I have a server with a bunch of services just as Docker containers. I see that Proxmox is popular among the self-hosting community. I was wondering why?

I understand that running things in a VM provides better security than running them in a container. But is the difference so important given the relatively low risk that an exploit happens inside a container that leads to doing damage to the host machine?

There’s also obviously the additional overhead of using Proxmox. It wouldn’t be an issue for me as I should have enough resources to, say replace all my Docker containers with VMs. I’m more wondering if the security difference is so massive, or if there is another reason I’m missing why people use Proxmox.

Or am I misunderstanding how people use Proxmox? I was assuming people would use it like how you use Docker, i.e. different services get their own VM/container. If you have a different kind of setup I’d be interested in hearing it.

Edit: I would appreciate if people stop being pedantic and actually read the post. Obviously I am aware that you can run containers in VMs, or containers on bare metal alongside VMs. That’s not what the question is and you know it.

  • Scrubbles@poptalk.scrubbles.techEnglish
    0·
    2 months ago

    I found proxmox and docker to be fairly incompatible, and went through many iterations of different things to make it work well. Docker in VMs, Docker in LXC, Docker on the host (which felt redundant as hell). Proxmox is an amazing hypervisor, but then I realized I didn’t really need a hypervisor since I was mostly running containers.

    My recommendations:

    • No need for VMs Just run debian and run containers on it

    • Some VMs, Mostly containers, 1 host Run proxmox, and create a VM in proxmox for your contianer workloads

    • Some VMs, Mostly containers, >1 host, easy mode Same as above, but make one host debian and the other one proxmox

    • Some VMs, Mostly Containers, >1 host, hard mode but worth it after 2 years Use kubernetes, I use k3s. Some nodes are just debian with k3s on them, others are running in VMs on proxmox using the extra compute available. This has a massive learning curve though, it took me well into a year to finally having it at a state I like it - but I’ll never go back.

      • Croquette@sh.itjust.worksEnglish
        0·
        2 months ago

        Same, and I use portainer to manage my docker compose stacks.

        I can bring down a container without bringing down the whole stack of services.

  • mlg@lemmy.worldEnglish
    0·
    2 months ago

    Proxmox or even just lazy old KVM GUI for anything that needs to be deployed manually in a VM (Home Assistant, WIndows VM, etc.). Otherwise you can even just spin up whatever manual service you want to run on an LXC container or bare metal host with the correct security settings with systemd and selinux if you want to be extra careful.

    Docker/Podman (the superior one lol) is just an automated deployment system in container form (like Ansible). It great for automated deployment without having to manually configure the installation process and worry about upgrades, changes, etc. You can even easily create your own images on the fly just for the purpose of having it run a single service inside a container.

    Proxmox equivalent would be like using Terraform/OpenTofu to deploy VMs to do the same thing. Its possible, but just not that common because of the reduced overhead with containers, and well supported deployment images with docker/podman specifically.

    Generally speaking, I’ve seen proxmox used more in lab environments were you want to emulate something like a complete network of machines whereas docker/podman has become the defacto server deployment platform.

    You’re just much more likely to find software with a published docker container and default docker compose script than the same thing in Terraform or even K8s/K3s.

  • sugar_in_your_tea@sh.itjust.worksEnglish
    0·
    2 months ago

    My vote is Podman with an immutable distro, like OpenSUSE MicroOS or Fedora Silverblue. Here are my reasons:

    • rolling base, with very minimal footprint, so you don’t need to worry about upgrades
    • podman runs proper rootless containers, so you get better security vs docker, which tends to run as root (breaking out does less damage if you manage permissions properly)
    • deploying a new service (or moving a service) just means copying configs and running, no concerns about what the host has
    • there’s nothing special about the host, so if MicroOS or Silverblue are abandoned, just copy the configs and data to a new host

    It’s a little more work to set up, but once things are running, it’s drama free. And I think that’s the best thing to optimize for, keeping things boring is a good thing.

  • Brkdncr@lemmy.worldEnglish
    0·
    2 months ago

    VMs are managed by you. You’re responsible for dealing with prerequisites, updates, security.

    Docker is a dev stating “works on my machine” and giving you a copy of their machine.

    You can run docker within proxmox, and doing so gives you the ability to run containers in addition to VMs.

    There are advantages and disadvantages to both.