Manual: pct.conf: Difference between revisions

From Proxmox VE
Jump to navigation Jump to search
No edit summary
No edit summary
 
(18 intermediate revisions by the same user not shown)
Line 7: Line 7:
pct.conf - Proxmox VE Container Configuration
pct.conf - Proxmox VE Container Configuration
SYNOPSIS
SYNOPSIS
/etc/pve/lxc/<CTID>.conf
/etc/pve/lxc/&lt;CTID&gt;.conf
DESCRIPTION
DESCRIPTION
The /etc/pve/lxc/<CTID>.conf files stores container configuration,
The /etc/pve/lxc/&lt;CTID&gt;.conf files stores container configuration,
where CTID is the numeric ID of the given container.
where CTID is the numeric ID of the given container.
IDs ⇐ 100 are reserved for internal purposes.
IDs &lt; 100 are reserved for internal purposes.
File Format
File Format
The file uses a simple colon separated key/value format. Each line has
The file uses a simple colon separated key/value format. Each line has
Line 26: Line 26:
Those settings are directly passed to the LXC low-level tools.
Those settings are directly passed to the LXC low-level tools.
Options
Options
arch: (amd64 | i386) (default=amd64)
arch: &lt;amd64 | arm64 | armhf | i386 | riscv32 | riscv64&gt; (default = amd64)
OS architecture type.
OS architecture type.
cmode: (console | shell | tty) (default=tty)
cmode: &lt;console | shell | tty&gt; (default = tty)
Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to console it tries to attach to /dev/console instead. If you set cmode to shell, it simply invokes a shell inside the container (no login).
Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to console it tries to attach to /dev/console instead. If you set cmode to shell, it simply invokes a shell inside the container (no login).
console: boolean (default=1)
console: &lt;boolean&gt; (default = 1)
Attach a console device (/dev/console) to the container.
Attach a console device (/dev/console) to the container.
cpulimit: number (0 - 128) (default=0)
cores: &lt;integer&gt; (1 - 8192)
The number of cores assigned to the container. A container can use all available cores by default.
cpulimit: &lt;number&gt; (0 - 8192) (default = 0)
Limit of CPU usage.
Limit of CPU usage.
If the computer has 2 CPUs, it has a total of 2 CPU time. Value 0 indicates no CPU limit.
If the computer has 2 CPUs, it has a total of 2 CPU time. Value 0 indicates no CPU limit.
cpuunits: integer (0 - 500000) (default=1024)
cpuunits: &lt;integer&gt; (0 - 500000) (default = cgroup v1: 1024, cgroup v2: 100)
CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.
CPU weight for a container. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this container gets. Number is relative to the weights of all the other running guests.
You can disable fair-scheduler configuration by setting this to 0.
debug: &lt;boolean&gt; (default = 0)
description: string
Try to be more verbose. For now this only enables debug log-level on start.
Container description. Only used on the configuration web interface.
description: &lt;string&gt;
hostname: string
Description for the Container. Shown in the web-interface CT&#8217;s summary. This is saved as comment inside the configuration file.
dev[n]: [[path=]&lt;Path&gt;] [,gid=&lt;integer&gt;] [,mode=&lt;Octal access mode&gt;] [,uid=&lt;integer&gt;]
Device to pass through to the container
gid=&lt;integer&gt; (0 - N)
Group ID to be assigned to the device node
mode=&lt;Octal access mode&gt;
Access mode to be set on the device node
path=&lt;Path&gt;
Path to the device to pass through to the container
uid=&lt;integer&gt; (0 - N)
User ID to be assigned to the device node
features: [force_rw_sys=&lt;1|0&gt;] [,fuse=&lt;1|0&gt;] [,keyctl=&lt;1|0&gt;] [,mknod=&lt;1|0&gt;] [,mount=&lt;fstype;fstype;...&gt;] [,nesting=&lt;1|0&gt;]
Allow containers access to advanced features.
force_rw_sys=&lt;boolean&gt; (default = 0)
Mount /sys in unprivileged containers as rw instead of mixed. This can break networking under newer (&gt;= v245) systemd-network use.
