DCK-PORT-01 · Deploy and Manage Portainer CE with Multi-Host Docker Management

Lab Overview

In this lab you will build a centralized Docker management platform from scratch. You will provision a Proxmox LXC container, install Docker Engine inside it, and deploy Portainer Community Edition as a containerized service. Once your Portainer server is running you will register an existing remote Docker host using the Portainer Agent, giving you a unified web interface to manage container workloads across multiple hosts.

📋 Business Context

Container workloads on the lab Docker host (192.168.128.92) are currently managed exclusively via SSH and CLI commands, creating friction for operators who are less experienced with Docker CLI syntax. This lab delivers a Portainer CE solution that reduces per-host CLI reliance and provides a unified GUI for container lifecycle management, image inspection, volume management, and log access across multiple Docker hosts.

What You Will Build

🖥️ Portainer Server (LXC)

Create an Ubuntu 22.04 LXC container on Proxmox and install Docker Engine with nesting enabled. Deploy Portainer CE as a Docker container with persistent storage.

🤝 Portainer Agent

Deploy the Portainer Agent on the existing Docker host at 192.168.128.92 so the agent listens on TCP/9001 and Portainer CE can reach it.

🌐 Multi-Host Management

Register the remote Docker host as a Portainer Environment and perform full container lifecycle operations (start, stop, logs) from the Portainer web UI.

🔬 Network Validation

Use a lightweight GNS3 Alpine Linux probe node to confirm Layer 3 reachability and port connectivity before and after agent deployment.

Learning Objectives

Create and configure a Proxmox LXC container suitable for running Docker Engine (nesting enabled)

Install and configure Docker Engine on Ubuntu 22.04 LXC following current best practices

Deploy Portainer CE with persistent storage using named Docker volumes

Understand the Portainer Agent architecture and deploy it on a remote Docker host

Perform container lifecycle operations (start, stop, inspect, logs) through the Portainer web UI

Validate network connectivity and port accessibility using lightweight GNS3 probe nodes

Skills Developed

Docker Engine Portainer CE LXC Containers Proxmox Linux Administration Container Lifecycle Multi-Host Management Network Validation Named Volumes Firewall Configuration

Follow-Up Labs

Deploy a multi-container application stack using Docker Compose and manage it through Portainer Difficulty 3
Configure Portainer with LDAP or OAuth authentication for enterprise identity integration Difficulty 3
Implement Portainer Edge Agent for managing Docker hosts across network segments without direct inbound connectivity Difficulty 3
Upgrade Portainer CE to Business Edition and explore RBAC for team environments Difficulty 3
Deploy a Docker Swarm cluster across multiple LXC nodes and manage Swarm services through Portainer Difficulty 4

Network Topology

All devices reside on VLAN 1 of the lab management network (192.168.128.0/24) with default gateway 192.168.128.1. The GNS3 Cloud node bridges to Proxmox vmbr0 so the Alpine probe participates in the same Layer 2 domain.

Device Inventory

Device Name	Type	IP Address	Subnet	VLAN	Key Ports	Notes
proxmox-host	Proxmox VE Hypervisor	192.168.128.191	255.255.254.0	1	8006/tcp	Physical or VM Proxmox host. Student must have shell or web UI access to create LXC.
portainer-lxc	Proxmox LXC (Ubuntu 22.04)	192.168.129.11	255.255.254.0	1	9443/tcp · 9000/tcp	Created by student. Docker Engine + Portainer CE installed inside. nesting=1 required.
docker-host-01	Existing Docker Host (Linux)	192.168.128.92	255.255.254.0	1	9001/tcp	Pre-existing lab host. Portainer Agent deployed here by student. Has nginx + sample containers.
alpine-probe-01	GNS3 Alpine Linux Node	192.168.128.200	255.255.254.0	1	—	Lightweight GNS3 node. Bridges to vmbr0 via GNS3 Cloud node. Used for ping + nc port probes.

