Create LXC containers with pct and pveam

A Proxmox VE container is a Linux system that shares the host kernel through LXC. Containers start in seconds and use little memory, which makes them a good fit for small Linux services. You create them from a template, a compressed root file system of a distribution.

1. Download a template

pveam (Proxmox VE Appliance Manager) lists and downloads templates. The list is refreshed daily, but you can update it by hand. Download into a storage that allows container templates, such as local.

pveam update
pveam available --section system
pveam download local <template-file>
pveam list local

Replace <template-file> with an exact name from the output of pveam available; names change with every release. After the download, pveam list local shows the full volume ID to use, in the form local:vztmpl/<template-file>. The web UI offers the same function under the storage’s CT Templates tab.

2. Create the container

pct create 200 local:vztmpl/<template-file> \
  --hostname dns01 \
  --memory 512 --swap 512 --cores 1 \
  --rootfs local-lvm:8 \
  --net0 name=eth0,bridge=vmbr0,ip=192.0.2.20/24,gw=192.0.2.1 \
  --ssh-public-keys /root/.ssh/admin.pub \
  --unprivileged 1 \
  --onboot 1

• --rootfs local-lvm:8 allocates an 8 GiB root volume on the local-lvm storage.
• --net0 creates eth0 attached to bridge vmbr0. Use ip=dhcp for DHCP.
• --unprivileged 1 maps root inside the container to an unprivileged user on the host. This is the default for new containers and the safer choice.
• --password prompts for a root password if you prefer that to SSH keys.

3. Start it and get a shell

pct start 200
pct enter 200        # root shell inside the container
pct console 200      # login prompt on the container console
pct exec 200 -- apt update

pct enter is the quickest way in from the host. Leave the shell with exit.

4. Change it later

pct config 200
pct set 200 --memory 1024
pct set 200 --mp0 local-lvm:20,mp=/srv/data   # add a 20 GiB volume
pct push 200 ./app.conf /etc/app.conf
pct pull 200 /var/log/syslog ./ct200-syslog

Many settings, such as memory and network, can be changed while the container runs.

Things that differ from VMs

• Containers only run Linux, and they use the host’s kernel.
• Running containers cannot be live-migrated. pct migrate 200 pve2 --restart shuts the container down, moves it and starts it again on the target node.
• Some workloads, such as running Docker inside a container or certain systemd features, need extra options like --features nesting=1. When in doubt, use a VM for those.
• If a container will not start, pct start 200 --debug prints a debug log.

Removing a container

Warning: pct destroy deletes the container and its volumes for good. Confirm the ID with pct config 200 and make sure you have a backup first.

pct config 200 | grep hostname
pct stop 200
pct destroy 200 --purge

Official documentation

• pct(1): Proxmox Container Toolkit, including container templates