Proxmox VE LXC Containers: Download Templates, Create Containers, Assign IPs and Limit Resources

Not every workload needs a full virtual machine. LXC containers in Proxmox VE share the host kernel, start in a second or two and use far less RAM and disk than KVM VMs, which makes them ideal for websites, databases, monitoring, proxies and internal tools on a dedicated server or host node. This guide covers downloading container templates, creating containers in the web interface and with pct, giving them a public or private IP, limiting CPU, memory, disk and bandwidth, running Docker inside a container, and backups.

LXC Container or KVM Virtual Machine?

Step 1: Download a Container Template

Templates are ready-made root filesystems for Debian, Ubuntu, Rocky Linux, AlmaLinux, Alpine and others. In the web interface open local → CT Templates → Templates, or use the command line on the host. Template file names include a version number, so copy the exact name from the list.

pveam update
pveam available --section system | grep -E 'debian-12|ubuntu-24.04|rockylinux-9|alpine'
pveam download local debian-12-standard_12.7-1_amd64.tar.zst   # use the exact name from the list
pveam list local

Step 2: Create a Container

In the web interface click Create CT and follow the wizard: hostname and root password (or SSH key), template, disk size, CPU cores, memory and network. Leave Unprivileged container ticked; it maps root inside the container to an unprivileged user on the host and is much safer. The same container from the command line:

pct create 101 local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst \
  --hostname web01 \
  --unprivileged 1 \
  --cores 2 --memory 2048 --swap 512 \
  --rootfs local-lvm:20 \
  --net0 name=eth0,bridge=vmbr0,ip=203.0.113.11/24,gw=203.0.113.1 \
  --nameserver 1.1.1.1 \
  --ssh-public-keys /root/.ssh/authorized_keys \
  --features nesting=1 \
  --onboot 1

pct start 101
pct enter 101          # open a root shell inside the container
pct list

Step 3: Networking: Public IP or Private NAT

Public IP: attach the container to the bridge that carries your public network (usually vmbr0) and give it one of your additional IPs with the gateway of that subnet, exactly as for a VM (see assigning a public IP to a Proxmox VM). If your additional IPs are routed to a specific MAC address, set it with hwaddr= in the net0 options.

Private NAT: to run many containers behind the host's single IP, put them on a private bridge such as vmbr1 and forward the ports you need, as described in Proxmox VE NAT networking:

pct set 102 --net0 name=eth0,bridge=vmbr1,ip=10.10.10.12/24,gw=10.10.10.1
pct reboot 102

Step 4: Limit CPU, Memory, Disk and Bandwidth

All limits can be changed while the container runs; most take effect immediately.

# CPU: 2 visible cores, but at most 1.5 cores of total CPU time
pct set 101 --cores 2 --cpulimit 1.5

# Memory and swap (MB)
pct set 101 --memory 1024 --swap 256

# Grow the root disk by 10 GB (disks can grow online but not shrink)
pct resize 101 rootfs +10G

# Bandwidth: rate is in MB/s, so 12.5 is roughly 100 Mbps
pct set 101 --net0 name=eth0,bridge=vmbr0,ip=203.0.113.11/24,gw=203.0.113.1,rate=12.5

pct config 101

Step 5: Run Docker Inside a Container

Docker works in an unprivileged container when nesting is enabled. The keyctl feature is also needed by some images.

pct set 101 --features nesting=1,keyctl=1
pct reboot 101
pct enter 101
# inside the container, install Docker as usual (see our Docker guide)

For production Docker hosts, especially ones with many containers or special storage drivers, a KVM VM is still the more predictable choice.

Step 6: Back Up, Snapshot and Clone

# Snapshot before risky changes (requires LVM-thin, ZFS or Ceph storage)
pct snapshot 101 before-upgrade
pct rollback 101 before-upgrade

# Full backup with compression (see our Proxmox backup guide for schedules)
vzdump 101 --mode snapshot --storage local --compress zstd

# Clone a container you have prepared as a base
pct clone 101 105 --hostname web05 --full 1

For scheduled backups and restores, see Proxmox VE backup and snapshots.

FAQ

The container has no internet access

Check the IP, prefix and gateway in pct config, that the bridge is correct, and DNS in /etc/resolv.conf inside the container. From inside, test ping -c3 1.1.1.1 and then ping -c3 google.com to separate routing from DNS problems. Also check that the Proxmox firewall is not blocking the container.

Can I convert a container into a VM later?

Not directly. Create a VM and migrate the data or the application, for example with rsync (see our server migration guide).

How many containers can one server run?

It depends on the workload, not on Proxmox. Because containers use little overhead, a server with 64 GB of RAM can comfortably host dozens of small websites or services. Watch RAM, disk I/O and CPU steal on the host and leave headroom for peaks.

Still stuck after following these steps? Open a support ticket and the IMIDC 24/7 technical team will help. Include the server IP, the Proxmox VE version, the container ID and configuration (pct config ID) and the full error output so we can pinpoint the issue faster.