tl;dr: Proxmox or bare metal? Containers yes/no? What is your use case?
I used a Dell R710 when I first started self-hosting, it ran ESXi with one VM for each service I wanted. Restarting the server required me to first shutdown each VM in order and then the whole host. When setting up a new service to host I had to create a new VM (allocate RAM, disk etc), install the OS (I ran Debian) and then follow instructions for how to setup the service. This mostly was not a problem but one software I never managed to get working was Apache Guacamole.
Nowadays I have a Dell Optiplex I salvaged for parts, got a new case and all my HDDs from my R710. Because it has much less RAM and an old Intel i5 (6th or 7th generation), I decided to get into Docker. With Docker containers you write your compose file and it will just work. No more need to dig through documentation for which version of a dependency to use, how to handle if two services on the same host need different versions (this was part of the reason for one VM/service). With Docker, I can try out a software in seconds and have it configured to my liking in minutes.
Today I have NixOS (bare metal) and it comes with Podman which uses systemd. Hence restarting my OS (albeit not that often, almost never unless I mess up my config) is a no-brainer because Podman via systemd will manage everything. Adding, stopping or removing containers in general is easy. I have a script running as a service which will stop a container, create a BTRFS subvolume snapshot, start the service again and start borg backup to backup from the snapshot.
For me using Proxmox would just an extra layer of complexity I don’t need. I only have one server and I am the only user.
Questions:
- Do you use Proxmox instead of a bare metal installation?
- Do you use containers or do you install manually?
- What is you use case that requires your setup the way it is?
You must log in or # to comment.
I like running docker containers inside of specific unprivileged LXCs on my proxmox host. Why? Because it works and I’m not an expert.
I can spin up a new LXC and test things without fucking up my entire server. It allows me the flexibility to try new services or attempt things that I’d otherwise be too timid to try on the chance it fucks up my entire system and I have to spend two and half weekends trying to get back to where I was when things just worked.
Security is a big reason to use VMs. Containers share the kernel with the host. That means that any of the kernel vulnerabilities from this year (like DirtyFrag and CopyFail) could have been used to compromise your host. Once the host is compromised, the only way to be safe is to literally buy a new machine. Seriously. Viruses can bury deep and even infect the motherboard firmware to persist indefinitely.
Kernel vulnerabilities are frequent enough that I find VMs worth it. I still use containers in my VMs though.
Do you have any sources on motherboard firmware viruses? I’m curious to know more about them
Just look up firmware rootkits and UEFI rootkits. For example: https://arstechnica.com/information-technology/2022/07/researchers-unpack-unkillable-uefi-rootkit-that-survives-os-reinstalls/
It’s not an either-or scenario. Running services in Docker/Podman is great and makes a lot of sense, as you’ve found. But there’s no reason the OS running those Docker containers can’t be a VM on a hypervisor like Proxmox. Then you get the simplicity of Docker, in addition to the isolation and segmentation (network and process) provided by VMs, and snapshot-based incremental backups from PBS. It’s the best of both worlds. You wouldn’t have a VM per service like you ran before, instead you’d have a VM per group of related services with common networking and security requirements. For example, all of your publicly exposed services can run in Docker in their own isolated VM that’s walled off from the rest of your network, while your internal-only services also run in Docker, but on a separate VM on your internal network.
Docker has its uses, but it has gone to far.
I already have a webserver with Apache, mariadb and everything. Why does your PHP based website only come as a docker solution? Fuck you.
When you go all in with docker, it quickly becomes a mess with rando NICs and containers named “random 32 character string” and dependencies up the wazoo. Ending up running ancient packages because the developer refuses to apt upgrade their shit.
Proxmox or any other hypervisor platform gives you control. Whereas you have to take it for docker and youre still at the mercy or the developers to keep your shit secure.
Ending up running ancient packages because the developer refuses to apt upgrade their shit.
Tell me you never really had to deal with dependency hell without telling me. That’s literally the main problem docker solves.
all the problems you expressed with docker aren’t real problems.
I think you may not like it because you don’t know how to use it.
don’t like how often a maintainer updates their images? build your own.
don’t like having multiple bridge interfaces on your host? configure and manage networks within docker and assign them to your containers.
don’t like having dozens of containers with random names? use docker compose. bonus, you can set up networking with it even easier.
Years ago I’d have one PHP app that required version X of PHP and another that required version Y and my distro often only had one of them (or you couldn’t install both simultaneously), so I’d have to either compile myself (or later use a 3rd party repo). All solvable of course, but then throw in MySQL version requirements and PHP extensions and it’s just extra crap that containers just take care of for you. I’ve had this kind of inter app requirements conflicts with stuff other than PHP, but I’ve had by far more of it with PHP. For a while I used FreeBSD jails to help, but jails was kind of a pain. I enthusiastically embraced docker for PHP stuff early on.
A benefit for application developers, particularly PHP is there’s a lot of differences between distros and how people install and configure PHP. Even like which PHP extensions are available and their settings. Other languages things tend to be more consistent at the system level and customizations are app are usually application level (contrast with PHP extensions and system level configurations). It really helps reduce support issues due to distro/user differences if a developer just provides a working dockerfile as a reference implementation and in my experience this is far more likely with PHP than other languages. I realize this is mostly applicable outside of PHP, but I actually personally see more benefit with PHP based on my past experiences.