fuse=&lt;boolean&gt; (default = 0)
Allow using fuse file systems in a container. Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.
keyctl=&lt;boolean&gt; (default = 0)
For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container. By default unprivileged containers will see this system call as non-existent. This is mostly a workaround for systemd-networkd, as it will treat it as a fatal error when some keyctl() operations are denied by the kernel due to lacking permissions. Essentially, you can choose between running systemd-networkd or docker.
mknod=&lt;boolean&gt; (default = 0)
Allow unprivileged containers to use mknod() to add certain device nodes. This requires a kernel with seccomp trap to user space support (5.3 or newer). This is experimental.
mount=&lt;fstype;fstype;...&gt;
Allow mounting file systems of specific types. This should be a list of file system types as used with the mount command. Note that this can have negative effects on the container&#8217;s security. With access to a loop device, mounting a file can circumvent the mknod permission of the devices cgroup, mounting an NFS file system can block the host&#8217;s I/O completely and prevent it from rebooting, etc.
nesting=&lt;boolean&gt; (default = 0)
Allow nesting. Best used with unprivileged containers with additional id mapping. Note that this will expose procfs and sysfs contents of the host to the guest.
hookscript: &lt;string&gt;
Script that will be exectued during various steps in the containers lifetime.
hostname: &lt;string&gt;
Set a host name for the container.
Set a host name for the container.
lock: (backup | migrate | rollback | snapshot)
lock: &lt;backup | create | destroyed | disk | fstrim | migrate | mounted | rollback | snapshot | snapshot-delete&gt;
Lock/unlock the VM.
Lock/unlock the container.
memory: integer (16 - N) (default=512)
memory: &lt;integer&gt; (16 - N) (default = 512)
Amount of RAM for the VM in MB.
Amount of RAM for the container in MB.
mp[n]: [volume=]<volume> ,mp=<Path> [,acl=<1|0>] [,backup=<1|0>] [,quota=<1|0>] [,ro=<1|0>] [,size=<DiskSize>]
mp[n]: [volume=]&lt;volume&gt; ,mp=&lt;Path&gt; [,acl=&lt;1|0&gt;] [,backup=&lt;1|0&gt;] [,mountoptions=&lt;opt[;opt...]&gt;] [,quota=&lt;1|0&gt;] [,replicate=&lt;1|0&gt;] [,ro=&lt;1|0&gt;] [,shared=&lt;1|0&gt;] [,size=&lt;DiskSize&gt;]
Use volume as container mount point.
Use volume as container mount point. Use the special syntax STORAGE_ID:SIZE_IN_GiB to allocate a new volume.
acl=boolean
acl=&lt;boolean&gt;
Explicitly enable or disable ACL support.
Explicitly enable or disable ACL support.
backup=boolean
backup=&lt;boolean&gt;
Whether to include the mountpoint in backups (only used for volume mountpoints).
Whether to include the mount point in backups (only used for volume mount points).
mp=<Path>
mountoptions=&lt;opt[;opt...]&gt;
Path to the mountpoint as seen from inside the container.
Extra mount options for rootfs/mps.
mp=&lt;Path&gt;
Path to the mount point as seen from inside the container.
Must not contain any symlinks for security reasons.
Must not contain any symlinks for security reasons.
quota=boolean
quota=&lt;boolean&gt;
Enable user quotas inside the container (not supported with zfs subvolumes)
Enable user quotas inside the container (not supported with zfs subvolumes)
ro=boolean
replicate=&lt;boolean&gt; (default = 1)
Read-only mountpoint
Will include this volume to a storage replica job.
size=<DiskSize>
ro=&lt;boolean&gt;
Read-only mount point
shared=&lt;boolean&gt; (default = 0)
Mark this non-volume mount point as available on all nodes.
This option does not share the mount point automatically, it assumes it is shared already!
size=&lt;DiskSize&gt;
Volume size (read only value).
Volume size (read only value).
volume=<volume>
volume=&lt;volume&gt;
Volume, device or directory to mount into the container.
Volume, device or directory to mount into the container.
