Plesk Docker extension: container management for hosting customers

Plesk ships a free Docker extension that turns the panel into a container manager — pull from Docker Hub or a private registry, run images, set resource limits, map ports, and proxy traffic from any Plesk domain into a container. For hosts, the appeal is offering customers Redis, Memcached, MongoDB, Mailpit, n8n, or any one-off app without building a custom service or carving out a separate VPS.

The catch is that Docker on a multi-tenant host is a root-equivalent escape waiting to happen if you grant access to the wrong audience. This guide covers installation, the permission model, port and proxy configuration, the persistence and backup gaps, and the cleanup cron everyone forgets until disk fills.

When the Docker extension is and isn't appropriate

Docker on Plesk is Linux-only — Windows Plesk has no Docker extension and no roadmap for one. Any modern AlmaLinux, Rocky, Debian, or Ubuntu install runs it without kernel changes.

Don't expose Docker to untrusted shared-hosting tenants. The Docker daemon runs as root, and any account that can mount the host filesystem, run privileged containers, or reach the daemon socket through a sidechannel can read every other customer's data. Plesk's UI sandbox helps for casual misuse, but it isn't a security boundary. Reserve the extension for:

• VPS or dedicated customers running their own Plesk instance
• Trusted reseller accounts on documented service tiers
• Internal use — your own monitoring, mail relays, or ancillary services on the hosting fleet

Skip it for £4-a-month shared plans. If you need per-tenant resource isolation on a shared box, CloudLinux's LVE model is the right tool, not Docker.

Step 1 — Install Docker Engine on the host

The Plesk extension is a UI wrapper; it does not bundle the Docker daemon. Install Engine from the distro repo first.

# AlmaLinux/Rocky 9
dnf install -y docker-ce docker-ce-cli containerd.io
systemctl enable --now docker

# Ubuntu 24.04
apt install -y docker.io
systemctl enable --now docker

Verify the socket is up before installing the extension:

docker info | head -5

If docker info errors with permission denied, the daemon isn't running or the socket at /var/run/docker.sock is owned by the wrong group. Plesk talks to the socket as root, so socket permissions almost never cause UI errors — but systemctl status docker will catch a stopped daemon every time.

Step 2 — Install the Plesk extension

From the CLI:

plesk bin extension --install docker

Or in the UI: Extensions → Extensions Catalog → Docker → Install. The first time you open the extension, Plesk inspects the daemon and shows an empty container list. If it reports "Cannot connect to Docker daemon", restart both services and re-check:

systemctl restart docker
systemctl restart psa

Step 3 — Grant access to specific accounts

By default only the admin sees Docker in the navigation. To expose it to resellers, edit their service plan:

Service Plans → [plan] → Permissions → Manage Docker containers

For customer subscriptions the same toggle lives under the reseller's hosting plan permissions. Plesk does not let you scope which images a tenant can pull — once Docker is enabled for an account, they have the full Docker Hub catalogue.

If you need to restrict the catalogue (compliance, abuse prevention, bandwidth cost), the only workable route is a private registry plus an egress firewall rule blocking docker.io:

# block direct egress to Docker Hub, force pulls through the local registry
iptables -A OUTPUT -d registry-1.docker.io -j REJECT
iptables -A OUTPUT -d production.cloudflare.docker.com -j REJECT

Point the daemon at your registry in /etc/docker/daemon.json:

{
  "registry-mirrors": ["https://registry.your-company.com"]
}

registry-mirrors alone does not block Docker Hub — it only mirrors pulls. The firewall rule is the part that actually constrains tenants.

Step 4 — Map domains to containers

Two things happen when you launch a container in Plesk:

1. The container's exposed ports get bound to host ports.
2. Optionally, a Plesk domain proxies HTTP traffic into the container.

The proxy is what makes this hosting-friendly. Instead of telling customers to hit https://server.example.com:32768, you bind app.customer.com to the container and Plesk's nginx terminates TLS and forwards the request.

Configure it in Domains → [domain] → Docker Proxy Rules → Add Rule:

• URL — the public path on the domain (/ for the whole domain, /admin for a subpath)
• Container — pick the running container from the dropdown
• Container port — the container-internal port, not the host-mapped one

WebSocket forwarding lives behind the "Use WebSocket" toggle in the Advanced section. Without it, anything that upgrades the connection — Mailpit's live view, n8n, Jupyter — will fall back to long-polling or break outright.

Step 5 — Resource limits

The container creation dialog exposes Memory limit and CPU quota fields under Resource limits. These map directly to Docker's --memory and --cpus flags. Two limitations matter:

• Limits apply per container, not per subscription. A reseller running ten containers each capped at 1 GB still consumes 10 GB.
• Plesk does not integrate with CloudLinux LVE for container-level constraints. The host's overall CPU and memory are the only ceilings.

For hosts that already run CloudLinux on multi-tenant boxes and want comparable container-tier isolation, the only clean answer is a separate Docker host per service tier, linked to your Plesk fleet via Multi-Server.

Backups and persistence

Plesk's Backup Manager captures container configurations and metadata, but not the contents of Docker volumes. Anything written inside a container, or to a named volume, is invisible to Plesk's Backup Manager. Two options:

• Mount volumes onto paths inside the customer's home directory (/var/www/vhosts/customer.com/docker-data/redis/). These paths are inside the Plesk backup scope and travel with subscription backups.
• Run separate volume backups out of cron — docker run --rm -v volume_name:/data -v /backup:/backup alpine tar czf /backup/volume.tar.gz /data — and ship the tarball to the same destination as your other backups.

The first approach is the only one customers can self-service through the Plesk UI. Default to it.

Updating images and pruning the disk

The extension shows an "Update" button next to each container that re-pulls the current tag and recreates the container with the same config. It does not delete the old image. Disk fills fast on busy hosts.

A weekly prune cron handles this:

0 4 * * 0 docker image prune -af --filter "until=168h" && docker volume prune -f --filter "label!=keep"

The label!=keep filter on volume prune lets you opt specific volumes out of cleanup by labelling them at creation: docker volume create --label keep=true customer-data. Without that label, the cron will delete any unreferenced volume — which is normally what you want and occasionally catastrophic.

For hosts running many short-lived test containers, schedule docker container prune -f daily as well.

Common errors

• docker: Error response from daemon: driver failed programming external connectivity — the host port you tried to bind is in use. Restart Docker or pick a different mapping.
• "Plesk cannot manage this container" — the container was created with docker run from the CLI, not the extension. Plesk only manages containers it launched. To adopt one, stop it and recreate through the UI with the same image and config.
• "Image pull failed: unauthorised" — you're hitting a private registry without credentials. Drop a config.json in /root/.docker/ (root runs the daemon, not the Plesk user) with the registry auth section.
• Container starts but the proxy returns 502 — the proxy rule points at the wrong container port. Use the port the container exposes internally, not the host-mapped port shown in the container list.

Next steps

• Plesk Git deployment for client sites — the other half of the developer-friendly Plesk story; many container-based stacks pair a Git-deployed frontend with a Docker-hosted backend.
• Plesk Web Pro vs Web Host edition — Docker works on both, but reseller capabilities and the 30-domain cap differ in ways that matter when you start onboarding customers.
• Activate or renew a Plesk license for production fleets — the extension is free but only runs on a licensed Plesk instance.