Hacker News Reader

Comment by HTTP418 | Hacker News Reader

Why run docker in lxc when you can run lxc directly?

LXC doesn't have the images and tools ecosystem around. Also, LXC and Proxmox have a mutual vibe that is amazing to work with (if you care to take a closer look).

LXC is a first class citizen in Proxmox, with clear documentation, config files, CLI tools and web UI. It can be backed-up just like a VM (Proxmox Backup Server FTW!), can be set up mostly like a VM, it boots instantly and so on. It's such a joy to work with, unless you want access to actual hardware (which includes things like mounting or hosting NFS/Samba), but even then it's easy to find help on docs and forums (the latter are surprisingly up to date).

But LXC does not have that "ephemeral" nature like Docker. Container "templates" are clean but full operating systems, full hard drives are connected and host all data, both user files/images and OS. Just like a VM, I guess.

Now, you can actually run Docker inside LXC easily and have best of both worlds: docker with docker-compose and alike to quickly prototype and homelab AND super light and quick to boot machines which will host that Docker for you.

It's actually a very clean and pleasant approach, I highly recommend this as tool for testing and homelabing.

just out of curiosity - why wouldn't You do a SAMBA in LXC? Specially since there's a turnkey template exactly for this.

Is it for making a RAID directly on the HW drives?

Oh no, just these services still use some /dev/ and /proc/ stuff, unprivileged container doesn't have access to that. So you either have to run privileged container (I wanted to avoid this), try to pass-through all devices needed, or mount those on the underlying host OS and pass that to container as a bind mount.

For me so far there is always a decent workaround when I want to use USB device etc.. The only thing I am currently stuck with is sound in LXC container (I build kind of a VDI desktop, RDP access to a system with KDE) and struggle to pass the actual sound card through. There is some active proxmox forum thread on that so I'm hopeful.

I would LOVE it if proxmox supported docker (or podman) out-of-the-box. (I mean with docker/podman showing up in the gui, just like LXC containers and vms)

LXC is just a container, docker is much more than just that. It is a recipe (dockerfiles), it is sort of a social project sharing setup, it is like a version control system (the layered filesystem that only updates changes), it is a disposable dev container, it is a deployable runtime container, etc

This is one of the reasons is switched to TrueNas Scale for my HomeServer. Before that I always had a VM that was the Docker Host and another one with OpenMediaVault as Backup Server. Both these VMs are replaced by TrueNas. Less complexity and less maintenance overhead.

Have you by chance tried GPU passthrough on TrueNAS Scale? I'm planning a Homelab do-over this summer and one requirement is to have a Windows VM with a dedicated GPU I can use as a Steam host via Parsec.

I haven't used TrueNAS since it was FreeNAS and BSD based.

I run nested Docker in unprivileged LXC on Proxmox on ZFS since 2019 without problems. Gitlab, Nextcloud, mailcow-dockerized etc., for 10 people, - altogether 10 LXC with about 25 Docker services, 1-2% CPU utilization on average, thanks to sharing all resources of the host. I've written a blog post about it [1].

[1]: https://du.nkel.dev/blog/2021-03-25_proxmox_docker/

Heck, I didn't know you could run containers in containers. I'm setting up some container VMs on my Proxmox soon and didn't even think of using LXC since I thought it technically infeasible.

And yes as others have said, LXC and docker use cases seem different.

LXC seems to be for the same use case as VMs, but smaller, easier to spin up, better resource utilization, etc.

Docker can be used that way too, but is more useful with the surrounding ecosystem of being ephemeral (all data stored on remote storage, container only contains the "app") and with supporting deployment infrastructure.

Reply on news.ycombinator.com