Portainer 3.0 Ends the Community Edition: Dockge vs Komodo vs Arcane as the Docker-Only Replacement

On September 11, 2026, Portainer CEO Neil Cresswell published a post titled "Portainer 3.0 is coming, and here's what it means for you." For the ten million people Portainer says its Community Edition touched (Portainer's own retrospective, April 2026), the translation is blunt: CE's future is its past. Version 2.45 LTS is the last release in the 2.x line, and 3.0 ships with no Community Edition build at all — the only free path onto 3.x is a node-capped Business Edition license tied to a Portainer account, not an open-source build.

Run Portainer CE? Here is the verdict up front, receipts below:

• Single box with compose stacks: run Dockge.
• Several hosts with GitOps deploys: run Komodo.
• Closest thing to CE's breadth on Docker alone: run Arcane.
• Git-push-to-URL instead of a console: Coolify or Dokploy — read the licensing row first.
• Kubernetes in your future: none of the above — skip to the catch section.

What Portainer actually announced​

Cresswell's announcement makes three moves at once. First, 2.45 LTS is the final 2.x release; 3.0.0 arrives as a short-term-support release on a new Kubernetes-first codebase, with a 3.x LTS to follow.

Second, the product splits into single-purpose consoles — Portainer-Run (already live), Portainer-IDP, Portainer-Command, Portainer-Operations, and Portainer-AiGrid — and every one of them is Kubernetes-only. Third, and most quoted: CE continues on the 2.x codebase and will not receive the 3.x changes, while 3.x stays free for the community under the existing 3 Nodes Free program. Portainer's reasoning is worth quoting directly: 3.x "is tailored specifically for an enterprise audience," and "releasing that as CE would misrepresent what it is and who it is for."

Docker users get a softer landing than the headlines suggest, but a landing all the same. Docker, Swarm, and Podman environments still work in 3.x — nothing that works today gets ripped out — but they are now "secondarily ordered" in the UI, with no new policy, GitOps, or observability capabilities coming. The stated reason is engineering arithmetic: every new capability in policy management, the operations API, and the auth model had to be built three times over, against three substrates.

There is also an AI-agent argument: Docker and Swarm have no equivalent of network policies, pod security standards, or admission controllers, the primitives Portainer wants for sandboxing autonomous agents. To ease the transition: a Docker-to-Kubernetes migration add-on, Portainer-D2K (a free synthetic-Docker translator running as a Kubernetes deployment), and KubeSolo, a sub-200MB MIT-licensed single-node Kubernetes with D2K embedded.

After the backlash came a clarification — "We are not abandoning Docker" — backed by large customers on Docker and Podman alone, one managing an edge fleet of over 125,000 Docker devices growing by around 7,000 a month. Any future Docker end-of-life would come with advance notice and a migration path. A maintenance build, 2.45.1 LTS, shipped on September 17 with security fixes and no new features. Coverage from Linuxiac and SelfHostPilot converges on three options, adapted here:

That last row is this post: SelfHostPilot's five replacements, each measured against what CE covered for free.

The baseline: what CE covered for free​

Any comparison needs a denominator, so here is the CE bundle you are trying to replace. Portainer CE is a Zlib-licensed open-source build covering Docker environments, Compose stacks, and multi-environment management through agents, with local users and teams for access control (Cloudzy's CE/BE breakdown). What it never included is the Business Edition layer: OAuth/SSO, granular RBAC, AD/LDAP, and audit logging — BE-only then and now, free for up to three nodes (Portainer's own CE-vs-BE page).

Note the tell, written before 3.0: "Choose Community Edition only if you specifically require a fully open-source build with no license key." CE was already the exception in Portainer's framing, not the default. Version 3.0 just makes it official.

The comparison​

Stars are GitHub counts at the time of writing (mid-October 2026); licenses verified against repo metadata.

