Proxmox: Wann LXC-Container statt VMs sinnvoll sind – Praxis-Vergleich

Title: When to Choose LXC Containers Over VMs - Practical Comparison

Proxmox recently published a comparison piece on when to use LXC containers instead of virtual machines (VMs). The author explains why he initially moved to LXC containers in 2018 after seeing the excessive resource usage of VMs for his WordPress instance. Although VMs have their place, the author argues that LXC containers can be more efficient in certain scenarios.

1. Resource Efficiency

LXC containers are more efficient with resources than VMs. They share the host kernel, utilizing only the resources each application actually requires. For example, a fresh Ubuntu VM consumes 300MB of RAM while idle, while an LXC container only uses the resources needed by the application. This can make a significant difference when running multiple systems. However, LXC containers may not be suitable for security-critical isolation or stateless services.

2. Storage Performance

LXC containers show improved storage performance when using local SSDs instead of traditional VM storage methods. With bind-mounted containers, IOPS (Input/Output Operations Per Second) can reach near-native performance without the overhead of SCSI stacks or VirtIO. However, this performance advantage comes at the cost of kernel queuing, which can impact performance for high-frequency database transactions. In such cases, KVM might be a better choice.

3. Security

While Proxmox markets LXC as lightweight VMs, the author cautions that this is a dangerous myth. Kernel exploits, such as Dirty Pipe (CVE-2022-0847), can compromise the entire host when running untrusted workloads in LXC containers. KVM offers better isolation against such attacks. For multi-tenant environments with untrusted workloads, VMs are the safer option. However, for internal microservices with proper security configurations, LXC can be an acceptable alternative.

The author concludes by suggesting a simple 2-minute check to determine whether to use LXC containers or VMs for a specific application. He recommends testing a stateless service in an unprivileged LXC container with specific parameters to help decide the best approach. Ultimately, the author emphasizes that there is a middle ground between LXC and VMs, and it's crucial to consider the specific needs of each application.