Run Docker in a Proxmox LXC Container

  Рет қаралды 75,085

OneMarcFifty

OneMarcFifty

Күн бұрын

Пікірлер: 74
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
If you try this with unprivileged containers - sorry but it turned out that the Debian version of Docker is incompatible with unprivileged containers. Please see this article here www.reddit.com/r/Proxmox/comments/t8medr/docker_inside_lxc_on_proxmox_7_failing_with_oci/
@haraldfielker4635
@haraldfielker4635 Жыл бұрын
Please also tell about the Security Issues that this creates! If you "take" the Docker container, you "take" the Proxmox host. That doesn't happen in a VM.
@rayjaymor8754
@rayjaymor8754 11 ай бұрын
arguably, you wouldn't run this in an environment that's exposed to the internet. Huge difference between doing this in a homelab, or doing this in a production server. Especially as in a homelab the extra overhead of a VM vs a CT is usually enough to warrant the effort.
@kontoname
@kontoname 10 ай бұрын
@@rayjaymor8754 In what scenario would it warrant it? The overhead created is so tiny that it's laughable. It's literally next to no cycles and maybe half a gig of ram at MOST (as overhead). If you balloon it it's next to no measurable overhead at all unless you run it on super outdated first gen raspis...
@abb0tt
@abb0tt 7 ай бұрын
@@kontonameagreed, the overhead is minimal.
@ch3n2k
@ch3n2k 2 жыл бұрын
I'm doing the same on Proxmox VE. LXC helps with network setup (a dedicated public IP per LXC container) and docker helps deploy the applications.
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Hi, many thanks for the feedback. That's a great explanation!
@daro_
@daro_ 2 жыл бұрын
You don't need separate LXC containers to get dedicated public IPs. You can have 1 LXC and docker networks can give you different IPs.
@wjffhfgj7045
@wjffhfgj7045 2 жыл бұрын
personaly I use a VM with alpine Linux to take lower ressources through vagrant and then I install Docker
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Totally valid solution. Gives you better isolation between Docker and Proxmox.
@rklauco
@rklauco Жыл бұрын
I got confused a bit - I guess it deserves a bit longer video.
@OneMarcFifty
@OneMarcFifty Жыл бұрын
Hi Robert - fair enough - I might pick that up some time (maybe in a larger tutorial)
@rvanwaay
@rvanwaay 2 жыл бұрын
I installed docker on the proxmox host, but maybe I'd better do this approach
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Yeah - much better to run it in a container or VM - installing Docker on the host can mess up networking
@sergeantsapient
@sergeantsapient Жыл бұрын
I recommend it as the whole point of Proxmox is compartmentalizing your services. If you need to restart the host running Docker you can do it without restarting Proxmox.
@dominick253
@dominick253 Жыл бұрын
Can't that lead to some kernel issues? Making it privileged can have it change the kernel and bork the proxmox install?
@arghyl
@arghyl 2 жыл бұрын
I'm going to try this RIGHT NOW!!!
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Awesome - let me know if it worked !
@arghyl
@arghyl 2 жыл бұрын
It worked out great! I wanted to thank you for your content, in specific, anything related to proxmox! You've opened my eyes as to what it can do! Thank you!
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Excellent! Glad it helped ;-)
@MaxBauer255
@MaxBauer255 11 ай бұрын
Hi @OneMarcFifty Is it possible to use Fedora CoreOS instead of Debian for the LXC-Container?
@yboujraf
@yboujraf 10 ай бұрын
Dear, Then to host docker in LXC container is to enable keyctl, nesting AND to keep unpriviliged. Is it right?
@rachidyekini1898
@rachidyekini1898 2 жыл бұрын
Good stuff as usual, thanks Marc. Not sure but I think I have read somewhere that proxmox makes SSD life shorter if installed on it, I hope you could explain this in one of your next videos. Cheers
@schmitzi99
@schmitzi99 2 жыл бұрын
that sounds odd. a server OS shouldn't do a lot IO unless you run applications on it. also keep in mind that a puny consumer ssd can write like 100+TB of storage before it's no longer under warranty (and not yet even broken).
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
I‘ll have a look into that! Thanks for the feedback!
@marcogenovesi8570
@marcogenovesi8570 2 жыл бұрын
