Understanding LXC containers#

An LXC container is an isolated Linux environment with its own processes, users, system files and network interfaces. It can be used much like a small server: install packages, start services with systemd and connect over SSH. It uses the host’s kernel, however. Installing Ubuntu inside a container provides Ubuntu programs without booting a separate Ubuntu kernel. LXC: introduction

In this homelab, Proxmox VE manages these containers. LXC 120, named coolify, provides the environment for Coolify.

LXC, virtual machines and Docker#

Layer	What it provides	Use here
Virtual machine	virtual hardware and an operating system with its own kernel	systems requiring their own kernel or stronger isolation
LXC	a Linux environment using the host’s kernel	Ubuntu with package management, SSH and Docker
Docker	images and containers for applications and their dependencies	the services operated by Coolify

Linux separates what processes can see using mechanisms including namespaces. cgroups limit and distribute resources such as memory and CPU time. Having its own IP address and filesystem does not turn a container into a VM. LXC: kernel features

What unprivileged means#

I can be root inside the container without having the same user ID as root on the Proxmox host. An unprivileged LXC maps its user IDs to different, unprivileged IDs on the host. The kernel is still shared; a VM is a better choice when stronger isolation is required. Proxmox: containers and isolation

Two features are enabled for Docker inside this LXC:

Feature	Purpose
`nesting=1`	permits nested containers and the required visibility into system filesystems
`keyctl=1`	permits the `keyctl()` system call, which Proxmox lists as a requirement for Docker in unprivileged containers

These permissions expand what the guest can do. The container remains unprivileged. Proxmox: feature reference

Creating the Coolify LXC#

Run the following commands as root on the Proxmox host. They assume x86-64, an unused CT ID 120, template storage local, container storage local-lvm and bridge vmbr0. Adjust those names and resources to match the host.

First update the template catalogue and download the Ubuntu 24.04 template:

pveam update

COOLIFY_TEMPLATE=$(pveam available --section system \
  | awk '$2 ~ /^ubuntu-24\.04-standard_.*_amd64/ {print $2; exit}')

pveam download local "${COOLIFY_TEMPLATE:?No Ubuntu 24.04 template found}"

After a successful download, create the container in the same shell. This command uses the final static network configuration directly; during the original setup, the address was changed from DHCP to static after the container had started.

pct create 120 "local:vztmpl/${COOLIFY_TEMPLATE}" \
  --hostname coolify \
  --ostype ubuntu \
  --unprivileged 1 \
  --features nesting=1,keyctl=1 \
  --cores 4 \
  --memory 4096 \
  --swap 512 \
  --rootfs local-lvm:40 \
  --net0 name=eth0,bridge=vmbr0,ip=10.10.10.20/24,gw=10.10.10.1 \
  --nameserver 10.10.10.3 \
  --onboot 1 \
  --start 1

--onboot enables startup when the host boots; --start starts the new container immediately. --swap 512 permits up to 512 MiB of swap available on the host; it does not create a separate swap file. Proxmox: templates, pct command reference

The IP address and VLAN must match#

10.10.10.20/24 belongs to this setup; it is not a universal default. Before reusing it, check address allocations and the DHCP range in the UDM. A static address must not belong to another device and must be excluded from dynamic allocation.

The hypervisor port profile carries server VLAN 10 as native/untagged. That is why net0 has no tag=10 here. If the server VLAN is instead carried tagged to the host, the switch, bridge and guest configuration must match that arrangement. An IP address alone does not select a VLAN.

Entering the container#

On the host:

pct enter 120

Commands now run inside the LXC. Set a password for console login and check the network configuration:

passwd
ip -4 -br addr show eth0
ip -4 route
getent hosts coolify.io

Expect 10.10.10.20/24, a default route through 10.10.10.1 and successful name resolution. Use exit to return to the host. Continue with Installing Coolify.

What Proxmox backs up#

A container backup can include the root filesystem and its installed services. For additional mount points, inclusion depends on their type and backup setting; host bind mounts are excluded from these backups. Databases also need a consistent backup and a tested recovery procedure. Proxmox: container backups

Having the host in the cluster xlab does not create a second copy of the container disk. Here it remains on the respective node’s local local-lvm storage.