Selfhosted

Check out Helper Scripts. These make getting LXCs up and running super easy. This was built by a community member who recently passed away and he turned it over to the community before his passing. Its a great project!

In general, I prefer unprivileged LXC to a full VM unless there’s some specific requirement that countermands that preference (like running an appliance or a non-Linux OS).

What I tend to do is create a new container for each service (unless there’s a related stack). If the service runs on Docker, I’ll install that right inside the container and manage it with docker compose. By installing Docker directly from get.docker.com instead of the built in packages, it pretty much works all the time.

Since each service is in its own container, restoring backups is pretty service-specific. If you wanted some kind of central control plane for docker, you could check out swarm mode.

Lastly there is podman that some people love for container management. It’s not my cup of tea, but it might fit you.

Install on a vm though, not lxc

I prefer VMs as I have found that LXC containers are buggy and slow.

I update a container by doing a backup, then logging in and running apt upgrade and apt update. Some applications I update manually by downloading and unpacking the installer.

I haven’t noticed any kind of performance issues. The only application I tried which seemed to require Docker was Immich.

I just create the lxc, and if the package requires docker I begrugendly install docker on the lxc, I've never had performance issues with Debian lxc, I use it as my base template and it runs flawlessly (outside of ping not working unless sudo)

That being said, I don't like installing Docker a billion times and I feel like that defeats the purpose of using an lxc in the first place, so for most small Docker containers I just put them on the same lxc since docker is going to handle all the isolation in those anyway

I don't ZFS though I still use normal EXT4, and I use PBS for backing it up to an external drive, but I'm curious if that may be the root cause of the issues.

If I remember correctly, Proxmox recommends running Docker in virtual machines instead of LXC containers. I sort of gave up on LXC containers for what I do, which is run stuff in Docker and use my server as a NAS with ZFS storage.

LXC containers are unprivileged by default, so the user IDs don't match the conventional pattern (1000 is the main user, etc.). For a file sharing system this was a pain in the butt, because every file ended up being owned by some crazy user ID. There are ways around it which I did for some time, but moving to virtual machines instead has been super smooth.

They also don't recommend running Docker on bare metal (Proxmox is Debian, after all). I don't know the reasons why, but I tend to agree simply for backups. My VMs get automatically backed up on a schedule, and those backups automatically get sent to Backblaze B2 on a schedule

A lot of how you set up your system is just going to depend on how you want to set it up.

I run podman (like an improved version of docker) in a single LXC container for applications that are primarily packaged as docker apps. I think I have 4 or 5 applications running on that LXC.

For things that are distributed via apt, git repo, etc, I'll either create a new LXC or use an existing LXC if it's related to other services I'm running. For example, crowdsec is run in the same machine as nginx since those two work together and I'll always want them both running at the same time, so there's no reason to separate them.

I have mariadb running in its own LXC so that it can follow a different (more frequent) backup schedule than the mostly static applications that interact with it.

Anything that needs to interact directly with hardware, like Home Assistant, or I want kernel separation for, will get a full fledge VM instead of a container.

It's all about how you want to use it.

Your problem with docker in LXC might be if you're using ZFS for your host storage, IIRC you need to install fuse-overlayfs on host and LXC that will be running docker. It works fine for me that way. I'm not sure if that requirement has changed recently, when I did it, the host was under PM 7.X and Debian 11 LXC.

I tried docker directly on LXCs. Don't do it man. It's brittle, it barely works, and every proxmox update it will cause things to break. It takes forever to get working because you're disabling things that should not be disabled, and it will only get harder.

I spent years trying to make what you're talking about work well, and it never did.

Just install a VM and run docker in there. If you really want to make docker containers more generic, then really you may be ready to go full kubernetes.