Proxmox VE guide (4): LXC containers, the lightweight alternative

Where this guide comes from: at work I administer a Proxmox VE cluster every day, with Ceph storage and backups to Proxmox Backup Server. This series is the version for starting from scratch at home, with a single server, and follows the official Proxmox VE 9.2 documentation.

In part 3 we created virtual machines. Now for their little sibling: LXC containers.

What an LXC container is

A virtual machine simulates a whole computer, with its own kernel and its own system. An LXC container, on the other hand, is Linux sharing the host’s kernel (Proxmox), but with its own filesystem, users, processes and network.

	Virtual machine	LXC container
Operating system	Anything (Linux, Windows…)	Linux only
Boot time	Tens of seconds	A couple of seconds
Memory	Whatever you assign, plus the full OS	Very little
Isolation	Maximum	Good, but shares the kernel

For a simple Linux service (a web server, a test database, a DNS server…), LXC is perfect.

What about Docker?

Docker also uses containers, but with a different philosophy: one container per app, disposable, created from an image. An LXC is more like a full Linux you look after like a small server: you update packages, SSH in, and so on.

Step 1: download a template

Containers are created from templates (ready-made base systems):

1. local storage → CT Templates → Templates.
2. Pick, for example, Debian 13 or Ubuntu and click Download.

Step 2: create the container

Create CT button:

• General:
  • CT ID and Hostname.
  • Unprivileged container: leave it ticked (explained below).
  • Root password and, better still, your public SSH key.
• Template: the one you downloaded.
• Disks: 8 GB is usually enough for a small service.
• CPU: 1 core.
• Memory: 512 MB; raise it if the service needs it.
• Network: bridge vmbr0, and DHCP or a fixed IP (fixed is better for services).
• DNS: use the host’s settings.

Finish, Start, and it’s running in a couple of seconds.

To get in from the host’s console:

pct enter 105

(with your container’s number). Or from the web UI: Console.

First thing inside, as on any Debian:

apt update && apt full-upgrade

Unprivileged: why it matters

In an unprivileged container, root inside isn’t root on the host: Proxmox maps it to a normal user with no special permissions. If someone compromised the container, they’d have a much harder time damaging Proxmox.

Privileged containers exist for very specific cases (certain network or hardware mounts), but to start with, always unprivileged.

Sharing a host folder

If you want the container to access a Proxmox folder (say, a data disk), you use a mount point:

pct set 105 -mp0 /mnt/data,mp=/data

Inside the container it shows up as /data. In unprivileged containers, watch out for permissions: users inside have different numbers on the host, so you sometimes need to adjust ownership.

When NOT to use LXC

• If you need Windows or any non-Linux system: VM.
• If you need a different kernel or custom kernel modules: VM.
• For Docker: it can run inside LXC with options like nesting enabled, but Proxmox recommends running Docker inside a virtual machine. Fewer problems with updates and isolation. At work I do run some Docker containers inside an LXC and they work fine, but for something new I’d start with a VM.
• If isolation is critical (something exposed to the Internet): a VM separates better.

My rule for the lab

• Simple, trusted Linux service → LXC.
• Windows, Docker, or anything sensitive → VM.

In part 5, the most important one: backups and snapshots, and why they’re not the same thing.