[ Replace Container ] Portainer with Alpine-based version

[DavidGarciaCat]

Hello,

I can see that there is a new version of Portainer, so I guess it's just a matter of days to get an update:

https://hub.docker.com/r/portainer/portainer-ce/tags

I would like to request that, as part of this new update, we get Alpine-based images instead of the current ones.

This is because Portainer is intended to manage apps that aren't yet supported, or that won't be supported for a variety of reasons. However, the current image does not include either bash or sh, which means I cannot even log into Portainer to perform manual actions if one of the stacks I am installing requires me to run a CLI command to generate admin credentials.

Please advise,

[DavidGarciaCat]

Also... Alpine images are much lighter, so we will use less disk space 😄

[DavidGarciaCat]

Hey @al-lac

Please accept my apologies for the direct ping, but I was hoping you could answer a couple of questions for me 🤔

• Is there any reason for not enabling Portainer to operate outside the Proxy Auth (by setting PROXY_AUTH_ADD: "false", as this is not happening right now)? Based on how I understand it, chances are that only one person manages Umbrel itself, but there might be one or more people who might be able (or need to) launch different Docker containers or stacks inside Portainer

• As a consequence of this ticket, I was wondering why the Portaner App (based on the Umbrel Apps repository) is setting a 2nd container to run Docker (in this case, docker:27.2.0-dind) instead of mounting the actual Docker socket that is running any other App in Umbrel

While running some testing and checks (that initiated this very Issue #5306 + the related PR #5307), I noticed that logging into Umbrel (ssh username@ip-address) allows me to see App Store apps when running docker ps -a but I cannot see Portainer-based apps, and that led me to consider running one or more commands from the Portainer container (which exposed the lack of bash orsh, so that's reason for considering changing the tag of this image)

When you have a moment (please, no rush), I would like to know about these two cases, so I can better understand some behind-the-scenes decisions, and maybe it's possible for us to consider alternative settings before merging that PR.

Thank you very much,

[al-lac]

Hey @DavidGarciaCat,

we usually stick to the LTS version of portainer, which would still be 2.39.1.

Where did you see that the alpine based versions are lighter in terms of disk usage?

Regarding your other points:

• I guess PROXY_AUTH_ADD could be set to "false" in this case, we usually only do it when there is a proper use case for it
• This is done so that portainer does not impact other running umbrel apps. This is also done for other container management apps like Arcane and Komodo, no app gets direct access to the docker socket of umbrel

For your case, you should just be able to run a terminal on the dind container of portainer and run your required commands from there.

Hope this answers your questions!

[DavidGarciaCat]

Hello, @al-lac,

Let me answer your points here in a structured way

---

we usually stick to the LTS version of portainer, which would still be 2.39.1.

OK 👍 I understand the benefits of sticking with LTS versions, and I can work with that.

---

I guess PROXY_AUTH_ADD could be set to "false" in this case, we usually only do it when there is a proper use case for it

Based on your previous comment (using the LTS version) I guess we can discard my current PR (#5307), but it would be possible to add a new one that adds the PROXY_AUTH_ADD environment variable, and define it as 2.39.1-1 version (probably there is no need to update the changelog, as this is only a setting adjustment but not an actual upgrade).

I would like to have the opportunity to replace the images too, and use the Alpine-based images. The reason will be explained below, while answering the questions about Alpine-based image sizes.

---

This is done so that portainer does not impact other running umbrel apps. This is also done for other container management apps like Arcane and Komodo, no app gets direct access to the docker socket of umbrel

I understand the reason, especially when Umbrel Apps have the proxy entry-point, which is not a standard Docker service (and it may cause issues). Still, we can face other problems if any ports are already used (so they cannot be re-assigned).

---

Where did you see that the alpine based versions are lighter in terms of disk usage?

About this specific case, currently, Umbrel OS App Store provides Portainer 2.39.1 through its image portainer/portainer-ce:2.39.1, but (and, as an exceptional case) this is one of the few situations (that I found) where we can see that:

• linux/amd64 platform and :2.39.1 tag needs 55.78 MB
• linux/amd64 platform and :2.39.1-alpine tag needs 59.34 MB
• However, if we check the Image Layers, we can see that the current image doesn't even pass (adds) a base system (which explains the lack of bash or sh, or the main blocker trying to run docker exec ... commands for apps running inside Portainer)

Alpine images are (usually) lighter than non-Alpine images, most Docker images available via Docker Hub. If we look for a specific image (software) and filter by specific versions (tags), we (usually) can see that -alpine suffixed images/tags are smaller.

I believe that Umbrel Home (as a product) runs Linux (Debian-based) and has an Intel/AMD CPU (at least, the one I bought is Intel), so I think the most important OS/arch setting here is linux/amd64. Still, linux/arm64 images (usually) also have their own Alpine-based tag (for those running Umbrel OS on a Raspberry Pi). So, for the examples below, I am sharing the required image size for linux/amd64 images:

Image	Non-Alpine version	Alpine version
PHP	8.5.5-fpm needs 171.85 MB	8.5.5-fpm-alpine needs 37.18 MB
Node.js	24.14.1 needs 388.83 MB	24.14.1-alpine needs 53.78 MB
Golang	1.26.2 needs 297.63 MB	1.26.2-alpine needs 68.07 MB
Postgres	15.17 needs 150.71 MB	15.17-alpine needs 104.1 MB
Redis	8.6.2 needs 50.77 MB	8.6.2-alpine needs 32.9 MB
Memcached	1.6.41 needs 30.7 MB	1.6.41-alpine needs 5.68 MB

Even if we would consider using -slim tags (should the image have one), it is also common to see that -apine tags still need smaller disk space for them to work. An example, for Node.js, based on this "build optimization" guide:

• Guide: https://webbylab.com/blog/minimal-size-docker-image-for-your-nodejs-app/
• -slim tag needs 75.67 MB
• -alpine tag needs 53.93 MB

Another example: when I pushed the first submission for Zabbix, images were already Alpine-based, and it seems this has continued until today:

Image	Alpine	Ubuntu	CentOS
Agent	7.4-alpine-latest 8.86 MB	7.4-ubuntu-latest 34.96 MB	7.4-centos-latest 60.51 MB
Backend	7.4-alpine-latest 29.1 MB	7.4-ubuntu-latest 89.63 MB	7.4-centos-latest 80.3 MB
Frontend	7.4-alpine-latest 48.85 MB	7.4-ubuntu-latest 126.83 MB	7.4-centos-latest 113.83 MB

I am happy to discuss other cases or compare potential changes for specific images, assuming there are any requirements for other tags. Still, I believe the provided examples should confirm my previous statement and answer your question, too.