I run a single Proxmox server in my home office for a mixture of personal and work VMs and LXCs.
I’d like to build a secure, simple-to-maintain base Docker VM template for deploying single-container (or single stack) VMs; I’d much rather run a small VM for each Docker-based workload than run a single monolithic Docker VM with a dozen unrelated stacks in it.
I’d like the base configuration to use as little RAM as possible, and I’m planning to use a simple firewall like ufw instead of something more complex like firewalld, just to keep things easy on myself.
I don’t want to use Ubuntu; even the base Ubuntu Server LTS install feels bloated–I don’t need snapd in a Docker Minecraft server VM, for example.
I don’t want the OS so locked down that I can’t easily do things like add additional virtual NICs, but I also don’t want to have to spend a ton of time configuring and securing a general-purpose OS, especially as I want to do a bit of public-facing self-hosting (e.g., Minecraft).
I was planning to use Debian’s LTS as a base, but I have a few questions about that:
If I want to get the lowest base footprint possible, is it worth it to learn Alpine? I know it would have a smaller base footprint, but how hard is it to pick up and configure coming from Debian? Would it be missing potential features that I would regret not having for general purpose Docker use?
Is it worth learning to use Cloud Init if I’m going to build all this up as a Proxmox VM template anyway?
Am I correct that a container-first OS like Flatcar or Fedora Core is entirely overkill for home server use? I’ve looked at solutions like that and as a hobbyist they just feel overwhelming.
Not to hype ZimaOS, but it really does work well. And it comes natively with ZVM (Zima Virtual Machine) and NinjaMonitor. Can make new VM’s right in Zima super easily. Use that as your Docker host and put them all in there. Screenshot shows how easy it is. Due to issues with drive management for USB drives (if you would be using any with this) the newest update (1.7.0) I highly recommend using ZimaOS 1.5.4 instead.
This will mostly be about disk size rather than CPU / RAM resources in my experience. Sure you might also have a advantage when it comes to RAM per VM, but IMHO if you use KSM (enabled by default in proxmox) you benefit more by using the exact same base image where ever possible.
It’s not that hard to pickup alpine in general: apt update && apt install becomes apk add, but the toolchain is musl libc, which can lead to incompatibilities with some tools. And of course you got only busybox tools and no systemd / journald.
In the end I decided against alpine since all my other VMs are debian and they got a longer support window by default.
I generally use Cloud-Init only to add SSH keys, setup users, install python and do the rest via ansible. I even create the VMs and cloud init image via ansible.
If you use these VMs to deploy single container (stacks) I would say it is.
Edit: When it comes to ufw vs. firewalld - I switched to firewalld mainly to use the same firewall everywhere since it can also be used to setup drop rules e.g.
if I understand you correctly you want a minimal vm that launches a container to get better isolation than running the container directly on the host?
In that case you’re overthinking it a bit. The VM’s runtime, firewall etc don’t matter. The vm is just there to launch the container and the runtime is defined by the container image. Firewalling would happen on the proxmox (host) side.
