Containers
Manage Docker containers and cloud workloads
BeyondTrust Gateways
The dashboard always keeps one gateway per cloud for its own tunnels and jumps, and removes it once nothing is using it. Add your own to carry session traffic — as many as you want, in whatever regions you want. They join the same PRA Gateway as additional cluster nodes, so nothing needs repointing.
Only regions with a per-region config set are listed — add one under Settings → Multi-region to deploy elsewhere. A region without its own subnet would put the gateway on the default region's network. Blank zone uses .
| Status | Name | Cloud | Region | Host | Created by | Actions |
|---|---|---|---|---|---|---|
| Loading… | ||||||
| No gateways yet. The managed one appears here the first time the dashboard needs it. | ||||||
| managed | Job | |||||
A gateway in error kept its row so the reason stays visible — open its job for the detail. Hover any status for the reason behind it.
missing means the host is no longer in the cloud and nothing asked for it to be removed. Remove the row, or deploy a replacement to take over its share of the session load.
degraded means the host is up but is not running the gateway task, so it cannot broker a session — the Cloud tab's ECS Tasks list shows the same thing. The next deploy that needs this gateway starts the task.
Let the dashboard run Portainer CE for you — a single container on a public Container-Optimized-OS GCE VM, firewalled to your allowed sources. A successful deploy fills in the URL and API token below automatically. This node is ephemeral: tearing it down wipes its users, environments and settings.
A managed Portainer server can't be deployed yet.
Set a GCP project (and the allowed source CIDRs) in Settings → Containers. You can still connect your own Portainer server instead.
Blank region keeps the node's current region (or the configured default). Only regions with a configured subnet are listed — the node needs a public subnet, and a subnet is regional on every cloud. Blank zone uses the region's first available zone; a capacity-exhausted zone auto-falls back to a sibling in the same region. Redeploying to a different region or cloud relocates the node.
Creates a portainer-ui Web Jump and stores the generated admin credential in the chosen
PRA Vault account group for injected login — the password never appears here. The Gateway's egress IP
is auto-added to the node firewall. Applied on Deploy/Redeploy.
Access:
No API token is stored for this node, so the environments below can't be listed yet. Mint one below, or add your own in Settings → Containers.
Durable state is on: survives a teardown,
so the next deploy comes back with its users, environments and settings. The disk keeps
billing until you tear the node down and confirm deleting it.
Reachability is governed by the portainer_allowed_source_cidrs firewall rule
(tcp 9443/8000; Settings). Stop deletes the VM + firewall and clears the node's runtime config.
Makes Portainer requestable in Entitle through a REST integration in
Ephemeral Accounts mode. A granted request mints a jit- user and adds it to
the team the requester asked for; a revoke removes that membership and the account.
Access is granted through team membership, so configure the environment
access policy on a team once and the per-request part stays reversible. Your real
Portainer users are never listed to Entitle, and the adapter refuses to delete an
account it did not create.
Not available yet:
vpc only if this Portainer is reachable from the function's subnet.
Adapter:
DRY RUN
STRANDED
Targets:
Endpoint Entitle calls:
Entitle integration:
Added to the node firewall:
— from the adapter's own network, which is no longer the node's, so it
admits nothing.
Entitle registration is disabled, so the adapter is deployed but not requestable.
Set entitle_registration_enabled in Settings, then use
Register in Entitle on the Cloud Functions page.
No Entitle integration is recorded for this adapter — check the
cloudfn_entitle_register job, or register it from the Cloud Functions page.
This server can't reach into your network — it has no Docker socket and no route to a
LAN address. An Edge agent runs on the Docker host and polls
outbound to port 8000 here, so nothing inbound is needed.
Run this on . The key is shown once — it isn't stored anywhere.
The agent appears as environment # within a few seconds of starting. Re-running Refresh above will list it.
Merges users, teams, memberships and registries from a migration bundle. Existing names are matched, not duplicated, so re-importing is safe. Environment connections are never imported — use the Edge agent above.
A Portainer .tar.gz backup can't be uploaded directly: it only restores
into a blank Portainer. Open it with a throwaway one, then
python -m web_dashboard.scripts.portainer_migrate export to get a bundle.
See the Portainer guide.
Selected .
Choosing an environment also deploys the bundle's stacks there —
that starts containers.
Portainer is not configured
Manage Docker hosts — cloud or on-prem — from this page by either deploying a managed Portainer CE server above, or connecting one you already run — set its URL and API token in Settings → Integrations → Portainer CE.