I haven't seen this in my homelab with 2 proxmox hosts. I also don't see why it should. The SSDs that are getting "consumed" are the ones used for VM storage. But that's because VM doing writes, that's expected
@gabrielporto.mikrotik
@gabrielporto.mikrotik Жыл бұрын
I have a Dell R210II with a consumer grade 128GB 2.5” SSD to boot proxmox, running 24/7 for about a year now. No problem at all. TGFT
@ayan.debnath
@ayan.debnath 2 жыл бұрын
AWESOME TIP. Pls make another video - I need to run Oracle Express Database (to test query optimization of office work) in Proxmox.
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Hey, thank you very much. Unfortunately I am not using Oracle DB ;-(
@ayan.debnath
@ayan.debnath 2 жыл бұрын
@@OneMarcFifty :(
@jolness1
@jolness1 2 ай бұрын
What benefit is there though? Security risks don’t seem worth it. I’m running an alpine Linux VM with docker.
@Berecutecu
@Berecutecu Жыл бұрын
Marc, I'm trying to learn Linux creating a media server at my home. I'm looking to setup Proxmox and have two server distros installed in containers(one as a backup incase something happen with the main one). I was wondering if I should use Docker, is this a bit advanced to my use case?
@HyuLilium
@HyuLilium 2 жыл бұрын
Why does keyctl need to be enabled? I have docker running on LXC without keyctl
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Hi, you only need it with unprivileged containers. Keyctl is a system call which will be allowed by the setting
@HyuLilium
@HyuLilium 2 жыл бұрын
@@OneMarcFifty i am running an unprivileged container with docker and portainer is running there. I have enabled only fuse and nesting. Fuse allows me to use fuse-overlayfs file system. Keyctl doesn't seem to do anything at all so i keep it disabled.
@albarkapeshwar5418
@albarkapeshwar5418 Жыл бұрын
where is Details Video ?
@daysiewaysie
@daysiewaysie 2 жыл бұрын
Hi Marc, and thank you for the tip. i'm using your option 1, privileged container so i am wondering what additional risks there may be if i was running in a production environment (i'm not, it's just my own learning home lab...but if i were.... ?). i also went for the turnkey core container, because it was right there in the templates, ready to deploy and i figured it would make for a lightweight host in which to run docker containers.
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
The general challenge/Risk with privileged containers is that someone who breaks into the container can also break into the host system. That means that the isolation between the host and the guest is not that strong. It's better with an unprivileged container and best with a VM. The Turnkey containers are nice. Just some of them are still running on older versions of Debian and might need an apt dist-upgrade or the like.
@daysiewaysie
@daysiewaysie 2 жыл бұрын
@@OneMarcFifty thank you so much for the reply, i'll keep these points in mind going forwards (applying best practices even if i am only doing homelab stuff). i plan on exploring high-level ansible next and will create testing hosts as non-privileged and with keyctl & nesting enabled. i'll be interested to see if i notice any differences (restrictions). Cheers, have a great day.
@VizionHUN
@VizionHUN 3 ай бұрын
and no backups, opened some security fisks, etc... other sily advices? use pve as desktop pls. Using a dedicated docker manager vm is secure, way easier to setup and manage...
@schmitzi99
@schmitzi99 2 жыл бұрын
cool video format!
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Thank you very much;-)
@Felix-ve9hs
@Felix-ve9hs 2 жыл бұрын
Just keep in mind that if your Proxmox VE Host uses zfs, you might run into problems with some docker containers (vfs etc.)
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
You mean this issue here right? github.com/moby/moby/issues/41055
@Felix-ve9hs
@Felix-ve9hs 2 жыл бұрын
@@OneMarcFifty Exactly, my Nginx Proxy Manager container exploded in size because of this :)
@ayan.debnath
@ayan.debnath 2 жыл бұрын
Thanks for the Tip. What FS you are using?
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
I use a "classic" ext4 file system
@RomanShein1978
@RomanShein1978 2 жыл бұрын
I suggest migrating the container disk to zvol then.
@fallen4021
@fallen4021 4 ай бұрын
While you can do that and will save yourself a couple of MBs, this is a big security risk.
@etebong