nameserver: string
nameserver: &lt;string&gt;
Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.
Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.
net[n]: name=<string> [,bridge=<bridge>] [,firewall=<1|0>] [,gw=<GatewayIPv4>] [,gw6=<GatewayIPv6>] [,hwaddr=<XX:XX:XX:XX:XX:XX>] [,ip=<IPv4Format/CIDR>] [,ip6=<IPv6Format/CIDR>] [,mtu=<integer>] [,rate=<mbps>] [,tag=<integer>] [,trunks=<vlanid[;vlanid...]>] [,type=<veth>]
net[n]: name=&lt;string&gt; [,bridge=&lt;bridge&gt;] [,firewall=&lt;1|0&gt;] [,gw=&lt;GatewayIPv4&gt;] [,gw6=&lt;GatewayIPv6&gt;] [,hwaddr=&lt;XX:XX:XX:XX:XX:XX&gt;] [,ip=&lt;(IPv4/CIDR|dhcp|manual)&gt;] [,ip6=&lt;(IPv6/CIDR|auto|dhcp|manual)&gt;] [,link_down=&lt;1|0&gt;] [,mtu=&lt;integer&gt;] [,rate=&lt;mbps&gt;] [,tag=&lt;integer&gt;] [,trunks=&lt;vlanid[;vlanid...]&gt;] [,type=&lt;veth&gt;]
Specifies network interfaces for the container.
Specifies network interfaces for the container.
bridge=<bridge>
bridge=&lt;bridge&gt;
Bridge to attach the network device to.
Bridge to attach the network device to.
firewall=boolean
firewall=&lt;boolean&gt;
Controls whether this interface’s firewall rules should be used.
Controls whether this interface&#8217;s firewall rules should be used.
gw=<GatewayIPv4>
gw=&lt;GatewayIPv4&gt;
Default gateway for IPv4 traffic.
Default gateway for IPv4 traffic.
gw6=<GatewayIPv6>
gw6=&lt;GatewayIPv6&gt;
Default gateway for IPv6 traffic.
Default gateway for IPv6 traffic.
hwaddr=<XX:XX:XX:XX:XX:XX>
hwaddr=&lt;XX:XX:XX:XX:XX:XX&gt;
The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)
A common MAC address with the I/G (Individual/Group) bit not set.
ip=<IPv4Format/CIDR>
ip=&lt;(IPv4/CIDR|dhcp|manual)&gt;
IPv4 address in CIDR format.
IPv4 address in CIDR format.
ip6=<IPv6Format/CIDR>
ip6=&lt;(IPv6/CIDR|auto|dhcp|manual)&gt;
IPv6 address in CIDR format.
IPv6 address in CIDR format.
mtu=integer (64 - N)
link_down=&lt;boolean&gt;
Whether this interface should be disconnected (like pulling the plug).
mtu=&lt;integer&gt; (64 - 65535)
Maximum transfer unit of the interface. (lxc.network.mtu)
Maximum transfer unit of the interface. (lxc.network.mtu)
name=<string>
name=&lt;string&gt;
Name of the network device as seen from inside the container. (lxc.network.name)
Name of the network device as seen from inside the container. (lxc.network.name)
rate=<mbps>
rate=&lt;mbps&gt;
Apply rate limiting to the interface
Apply rate limiting to the interface
tag=integer (1 - 4094)
tag=&lt;integer&gt; (1 - 4094)
VLAN tag for this interface.
VLAN tag for this interface.
trunks=<vlanid[;vlanid...]>
trunks=&lt;vlanid[;vlanid...]&gt;
VLAN ids to pass through the interface
VLAN ids to pass through the interface
type=(veth)
type=&lt;veth&gt;
Network interface type.
Network interface type.
onboot: boolean (default=0)
onboot: &lt;boolean&gt; (default = 0)
Specifies whether a VM will be started during system bootup.
Specifies whether a container will be started during system bootup.
ostype: (alpine | archlinux | centos | debian | fedora | gentoo | opensuse | ubuntu | unmanaged)
ostype: &lt;alpine | archlinux | centos | debian | devuan | fedora | gentoo | nixos | opensuse | ubuntu | unmanaged&gt;
OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value unmanaged can be used to skip and OS specific setup.
OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/&lt;ostype&gt;.common.conf. Value unmanaged can be used to skip and OS specific setup.
protection: boolean (default=0)
protection: &lt;boolean&gt; (default = 0)
Sets the protection flag of the container. This will prevent the CT or CT’s disk remove/update operation.
Sets the protection flag of the container. This will prevent the CT or CT&#8217;s disk remove/update operation.
rootfs: [volume=]<volume> [,acl=<1|0>] [,quota=<1|0>] [,ro=<1|0>] [,size=<DiskSize>]
rootfs: [volume=]&lt;volume&gt; [,acl=&lt;1|0&gt;] [,mountoptions=&lt;opt[;opt...]&gt;] [,quota=&lt;1|0&gt;] [,replicate=&lt;1|0&gt;] [,ro=&lt;1|0&gt;] [,shared=&lt;1|0&gt;] [,size=&lt;DiskSize&gt;]
