LXC Templates¶

Overview¶

Two LXC template variants are maintained on the Proxmox cluster. Both are derived from a shared Debian base container to keep the OS foundation consistent and minimize unnecessary package divergence.

Template	Purpose
`playground`	Testing, diagnostics, and quick operational tasks
`prod-ready`	Production-grade containers with a minimal package set

Base Container¶

Start by creating a shared base container from the official Debian 13 template.

# Download the template
pveam download local debian-13-standard_13.1-2_amd64.tar.zst

# Create the base container
pct create 9000 local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst \
  --hostname deb13-base-build \
  --rootfs local-lvm:8 \
  --memory 1024 \
  --cores 2 \
  --net0 name=eth0,bridge=vmbr0,ip=dhcp \
  --unprivileged 1

Note

No root password is set at this stage. Enter the container with pct enter 9000.

Install the baseline packages:

apt update
apt -y full-upgrade
apt -y install --no-install-recommends \
  ca-certificates curl wget sudo nano iproute2 iputils-ping

Create the standard users defined in the VM & LXC Security Standard:

adduser sysadmin
usermod -aG sudo sysadmin

adduser appcircle

Playground Template¶

Clone the base container and install a broader set of diagnostic and operational tools.

pct clone 9000 9100 --hostname deb13-playground --full 1

apt update
apt -y install --no-install-recommends \
  vim nano less bash-completion tmux screen \
  curl wget jq rsync unzip zip ca-certificates \
  iproute2 iputils-ping net-tools dnsutils traceroute mtr-tiny \
  tcpdump socat netcat-openbsd \
  procps psmisc lsof strace htop iotop iftop ncdu tree file \
  git openssh-client sudo isc-dhcp-client

Use cases:

Test and development environments
Network diagnostics and troubleshooting
Operational inspection and observation

Prod-Ready Template¶

Clone the base container and install only what is strictly required for production workloads.

pct clone 9000 9200 --hostname deb13-prod --full 1

apt update
apt -y full-upgrade
apt -y install --no-install-recommends \
  ca-certificates curl sudo openssh-client qemu-guest-agent

Use cases:

Production-grade container provisioning
Minimal attack surface
Predictable and controlled package footprint

Converting to a Template¶

Once a container is prepared, convert it to a Proxmox template. Any future LXC can then be cloned from it.

Note

The same base → variant approach applies to VM templates as well.

Versioning¶

When updating a template, always use an explicit version suffix. Never overwrite an existing template in place.

Naming convention:

deb13-base-v1
deb13-base-v2
deb13-playground-v1
deb13-playground-v2
deb13-prod-v1
deb13-prod-v2

Rules:

Increment the version number on every update
Keep the previous version available until the new one is validated
Do not mix base templates with derived variants in naming

Warning

Overwriting a template that is currently in use as the source for linked clones can break existing containers. Always version explicitly.