I run a small server with Proxmox, and I’m wondering what are your opinions on running Docker in separate LXC containers vs. running a specific VM for all Docker containers?

I started with LXC containers because I was more familiar with installing services the classic Linux way. I later added a VM specifically for running Docker containers. I’m thinking if I should continue this strategy and just add some more resources to the docker VM.

On one hand, backups seem to be easier with individual LXCs (I’ve had situations where I tried to update a Docker container but the new container broke the existing configuration and found it easiest just to restore the entire VM from backup). On the otherhand, it seems like more overhead to install Docker in each individual LXC.

  • bizdelnick@lemmy.mlEnglish
    101·
    2 days ago

    What’s the purpose of running container in a container? Why not install docker on your host machine?

    • ddh@lemmy.sdf.orgEnglish
      81·
      2 days ago

      If you do that, Docker is stuck on that host. If it’s in an LXC it can move to another host. Plus, backing up and snapshotting are easier IMO.

      • bizdelnick@lemmy.mlEnglish
        5·
        2 days ago

        Snapshotting in docker is as easy as docker commit. After that you can back it up with docker save. Then move to another host, but not without downtime.

        However normally you need to backup/move only volumes attached to containers. If that’s not the way how you like to organize your services, you likely don’t need docker.

      • bizdelnick@lemmy.mlEnglish
        1·
        22 hours ago

        Well, I don’t use proxmox, however docker coexists with libvirt and other virtualization systems. If there are overlapping networks that docker ant proxmox attempt to manage, they are configurable.

      • sugar_in_your_tea@sh.itjust.worksEnglish
        1·
        2 days ago

        I don’t use proxmox, but it works absolutely fine for me on my regular Linux system, which has a firewall, some background services, etc. Could you be more specific on the issues you’re running into?

        Also, I only really expose two services on my host:

        • Caddy - handles all TLS and proxies to all other services in the internal docker network
        • Jellyfin - my crappy smart TV doesn’t seem to be able to handle Jellyfin + TLS for some reason, it causes the app to lock up

        Everything else just connects through an internal-only docker network.

        If you’re getting conflicts, I’m guessing you’ve configured things oddly, because by default, docker creates its own virtual interface to explicitly not interfere with anything else on the host.

          • sugar_in_your_tea@sh.itjust.worksEnglish
            2·
            2 days ago

            I don’t use proxmox, so I guess I don’t understand the appeal. I don’t see any reason to backup a container or a VM, I just backup configs and data. Backing up a VM makes sense if you have a bunch of customizations, but that’s pretty much the entire point of docker, you quarantine your customizations to your configs so it’s completely reproducible if you have the configs and data.

            • MangoPenguin@lemmy.blahaj.zoneEnglish
              2·
              1 day ago

              Ease of use mostly, one click to restore everything including the OS is nice. Can also easily move them to other hosts for HA or maintenance.

              Not everything runs in docker too, so it’s extra useful for those VMs.

              • sugar_in_your_tea@sh.itjust.worksEnglish
                1·
                1 day ago

                That’s fair.

                That said, I can’t think of anything I’d want to run that doesn’t work in docker, except maybe pf? But I’d probably put that on a dedicated machine anyway. Pretty much everything else runs on Linux or has a completely viable Linux alternative, so I could easily built a docker image for it.

    • mr_jaaay@lemmy.mlOPEnglish
      1·
      2 days ago

      Honestly, I never really thought of installing Docker directly on Proxmox. I guess that might be a simpler solution, to run Dockers directly, but I kind of like to keep the hypervisor more stripped down.