Docker VM Template Advice for Home Server for Small, Secure, Single-Apps. Suggestions?

[SinisterPisces]

Hello,

I run a single Proxmox server in my home office for a mixture of personal and work VMs and LXCs.

I’d like to build a secure, simple-to-maintain base Docker VM template for deploying single-container (or single stack) VMs; I’d much rather run a small VM for each Docker-based workload than run a single monolithic Docker VM with a dozen unrelated stacks in it.

I’d like the base configuration to use as little RAM as possible, and I’m planning to use a simple firewall like ufw instead of something more complex like firewalld, just to keep things easy on myself.

I don’t want to use Ubuntu; even the base Ubuntu Server LTS install feels bloated–I don’t need snapd in a Docker Minecraft server VM, for example.

I don’t want the OS so locked down that I can’t easily do things like add additional virtual NICs, but I also don’t want to have to spend a ton of time configuring and securing a general-purpose OS, especially as I want to do a bit of public-facing self-hosting (e.g., Minecraft).

I was planning to use Debian’s LTS as a base, but I have a few questions about that:

1. If I want to get the lowest base footprint possible, is it worth it to learn Alpine? I know it would have a smaller base footprint, but how hard is it to pick up and configure coming from Debian? Would it be missing potential features that I would regret not having for general purpose Docker use?
2. Is it worth learning to use Cloud Init if I’m going to build all this up as a Proxmox VM template anyway?
3. Am I correct that a container-first OS like Flatcar or Fedora Core is entirely overkill for home server use? I’ve looked at solutions like that and as a hobbyist they just feel overwhelming.

[LTS_Tom]

Not sure why you would want to run each docker in a separate VM, but you certainly can. I always stick with Debian since it the environment that I know the best and has the best support for anything I might want to apt get install. While distros like Alpine are MUCH smaller, that size is still measured in MB which unless you are running thousands of those VM’s it not really a big deal.

I have a video here on my Docker setup:

Forget Kubernetes, This Is How I Run my Docker Containers

A breakdown here on containers in Proxmox

Virtual Machines vs LXC System Containers vs Docker

Technical Reference: Virtualization (KVM/Xen) vs. System Containers (LXC) vs. App Containers (Docker) [Virtual Machines vs LXC vs Docker: What’s the Real Difference?] This guide breaks down the architectural distinctions, maintenance lifecycles, and performance for modern virtualization and containerization. 1. Technical Comparison Matrix Feature Virtual Machines (KVM/Xen) System Containers (LXC) App Containers (Docker) Abstraction Hardware. Emulates CPU, RAM, NIC. OS. Isol…

[Louie1961]

What is the reasoning behind one stack per VM? That is a very counter-intuitive approach, a perfect example of an “anti-pattern”. Are you doing this because you want to use Proxmox to back up each one individually? Running each stack in a VM is a giant waste of memory, CPU, etc. It really defeats the purpose of using containers.

[SinisterPisces]

@LTS_Tom

Not sure why you would want to run each docker in a separate VM, but you certainly can. I always stick with Debian since it the environment that I know the best and has the best support for anything I might want to apt get install. While distros like Alpine are MUCH smaller, that size is still measured in MB which unless you are running thousands of those VM’s it not really a big deal.

I have a video here on my Docker setup:

Thanks! This is exactly what I needed to get started.

I’m probably over-complicating things for myself, but there are a few reasons I want to run certain containers in separate VMs.

This is what I’m envisioning:

1. A general purpose Docker host where I can run whatever random stacks I want to experiment with, along with more permanent stacks that don’t need a lot of extra configuration beyond adding some persistent storage.
2. Dedicated VMs for things like a Pterodactyl gaming server that will be exposed to the internet, that I’ll need to be a bit more intentional about when it comes to backups, persistent storage, NIC configurations, firewall settings, etc. I want anything exposed to the WAN to be a standalone VM, so even if someone does break into it, they don’t suddenly potentially have access to every other thing I’m running via Docker. Dedicated VMs for things like this also appeal to me because sometimes I might want to just be able to turn off a single-task VM (e.g., Pterodactyl) from the PVE GUI without having to interact with Docker directly.
3. Something like Portainer running in a separate VM to manage all my Docker hosts in one place.
4. I don’t like working with Docker networking. I can do it, but as someone who’s doing SOHO self-hosting, I find it overcomplicated and easy to screw up. Being able to separate out certain workloads and their networking configurations into separate VMs will

If I were trained and using proper container orchestration toolchains and automation, I doubt I’d want to do it this way, but I’d like to get up and going with some projects, and it makes more sense and seems less overwhelming for me to try to manage it this way.

@Louie1961

It really defeats the purpose of using containers.

I’m not trying to min-max my hardware resources.

I only care about running Docker (or Podman) because for certain workloads, it’s the easiest and best way to deploy things (e.g., Pterodactyl). That is my purpose for using Docker at all. I mostly try to avoid it unless I have to use it.