Making containers clickable, or running the platform
Portainer’s promise is simple and it keeps it. One self-hosted GUI over Docker, Swarm, Podman and Kubernetes lets a small team, or one without Kubernetes specialists, deploy and manage workloads safely. One licence covers every runtime, and its edge agents manage huge fleets of devices: Portainer tested 2.45 against 500,000 of them.
Ankra covers more of the work behind a production service. It builds the cluster, turns a repository into a release that passed tests and scans, keeps the platform add-ons current, ranks vulnerabilities, estimates cost and backs up data. Its AI works across all of it.
Portainer helps people do the work. Ankra does more of the work and asks people to approve it.
Where Portainer is heading
Portainer released 3.0.0 on 29 October 2026 and 3.0.1 on 4 November. The company describes it as “Kubernetes-first, not Kubernetes-only”: Docker, Swarm and Podman environments stay in the product and keep working, but get no new policy, GitOps or observability features. Community Edition stays on the 2.x line.
The 3.0 releases are short-term support versions, which Portainer does not recommend for production. 2.45 LTS is the production line, and the first long-term 3.x release, 3.3, is planned for December 2026. Several features below exist only in 3.0, so check which line you would run.
Cluster creation has narrowed. Portainer removed its multi-cloud provisioning in 2.43, and today it creates Talos clusters through Sidero Omni. For devices and factory floors it also installs KubeSolo, its own single-node Kubernetes, which 3.0 can roll out in bulk over SSH.
Ankra builds kubeadm or k3s on Hetzner, OVHcloud, UpCloud, DigitalOcean, AWS EC2 and Proxmox VE. It creates EKS, GKE, AKS, DOKS, OVHcloud MKS and UpCloud UKS. Two more, Scaleway Kapsule and Ankra Cloud Kubernetes on Ankra Cloud, Ankra’s own EU cloud, are in closed beta. It imports any conformant cluster, Talos included. On clusters it builds, it handles upgrades, node groups and power schedules, and on the five public clouds node autoscaling and rolling OS security patching.
Delivery and GitOps
Portainer’s Git support has grown up. Applications can come from Git sources and redeploy on a polling interval or a webhook, and the “Always apply manifest” option re-applies on every interval, overwriting local changes. Portainer can build images, but it has no CI pipeline with tests or scanners. In 3.0, a reconciliation engine in beta adds server-side apply, pruning, drift and health reporting, and stacks that deploy in dependency order.
Ankra’s stacks order Helm charts and manifests by dependency, so the database comes up before the service that needs it. Its own deployment engine applies every Git push, and two-way Git sync commits platform changes back to the repository and holds any sync that would remove a large share of a cluster. Stack profiles carry a proven setup to the next environment.
For your own code, Applications generate the build files and deploy every successful build, or keep the CI you already have. Ankra Pipelines run tests, rootless builds and Semgrep, Checkov and Trivy scans in your own cluster, and only the image that passed the gate is published. Applications work with GitHub repositories, and some documented pipeline stage kinds do not run yet. Pull-request previews exist for Applications on GitHub, but Ankra’s docs say not to rely on them yet.
Security, cost and data
Portainer adds governance through fleet policies for Pod Security Standards and network security, plus a FIPS mode. Its 3.0 release adds a vulnerability scanning policy that deploys the Trivy Operator and lists workloads by their worst severity. 2.45 LTS has no vulnerability scanning. Portainer has no cost tools, and its backups cover the Portainer server itself.
Ankra’s Security Center lists vulnerabilities across every cluster and ranks them by CISA’s Known Exploited Vulnerabilities catalogue and FIRST’s EPSS scores, so the exploited ones come first. Its scanning baseline is installed by default on clusters Ankra builds and is opt-in on imported ones. It adds optional SBOMs and compliance evidence for Pod Security Standards, and for CIS and NSA/CISA where enabled. Ankra’s security and compliance material is on its trust page.
Cloud Cost estimates spend per namespace and stack from list prices. Backups write volumes and PostgreSQL or MySQL dumps to a bucket you own and restore them in place. Databases run by CloudNativePG or Percona operators are captured, but cannot yet be restored in place.
AI on both sides
Portainer has a careful AI design. Portainer-Command gives AI agents such as Claude Code and Cursor expiring, read-only access to clusters. Their only write path is a Git pull request that a person approves, with one-click revert and an emergency halt. It is available now and included with a Business licence, the free 3-node one too. Portainer-Run is a governed place to deploy AI-built business apps, and its assistant answers health questions from logs and events.
Ankra’s AI is part of the platform rather than an add-on. It drafts stacks from a description, analyses firing alerts with AI Insights, reviews pull requests and opens fix pull requests on GitHub through the AI Gateway, and commits fixes to a failing pull request’s own branch. Its own writes wait for a person by default, and autonomy controls set how far it may go. Ankra also has an MCP server for your own tools, where writes are audited and your client decides how to confirm them.
When to choose Ankra, and when to choose Portainer
Choose Ankra when Kubernetes is your production platform and you want clusters, delivery, vulnerability ranking, cost and backups in one product, with an AI that does the routine work and asks before it changes anything.
Choose Portainer when
- Docker, Swarm or Podman matter as much as Kubernetes
- you manage large edge or industrial fleets of devices, including single-node ones
- you want a self-hosted platform on every plan, not only on Enterprise
- you want a GUI that lets non-specialists run containers, with AI agents kept read-only
Compare the work that remains
- Create the foundation. Record the servers, network and storage work done outside the product.
- Ship a release. Include tests, scans, a staging deploy and a rollback.
- Handle an incident. Note who finds the cause and how the fix reaches the cluster.
- Investigate a vulnerability. Find every affected workload and decide which to fix first.
- Compare total cost. Include licences, the hours your team spends on platform work and the infrastructure.
Portainer publishes its pricing: 3 nodes free, then Starter from $1,045 and Scale from $2,095 a year. Ankra’s free tier includes 30 worker vCPU, and beyond that Startup costs €0.01 per worker vCPU-hour, about €7.20 a month. Your provider bills the servers. See Ankra’s pricing.
Reviewed 9 November 2026 against Portainer’s documentation and pricing. Product scope and plans can change.