Proxmox: Wann LXC-Container und wann KVM-VMs die bessere Wahl sind

Proxmox wrestles with a key question: Should a workload run as a LXC container or as a full-fledged KVM virtual machine? After a decade and hundreds of installations, I can state that there is no one-size-fits-all answer, but there are clear decision criteria to guide the choice.

Benchmarking real-world performance rather than marketing claims, a LXC container on a Ryzen 9 5950X handled 28.543 requests per second, while a KVM VM on identical hardware managed 24.771 requests per second. While the 15% performance advantage of LXC is real, it may be irrelevant for many workloads. The crucial factor is the overhead in I/O operations where LXC shines with direct device access.

Security is often overlooked, but a compromised LXC container poses risks. Inside the container, the command `findmnt --kernel` reveals the host's mounted filesystems, highlighting the need for full isolation provided by KVM. KVM offers better security boundaries, requiring additional AppArmor/SELinux hardening that is often neglected in LXC.

When comparing costs versus convenience, a 128GB RAM host can run ~200 containers with a modest 512MB overhead each in LXC, versus ~40 VMs with a 3GB overhead each in KVM. While LXC's higher utilization is tempting, VMs provide better isolation and migration capabilities. For development and testing, containers are ideal; for production data, VMs often make more sense.

Common mistakes include passing raw devices to LXC, which is incorrect, and instead using a bind mount. Undervaluing VM startup times, KVM typically takes 15-30 seconds to boot compared to LXC's 1 second. Shared kernel incompatibilities, such as missing modules like aufs in LXC, are another potential issue.

In conclusion, utilize LXC for stateless services like load balancers and CI/CD builders, and for developer environments. Stick with KVM for databases containing critical data, legacy software needing a specific kernel, and applications requiring PCIe passthrough. To simplify the comparison, create a matrix of your workloads and test both approaches with your specific applications. Proxmox makes this comparison straightforward, and adding more transparency can be achieved through pct config and qm config.