📡 GNS3 Project

docker-portainer-network-probe — A minimal GNS3 project containing one Alpine Linux node and one Cloud node bridged to vmbr0 (192.168.128.0/24). The Alpine node uses static IP 192.168.128.200/24. Students use it to confirm TCP connectivity to ports 9000, 9443, and 9001 on both the Portainer LXC and the Docker host before and after agent deployment.

Prerequisites

Complete all items below before beginning the Configuration section. A missing prerequisite will cause failures mid-lab.

Knowledge Prerequisites

🐧 Linux CLI

Comfortable with file navigation, text editing (nano or vi), and systemctl commands. You will run multi-line shell commands and edit configuration files.

🖥️ Proxmox UI

Ability to navigate to nodes, open a shell, and create LXC containers in the Proxmox web UI at port 8006.

🐳 Container Concepts

Conceptual understanding of containers vs virtual machines. No Docker CLI expertise required — this lab builds those skills.

🌐 Networking Basics

IP addressing, default gateways, TCP ports, and the ability to use SSH to connect to Linux hosts.

Environment Readiness Checklist

Proxmox Host (192.168.128.191)

Verify you can access the Proxmox web UI at https://192.168.128.191:8006 and open a shell on the node.
Confirm the Ubuntu 22.04 LXC template is available. Run the following on the Proxmox shell:
Proxmox Shell
```
pveam list local | grep ubuntu-22.04
```
If no output, download the template:
Proxmox Shell
```
pveam update
pveam download local ubuntu-22.04-standard_22.04-1_amd64.tar.zst
```
Confirm available storage on local-lvm (need at least 10 GB free):
Proxmox Shell
```
pvesm status
```

Docker Host (192.168.128.92)

Verify Docker Engine is installed and running:
docker-host-01
```
docker --version
systemctl is-active docker
```

Confirm at least two sample containers exist (nginx + hello-world or equivalent):

docker-host-01

docker ps -a

If no containers exist, create quick samples:

docker-host-01

docker run -d --name nginx-lab --restart unless-stopped -p 80:80 nginx
docker run -d --name whoami-lab --restart unless-stopped -p 8080:8080 containous/whoami

Note the OS and firewall tool in use (UFW or firewalld) — you will need it during agent deployment:

docker-host-01

uname -a
systemctl is-active ufw 2>/dev/null || systemctl is-active firewalld 2>/dev/null || echo "No firewall detected"

GNS3 Network Probe Project

Open GNS3 and confirm the docker-portainer-network-probe project is available. Start the project and start both the Cloud node and the Alpine node.
Open a console on alpine-probe-01 and verify its IP address and default route:
alpine-probe-01 (GNS3 console)
```
ip addr show eth0
ip route show
```
Expected: 192.168.128.200/24 and default route via 192.168.128.1.
Run a quick reachability test to the lab gateway and Docker host:
alpine-probe-01
```
ping -c 3 192.168.128.1
ping -c 3 192.168.128.92
```
Both should reply before proceeding.

⚠️ Docker-in-LXC Requirement

Running Docker inside a Proxmox LXC container requires nesting=1 to be set on the container feature flags and the container must run as privileged (or with specific AppArmor/seccomp overrides). The provisioning script handles this automatically. If you create the LXC manually, do not forget to enable nesting.

Configuration

Follow the four phases below in order. Each phase builds on the last — do not skip ahead.

🗺️ Phase Map

Phase 1 → Create LXC container on Proxmox
Phase 2 → Install Docker Engine inside the LXC
Phase 3 → Deploy Portainer CE in the LXC
Phase 4 → Deploy Portainer Agent on docker-host-01 and register the remote environment

Phase 1 — Create the Portainer LXC Container on Proxmox

You can use either the automated provisioning script (recommended) or the manual steps below.

