LXC Containers vs Docker: When to Use Which and Why

The Container Confusion

Most people use "container" to mean Docker, but there are two fundamentally different types of Linux containers:

• System containers (LXC/LXD): Act like lightweight VMs. Run a full init system, have their own network stack, and feel like a complete OS.
• Application containers (Docker): Package a single application with its dependencies. Ephemeral, immutable, and designed to run one process.

Understanding the difference helps you make better architecture decisions.

Architecture Comparison

LXC (System Containers)

Host Kernel
  |
  +-- LXC Container 1 (Ubuntu 24.04)
  |     +-- systemd (PID 1)
  |     +-- sshd
  |     +-- nginx
  |     +-- postgresql
  |     +-- cron
  |
  +-- LXC Container 2 (Debian 12)
        +-- systemd (PID 1)
        +-- docker daemon
        +-- other services

Each LXC container runs a full OS with systemd, has its own IP address, and can run multiple services — just like a VM, but sharing the host kernel.

Docker (Application Containers)

Host Kernel
  |
  +-- Docker Engine
        +-- Container 1: nginx (PID 1 = nginx)
        +-- Container 2: postgres (PID 1 = postgres)
        +-- Container 3: redis (PID 1 = redis)
        +-- Container 4: api (PID 1 = node)

Each Docker container runs one application, shares the host network (or uses bridge networking), and is built from an immutable image.

Performance Comparison

Both LXC and Docker have near-native performance. The difference is in what they run.

When to Use LXC

1. Running Docker Inside Containers

This is the most common use case. Run Docker inside an LXC container on Proxmox for the best of both worlds:

# /etc/pve/lxc/100.conf
arch: amd64
cores: 7
memory: 14336
features: nesting=1,keyctl=1
unprivileged: 1

2. Multi-Tenant Isolation

Give each team or client their own LXC container with isolated networking, storage, and resource limits.

3. Legacy Applications

Applications that expect a full OS with systemd, cron, and multiple daemons run naturally in LXC.

4. Network-Heavy Workloads

LXC containers get their own real IP address on the network. No NAT, no port mapping, no Docker bridge overhead.

When to Use Docker

1. Microservice Architectures

Docker's single-process model is perfect for microservices. One container per service, scaled independently.

2. CI/CD Pipelines

Docker images provide reproducible builds. Same image in dev, staging, and production.

3. Third-Party Services

Most software publishes official Docker images. One-command deployment:

docker run -d --name postgres -e POSTGRES_PASSWORD=secret postgres:16

4. Horizontal Scaling

Docker Compose or Kubernetes can scale containers horizontally:

services:
  api:
    image: myapp/api:latest
    deploy:
      replicas: 3

Networking Differences

LXC Networking

# LXC gets a real IP on the network
net0: name=eth0,bridge=vmbr0,ip=192.168.1.101/24,gw=192.168.1.1

The container appears as a separate device on your network. Other machines can reach it directly.

Docker Networking

# Docker uses bridge networks by default
networks:
  app-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

Docker containers communicate via internal bridge networks. External access requires port mapping or host networking.

Storage Differences

LXC Storage

LXC containers use a root filesystem (ext4, ZFS, or Btrfs). They can have additional mount points from the host:

mp0: /mnt/storage,mp=/data,backup=0

Docker Storage

Docker uses overlay2 by default. Data persistence requires volumes:

volumes:
  - postgres_data:/var/lib/postgresql/data
  - ./config:/app/config:ro

The Best of Both Worlds

At TechSaaS, we use both:

1. Proxmox manages the physical server
2. One LXC container (CT 100) runs Ubuntu 24.04 with Docker installed
3. 50+ Docker containers run inside the LXC container
4. LXC provides: real networking, GPU passthrough, resource limits, snapshot backups
5. Docker provides: application packaging, service isolation, easy deployment

This architecture gives us VM-like isolation at the LXC level with Docker's ease of deployment at the application level.

Physical Server (Proxmox)
  +-- CT 100 (LXC - Ubuntu 24.04)
  |     +-- Docker Engine
  |     |     +-- traefik
  |     |     +-- authelia
  |     |     +-- postgres
  |     |     +-- gitea
  |     |     +-- n8n
  |     |     +-- ... (50+ more)
  |     +-- NVIDIA drivers
  |     +-- mise (dev tools)
  +-- CT 200 (LXC - potential future use)

Decision Framework

Use LXC when you need:

• Full OS environment
• Real network IP
• GPU passthrough
• Multiple services per container
• Long-lived mutable state

Use Docker when you need:

• Single-service containers
• Reproducible deployments
• Quick service deployment
• Horizontal scaling
• CI/CD integration

Use both when you want the best of both worlds — which is what we recommend.

Questions about container architecture? Contact [email protected].