Use volume as container root.
Use volume as container root.
acl=boolean
acl=&lt;boolean&gt;
Explicitly enable or disable ACL support.
Explicitly enable or disable ACL support.
quota=boolean
mountoptions=&lt;opt[;opt...]&gt;
Extra mount options for rootfs/mps.
quota=&lt;boolean&gt;
Enable user quotas inside the container (not supported with zfs subvolumes)
Enable user quotas inside the container (not supported with zfs subvolumes)
ro=boolean
replicate=&lt;boolean&gt; (default = 1)
Read-only mountpoint
Will include this volume to a storage replica job.
size=<DiskSize>
ro=&lt;boolean&gt;
Read-only mount point
shared=&lt;boolean&gt; (default = 0)
Mark this non-volume mount point as available on all nodes.
This option does not share the mount point automatically, it assumes it is shared already!
size=&lt;DiskSize&gt;
Volume size (read only value).
Volume size (read only value).
volume=<volume>
volume=&lt;volume&gt;
Volume, device or directory to mount into the container.
Volume, device or directory to mount into the container.
searchdomain: string
searchdomain: &lt;string&gt;
Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.
Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.
startup: `[[order=]\d+] [,up=\d+] [,down=\d+] `
startup: `[[order=]\d+] [,up=\d+] [,down=\d+] `
Startup and shutdown behavior. Order is a non-negative number defining the general startup order. Shutdown in done with reverse ordering. Additionally you can set the up or down delay in seconds, which specifies a delay to wait before the next VM is started or stopped.
Startup and shutdown behavior. Order is a non-negative number defining the general startup order. Shutdown in done with reverse ordering. Additionally you can set the up or down delay in seconds, which specifies a delay to wait before the next VM is started or stopped.
swap: integer (0 - N) (default=512)
swap: &lt;integer&gt; (0 - N) (default = 512)
Amount of SWAP for the VM in MB.
Amount of SWAP for the container in MB.
template: boolean (default=0)
tags: &lt;string&gt;
Tags of the Container. This is only meta information.
template: &lt;boolean&gt; (default = 0)
Enable/disable Template.
Enable/disable Template.
tty: integer (0 - 6) (default=2)
timezone: &lt;string&gt;
Time zone to use in the container. If option isn&#8217;t set, then nothing will be done. Can be set to host to match the host time zone, or an arbitrary time zone option from /usr/share/zoneinfo/zone.tab
tty: &lt;integer&gt; (0 - 6) (default = 2)
Specify the number of tty available to the container
Specify the number of tty available to the container
unprivileged: boolean (default=0)
unprivileged: &lt;boolean&gt; (default = 0)
Makes the container run as unprivileged user. (Should not be modified manually.)
Makes the container run as unprivileged user. (Should not be modified manually.)
unused[n]: string
unused[n]: [volume=]&lt;volume&gt;
Reference to unused volumes. This is used internally, and should not be modified manually.
Reference to unused volumes. This is used internally, and should not be modified manually.
volume=&lt;volume&gt;
The volume that is not used currently.
Copyright and Disclaimer
Copyright and Disclaimer
Copyright © 2007-2016 Proxmox Server Solutions GmbH
Copyright &#169; 2007-2022 Proxmox Server Solutions GmbH
This program is free software: you can redistribute it and/or modify
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
it under the terms of the GNU Affero General Public License as
Line 137: Line 188:
You should have received a copy of the GNU Affero General Public
You should have received a copy of the GNU Affero General Public
License along with this program.  If not, see
License along with this program.  If not, see
http://www.gnu.org/licenses/
https://www.gnu.org/licenses/
</pvehide>
</pvehide>
<!--PVE_IMPORT_END_MARKER-->
<!--PVE_IMPORT_END_MARKER-->