Option A — Automated (Provisioning Script)

Copy the script setup-docker-portainer-lxc.sh to the Proxmox host root home directory:
Your workstation
```
scp setup-docker-portainer-lxc.sh root@192.168.128.191:/root/
```
SSH to the Proxmox host and execute the script:
Proxmox Shell
```
ssh root@192.168.128.191
chmod +x /root/setup-docker-portainer-lxc.sh
/root/setup-docker-portainer-lxc.sh
```
The script creates CT 200 (portainer-lxc), enables nesting, and starts the container. Review the output summary for IP and credentials.

Option B — Manual via Proxmox Web UI

In the Proxmox web UI, click your node → Create CT. Set the following values:

Field	Value
CT ID	200
Hostname	portainer-lxc
Template	ubuntu-22.04-standard_22.04-1_amd64.tar.zst
Disk Size	10 GB (local-lvm)
CPU Cores	2
RAM	2048 MB
Network Bridge	vmbr0
IP	192.168.129.11/24
Gateway	192.168.128.1
Unprivileged	No (must be privileged for Docker)

After creating the container, select it in the tree, go to Options → Features and enable Nesting.

🔴 Critical
Nesting MUST be enabled before you start the container. Docker Engine will fail to start inside the LXC without it.
Start the container and open a shell:
Proxmox Shell
```
pct start 200
pct enter 200
```

✅ Phase 1 Checkpoint

CT 200 is running and you have a root shell inside the LXC. Confirm with hostname (should return portainer-lxc) and ip a (should show 192.168.129.11).

Phase 2 — Install Docker Engine inside the LXC

All commands below run inside the LXC container shell (pct enter 200 from the Proxmox host, or SSH to 192.168.129.11).

Update the package index and install prerequisites:

portainer-lxc

apt-get update -y
apt-get install -y ca-certificates curl gnupg lsb-release

Add Docker's official GPG key and repository:

portainer-lxc

install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" \
  | tee /etc/apt/sources.list.d/docker.list > /dev/null

Install Docker Engine, CLI, containerd, and the Compose plugin:

portainer-lxc

apt-get update -y
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Enable Docker to start on boot and start it now:
portainer-lxc
```
systemctl enable docker
systemctl start docker
```
Verify Docker is running and test with hello-world:
portainer-lxc
```
systemctl is-active docker
docker run --rm hello-world
```
You should see the "Hello from Docker!" message. If you get a permission or cgroup error, double-check that nesting is enabled on CT 200.

✅ Phase 2 Checkpoint

docker run --rm hello-world completes successfully. systemctl is-active docker returns active.

Phase 3 — Deploy Portainer CE

Still inside the LXC shell. Portainer CE will run as a Docker container and persist its data in a named volume.

Create the named Docker volume for Portainer persistent data:
portainer-lxc
```
docker volume create portainer_data
```
Verify the volume was created:
portainer-lxc
```
docker volume ls | grep portainer_data
```
Pull the latest Portainer CE image:
portainer-lxc
```
docker pull portainer/portainer-ce:latest
```
Deploy the Portainer CE container. This single command exposes HTTP (9000) and HTTPS (9443) and mounts the Docker socket so Portainer can manage the local environment:
portainer-lxc
```
docker run -d \
  --name portainer \
  --restart always \
  -p 8000:8000 \
  -p 9443:9443 \
  -p 9000:9000 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest
```
Key flags explained:
- --restart always — Portainer restarts automatically with Docker
- -p 9443:9443 — HTTPS management UI
- -p 8000:8000 — Edge agent tunnel (needed for future Edge agent labs)
- -v /var/run/docker.sock — Grants Portainer access to the local Docker daemon
- -v portainer_data:/data — Persists Portainer configuration across container restarts
Verify Portainer is running:
portainer-lxc
```
docker ps --filter name=portainer
```
Expected: STATUS shows Up X seconds or minutes.
Open a browser on your workstation and navigate to:
Browser
```
https://192.168.129.11:9443
```
Accept the self-signed certificate warning. The Portainer initial setup screen should appear.

⏱ Timing Note
Portainer has a 5-minute timeout for initial admin account creation from first start. If the setup screen never appeared and you see a login prompt instead, restart the container: docker restart portainer
Create your admin account. Choose a strong password (minimum 12 characters). Record the credentials in your lab password vault before clicking Create User.

