Portainer-Command: The Safe Way to Put AI to Work on Your Kubernetes Fleet

This webinar aired live on Wednesday 14 October 2026. If you couldn’t make it, or want to revisit a section, you can watch the complete recording at the link above.

Anyone can point an AI agent at kubectl today. What most teams can't do is get that approved, and for good reason. An agent holding someone's cluster credentials is hard to trace when it gets something wrong and harder to undo.

Portainer-Command is a governed, audited workspace where your developers use an AI agent to deploy and manage workloads on the Kubernetes clusters you already manage with Portainer. Agents connect over MCP, whether that's Claude, another MCP-compatible client, or a workspace your admins provision inside Portainer. They can read cluster state through sessions that carry a stated reason, expire on a time limit, and map to a named person. They cannot write to the cluster directly. Each agent gets access only to its own environment's manifest folder, and its changes land as pull requests that a human approves before Portainer applies them through GitOps. After the merge, the agent checks the rollout and corrects a failed deployment.

In this session, Nathan Peck, Chief Product Officer at Portainer, will show Portainer-Command on a live environment. Two groups of teams will get the most out of it.

If you haven't started using AI for ops, you'll see the built-in workspace. It needs no setup, comes with a prompt library for real tasks like security audits, image pinning and network policies, and lets you undo every change. The guardrails are what let you begin.

If your engineers are already using AI agents against your clusters, officially or otherwise, you'll see how to bring that under control. The demo covers per-environment rules for what agents can read or propose, namespace restrictions, and a full timeline of AI activity for tracing what happened during an incident. You'll also see one-click revert of any AI change, rollback to a known-good state, and emergency halt that cuts off agents at the fleet, environment or user level.

One thing to know going in: Portainer-Command runs independently of your existing pipelines, repos and GitOps tooling (Portainer GitOps, Argo CD or Flux). It manages its own workloads through its own GitOps repository, so you can start with new services or a non-production environment. It doesn't yet manage applications deployed from your own repositories through Portainer GitOps; we're actively working on this.

Every registrant will receive our published threat model, which documents the threats and mitigations, to share with your security team.

Speakers

Nathan Peck Chief Product Officer, Portainer

Nathan has spent more than a decade building and operating container platforms in production, across Amazon Elastic Container Service and Kubernetes. He focuses on container orchestration and on using automation to solve real operational problems.