[[Category: HOWTO]]
[[Category: HOWTO]]

Latest revision as of 14:11, 23 November 2023

NAME

pct.conf - Proxmox VE Container Configuration

SYNOPSIS

/etc/pve/lxc/<CTID>.conf

DESCRIPTION

The /etc/pve/lxc/<CTID>.conf files stores container configuration, where CTID is the numeric ID of the given container.

Note IDs < 100 are reserved for internal purposes.

File Format

The file uses a simple colon separated key/value format. Each line has the following format:

OPTION: value

Blank lines in the file are ignored, and lines starting with a # character are treated as comments and are also ignored.

One can use the pct command to generate and modify those files.

It is also possible to add low-level LXC-style configuration directly, for example:

lxc.init_cmd: /sbin/my_own_init

or

lxc.init_cmd = /sbin/my_own_init

Those settings are directly passed to the LXC low-level tools.

Options

arch: <amd64 | arm64 | armhf | i386 | riscv32 | riscv64> (default = amd64)

OS architecture type.

cmode: <console | shell | tty> (default = tty)

Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to console it tries to attach to /dev/console instead. If you set cmode to shell, it simply invokes a shell inside the container (no login).

console: <boolean> (default = 1)

Attach a console device (/dev/console) to the container.

cores: <integer> (1 - 8192)

The number of cores assigned to the container. A container can use all available cores by default.

cpulimit: <number> (0 - 8192) (default = 0)

Limit of CPU usage.

Note If the computer has 2 CPUs, it has a total of 2 CPU time. Value 0 indicates no CPU limit.
cpuunits: <integer> (0 - 500000) (default = cgroup v1: 1024, cgroup v2: 100)

CPU weight for a container. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this container gets. Number is relative to the weights of all the other running guests.

debug: <boolean> (default = 0)

Try to be more verbose. For now this only enables debug log-level on start.

description: <string>

Description for the Container. Shown in the web-interface CT’s summary. This is saved as comment inside the configuration file.

dev[n]: [[path=]<Path>] [,deny-write=<1|0>] [,gid=<integer>] [,mode=<Octal access mode>] [,uid=<integer>]

Device to pass through to the container

deny-write=<boolean> (default = 0)

Deny the container to write to the device

gid=<integer> (0 - N)

Group ID to be assigned to the device node

mode=<Octal access mode>

Access mode to be set on the device node

path=<Path>

Path to the device to pass through to the container

uid=<integer> (0 - N)

User ID to be assigned to the device node

features: [force_rw_sys=<1|0>] [,fuse=<1|0>] [,keyctl=<1|0>] [,mknod=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]

Allow containers access to advanced features.

force_rw_sys=<boolean> (default = 0)

Mount /sys in unprivileged containers as rw instead of mixed. This can break networking under newer (>= v245) systemd-network use.

fuse=<boolean> (default = 0)

Allow using fuse file systems in a container. Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.

keyctl=<boolean> (default = 0)

For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container. By default unprivileged containers will see this system call as non-existent. This is mostly a workaround for systemd-networkd, as it will treat it as a fatal error when some keyctl() operations are denied by the kernel due to lacking permissions. Essentially, you can choose between running systemd-networkd or docker.

mknod=<boolean> (default = 0)

Allow unprivileged containers to use mknod() to add certain device nodes. This requires a kernel with seccomp trap to user space support (5.3 or newer). This is experimental.

mount=<fstype;fstype;...>

Allow mounting file systems of specific types. This should be a list of file system types as used with the mount command. Note that this can have negative effects on the container’s security. With access to a loop device, mounting a file can circumvent the mknod permission of the devices cgroup, mounting an NFS file system can block the host’s I/O completely and prevent it from rebooting, etc.

nesting=<boolean> (default = 0)

Allow nesting. Best used with unprivileged containers with additional id mapping. Note that this will expose procfs and sysfs contents of the host to the guest.

hookscript: <string>

Script that will be executed during various steps in the containers lifetime.

hostname: <string>

Set a host name for the container.

lock: <backup | create | destroyed | disk | fstrim | migrate | mounted | rollback | snapshot | snapshot-delete>

Lock/unlock the container.

memory: <integer> (16 - N) (default = 512)

Amount of RAM for the container in MB.

mp[n]: [volume=]<volume> ,mp=<Path> [,acl=<1|0>] [,backup=<1|0>] [,mountoptions=<opt[;opt...]>] [,quota=<1|0>] [,replicate=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]

Use volume as container mount point. Use the special syntax STORAGE_ID:SIZE_IN_GiB to allocate a new volume.

acl=<boolean>

Explicitly enable or disable ACL support.

backup=<boolean>

Whether to include the mount point in backups (only used for volume mount points).

mountoptions=<opt[;opt...]>

Extra mount options for rootfs/mps.

mp=<Path>

Path to the mount point as seen from inside the container.

Note Must not contain any symlinks for security reasons.
quota=<boolean>

Enable user quotas inside the container (not supported with zfs subvolumes)

replicate=<boolean> (default = 1)

Will include this volume to a storage replica job.

ro=<boolean>

Read-only mount point

shared=<boolean> (default = 0)

Mark this non-volume mount point as available on all nodes.