🔴 Document Credentials Now
Username: admin
Password: [your chosen password]
Portainer URL: https://192.168.129.11:9443
Store these in the lab password vault before proceeding.
After logging in, Portainer will prompt you to configure the initial environment. Select Get Started to use the local Docker socket environment (the LXC's own Docker daemon). You will add the remote environment in Phase 4.

✅ Phase 3 Checkpoint

Portainer CE web UI loads at https://192.168.129.11:9443. Admin login succeeds. The local Docker environment (portainer-lxc) appears in the Environments list with status Up.

Phase 4 — Deploy Portainer Agent and Register the Remote Environment

Step 4.1 — Deploy the Portainer Agent on docker-host-01

SSH to the Docker host at 192.168.128.92. You can use the automated script or run the commands manually.

Option A — Automated Script

Copy and run the preflight agent script on docker-host-01:

Your workstation

scp setup-docker-portainer-agent.sh user@192.168.128.92:/tmp/
ssh user@192.168.128.92 "sudo bash /tmp/setup-docker-portainer-agent.sh"

Option B — Manual Steps

SSH to the Docker host and ensure Docker starts on boot:
docker-host-01
```
ssh user@192.168.128.92
sudo systemctl enable docker
```

Open TCP/9001 in the host firewall:

docker-host-01 (UFW)

# If using UFW:
sudo ufw allow 9001/tcp comment 'Portainer Agent'
sudo ufw status

docker-host-01 (firewalld)

# If using firewalld:
sudo firewall-cmd --permanent --add-port=9001/tcp
sudo firewall-cmd --reload

Deploy the Portainer Agent container. Use the same version tag as your Portainer CE instance:
docker-host-01
```
docker run -d \
  --name portainer_agent \
  --restart always \
  -p 9001:9001 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /var/lib/docker/volumes:/var/lib/docker/volumes \
  portainer/agent:latest
```
Key flags explained:
- -p 9001:9001 — Exposes the agent API to Portainer CE
- -v /var/run/docker.sock — Grants agent access to the Docker daemon
- -v /var/lib/docker/volumes — Allows agent to manage Docker volumes
Verify the agent is running and port 9001 is listening:
docker-host-01
```
docker ps --filter name=portainer_agent
ss -tlnp | grep 9001
```

Step 4.2 — Validate Connectivity from Alpine Probe (GNS3)

Open the console on alpine-probe-01 in GNS3 and run the following connectivity checks:

alpine-probe-01

# Ping both hosts
ping -c 3 192.168.129.11
ping -c 3 192.168.128.92

# Test Portainer HTTPS port
nc -zv 192.168.129.11 9443

# Test Portainer Agent port on Docker host
nc -zv 192.168.128.92 9001

All four tests must succeed before proceeding to register the remote environment.

⚠️ If nc Is Not Available on Alpine

Install it with: apk add netcat-openbsd — Alpine uses a minimal package set.

Step 4.3 — Register Remote Environment in Portainer CE

In the Portainer web UI, navigate to Settings → Environments (or click the Environments link in the left sidebar).
Click Add environment. When prompted for environment type, select Docker Standalone then click Start Wizard.
Select the Agent connection method (not "API" or "Socket"). Fill in the fields:

Field Value

Name docker-host-01

Environment URL tcp://192.168.128.92:9001
Click Connect. Portainer will attempt to reach the agent. After a moment, the environment should show status Up.

