A modern Proxmox Docker architecture with disposable VMs, VirtIO-FS, and ZFS

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

The Linux kernel's security model is constantly evolving. In 2026, my Docker-in-LXC nesting became increasingly fragile and needed a replacement. Here I describe a state of the art architecture for Proxmox. The post outlines deploying lightweight VMs via cloud-init linked clones, isolating services in rootless Docker namespaces, and using VirtIO-FS with native VFS idmapped mounts for resource…

Read on du.nkel.dev ↗