Contribute

We value contributions from the Portainer community and encourage developers to propose fixes, improvements, and new ideas.

The following guidelines outline our engineering workflows, please review these before making a contribution to ensure any changes can be integrated smoothly.

Contributing to the Portainer CE codebase

AI assistance notice

If you use any form of AI assistance to create your contribution - whether for code, documentation, or drafting pull request (PR) responses - it must be disclosed in your pull request description.

Trivial assistance, like single-word auto-completion, does not require disclosure. Disclosing AI usage helps maintainers apply the correct level of scrutiny during review.

For commits where an AI tool has significantly contributed to the code, it is recommended to add a Co-Authored-By trailer in the commit message to formally credit the tool, using the format specified by the tool's provider.

The Portainer CE codebase is available in GitHub. Please follow our build instructions and the following guidelines when making a contribution.

Repository structure

• Our main development occurs in private repositories, which are mirrored to public GitHub repos (e.g. portainer/portainer).

• The develop and release/* branches in public repositories are read-only: merges into these branches are blocked to preserve synchronization with our internal repositories.

Contribution process

1. Fork the repository

   • Create your own fork of the relevant Portainer public repository.

2. Create a feature branch

   • Base your changes on the current develop branch (not main or release/*). This ensures you are working off the latest version of the codebase.

3. Submit a Pull Request (PR)

   • Open your PR against the develop branch.

4. Review and feedback

   • Contributions will be reviewed by Portainer engineers.

   • We may request changes to align with coding standards, tests, or design decisions.

   • In some cases, we may adapt or refactor a contribution before merging.

5. Integration

   • Once approved, Portainer engineers will cherry-pick contributions into the upstream private repository.

   • These changes will then flow into develop and subsequent releases through our normal sync process.

   • Not all contributions will be integrated upstream. Decisions will be based on roadmap alignment, technical fit, and quality.

Contribution expectations

• Coding standards: Please follow existing project style and conventions.

• Tests: Include tests where applicable. Contributions without tests may be delayed.

• Documentation: Update relevant docs (e.g. README, usage notes) when changing functionality.

• Scope: Focus on well-defined features, fixes, or improvements. Large architectural changes should be discussed in an issue first.

Communication

• Use GitHub Ideas to propose new features or significant changes before starting work.

• PR discussions are the best place for clarifications on specific contributions.

Reporting bugs

If you find a bug, please tell us so we can triage it. All bugs are managed in the GitHub issues repo. When you click through, our template makes it easy to record all of the details. Check the list of open bugs before reporting to avoid duplicates.

This article covers how we prioritize bug fixes.

Reporting security vulnerabilities

The Portainer team takes the security of our products seriously. If you believe you have discovered a security vulnerability in any Portainer-owned repository, please report it responsibly.

Please do not report security vulnerabilities through public channels, including standard GitHub issues.

Instead, report vulnerabilities using one of the following methods:

• Email the Portainer team at [e-mail]

• Submit a private vulnerability report through the relevant Portainer repository on GitHub

These channels allow the team to review and address the issue as quickly as possible while minimizing the risk of public exposure before a fix is available.

In your report, please include a description of the vulnerability and the potential impact, step-by-step reproduction, and the version and environment where you found it. We will acknowledge your report, give an initial assessment, and provide an estimated timeline for remediation - we do not commit to a fixed window. We will let you know when a fix ships and credit you using your GitHub handle.

Portainer does not operate a paid bug bounty program and does not offer monetary rewards for vulnerability reports. Portainer will not pursue legal action against good-faith research conducted in line with this policy.

Feature requests

You can request new features by posting an Idea in our GitHub Discussions forum. Please check to see if someone has already requested the feature you want, and give it an upvote if so.

Learn how we prioritize feature development in this article.