Containers
A container is a Linux system that shares its node's kernel instead of booting its own. It runs a full distribution (systemd, SSH, packages, users) like a VM, but it needs a fraction of the memory and starts in about a second. On mini PCs, where memory runs out first, that means many more small services per node.
Containers live on the Virtual machines page next to your VMs, marked Container. Protection, replication and failover work for them exactly as for VMs.
Container or VM?
| Container | Virtual machine | |
|---|---|---|
| Memory | Only what its programs use, often 20-100 MB for a small service | Everything you give it, plus its own kernel |
| Starts in | About a second | 10-30 seconds |
| Operating systems | Linux only, from the image catalog | Any: Linux, Windows, BSD, appliances from an ISO |
| Isolation | Shares the node's kernel: a kernel flaw could let it reach the node | Its own kernel and virtual hardware |
| Moves | Restart on the other node (a few seconds) | Can also move live, without stopping |
| Console | Terminal, Root shell, Files, Boot log | Also Screen |
Choose a container for Linux services you trust: DNS, Home Assistant core, databases, reverse proxies, file shares. Choose a VM for Windows or other operating systems, anything that needs its own kernel or kernel modules, anything exposed to the internet that you'd rather keep isolated, and anything that runs Docker (see Limits).
Create a container
- Click New VM and choose Container at the top of the dialog.
- Fill in Name, then choose the Operating system and Version. Only images with a container build are listed. Your saved images lists images saved from containers.
- Set CPU limit, Memory limit and Disk (GiB) (1 CPU, 512 MiB and 8 GiB to start with; memory from 256 MiB). A container uses only what it needs up to these limits.
- Fill in Sign-in and, optionally, Address, VLAN and Run on, as for a VM (see Create a VM).
- Leave Protect this container ticked to keep a copy on another node and start it there if its node fails.
- Click Create container. It starts on its own.
Containers need every node in the cluster online and running staxmax 0.2 or later. Until then, creating one says so: a node on an older version doesn't see containers, so it could neither stop one when it is cut off nor take one over.
What works the same
Start, stop and restart, Edit (CPUs, memory, disk, disk speed, VLANs and network cards, scheduled snapshots, start order, backups, notes), snapshots, Clone, Save as image, backups and downloads, USB devices, protection, moves, maintenance mode, failover and force start all work as described in Virtual machines.
A clone, or a container made from a saved image, gets its own MAC address, machine ID and hostname, as a VM does. Its Root shell and Files tabs work without installing anything: Incus reaches into a container directly, with no agent.
Limits
- No live moves. Move to node reads (restart): the container stops, the latest changes are sent, and it starts on the other node, usually within a few seconds. Maintenance mode moves containers the same way.
- No screen. The console has no Screen tab. The Terminal is the container's own console; press Enter if you see no prompt.
- No ISO installs, Windows, legacy BIOS, Secure Boot, virtual TPM or memory saving. These belong to virtual hardware, which a container doesn't have, so the dialogs don't offer them.
- Always unprivileged. Root inside a container is an ordinary user on the node, so a compromised container can't act as root on the node.
- USB devices only as raw USB. A container gets the USB device itself, while the node keeps driving it. That suits software that talks to the device through libusb, such as a UPS (NUT), a printer or scanner, a security key or an SDR dongle. It doesn't get the sound card, serial port (
/dev/ttyUSB0, as on most Zigbee and Z-Wave sticks), disk, camera, Bluetooth or network card the node makes of it: the USB devices dialog warns about these. Pass them through to a VM instead. - No Docker inside, for now. Running Docker in a container needs settings staxmax doesn't turn on yet. Run Docker in a VM.
- Saved images keep their kind. An image saved from a container makes containers, and one saved from a VM makes VMs.
Containers created outside staxmax
A container created directly with incus on a node shows up on the Virtual machines page like any other instance, once every node runs a version that supports containers. Like every instance on a node, it is stopped if the node is cut off from the rest of the cluster (see Failover).