💡 Tip
If the connection fails, verify the agent container is running on docker-host-01 and port 9001 is reachable from the LXC: nc -zv 192.168.128.92 9001 run from inside the LXC.
Click Close to return to the Environments list. You should now see two environments:
- local — The LXC's own Docker daemon (status: Up)
- docker-host-01 — Remote Docker host via agent (status: Up)
Click on docker-host-01 to switch to that environment. Navigate to Containers. You should see the existing containers (nginx-lab, whoami-lab) running on the remote host.
Perform the following lifecycle operations from the Portainer UI to confirm full management capability:
- Select the nginx-lab container and click Stop
- Confirm the container state changes to Exited
- Click Start to bring it back up and confirm it returns to Running
- Click the container name → Logs tab → verify log output appears

Field	Value
Name	docker-host-01
Environment URL	tcp://192.168.128.92:9001

✅ Phase 4 Complete — Lab Objective Achieved

Both environments visible and Up in Portainer. Remote containers visible, stoppable, startable, and log-accessible from the Portainer web UI. The centralized Docker management platform is operational.

Troubleshooting

Use this section when something does not work as expected. Issues are grouped by symptom.

Docker Engine Won't Start in LXC

Symptom

systemctl start docker fails or docker run hello-world returns a cgroup or permission error.

Cause

Nesting feature not enabled on the LXC container, or the container is running as unprivileged without the required AppArmor profile overrides.

Resolution

Exit the LXC shell. On the Proxmox host, verify nesting is enabled:
Proxmox Shell
```
pct config 200 | grep features
```
Expected output: features: nesting=1
If nesting is not set, apply it and restart the container:
Proxmox Shell
```
pct set 200 --features nesting=1
pct stop 200 && pct start 200
```
If running unprivileged, check for AppArmor issues:
portainer-lxc
```
journalctl -u docker --no-pager -n 30
```

Portainer Web UI Not Accessible

Symptom

Browser cannot reach https://192.168.129.11:9443 — connection refused or timeout.

Resolution

Verify the Portainer container is running:

portainer-lxc

docker ps --filter name=portainer
docker logs portainer --tail 30

Confirm the port is listening:
portainer-lxc
```
ss -tlnp | grep 9443
```
Check for a host firewall blocking 9443 on the LXC:
portainer-lxc
```
ufw status
iptables -L -n | grep 9443
```
If UFW is active and blocking: ufw allow 9443/tcp
If the Portainer container exited, inspect why and restart:
portainer-lxc
```
docker inspect portainer | grep -A5 '"Status"'
docker start portainer
```

Portainer Admin Account Creation Timed Out

Symptom

Navigating to the Portainer URL shows the login screen instead of the initial setup wizard — the 5-minute setup window expired.

Resolution

portainer-lxc

# Restart the Portainer container to reset the timer
docker restart portainer

# Then immediately open the browser to:
# https://192.168.129.11:9443

Complete account creation within 5 minutes of the container starting.

Remote Environment Shows "Down" or Cannot Connect

Symptom

After adding docker-host-01 as an environment, the status shows Down or the connection wizard returns an error.

Diagnostic Tree

Confirm the Portainer Agent container is running on docker-host-01:
docker-host-01
```
docker ps --filter name=portainer_agent
docker logs portainer_agent --tail 20
```
Test port 9001 reachability from inside the LXC (Portainer's perspective):

portainer-lxc
nc -zv 192.168.128.92 9001

If this fails, the issue is network or firewall — not Portainer configuration.
Check the firewall on docker-host-01:
docker-host-01
```
sudo ufw status | grep 9001
sudo ss -tlnp | grep 9001
```
Add the rule if missing: sudo ufw allow 9001/tcp
Verify the Environment URL in Portainer is exactly tcp://192.168.128.92:9001 (include the tcp:// prefix).
Check for version mismatch between Portainer CE and the Agent:
portainer-lxc + docker-host-01
```
# On portainer-lxc:
docker inspect portainer | grep -i '"Image"' | head -1

# On docker-host-01:
docker inspect portainer_agent | grep -i '"Image"' | head -1
```
Both should reference the same version tag. Update the agent image to match if they differ.

LXC Container IP Address Not Reachable

Symptom

Cannot ping 192.168.129.11 from other hosts on the lab network.

