Proxmox LXC containers share the host kernel, so they start in seconds and use very little overhead compared with full VMs. Managing them well means understanding privileges, resource limits and how to share storage safely. Creating one is covered in create an LXC container.
Before you start
- A Proxmox VE host with at least one container.
- Root shell access for commands such as
pct.
Unprivileged vs privileged containers
| Unprivileged (default) | Privileged | |
|---|---|---|
| Root in container | Mapped to a normal user on the host | Same as root on the host |
| Security | Much safer | A container escape gives host root |
| Compatibility | Some apps and mounts need tweaks | Fewer restrictions |
Keep containers unprivileged unless an application truly requires otherwise, and never run untrusted users' workloads in privileged containers.
Change resources
- Resources tab: change cores, memory and swap live.
- Grow the root disk with Resources → Root Disk → Volume Action → Resize, or
pct resize 110 rootfs +5G. Containers see the new size immediately.
Share host storage with bind mounts
Bind mounts expose a host directory inside a container, for example a media library:
pct set 110 -mp0 /tank/media,mp=/srv/mediaIn unprivileged containers, file ownership is shifted (container root is UID 100000 on the host), so set host permissions to match or configure ID mapping.
Warning: Bind-mounted data is not included in container backups. Back up the host directory separately.
Run Docker inside a container
- In Options → Features, enable nesting (and keyctl for unprivileged containers if needed).
- Restart the container and install Docker.
For production Docker workloads, a full VM is often simpler and better isolated.
Back up and restore containers
- Containers are included in normal backup jobs (vzdump, PBS).
- Use snapshot mode on storage that supports snapshots for no downtime.
Troubleshooting
- Permission denied on a bind mount: UID mapping; chown the host directory to the shifted IDs (for example 100000:100000).
- Container will not start after a template change: run
pct start 110 --debugto see the reason. - Docker fails: nesting is not enabled.
Frequently asked questions
Container or VM?
Containers suit Linux services you trust; VMs suit Windows, custom kernels and untrusted workloads (containers vs VMs).
Can I convert privileged to unprivileged?
Back up and restore with the unprivileged option set.
Can containers be live migrated?
No, they migrate with a short restart.