Ram is expensive… so all my 24x7 things are containers (docker compose on Alpine Linux) or FreeBSD jails.

I use VMs for OS isolated and hardware isolation. I run containers on top of OSs for apps.

That said I use Harvester so I can run containers on bare metal AND VMs as containers.

Even on one bare metal I do this, so I can spin up a test VM of harvester to confirm configs. If you one node is super beefy a neat trick is to have VMs running a cluster so you can have a kind of high availability even if your infra is a single point of failure.

It’s not an either-or scenario. Running services in Docker/Podman is great and makes a lot of sense, as you’ve found. But there’s no reason the OS running those Docker containers can’t be a VM on a hypervisor like Proxmox. Then you get the simplicity of Docker, in addition to the isolation and segmentation (network and process) provided by VMs, and snapshot-based incremental backups from PBS. It’s the best of both worlds. You wouldn’t have a VM per service like you ran before, instead you’d have a VM per group of related services with common networking and security requirements. For example, all of your publicly exposed services can run in Docker in their own isolated VM that’s walled off from the rest of your network, while your internal-only services also run in Docker, but on a separate VM on your internal network.

I used to be bare metal Debian, but I moved to ProxMox for a few reasons.

1. Backup and restore is a breeze, and the UI makes things human friendly.
2. It makes it easier to separate my wiki notes in an LXC so that I can still see them if I’m doing maintenance on my main server VM that requires restarts.
3. There is essentially no noticeable performance reduction.

It works, it’s easy, and the simplicity has saved my butt a few times. I don’t think I’ll be switching, and I’d recommend it to anyone running a homelab. I still use docker to manage most of my services inside a VM.

Security is a big reason to use VMs. Containers share the kernel with the host. That means that any of the kernel vulnerabilities from this year (like DirtyFrag and CopyFail) could have been used to compromise your host. Once the host is compromised, the only way to be safe is to literally buy a new machine. Seriously. Viruses can bury deep and even infect the motherboard firmware to persist indefinitely.

Kernel vulnerabilities are frequent enough that I find VMs worth it. I still use containers in my VMs though.

I like the flexibility that proxmox provides me. I do this as a hobby and I’m self taught. I can try a bunch of things and if I mess up I can start over without much hassle.

Proxmox is a hypervisor, while docker is containerization.

Comparing them is like comparing an apple to a glass of milk. They have different use cases.

I run multiple VMs specifically for Docker services. I run other VMs for other things. And LXCs for applications where containerization makes sense but I don’t want to use Docker.

I’ll die on this hill.

Containers run on “bare metal” in the same way that other processes on your system run.

Proxmox running LXC’s and VM’s, all of them also have docker installed

Generally speaking:

• just want it to work with minimal effort: containers
• need very custom things, or very high efficiency: bare metal
• need high security, emulating bare metal, or like to do extra IT work: virtualization

Generally, these days, containers win 99% of the time as the best home lab backbone.

I like running docker containers inside of specific unprivileged LXCs on my proxmox host. Why? Because it works and I’m not an expert.

I can spin up a new LXC and test things without fucking up my entire server. It allows me the flexibility to try new services or attempt things that I’d otherwise be too timid to try on the chance it fucks up my entire system and I have to spend two and half weekends trying to get back to where I was when things just worked.

Having to manually start and stop your VMs is very atypical, proxmox can absolutely handle that itself

I use Proxmox as a VDI server. I understand that this isn’t homelab territory, but selfhosted VDIs have proven exponentially more reliable and easier to manage than cloud based ones (after the initial PitA setup). Flawless copy/paste, screen resize, and most importantly, file transfers. When you connect to 12 different clients, each with a different set of security requirements, system hardening, monitoring, and VPN access, being able to console amd fully interact with a sandboxed desktop becomes priceless.

Check out the krun runtime for podman, if you want stronger container isolation from the host. It creates a small VM for each container. Gpu passthrough on linux is limited though.

Proxmox exclusively with unprivileged LXCs, which themselves host other docker containers/stacks managed with Dockhand (a more modern alternative to both Portainer and Dockge). I have a very tiny low power machine so I have to be kind with my resources, therefore no VMs. But LXCs are simpler anyway. I can easily pass devices like /dev/tun for tailscale and i forget the name of the iGPU for accelerated workloads (for Immich, Nextcloud).

Reasoning: with containers it’s easy to make mistakes without dire consequences (just docker compose down -v and start over). The LXCs are easy to back up and restore. They hold internal running state of whatever docker containers I run in them.

Pro tip: don’t map host paths using the UI (mp0 etc), use lxc.mount instead. This will let you continue to have snapshots of your LXCs whereas the other approach makes your LXC incompatible with snapshots.

Good luck!