Three patterns jump out first. First, every replacement's auth is weaker than CE's teams (Dockge) or stronger in exactly the SSO direction Portainer charges for (Komodo, Arcane) — the middle is empty. Second, Swarm support survives only in Komodo 2.0 and Arcane. Third, Coolify and Dokploy are a different species — PaaS panels, not consoles — so read their row as "different job," not "worse console."

Dockge: the compose purist​

Dockge is built by Louis Lam, the developer behind Uptime Kuma, and its README states the thesis as a FAQ: "Portainer provides a lot of Docker features. While Dockge is currently only focusing on docker-compose with a better user interface and better user experience." In practice: an interactive compose.yaml editor, a web terminal, one-click image updates, a converter that turns docker run invocations into compose files — and files that stay on disk, so terminal and UI never fight. Multi-agent support since 1.4.0 shows stacks from many hosts in one UI, though the ceiling is stack management, not fleet operations.

The honest caveats are auth and velocity. Dockge has an admin login, but no teams, no roles, no SSO — the current install guidance treats TLS plus authentication in front of Dockge (proxy, tunnel, or VPN-only) as mandatory hardening, not optional, because the docker socket behind that login is root-equivalent (Bitdoze's October 2026 guide). And 1.5.0 — a March 2025 security release — remains the last stable, with development landing in bursts. Verdict: the single-box answer, and the right default for a short list of compose files.

Komodo: the fleet builder​

Komodo is the one Linuxiac now says "has already displaced Portainer as the default first choice for many users." The architecture explains why: a Core server plus a Periphery agent on every host, with no server limit, outbound connections for NATed hosts, PKI agent auth with rotation, and reusable onboarding keys. Version 2.0 added Docker Swarm support, which makes Komodo one of only two tools here that covers CE's Swarm users. Above that sits a build-and-deploy engine — GitOps sync, build servers, procedures — that CE never attempted.

Komodo's auth story is arguably the strongest free offering in the table: local users, linked OIDC/GitHub/Google logins, passkey/TOTP two-factor, API keys, and registration controls (v2.0.0 release notes). That is SSO plus 2FA for free — the exact layer Portainer gates behind Business Edition. The price is GPL-3.0 copyleft: irrelevant if you run it, worth knowing if you fork or embed it. Verdict: the multi-host answer — and the only replacement that is also a deployment pipeline.

Arcane: the modern all-rounder​

Arcane is the youngest tool here and the closest to CE's breadth on Docker alone: Swarm support, image builds, update checks, vulnerability scanning, volume backups, GitOps sync, and global env vars in a mobile-first Go UI. Direct or outbound-edge agents cover multi-environment management; auth spans local accounts, passkeys, TOTP, and OIDC SSO with role mapping (Arcane's SSO docs). It even publishes an SBOM — a transparency habit none of its rivals here match.

The tradeoff is maturity versus velocity. At 7,900 stars it is the smallest community here, but also the only project with commits landing daily through October 2026. You are betting that the fastest-moving project keeps moving. Verdict: the CE-breadth answer for Docker-only fleets, best suited to operators who update often and read changelogs.

Coolify and Dokploy: the PaaS pair​

Coolify and Dokploy share one section because they answer a different question: not "give me a console for my Docker hosts" but "give me git-push-to-URL with SSL on my own VPS." Both manage many servers, deploy apps and databases from git and compose, and handle TLS automatically. If your CE usage was mostly stacks-behind-a-proxy, either one absorbs that workflow — proxy configuration included.

The difference is licensing — sharp enough that we covered it standalone: Coolify is Apache 2.0 across the whole repo with no gated code, while Dokploy pairs an Apache 2.0 core with proprietary directories under the Dokploy Source Available License, gating SSO, custom RBAC roles, audit logs, and whitelabeling behind a commercial agreement for production use (our Dokploy-vs-Coolify licensing breakdown). For this post's auth axis: on Dokploy without an agreement, local users, full stop. Verdict: Coolify if you want the license question to evaporate; Dokploy if you prefer its product feel and will either pay for the enterprise layer or live without it.