I used to be bare metal Debian, but I moved to ProxMox for a few reasons.
- Backup and restore is a breeze, and the UI makes things human friendly.
- It makes it easier to separate my wiki notes in an LXC so that I can still see them if I’m doing maintenance on my main server VM that requires restarts.
- There is essentially no noticeable performance reduction.
It works, it’s easy, and the simplicity has saved my butt a few times. I don’t think I’ll be switching, and I’d recommend it to anyone running a homelab. I still use docker to manage most of my services inside a VM.
I secon running docker apps on a Proxmox VM. It has saved my homlab admin time significantly.
Why not put your wiki notes on your admin machine (whatever machine you use to manage the proxmox server)?
I could, but it’s more convenient for me to have it served up by an LXC container on the server. I’m usually interacting with things on a laptop or a phone, so it’s just easy being able to have a tab open with my wiki served through Tailscale, and ProxMox makes sure it stays backed up to an external drive and the cloud so I don’t lose anything.
The few times I’ve had a critical error with ProxMox, it’s been super simple to do a fresh install and just restore my daily backup.
There are many ways it could be done, but this way has been mine, and it’s worked for me.
Podman sounds like a podcast about other podcasts
I like the flexibility that proxmox provides me. I do this as a hobby and I’m self taught. I can try a bunch of things and if I mess up I can start over without much hassle.
Having to manually start and stop your VMs is very atypical, proxmox can absolutely handle that itself
I’ll die on this hill.
Containers run on “bare metal” in the same way that other processes on your system run.
Well, they are just in a separate namespace.
Who was saying it was otherwise? Containers are not virtualization and never have been.
Maybe I misunderstood - The “NixOS (bare metal)” seemed to imply to me that the containers were not bare-metal by omission. If not then my complaint is retracted.
Proxmox with Kubernetes and containerization can allow you more easily manage your services and to have less downtime. But, as you said, it adds another layer. Is it worth the time to set it up? Over a long period, yes.
As a DevOps/Developer/Sysadmin, I’d probably use it if I set up a lot of services. If I just have some kind of file share thing, probably not.
Proxmox running LXC’s and VM’s, all of them also have docker installed
I use both. The main benefit of proxmox is having VM snapshots/daily backups, if you mess up, just restore the whole thing. You also have stricter isolation, e.g. put public facing containers in one VM and local only stuff in another.
Also has high availability if you have multiple nodes but that can be achieved with container orchestration as well.
Couldnt you just make daily snapshots on baremetal? Like most configs will support a ZFS pool.
All my stuff is just configs anyway, so my backup is a Git commit. Lighter than a full snapshot. My server can be restarted with like 50mbs of information.
Docker images are images so disposable. All my files and databases are on my NAS which is a ZFS pool mirrored and with a weekly backup to a secondary NAS also mirrored. Plus I have an offsite cloud backup of everything. There isnt really anything on my server that matters other than some configs, scripts and ymls. Which by commiting to my Gitea, are all on my NAS with the rest of my data.
I still feel like Proxmox just invites you to tinker and fiddle with stuff that should be set and forget. Or overcomplexify your setup with too many moving parts.
For public stuff I just use a VPS. Better internet connection than at home, high availability and DDOS protection. Otherwise, an LXC with good firewall rules and a well configured reverse proxy should be sufficient.
Sure, you can probably build something similar with zfs snapshots, but it’ll likely not be as convenient. Have a VM? Create daily snapshots. Break something and can’t figure it out? Just reset to the last backup to a complete working state.
Personally, I have the containers’ mounts in the VMs (ergo on the nodes’ disks) and just using the NAS for the backups. Even if both Proxmox nodes catch fire I can just import the snapshot to a new one and have a working VM in the same state again. That’s a whole different level from re-cloning all the compose stacks, mount NFS shares etc. It’s the ease of use.
- No
- Manual only
- Because I’m old and crusty, and always rawdogged service setups. I’m sure containers are nice and all, I just never got around to learning them properly.
Proxmox exclusively with unprivileged LXCs, which themselves host other docker containers/stacks managed with Dockhand (a more modern alternative to both Portainer and Dockge). I have a very tiny low power machine so I have to be kind with my resources, therefore no VMs. But LXCs are simpler anyway. I can easily pass devices like
/dev/tunfor tailscale and i forget the name of the iGPU for accelerated workloads (for Immich, Nextcloud).Reasoning: with containers it’s easy to make mistakes without dire consequences (just
docker compose down -vand start over). The LXCs are easy to back up and restore. They hold internal running state of whatever docker containers I run in them.Pro tip: don’t map host paths using the UI (
mp0etc), uselxc.mountinstead. This will let you continue to have snapshots of your LXCs whereas the other approach makes your LXC incompatible with snapshots.Good luck!
Proxmox with VMs running Docker using Cosmos.
Pros: backups, easy VM management, easy disk management.
