaS: it deploys from git with Nixpacks, Railpack, Dockerfile or Docker Compose, sets up Traefik or Caddy with certificates and schedules database backups. It is not designed to manage containers created by hand, its documentation recommends a fresh server, and its Docker Swarm support is deprecated and will be removed in Coolify v5.

Is Dockhand free for commercial use?

It is unclear, because its two license texts contradict each other. The repository's LICENSE.txt is the Business Source License 1.1 with a grant that permits internal business use in production, as long as it is not offered as a SaaS. The license terms on dockhand.pro instead require a paid license for commercial users in production or on shared instances, and the pricing table puts the commercial usage license in the SMB plan at $499 per host per year. Personal use is free with no ambiguity.