Proxmox container creation and bootstrap

LXC or VM

For a trusted personal home server, the reference compact topology uses an unprivileged Debian LXC. It enables the Proxmox nesting and keyctl features that Docker inside an unprivileged container requires.

Choose a QEMU VM when stronger isolation, untrusted users, or live migration matter. Then follow the existing Docker server guide inside the VM.

Never make the LXC privileged, disable AppArmor, or expose broad host paths to make installation easier.

What the bootstrap does

The bootstrap is plan-first. It can:

• validate the requested container ID, bridge, storage, Debian template, address, and SSH public key;
• create a protected unprivileged LXC;
• install Docker from the official repository;
• create least-privilege Omakase directories;
• optionally plan /dev/net/tun without enabling a torrent client;
• write a secret-free bootstrap receipt.

It intentionally stops before application startup. It cannot infer credentials, public exposure, media rights, or access to a private release.

Plan and apply

On the Proxmox node, copy and edit the bootstrap configuration:

cp stack-config.example.env stack-config.env
chmod 0600 stack-config.env

./bootstrap-omakase-stack.sh plan \
  --config stack-config.env \
  --out omakase-stack-plan.json

Review every field and preserve the printed plan hash. Apply only that exact plan:

./bootstrap-omakase-stack.sh apply \
  --plan omakase-stack-plan.json \
  --expected-plan-hash <printed-sha256> \
  --receipt omakase-stack-bootstrap-receipt.json

Planning refuses an occupied container ID, missing bridge or storage, unsupported template, unsafe bind mount, absent SSH public key, malformed static network, implicit public exposure, or changed release archive.

A partial apply leaves the container visible for inspection. It does not destroy the container automatically.

Storage choices

Prefer an LXC-managed volume for the first install. If a host bind mount is necessary:

• reserve a non-symlink path below a dedicated bind-mount root;
• plan unprivileged UID mapping;
• back up the bind-mounted content separately because Proxmox vzdump does not include it;
• never bind /, /etc, /var, the Docker socket, or a broad NAS root.

Keep Omakase SQLite local to the application host. Do not place SQLite on NFS.

Ports and exposure

The examples bind Omakase, Plex, and optional provider interfaces to loopback first. No router forwarding is required. Use a trusted LAN path, private overlay network, or authenticated HTTPS reverse proxy for remote administration.

After the bootstrap, install the exact private release with Existing Docker server quick start.