LXC vs. VM in Proxmox
What This Article Covers
- Technical differences between LXC and VMs.
- When containers are the right choice and when VMs make sense.
- Trade-offs in resource usage, security, and management.
- How GPU passthrough works with each approach.
- Practical tips for running AI services.
Introduction: LXC vs. VM in Proxmox
Proxmox VE offers two virtualization options: Linux Containers (LXC) and virtual machines (VMs). Both have their place, and the choice depends on your requirements. Containers are lightweight, while VMs provide stronger isolation. For local AI projects, this decision matters especially when GPU passthrough, security, and resource efficiency are on the table.
This article compares both approaches and shows which to pick for AI services like Ollama, OpenClaw, OpenHands, or databases.
Key Terms
- LXC: Linux Container, shares the kernel with the host.
- VM: Virtual machine with its own operating system and kernel.
- KVM: Kernel-based Virtual Machine, the virtualization technology behind Proxmox VMs.
- CT: Container in Proxmox terminology.
- Passthrough: Passing physical hardware directly to a guest.
- Overhead: Extra resource consumption caused by virtualization.
- Snapshot: A saved state of a running or stopped system.
What Is an LXC?
An LXC is an isolated process environment that shares the host’s kernel. Containers start quickly, use little memory, and are straightforward to manage. They work well for Linux applications that don’t need their own kernel, such as web servers, databases, or monitoring tools.
What Is a VM?
A VM emulates a complete computer with its own kernel, network stack, and devices. It offers stronger isolation but consumes more resources and takes longer to start. VMs make sense for Windows, special kernel requirements, GPU passthrough, and maximum security.
Comparison
| Criterion | LXC | VM |
|---|---|---|
| Start time | Seconds | Minutes |
| Overhead | Very low | Higher |
| Isolation | Lower | Strong |
| Kernel | Shared | Own |
| GPU passthrough | Difficult but possible | Easier |
| Snapshots | Fast | Slower |
| Memory | Efficient | More overhead |
| Security | Container escape possible | Strongly isolated |
| Operating system | Linux only | Any |
When to Choose LXC
- Ollama: Runs well in an LXC, Docker works with
nesting=1. - Databases: PostgreSQL and SQLite are container-friendly.
- Reverse Proxy: Nginx Proxy Manager or Traefik.
- Monitoring: Grafana, Prometheus.
- OpenClaw: LXC is sufficient as long as you follow security practices.
When to Choose a VM
- Windows Guest: LXC cannot run Windows.
- GPU Passthrough: VMs offer simpler PCI passthrough.
- Strict Isolation: Higher security for critical services.
- Custom Kernel Modules: When the guest needs its own kernel.
- OpenHands with Docker: VMs simplify Docker socket operation.
GPU Passthrough
In a VM
GPU passthrough in VMs is the established approach. You attach the GPU via PCI passthrough and install the appropriate driver in the guest. AMD and Nvidia cards both work, though they sometimes require workarounds like VBIOS or reset-bug fixes.
In an LXC
GPU passthrough in LXC is more complex. You must pass device files like /dev/dri or /dev/nvidia* to the container. This works with some cards but isn’t as stable as VM passthrough.
Security
- VMs: Better isolation, kernel exploits in the guest usually stay contained.
- LXC: Shares the host kernel. A container breakout could endanger the host.
- Privileged LXC: Avoid when possible.
- AppArmor and Seccomp: Enabled by default in LXC, verify them.
Resource Management
- LXC share kernel resources efficiently.
- VMs reserve RAM at startup.
- LXC can have memory assigned dynamically, while VMs require stricter allocation.
Practical Recommendations for AI
| Service | Recommended Approach |
|---|---|
| Ollama | LXC or VM, VM if GPU needed |
| OpenClaw | LXC, move to VM if higher security required |
| OpenHands | LXC with Docker, VM if GPU needed |
| PostgreSQL for RAG | LXC |
| Open WebUI | LXC |
| Windows with GPU | VM |
Common Pitfalls
- LXC won’t start: Missing features like
nestingorkeyctl. - VM won’t boot: UEFI chosen instead of SeaBIOS, VBIOS missing.
- GPU passthrough in LXC: Device files not passed through correctly.
- Network unreachable: Bridge
vmbr0misconfigured. - Insufficient RAM: VM or LXC allocated too little memory.
Further Reading and Resources
- BotServ.de Proxmox Basics
- BotServ.de Proxmox Backups and Restore
- BotServ.de OpenClaw on Proxmox
- BotServ.de Managing Ollama
- BotServ.de OpenHands on Proxmox
FAQ: LXC vs. VM
Is an LXC faster than a VM? Yes, because it shares the host kernel and has less overhead.
Do I need a VM for Ollama? No, an LXC is usually sufficient. For GPU passthrough, a VM is simpler though.
When is a VM more secure? When strong isolation and a separate kernel are required.
Can I do GPU passthrough in LXC? Yes, but it’s more involved and less stable than in VMs.
What is easier to maintain? LXC are simpler and faster to manage, especially for Linux services.
Sources and Further Reading
- Proxmox LXC: https://pve.proxmox.com/wiki/Linux_Container
- Proxmox VM: https://pve.proxmox.com/wiki/Qemu/KVM_Virtual_Machines
- Proxmox GPU Passthrough: https://pve.proxmox.com/wiki/PCI_Passthrough
Summary: LXC vs. VM in Proxmox
LXC and VMs in Proxmox each have distinct strengths. Containers are resource-efficient, fast, and simple to manage but offer less isolation. VMs are more secure, better suited for GPU passthrough, and the only choice for Windows. For AI services like Ollama, OpenClaw, and OpenHands, LXC usually suffices, while GPU-accelerated workloads and strict security requirements often call for a VM. Understanding these differences helps you pick the right tool for each job.