{"id":5212,"date":"2024-09-17T10:00:00","date_gmt":"2024-09-17T10:00:00","guid":{"rendered":"https:\/\/netguide.io\/linux\/docker-in-proxmox-ct-lcx-container-or-vm-best-practices\/"},"modified":"2024-09-17T10:00:00","modified_gmt":"2024-09-17T10:00:00","slug":"docker-in-proxmox-ct-lcx-container-or-vm-best-practices","status":"publish","type":"post","link":"https:\/\/netguide.io\/linux\/en\/docker-in-proxmox-ct-lcx-container-or-vm-best-practices\/","title":{"rendered":"Docker in Proxmox CT \/ LXC Container or VM \u2013 Best practices"},"content":{"rendered":"<script type=\"text\/plain\" data-tcf=\"waiting-for-consent\" data-id=\"4797\" data-bid=\"2\" data-placement=\"4798\">PGRpdiBpZD0ibmV0Z3VpZGVhLTI0NTI2MDA5MDQiIGNsYXNzPSJuZXRndWlkZWEtYmVmb3JlLWNvbnRlbnQgbmV0Z3VpZGVhLWVudGl0eS1wbGFjZW1lbnQiPjxkaXYgY2xhc3M9Im5ldGd1aWRlYS1hZGxhYmVsIj5BZHZlcnRpc2VtZW50czwvZGl2PjxzY3JpcHQgYXN5bmMgc3JjPSIvL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9qcy9hZHNieWdvb2dsZS5qcz9jbGllbnQ9Y2EtcHViLTYyNTg1NTYyNTcyNDU5OTgiIGNyb3Nzb3JpZ2luPSJhbm9ueW1vdXMiPjwvc2NyaXB0PjxpbnMgY2xhc3M9ImFkc2J5Z29vZ2xlIiBzdHlsZT0iZGlzcGxheTpibG9jazsiIGRhdGEtYWQtY2xpZW50PSJjYS1wdWItNjI1ODU1NjI1NzI0NTk5OCIgCmRhdGEtYWQtc2xvdD0iMzQ5NDExNTM0MiIgCmRhdGEtYWQtZm9ybWF0PSJhdXRvIj48L2lucz4KPHNjcmlwdD4gCihhZHNieWdvb2dsZSA9IHdpbmRvdy5hZHNieWdvb2dsZSB8fCBbXSkucHVzaCh7fSk7IAo8L3NjcmlwdD4KPC9kaXY+<\/script>\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/netguide.io\/linux\/de\/category\/proxmox\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Proxmox Category\">Proxmox<\/a> hypervisor natively supports two types of virtualization: <a href=\"https:\/\/netguide.io\/linux\/de\/category\/proxmox\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Proxmox Category\">Proxmox<\/a> CT or LXC (Linux Container) and KVM (Kernel-based Virtual Machine) VMs. Docker is not supported directly.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>LXC Container<\/strong>: Lightweight, fast and resource-saving virtualization, ideal for scalable applications and environments based on the same kernel.<\/li>\n\n\n\n<li><strong>KVM VMs<\/strong>: Complete, isolated operating systems with greater isolation and support for different operating systems, ideal for safety-critical and heterogeneous environments.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">LXC containers are more resource-efficient than full-fledged VMs as they share the kernel with the host, i.e. the Proxmox server itself. However, this also causes some problems: If you want to use features such as NFS, CIFS or GPU passthrough, the CT container must be created with privileges.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This gives the container root rights, even on the host itself. If an intruder can penetrate the CT, it is easy to compromise the entire host. Privileged LXC \/ CT containers should therefore only be used in absolutely exceptional cases.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">CT or VM as Docker host?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The VM clearly wins in terms of flexibility and security. The KVM VM is much better isolated from the host than the CT container, can have full root rights, use features such as GPU passthrough and thus supports live migration. The official Proxmox documentation also recommends implementing Docker hosts as VMs.<\/p>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What is a Live Migration?<\/summary>\n<p class=\"wp-block-paragraph\">Live migration is the process of moving a running virtual machine (VM) from one physical host to another without interrupting the operation of the VM. This allows maintenance work to be carried out or loads to be better distributed without the users accessing the VM&#8217;s services noticing any downtime. The VM remains active and accessible during the entire process, ensuring high availability and minimal service interruptions.