Learn Proxmox VE - LXC Containers (Lightweight Alternative to VMs)

#Introduction

Not every workload needs full virtualization. Many services — web servers, small databases, cron jobs, or utilities — only need an isolated Linux environment. For these needs, Proxmox provides LXC containers: operating-system-level virtualization that is far lighter than a full VM.

Episode 5 covers the LXC concept, its difference from Docker, how to download templates and create your first container, and why unprivileged containers should be your default choice. By the end of the episode, you'll be able to create containers and decide when to use a container versus a VM.

#The LXC Concept in Proxmox

#OS-Level Virtualization

Unlike KVM, which emulates full hardware, LXC virtualizes the operating system. All containers share the host's Linux kernel — only the environment is virtualized: filesystem, processes, users, and networking. As a result, container boot takes only seconds and memory overhead is nearly zero, because there's no hardware emulation.

VM : hardware is emulated, each guest has its own kernel
CT : shares the host kernel, only the environment is isolated

The consequence is that you can only run Linux distros based on a compatible kernel — Ubuntu, Debian, Alpine, CentOS. Windows can't run as a container.

#LXC Container vs Docker Container

Confusion between the two is common. LXC is a system container: it contains an init system, service manager, and many processes — like a mini VM without its own kernel. Docker is an application container: it packages a single application along with its dependencies, generally without an init system, and is designed for a single process. In Proxmox, LXC is managed directly with the pct tool, while Docker should run inside a prepared VM or LXC.

#Downloading Container Templates

#Update the Template Repository

Container templates are available from the official Proxmox repository. Before you can use them, you need to refresh the list and download one:

pveam update
pveam available
pveam download local ubuntu-24.04-standard_24.04-2_amd64.tar.zst

The pveam update command refreshes the list of the latest templates, pveam available shows all the options, and pveam download fetches the chosen template into the local storage. You can also pick a template directly from the web UI at local -> CT Templates.

#Where Templates Live on Disk

Downloaded templates are stored as archive files in the /var/lib/vz/template/cache/ folder. These .tar.zst files are container rootfs images ready to be used as blueprints.

#Creating an LXC Container

#The Container Creation Wizard

Click Create CT in the web UI. Fill in the CT ID and hostname, select the template you downloaded, then set the root password or SSH key for initial access. Configure the resources: CPU cores, RAM, swap, disk size, and network configuration just like a VM. The next most important part is the container type, which we'll discuss in a moment.

pct create 100 local:vztmpl/ubuntu-24.04-standard_24.04-2_amd64.tar.zst \
  --hostname web-ct --cores 2 --memory 1024 --swap 512 \
  --net0 name=eth0,bridge=vmbr0,ip=dhcp --storage local-lvm
pct start 100
pct enter 100

The pct create command creates a container according to the specification, pct start powers it on, and pct enter drops you into the container's shell without needing SSH.

#Managing the Container Lifecycle

The container lifecycle is managed with pct — the counterpart of qm for VMs:

• pct start and pct stop to power on and off.
• pct shutdown for a clean shutdown.
• pct reboot for a restart.
• pct list to see all containers on the node.

#Privileged vs Unprivileged Containers

#The Risk of Privileged Containers

Privileged containers run with the same root as the host root. If a process inside the container manages to attack the kernel, the distance to the host becomes very short — this is a serious security risk in multi-tenant environments.

#Unprivileged with UID Mapping

Unprivileged containers use UID/GID mapping: the user id inside the container (e.g. root = 0) is mapped to a non-privileged id on the host (e.g. 100000). As a result, even if a process inside the container thinks it's root, at the host level it's just a regular user without privileges.

inside the container : uid 0 (root)
at the host level    : uid 100000 (not root)

Because of this mapping, an attack that escapes the container doesn't automatically become root on the host. That's why unprivileged is Proxmox's default recommendation for all new containers.

#Choosing Between Container and VM

The question always comes up: when to use a container, when to use a VM? There's no single answer, but the following guidance helps:

• Use containers for lightweight Linux services that don't need a special kernel.
• Use VMs for workloads that need their own kernel, strong isolation, or a non-Linux OS.
• Use VMs when you need features like hardware passthrough or live migration between different hardware.

CT : lightweight Linux services, fast boot, low overhead
VM : own kernel, strong isolation, any OS support

Many production infrastructures use a combination of both: containers for stateless services, and VMs for heavier workloads or those that need kernel flexibility. Consistency in your choices keeps the infrastructure easy to understand.

#Closing

Episode 5 introduced LXC as a lightweight alternative to VMs: sharing the host kernel, booting in seconds, managed with pct, and safer in unprivileged mode because UID mapping separates root privileges.

The key takeaways:

• LXC is a system container that shares the host kernel, not hardware emulation.
• LXC manages a complete environment; Docker packages a single application.
• Download templates with pveam update and pveam download.
• Manage containers with pct, the counterpart of qm.
• Unprivileged containers are safer because of UID mapping.
• Use privileged containers only when you need special mounts or device access.

In the next episode, episode 6, we will cover storage architecture and local storage management — understanding content types, the differences between directory storage, LVM, and LVM-thin, which is the default recommendation for VM disks. Your container is alive; now it's time to understand where they store their data!