Problem
The "Create Container" wizard for Proxmox nodes exposes nesting as a feature
toggle, but not keyctl. Both are required for running Docker inside an
unprivileged LXC. A container created through PegaProx with the nesting box
ticked will start, but Docker will run into kernel keyring / overlay2 permission
errors at runtime (depending on the image and workload, sometimes only on the
first docker run).
The native Proxmox web UI exposes both toggles side by side in the Features
tab of the Create CT wizard, so users who switch from the native UI to
PegaProx will silently lose the keyctl setting and not notice until Docker
misbehaves.
Reproduction
- PegaProx → cluster → node → Create CT
- Select a Debian template (tested with
debian-13-standard), pick
unprivileged, default resources
- Features section: only
nesting is available — there is no keyctl checkbox
- Finish the wizard, start the container, install and run Docker
- Symptoms will surface when Docker uses overlay2 / needs session keyrings
Workaround on the host, after create:
pct set --features nesting=1,keyctl=1
pct reboot
Suggested fix
Expose keyctl alongside nesting in the Features section of the Create CT
wizard (and ideally in the "Options → Features" edit dialog of an existing CT
too). The PVE REST endpoint POST /nodes/{node}/lxc already accepts
features=nesting=1,keyctl=1 so no backend work should be needed — it's a UI
additions only.
Also fuse=1 and mount=<types> would be nice to have in the same section
for feature parity with the native wizard, though those are lower priority
than keyctl which is a Docker-in-LXC blocker.
Environment
- PegaProx version: 26.04.1.6442 (running as Docker)
- Proxmox VE: 8.x
- Observed: 2026-04-09
Problem
The "Create Container" wizard for Proxmox nodes exposes
nestingas a featuretoggle, but not
keyctl. Both are required for running Docker inside anunprivileged LXC. A container created through PegaProx with the
nestingboxticked will start, but Docker will run into kernel keyring / overlay2 permission
errors at runtime (depending on the image and workload, sometimes only on the
first
docker run).The native Proxmox web UI exposes both toggles side by side in the Features
tab of the Create CT wizard, so users who switch from the native UI to
PegaProx will silently lose the
keyctlsetting and not notice until Dockermisbehaves.
Reproduction
debian-13-standard), pickunprivileged, default resources
nestingis available — there is nokeyctlcheckboxWorkaround on the host, after create:
pct set --features nesting=1,keyctl=1
pct reboot
Suggested fix
Expose
keyctlalongsidenestingin the Features section of the Create CTwizard (and ideally in the "Options → Features" edit dialog of an existing CT
too). The PVE REST endpoint
POST /nodes/{node}/lxcalready acceptsfeatures=nesting=1,keyctl=1so no backend work should be needed — it's a UIadditions only.
Also
fuse=1andmount=<types>would be nice to have in the same sectionfor feature parity with the native wizard, though those are lower priority
than
keyctlwhich is a Docker-in-LXC blocker.Environment