The catch every row shares​

The shortlist carries its own warning label, and it applies to all five: "You give up Portainer's Kubernetes option if you ever need it." CE was a console for Docker and Kubernetes and the edge agents spanning them; every replacement above manages Docker-shaped infrastructure only. Outgrowing one box the Docker way — more hosts, more stacks — Komodo or Arcane carry you further than CE ever needed to. But outgrowing Docker itself is a migration, not an upgrade, and none of these tools is a stepping stone.

Portainer knows this: the announcement nudges Docker users toward D2K, the migration add-on, and KubeSolo — never toward a third-party console. Read that nudge for what it is: a vendor offering to keep you inside its licensing orbit through the transition. The honest alternative, if Kubernetes is in your future, is to learn it on substrates no vendor controls — Headlamp for the console, Cluster API for the machines — rather than arriving through a Business Edition license.

The open-core lesson​

Portainer did not relicense anything. The Zlib code stays Zlib; 2.45 CE keeps its security patches. What Portainer did is the subtler open-core maneuver: freeze the open build and tie the product's future to an account-gated artifact. The free thing stops tracking the real thing, and "free" quietly changes meaning from "open-source build" to "license tier." SelfHostPilot states the new reality plainly: "the free tier going forward is a Portainer Business licence tied to an account, not a community-maintained build."

This show has run before, with harsher endings. Terraform's BSL move begat OpenTofu; Redis's SSPL move begat Valkey; Elasticsearch's SSPL move begat OpenSearch — in all three cases the license change produced a foundation-homed fork of the last open release (The Register's 2025 retrospective, the Open Forum Europe research paper). The moral is structural: a vendor can narrow any tier it owns, usually for reasons that are rational from its side. Portainer's engineering arithmetic — every capability built three times — is genuinely sympathetic. Sympathy does not keep your console's roadmap pointed at your substrate.

The defense is to build on projects whose ownership structure makes the maneuver impossible. Cluster API lives in kubernetes-sigs under Apache 2.0 with no vendor edition to upsell you into. Headlamp is a CNCF project in kubernetes-sigs under Apache 2.0, and since the official Kubernetes Dashboard was archived on January 21, 2026, it is the console SIG UI itself recommends — the transition has an official Kubernetes blog guide. No single company can freeze either project's community build, because there is no other build. For every tool that does have a vendor, keep the ten-minute habit: read the LICENSE file at your deploy commit, grep for gated directories, and re-check on every upgrade — licenses move under you (details here).

The decision tree​

One box, compose files, no team. Dockge. Smallest concept count, files on disk, admin login behind your proxy or tailnet. Accept the bursty release cadence; compose files do not need weekly features.

Several hosts, GitOps deploys, maybe Swarm. Komodo. Core plus Periphery agents, the strongest free auth of the five, and a deployment engine CE never had. Accept GPL-3.0 and a bigger mental model than "console."

CE-like breadth, Docker-only, modern UI. Arcane. Swarm, builds, backups, vuln scans, OIDC with roles — the fullest Docker surface here. Accept the youngest codebase and update deliberately.

Git-push PaaS, not a console. Coolify for zero license diligence, Dokploy if you prefer its experience and have a plan for the DSAL-gated layer. Either way, read the license file at your deploy commit, not the marketing page.

Kubernetes in the roadmap. None of the five. Stay on 2.45 CE while it is patched; spend the migration energy on Headlamp and Cluster API, not another Docker console you will outgrow the same way.

Nothing here is urgent — the final mercy of a freeze as opposed to a kill. If your homelab runs Portainer 2.45 CE today, nothing breaks tomorrow. Update to 2.45.1 LTS, pick your lane from the tree above, and make the move on your own schedule — before the next announcement picks it for you.

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.