If you need to run Docker on your Proxmox installation under LXC instead of in a VM, it’s possible, but there are some extra steps, especially where ZFS in concerned as the host file system. I feel, however, like it’s worth it due to the reduced overhead vs a VM.

First, create an unprivileged LXC container. In my case, I chose Ubuntu 20.04.

• Select the Ubuntu 20.04 template.
• Select your local Proxmox storage, usually either local-lvm or local-zfs. If you choose ZFS, we’ll get into that headache later.
• Start and enter the shell of your created container.

#apt update && apt upgrade -y

Install fuse-overlayfs if you’re using ZFS as your host filesystem. The default “overlay2” doesn’t work and docker will refuse to start. It will also work on lvm-based partition schemes, so use fuse-overlayfs if you think you might ever move your container to a ZFS partition down the line.

#apt install fuse-overlayfs docker.io

At this point, docker will attempt to start itself. If you’re using ZFS, it will attempt to use “overlay2” and fail, then fall back to fuse-overlayfs since it’s installed.

To ensure that docker always uses the fuse-overlayfs storage driver instead of VFS (which happened to me and my filesystem ballooned to 16GB from 3GB by doing a simple pull request), create /etc/docker/daemon.json and add the following:

{
  "storage-driver": "fuse-overlayfs"
}

Shut your container down and edit /etc/pve/lxc/<containernumber>.conf. Add the following line at the bottom:

lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file,rw,uid=165536,gid=165536 0 0

This will allow the fuse device on the host to pass through into the container. Start it back up.

Let’s install Portainer as a test, as well as a good orchestration environment:

docker run -d -p 8000:8000 -p 9443:9443 --name portainer \
    --restart=always \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v portainer_data:/data \
    portainer/portainer-ce:2.9.3

If everything was configured properly, it should download and start immediately.

Troubleshooting

Q: I get an error that complains I might need to run “modprobe fuse”

A: You need to add the /dev/fuse line to the container configuration.

Q: Docker refuses to run with an error “attempted to load a profile while confined?”

A: You’ve created a privileged container. Back up your container, then restore it was an unprivileged container. Otherwise, the only way I’ve found to fix this is to uninstall apparmor.