Resolution

Verify the container's network configuration from the Proxmox host:

Proxmox Shell
pct config 200 | grep net

Should show bridge=vmbr0,ip=192.168.129.11/24,gw=192.168.128.1
Inside the LXC, verify the interface is up and has the correct IP:
portainer-lxc
```
ip addr show eth0
ip route show
ping -c 3 192.168.128.1
```
If the interface is missing or shows a different IP, edit the network config inside the LXC:
portainer-lxc
```
cat /etc/netplan/*.yaml
# If IP is wrong, edit and apply:
netplan apply
```

Alpine Probe Cannot Reach Hosts

Symptom

Pings from alpine-probe-01 time out to lab hosts.

Resolution

Verify the GNS3 Cloud node is linked to vmbr0 (not a different bridge). In GNS3, right-click the Cloud node → Configure → check the interface mapping.
Confirm the Alpine node has the correct static IP:

alpine-probe-01
ip addr show eth0 # If missing, set manually: ip addr add 192.168.128.200/24 dev eth0 ip route add default via 192.168.128.1
Verify the GNS3 project is started (all nodes green) and the Cloud → Alpine link is connected (cable icon visible).

Verification

Complete every verification step in order to confirm full lab success. Screenshot or record evidence for your lab documentation.

📋 Documentation Reminder

Your lab submission must include: LXC container configuration details, IP addressing table, Portainer admin credentials stored in the lab vault, a screenshot of the Portainer Environments page showing both environments healthy, and the agent deployment command used on docker-host-01.

Step 1 — Network Reachability (Alpine Probe)

Run from the GNS3 alpine-probe-01 console:

alpine-probe-01

# L3 reachability
ping -c 4 192.168.129.11
ping -c 4 192.168.128.92

# Port connectivity
nc -zv 192.168.129.11 9443
nc -zv 192.168.129.11 9000
nc -zv 192.168.128.92 9001

✅ Expected

All pings reply. All three nc tests return Connection to [host] [port] port [tcp/...] succeeded!

Step 2 — Portainer Web UI Access

Open a browser and navigate to https://192.168.129.11:9443.
Log in with your admin credentials. Confirm you reach the Portainer dashboard without errors.

✅ Expected

Portainer dashboard loads. The browser address bar shows https://192.168.129.11:9443/#!/home (or similar). No login failures.

Step 3 — Verify Both Environments Are Healthy

Navigate to Environments in the Portainer left sidebar.
Confirm both environments are visible:

Environment Name Type Expected Status

local Docker Standalone (socket) Up

docker-host-01 Docker Standalone (agent) Up

📸 Take a screenshot of this page for your lab documentation.

Environment Name	Type	Expected Status
local	Docker Standalone (socket)	Up
docker-host-01	Docker Standalone (agent)	Up

Step 4 — Verify Remote Containers Are Visible

Click on the docker-host-01 environment to switch context.
Navigate to Containers in the left sidebar.
Confirm the containers pre-deployed on docker-host-01 (e.g., nginx-lab, whoami-lab) appear in the list with status Running.

✅ Expected

At least two containers appear. State column shows running.

Step 5 — Container Lifecycle Operations via UI

Select the nginx-lab container (checkbox) and click Stop.
Confirm status changes to Exited.
Select it again and click Start. Confirm status returns to Running.
Click the container name to open the detail view. Click the Logs tab. Confirm log output appears.

✅ Expected

Stop → Exited → Start → Running cycle completes successfully. Log output visible in the Portainer log viewer.

Step 6 — Verify Persistent Data Volume

Confirm the portainer_data volume exists and Portainer configuration survives a container restart:

portainer-lxc

# Verify volume exists docker volume inspect portainer_data # Restart Portainer and confirm settings persist docker restart portainer sleep 10

After restart, log into the Portainer UI again — your environments and admin account should still be present (not reset).

✅ Expected

Volume inspect shows Mountpoint pointing to a Docker volumes path. After restart, both environments are still present and admin login works.

Step 7 — Verify Docker Auto-Start on Both Hosts

portainer-lxc

systemctl is-enabled docker

docker-host-01

systemctl is-enabled docker

✅ Expected

Both return enabled.

