LXC and Docker compatibility now

[Thendeo]

I'm new to Proxmox, started to play a bit with, and currently loving it !

I'm using LXCs on a dedicated server to support various services for myself. Still, I have one that is using Docker (Affine.pro self-hosted setup is simpler with it). I saw some threads about using Docker under LXC not being that good (here for example), but other saying it is fine (here for example). On the official doc the only reference to docker is about the keyctl flag.

Currently I've got no trouble, but it seems that it is during updates that it can raise quite some headache.

I'm struggling to get up to date information :
- Are LXC and Docker fine during updates now ?
- What is the current state of the known issues regarding this topic ?

Best,
Thendeo

 

[Impact]

Here's my current thoughts/opinions about running docker/podman in CTs

- It currently works fine (at least in a debian CT)
- It might break on docker (related) or kernel updates
- Breakage is likely to be fixed soon but you'll have to be patient and find workarounds until then or hold off on upgrades (Test in a virtual PVE first)
- It is often recommended against by proxmox staff and you will have to live with hearing this whenever this is discussed
- I find the combined benefits of LXC CTs and docker (I use podman) too good not to use so I use it myself anyways

It's a compromise. If you want a stable/reliable environment to run docker/podman on you should use a VM. If you're comfortable with fixing potential breakage I think it's fine to do in a homelab.

 

[Johannes S]

Are LXC and Docker fine during updates now ?

No and propably never will be since they use the same features of the kernel ( namespaces, cgroups etc) and host system ( apparmor etc ) so any update might introduce a breaking change. This is more likely with major upgrades ( like PVE8 to PVE9 ) but can happen at any other update too since a bug fix might also have unintended side effects.
Please note that most of the time nothing bad happens. But at some point it will break like due to a change in AppArmor and lxcs between PVE8 and PVE9:
https://forum.proxmox.com/threads/d...bian-13-host-worked-fine-on-proxmox-8.169508/

https://forum.proxmox.com/threads/d...rivileged_port_start-error.175437/post-814307

If you have good knowledge of Linux and containers don't mind potential breakage and troubleshooting nobody can force you not to put docker/podman in lxcs. It might be even useful for playing around and trying new things without spinning up a vm. But if you mostly want host a service with as small frictions as possible you are better off with vm. If you want to save resources it makes sense to put all docker/podman container in the same vm.

Only you can decide what's acceptable for you or not.