Portainer connection error
Check the Portainer URL, API token, and SSL settings in Settings → Integrations → Portainer CE.
Containers
Fetching containers from Portainer…
| Name | Image | Status | Ports | Actions |
|---|---|---|---|---|
| — |
|
Stacks
| Stack Name | Status | Type |
|---|---|---|
ECS Tasks
ECS error
| Task ID | Definition | Containers | Status | Started | Stopped | Actions |
|---|---|---|---|---|---|---|
Azure Container Instances (ACI)
| Name | State | CPU / Memory | Containers | Created | Actions |
|---|---|---|---|---|---|
| Running Failed |
|
GCE Container Instances
| Name | Purpose | Zone | Machine | Container Image | Status | Actions |
|---|---|---|---|---|---|---|
Both run as containers on Container-Optimised OS GCE instances. Gateways are recreated automatically on the next VM deploy; Compose instances are deployed via + Deploy Compose. Stop / Delete removes the COS instance.
GCP Cloud Run Jobs
| Name | Purpose | Region | Image | Status | Created |
|---|---|---|---|---|---|
Ansible, image-promote, and Kubernetes runners execute as ephemeral Cloud Run Jobs and are removed when they finish — only the ones still in flight are listed here.
Rancher management node
A single privileged Rancher container on a public Container-Optimized-OS GCE VM. Import any k8s cluster into it — the cattle-cluster-agent dials out to this node, so private clusters on any cloud / on-prem work as long as they have egress. This node is ephemeral: a stop/recreate changes its IP and wipes state.
Rancher node isn't configured yet.
Set a GCP project and a Rancher bootstrap password (and allowed source CIDRs) in Settings → Kubernetes before deploying.
Node
Blank region keeps the node's current region (or the configured default). Only regions with a configured subnet are listed — the node needs a public subnet, and a subnet is regional on every cloud. Blank zone uses the region's first available zone; a capacity-exhausted zone auto-falls back to a sibling in the same region. Redeploying to a different region or cloud relocates the node.
A deploy reuses a running node, and a container's arguments are fixed when it is created — so changing the certificate domain cannot take effect without replacing it. Leave this off and the deploy will refuse rather than silently ignore the change. Replacing wipes Rancher's state (it lives inside the container): users, settings and imported clusters go, and the clusters must be re-imported. On Azure with a certificate domain set the node keeps its address, so DNS needs no change.
Creates a rancher-ui Web Jump and stores the generated admin credential in the chosen
PRA Vault account group for injected login — the password never appears here. Applied on Deploy/Redeploy.
Access:
Entitle: registered as
— users request
just-in-time Rancher RBAC in Entitle, which mints an ephemeral account per grant.
The grant shows only the password — the username is the requester's
Entitle email.
Entitle: not registered.
A node deploy registers automatically, and it is best-effort — so either that
attempt failed, or entitle_registration_enabled was switched on
afterwards. Use Register in Entitle above; track it in Jobs.
Entitle: resource registration is
off (entitle_registration_enabled in Settings → Integrations), so this
node is not requestable.
Agent-brokered (entitle_rancher_private): the shared Entitle agent
reaches this node from inside, so no inbound ranges are opened for Entitle.
Entitle's cloud dials this node directly, so the node firewall admits its egress
ranges for as long as the integration exists:
. Deregistering takes
them away again. This is the set the rule is BUILT from, not a read of the live
rule — if a grant still times out, Re-apply firewall, and if it
already lists these, your tenant egresses from somewhere else (the published
addresses are per-deployment, not per-region): override with
entitle_source_cidrs.
Registered, but Entitle cannot reach it.
Entitle's cloud dials this node directly and its egress ranges are not known to
this dashboard, so the firewall was not opened to them. Registration succeeded
regardless — it talks to Entitle's API, not to the node — and a grant will time
out until you set entitle_source_cidrs (Entitle's published
allow-list for your region) or switch to agent-brokered mode with
entitle_rancher_private.
Reachability is governed by the rancher_allowed_source_cidrs firewall rule (Settings).
Stop deletes the VM + firewall and clears the node's runtime config.
Import a cluster
Creates an imported cluster in Rancher and returns a registration command to run against the target cluster's kubeconfig. Works for private clusters anywhere (egress to this node only).
Deploy + bootstrap the node first (it needs a server URL + API token).