Proxmox VE: decisions for a recoverable lab
Criteria for choosing KVM or LXC and planning storage, networking, backups, and a restore test in a lab.
A lab is not recoverable merely because its services start. Before installing applications, it helps to separate four decisions: what to isolate, where to keep data, which networks can reach it, and how to verify a restore. These are design criteria, not a record of a completed installation.
Choosing between a VM and a container
A KVM virtual machine runs its own virtualized operating system and kernel. It makes sense when a different operating system, control over the guest kernel, or a stronger isolation boundary is needed. In return, the full guest system must be maintained.
An LXC container shares the host kernel and suits Linux services compatible with that model. Its isolation is not equivalent to a VM’s: if an application needs privileges or kernel access that break the intended boundary, reconsider the architecture rather than making the container privileged for convenience.
The choice follows the service’s requirements and acceptable risk, not a claim that either format is always “faster” or “safer.”
Storage and networking before deployment
Storage for VM disks or container root filesystems, images and templates, and backup destinations serve different purposes. Decide which data is persistent and confirm that the chosen storage type supports the expected content. A copy kept only on the same host does not cover the loss of that host.
For networking, a bridge connects guests to the intended topology; it does not replace an access policy. Define which services need exposure, separate management from application traffic where appropriate, and verify firewall rules, DNS, and routes from the guest’s perspective. These decisions do not require invented addresses or open ports.
Verify a backup by restoring it
A snapshot can return an environment to an earlier state, but it does not replace an independent backup. The plan should state which guests and data are copied, where copies are kept, how long they are retained, and which host configuration would need separate reconstruction.
The meaningful test is to restore a copy in an isolated environment, start the guest, and check that the expected data and service work. Recording the test’s date, scope, and failures distinguishes “backup created” from “recovery verified.” This article describes that criterion; it does not claim such a test was performed in a particular lab.
Primary reference: Proxmox VE Administration Guide 8.4 (April 9, 2025).