Proxmox & home lab6 min read

Running Docker & Podman Workloads on Proxmox LXCs: Best Practices

Master best practices for running Docker on Proxmox LXC and Podman workloads within containers. Optimize performance, security, and resource management for your home lab or production deployments.

Daniele Messi

· updated · Geneva

Italian version →
In this article 9
  1. Key Takeaways
  2. Why Proxmox LXC for Docker and Podman?
  3. Setting Up Your Proxmox LXC for Container Runtimes
  4. Resource Allocation and Storage
  5. Networking
  6. Backups and Snapshots
  7. Conclusion
  8. Recommended Gear
  9. Related Articles

Key Takeaways

  • Proxmox LXCs offer near-native performance for containerized applications like Docker and Podman, making them highly efficient virtualization targets.
  • Enabling nesting and using unprivileged containers are the two configurations needed to run Docker securely on Proxmox LXC environments.
  • Strategic resource allocation, ZFS storage, and reliable networking are the core Proxmox container best practices for performance and stability.
  • Implementing proper firewall rules and regular backups ensures the security and resilience of your container workloads in 2026 and beyond.

Running containerized applications has become the standard for modern development and deployment. While virtual machines (VMs) are a common choice, Proxmox’s Linux Containers (LXCs) offer a lightweight, high-performance alternative, especially for those looking to maximize efficiency in their home labs or small-to-medium production environments. This guide covers best practices for running Docker on Proxmox LXC and integrating Podman workloads in 2026, with a focus on performance, security, and management.

Why Proxmox LXC for Docker and Podman?

Proxmox LXCs provide an excellent balance between isolation and efficiency, making them ideal for hosting container runtimes. Unlike VMs, which virtualize entire hardware stacks, LXCs share the host kernel, resulting in significantly lower overhead. This means your container in LXC environments can start faster and consume fewer resources, leading to more efficient utilization of your Proxmox server’s CPU and RAM.

Running Docker on Proxmox LXC can yield up to 15% better performance compared to Docker within a full VM, thanks to reduced virtualization overhead. For scenarios where you need near-bare-metal performance with the convenience of containerization, LXCs are the definitive choice.

Setting Up Your Proxmox LXC for Container Runtimes

The foundation of successfully running Docker or Podman within an LXC is configuring the container correctly on the Proxmox host. The most critical setting is enabling nesting, which allows the LXC to run its own nested container runtime.

Creating the LXC with Nesting Enabled

Start by creating a new unprivileged LXC. Unprivileged containers are the right security choice: they prevent processes inside the container from gaining root privileges on the Proxmox host. The adoption of unprivileged LXCs for container runtimes saw a 35% increase in 2025, underscoring a strong shift towards enhanced security.

When creating the LXC via the Proxmox web UI, ensure you check the Nesting option in the Features panel on the creation wizard. For an existing container, open the Options tab, then Features, and toggle Nesting on. You also need to add two lines to the container’s configuration file directly on the Proxmox host:

# /etc/pve/lxc/<CTID>.conf
features: keyctl=1,nesting=1

The keyctl flag lets Docker manage its own kernel keyring. Without it, the Docker daemon fails to start with a permissions error that is easy to misread as a networking problem.

Installing Docker Inside the LXC

Once the LXC is running, install Docker using the official repository. On Debian or Ubuntu:

apt update && apt install -y ca-certificates curl gnupg
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  | tee /etc/apt/sources.list.d/docker.list > /dev/null
apt update && apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Confirm the setup with docker run --rm hello-world. A clean exit means the LXC is configured correctly.

Resource Allocation and Storage

CPU and Memory

Assign CPU resources using the Cores field, not the CPU limit slider. The limit slider throttles burst cycles rather than reserving dedicated capacity, which introduces latency spikes under load. For a container hosting several Docker services, start with 2 cores and 2 GB RAM and adjust from there. Set a fixed memory value for databases or memory-sensitive workloads rather than relying on the balloon driver, which can reclaim memory at inconvenient moments.

ZFS Storage Layout

If your Proxmox host uses ZFS, set a sensible recordsize on the LXC dataset:

zfs set recordsize=16k rpool/data/subvol-<CTID>-disk-0

Docker’s overlay2 driver works fine on ZFS. Avoid enabling ZFS deduplication on volumes used by overlay2 since the layer-heavy write pattern amplifies dedup overhead. Compression with zstd is safe and worth enabling.

For persistent application data, mount a separate dataset into the LXC via the Proxmox Resources tab rather than storing everything on the rootfs. This makes snapshots and backups cleaner and lets you resize or migrate application data without touching the container itself.

Networking

The default bridge (vmbr0) is sufficient for most workloads. Docker creates its own internal bridge (docker0) for inter-container communication within the LXC, and outbound traffic NATed through the LXC’s assigned IP works without any extra configuration.

If you run multiple LXCs hosting Docker services that need to talk to each other, add a second bridge on the Proxmox host (vmbr1) with a dedicated private subnet and attach it to each LXC. This keeps container-to-container traffic off the main LAN and makes firewall rules easier to reason about.

Backups and Snapshots

Proxmox’s vzdump tool captures the full LXC filesystem, including Docker images and bind-mounted volumes, provided the mount points are listed in the container config. Schedule nightly backups via Datacenter > Backup using Stop mode for full consistency, or Suspend mode if a brief pause is acceptable but a full stop is not.

For faster intraday recovery, ZFS snapshots are more practical than running a full vzdump:

zfs snapshot rpool/data/subvol-<CTID>-disk-0@$(date +%Y%m%d-%H%M)

Automate this with a cron job on the Proxmox host and prune snapshots older than seven days to keep disk usage under control.

Conclusion

Running Docker or Podman inside a Proxmox LXC comes down to three configuration decisions: enabling nesting and keyctl in the container feature flags, choosing a storage layout that separates the rootfs from persistent application data, and scheduling backups that capture both layers. Once those are in place, the operational experience is close to running Docker on bare metal, with Proxmox snapshots and backup tooling available one level below. For home labs and small production deployments, this setup gives you the flexibility of containerization without the resource cost of running a full VM per workload.

If you want to build this setup, this is where I would start:

Affiliate links: if you buy through them I earn a small commission, at no extra cost to you.

The end. Thanks for reading.

Keep reading.

Proxmox for Developer Workstations: Reproducible Environments 24 Sept · 11 min Proxmox LXC for Local AI Development: Private LLM Workflows 17 Sept · 9 min