Warning This option does not share the mount point automatically, it assumes it is shared already!
size=<DiskSize>

Volume size (read only value).

volume=<volume>

Volume, device or directory to mount into the container.

nameserver: <string>

Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.

net[n]: name=<string> [,bridge=<bridge>] [,firewall=<1|0>] [,gw=<GatewayIPv4>] [,gw6=<GatewayIPv6>] [,hwaddr=<XX:XX:XX:XX:XX:XX>] [,ip=<(IPv4/CIDR|dhcp|manual)>] [,ip6=<(IPv6/CIDR|auto|dhcp|manual)>] [,link_down=<1|0>] [,mtu=<integer>] [,rate=<mbps>] [,tag=<integer>] [,trunks=<vlanid[;vlanid...]>] [,type=<veth>]

Specifies network interfaces for the container.

bridge=<bridge>

Bridge to attach the network device to.

firewall=<boolean>

Controls whether this interface’s firewall rules should be used.

gw=<GatewayIPv4>

Default gateway for IPv4 traffic.

gw6=<GatewayIPv6>

Default gateway for IPv6 traffic.

hwaddr=<XX:XX:XX:XX:XX:XX>

A common MAC address with the I/G (Individual/Group) bit not set.

ip=<(IPv4/CIDR|dhcp|manual)>

IPv4 address in CIDR format.

ip6=<(IPv6/CIDR|auto|dhcp|manual)>

IPv6 address in CIDR format.

link_down=<boolean>

Whether this interface should be disconnected (like pulling the plug).

mtu=<integer> (64 - 65535)

Maximum transfer unit of the interface. (lxc.network.mtu)

name=<string>

Name of the network device as seen from inside the container. (lxc.network.name)

rate=<mbps>

Apply rate limiting to the interface

tag=<integer> (1 - 4094)

VLAN tag for this interface.

trunks=<vlanid[;vlanid...]>

VLAN ids to pass through the interface

type=<veth>

Network interface type.

onboot: <boolean> (default = 0)

Specifies whether a container will be started during system bootup.

ostype: <alpine | archlinux | centos | debian | devuan | fedora | gentoo | nixos | opensuse | ubuntu | unmanaged>

OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value unmanaged can be used to skip and OS specific setup.

protection: <boolean> (default = 0)

Sets the protection flag of the container. This will prevent the CT or CT’s disk remove/update operation.

rootfs: [volume=]<volume> [,acl=<1|0>] [,mountoptions=<opt[;opt...]>] [,quota=<1|0>] [,replicate=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]

Use volume as container root.

acl=<boolean>

Explicitly enable or disable ACL support.

mountoptions=<opt[;opt...]>

Extra mount options for rootfs/mps.

quota=<boolean>

Enable user quotas inside the container (not supported with zfs subvolumes)

replicate=<boolean> (default = 1)

Will include this volume to a storage replica job.

ro=<boolean>

Read-only mount point

shared=<boolean> (default = 0)

Mark this non-volume mount point as available on all nodes.

Warning This option does not share the mount point automatically, it assumes it is shared already!
size=<DiskSize>

Volume size (read only value).

volume=<volume>

Volume, device or directory to mount into the container.

searchdomain: <string>

Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.

startup: `[[order=]\d+] [,up=\d+] [,down=\d+] `

Startup and shutdown behavior. Order is a non-negative number defining the general startup order. Shutdown in done with reverse ordering. Additionally you can set the up or down delay in seconds, which specifies a delay to wait before the next VM is started or stopped.

swap: <integer> (0 - N) (default = 512)

Amount of SWAP for the container in MB.

tags: <string>

Tags of the Container. This is only meta information.

template: <boolean> (default = 0)

Enable/disable Template.

timezone: <string>

Time zone to use in the container. If option isn’t set, then nothing will be done. Can be set to host to match the host time zone, or an arbitrary time zone option from /usr/share/zoneinfo/zone.tab

tty: <integer> (0 - 6) (default = 2)

Specify the number of tty available to the container

unprivileged: <boolean> (default = 0)

Makes the container run as unprivileged user. (Should not be modified manually.)

unused[n]: [volume=]<volume>

Reference to unused volumes. This is used internally, and should not be modified manually.

volume=<volume>

The volume that is not used currently.

Copyright and Disclaimer

Copyright © 2007-2022 Proxmox Server Solutions GmbH

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with this program. If not, see https://www.gnu.org/licenses/

Retrieved from "https://pve.proxmox.com/mediawiki/index.php?title=Manual:_pct.conf&oldid=11837"