What it is
The standard pattern I use for Docker workloads in the homelab: each logical stack gets its own small host instead of every app sharing one giant machine. That keeps edge infrastructure, passwords, media, tools, experiments, and project dashboards separated.
Why I run it this way
The default question for a self-hoster is "one big Docker host or many small ones?" The answer for me is many small ones. Specifically:
- Blast radius. If Plex's nightly maintenance burst fills the rootfs (which has happened), only the media stack is affected. The password manager, the reverse proxy, and the dev environment are untouched.
- Backup granularity. PBS snapshots whole LXCs. A per-stack LXC means each stack gets its own snapshot, and a restore brings back exactly that stack — no cross-contamination.
- Resource isolation. The CPU/memory ceiling on each LXC bounds the worst-case impact of a runaway container. A leaky n8n workflow can't starve the reverse proxy.
- Deploy independence. I can rebuild the media-stack LXC from scratch without touching anything else.
The cost is a bit of duplication — six Docker installs, six Watchtower instances, six Portainer agents. That's been a fair trade.
How I use it
Each Docker LXC follows the same playbook: unprivileged container with nesting=1,keyctl=1 features, static IP (never DHCP — routers lose reservations on firmware updates), Docker installed from the official Docker apt repo (not docker.io), Container Protection enabled in Proxmox to prevent accidental destroy. Services live as docker-compose.yml files under /opt/stacks/<service>/, version-controlled where it matters.
The six current LXCs:
- docker-edge — Nginx Proxy Manager, AdGuard primary, Uptime Kuma, Homepage, Portainer.
- vaultwarden-host — Vaultwarden, isolated for blast-radius reasons.
- docker-media — the entire media stack (Plex, Tautulli, Overseerr, Riven, Seanime, AniBridge) plus the rclone-zurg FUSE mount.
- docker-tools — Stirling PDF, the Prometheus/Grafana observability stack, and a few utilities.
- docker-sandbox — code-server and experimental projects. The one I'm willing to break.
- northstar-lab — private project dashboard, access layer, scheduler summaries, and review notes.
Every Docker LXC also runs a Portainer agent for unified container management, and its own Watchtower instance configured monitor-only (notifies me of available updates but never applies them).