Complete Verification Checklist

#	Check	Expected Result
1	Ping 192.168.129.11 from Alpine probe	Replies
2	Ping 192.168.128.92 from Alpine probe	Replies
3	nc -zv 192.168.129.11 9443	Succeeded
4	nc -zv 192.168.128.92 9001	Succeeded
5	Portainer UI loads at https://192.168.129.11:9443	Login page / dashboard
6	Admin login succeeds	Dashboard visible
7	Environments page shows "local" as Up	Green Up badge
8	Environments page shows "docker-host-01" as Up	Green Up badge
9	Remote containers visible in docker-host-01 environment	nginx-lab, whoami-lab listed
10	Stop/Start container from UI	State changes correctly
11	View container logs from UI	Log output visible
12	portainer_data volume exists	docker volume inspect succeeds
13	Docker enabled on portainer-lxc	systemctl: enabled
14	Docker enabled on docker-host-01	systemctl: enabled

Knowledge Check

Test your understanding of the concepts covered in this lab. Select the best answer for each question and click Check Answer.

1. Why must the nesting=1 feature be enabled on a Proxmox LXC container before installing Docker Engine inside it?

It increases the container's CPU allocation to support containerized workloads. It allows the LXC kernel to run nested container runtimes by enabling the required cgroup and namespace features inside the container. It enables the LXC container to access the host's physical NIC directly without a bridge. It grants the container root access to the Proxmox host filesystem.

2. What is the purpose of mounting /var/run/docker.sock into the Portainer CE container?

It provides Portainer with persistent storage for its database and configuration. It allows Portainer to communicate directly with the local Docker daemon to manage containers on the same host. It exposes the Portainer web UI port to the host network. It enables TLS encryption between Portainer and remote Docker agents.

3. Which Portainer connection method is used in this lab to manage the remote Docker host at 192.168.128.92, and on which TCP port does it communicate?

Docker API over TCP/2375 (unauthenticated) SSH tunneling over TCP/22 Portainer Agent over TCP/9001 Portainer Edge Agent over TCP/8000 with reverse tunnel

4. What is the primary benefit of using a named Docker volume (portainer_data) rather than a bind mount for Portainer's /data directory?

Named volumes allow Portainer to use NFS storage automatically. Named volumes are managed by Docker and persist independently of the container lifecycle — Portainer configuration survives container removal and recreation. Named volumes provide better read/write performance than bind mounts in all cases. Named volumes encrypt data at rest by default.

5. In this lab, what is the role of the GNS3 Alpine Linux probe node (192.168.128.200)?

It runs the Portainer Agent as an alternative to docker-host-01. It simulates external internet traffic to the Portainer server for load testing. It provides a lightweight, independent network vantage point to validate Layer 3 reachability and TCP port connectivity between the Portainer server and Docker host before agent deployment. It acts as a DNS server for container name resolution across the lab network.

6. You have successfully deployed Portainer CE and added the remote Docker host. A junior team member notices that Portainer shows environment status "Down" for docker-host-01 after the environment was working earlier. Which of the following is the MOST likely cause and first check?

Portainer CE has expired — it requires a license renewal to maintain agent connectivity. The portainer_agent container on docker-host-01 has stopped — check with docker ps --filter name=portainer_agent and restart if needed. The Portainer named volume was deleted — recreate it with docker volume create portainer_data. The LXC container IP address changed — update the Portainer server bind address in its configuration file.

7. Which docker run flag ensures the Portainer CE container automatically restarts if the LXC is rebooted or Docker daemon is restarted?

--keep-alive --restart on-failure --restart always --daemon

8. Portainer has a 5-minute timeout window during initial setup. What happens if this window expires before you create the admin account, and how do you recover?

Portainer permanently locks the admin setup — you must delete the portainer_data volume and redeploy the container. The Portainer container automatically creates a default admin/admin account that must be changed on first login. The setup wizard is replaced by the login screen; restarting the Portainer container resets the 5-minute timer and returns the setup wizard. You must reinstall Portainer using a different image tag to reset the timeout.