@etebong 7 ай бұрын
But why tho
@sheldonkupa9120
@sheldonkupa9120 2 жыл бұрын
👍👏Yeah that ez😜
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
In theory ;-)
Жыл бұрын
@@OneMarcFifty It always sounds easy in theory :D
@Currysuechtig
@Currysuechtig 5 ай бұрын
Just don't do that. VM's are just so much better for isolation, backup and migration. And if you are creating the Docker LXC-Container on a ZFS filesystem, you have to create a ext4-Disk on top of that for /var/lib/docker as a workaround. Best practice is to not even create a single LXC container and just rely on VM's and Docker-containers.
@member5003
@member5003 2 жыл бұрын
Or just ssh and install docker?
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Yeah - well no - if the container is not configured correctly it won‘t work because the /proc filesystem is not exposed ;-)
@member5003
@member5003 2 жыл бұрын
Proxmox is just debían under the hood, if you ssh in the proxmox machine and run the command for a Debian docker install you will get docker running natively on Debian
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Oh you mean on the host directly - of course that’s a third option
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Hang on - I have thought this over. Installing Docker directly on the Proxmox host has side effects! Not so much with regards to virtualization - that should work. But rather with networking! If you only have one network interface defined on your Proxmox host then this is fine. But Docker adds additional networks and also ENABLES IPv4 FORWARDING. That means that your Proxmox host becomes a router! Also, Docker adds forwarding rules for the bridge network etc. so that might interfere with your Proxmox firewall. In a nutshell - I wouldn't do it if my Proxmox host had access to multiple networks.
@stephendetomasi1701
@stephendetomasi1701 2 жыл бұрын
Please don't install docker on the Proxmox host. If you break something you're basically screwed, rolling back a host snapshot is not going to be practical.
@АндрейРожнов-ш9к
@АндрейРожнов-ш9к 2 жыл бұрын
👍
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Thanks Andrei!
@giorgos-cf2rv
@giorgos-cf2rv 9 ай бұрын
NO lxc containers are NOT ment for docker the brake all the time. Please don't
@michaelgleason4791
@michaelgleason4791 5 ай бұрын
I just used the template...
@AmalChandran-k8v
@AmalChandran-k8v Жыл бұрын
not every docker image works smoothly in this way eg: appsmith. so moved away from it and running a vm for docker
@redetermine
@redetermine 5 ай бұрын
this is unsupported, i found out the hard way once.
@abb0tt
@abb0tt 7 ай бұрын
Or go down the Kubernetes rabbit hole 🐇🕳️🥰
@basdfgwe
@basdfgwe Жыл бұрын
Run a container inside a container doesnt seem right 😂
@BobSmith42
@BobSmith42 Жыл бұрын
This is the third level of Inception. But don't worry, it's contained.
@Meerkat000
@Meerkat000 Жыл бұрын
Gosh this video keeps popping up for me and I truly hate it
@fastmover45
@fastmover45 2 жыл бұрын
Plus one comment
@OneMarcFifty
@OneMarcFifty 2 жыл бұрын
Thanks mate !
What is new in OpenWrt 22.03 ?
14:49
OneMarcFifty
Рет қаралды 69 М.
More POWER for my HomeLab! // Proxmox
17:49
Christian Lempa
Рет қаралды 111 М.
Support each other🤝
00:31
ISSEI / いっせい
Рет қаралды 81 МЛН
It works #beatbox #tiktok
00:34
BeatboxJCOP
Рет қаралды 41 МЛН
BAYGUYSTAN | 1 СЕРИЯ | bayGUYS
36:55
bayGUYS
Рет қаралды 1,9 МЛН
Overview of Ku/Ka Band LNB and their WaveGuide to Micro Strip Line Transitions
1:18:34
Mohamed Nezami دكتور محمد النظامي
Рет қаралды 6
What's On My Smart HomeLab Server?
15:41
Everything Smart Home
Рет қаралды 337 М.
Proxmox Creating an LXC Container
8:10
Viatto
Рет қаралды 47 М.
What's ACTUALLY running in my Homelab?
19:21
Hardware Haven
Рет қаралды 260 М.
A SERIOUS Home Server That's Affordable [Lenovo P520]
18:59
Hardware Haven
Рет қаралды 292 М.
Running a NAS on Proxmox, Different Methods and What to Know
18:47
ElectronicsWizardry
Рет қаралды 66 М.
Don’t run Proxmox without these settings!
25:45
Christian Lempa
Рет қаралды 312 М.
18 Weird and Wonderful ways I use Docker
26:18
NetworkChuck
Рет қаралды 437 М.
Perfect 1L Homelab in 3 Upgrade Tiers Project TinyMiniMicro
17:50
ServeTheHome
Рет қаралды 1 МЛН
What's on my Home Server?? MUST HAVE Services 2023!
27:29
TechHut
Рет қаралды 884 М.
Support each other🤝
00:31
ISSEI / いっせい
Рет қаралды 81 МЛН