<\/p>\n<\/details>\n\n\n\n<figure class=\"wp-block-pullquote has-text-align-left\" style=\"font-size:12px\"><blockquote><p>If you want to run application containers, for example, <em>Docker<\/em> images, it is recommended that you run them inside a Proxmox QEMU VM. This will give you all the advantages of application containerization, while also providing the benefits that VMs offer, such as strong isolation from the host and the ability to live-migrate, which otherwise isn&#8217;t possible with containers.<\/p><cite><a href=\"https:\/\/pve.proxmox.com\/pve-docs\/pve-admin-guide.html#chapter_pct\">Proxmox Documentation: 11th Proxmox Container Toolkit<\/a><\/cite><\/blockquote><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">While you can certainly use Docker in Proxmox CT containers and this makes sense in some use cases, it is generally better to use a VM.<\/p>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1721841165562\"><strong class=\"schema-faq-question\">Can I install Docker in a Proxmox CT \/ LXC container?<\/strong> <p class=\"schema-faq-answer\">Yes, you can install Docker in a Proxmox CT container.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1721841202494\"><strong class=\"schema-faq-question\">Can I install Docker in a Proxmox VM?<\/strong> <p class=\"schema-faq-answer\">Yes, Docker can be installed in a VM.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1721841231862\"><strong class=\"schema-faq-question\">What are the risks of using Privileged LXC Containers?<\/strong> <p class=\"schema-faq-answer\">Privileged containers have root access to the host \/ hypervisor and are therefore a security risk.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1721841336475\"><strong class=\"schema-faq-question\">What consumes fewer resources: Proxmox CT containers or VMs?<\/strong> <p class=\"schema-faq-answer\">Proxmox CT \/ LXC containers consume fewer resources than fully-fledged VMs.<\/p> <\/div> <\/div>\n<script type=\"text\/plain\" data-tcf=\"waiting-for-consent\" data-id=\"4799\" data-bid=\"2\" data-placement=\"4800\">PGRpdiBpZD0ibmV0Z3VpZGVhLTI3MjM2NTUzODciIGNsYXNzPSJuZXRndWlkZWEtYWZ0ZXItY29udGVudCBuZXRndWlkZWEtZW50aXR5LXBsYWNlbWVudCI+PGRpdiBjbGFzcz0ibmV0Z3VpZGVhLWFkbGFiZWwiPkFkdmVydGlzZW1lbnRzPC9kaXY+PHNjcmlwdCBhc3luYyBzcmM9Ii8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2pzL2Fkc2J5Z29vZ2xlLmpzP2NsaWVudD1jYS1wdWItNjI1ODU1NjI1NzI0NTk5OCIgY3Jvc3NvcmlnaW49ImFub255bW91cyI+PC9zY3JpcHQ+PGlucyBjbGFzcz0iYWRzYnlnb29nbGUiIHN0eWxlPSJkaXNwbGF5OmJsb2NrOyIgZGF0YS1hZC1jbGllbnQ9ImNhLXB1Yi02MjU4NTU2MjU3MjQ1OTk4IiAKZGF0YS1hZC1zbG90PSI0NTU5Nzg1MDAyIiAKZGF0YS1hZC1mb3JtYXQ9ImF1dG8iPjwvaW5zPgo8c2NyaXB0PiAKKGFkc2J5Z29vZ2xlID0gd2luZG93LmFkc2J5Z29vZ2xlIHx8IFtdKS5wdXNoKHt9KTsgCjwvc2NyaXB0Pgo8L2Rpdj4=<\/script>","protected":false},"excerpt":{"rendered":"<p>Should Docker run in a Proxmox LXC\/CT container or a VM? Compare isolation, resources, security and live migration to choose the best-practice Docker host.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_affilinode_tracking":"","_affilinode_autolink_off":false,"_affilinode_rating":"","_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[7],"tags":[],"class_list":["post-5212","post","type-post","status-publish","format-standard","hentry","category-uncategorized-en"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"Tobias","author_link":"https:\/\/netguide.io\/linux\/author\/tobias-pries\/"},"uagb_comment_info":0,"uagb_excerpt":"Should Docker run in a Proxmox LXC\/CT container or a VM? Compare isolation, resources, security and live migration to choose the best-practice Docker host.","brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts\/5212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/comments?post=5212"}],"version-history":[{"count":0,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts\/5212\/revisions"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/media?parent=5212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/categories?post=5212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/tags?post=5212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}