The Nightmare of “Manual Setup”
Have you ever felt frustrated typing apt update and installing vim or curl for the 10th container of the day? If each container takes 5-10 minutes to set up, a 20-node lab cluster will burn your entire morning on repetitive tasks.
The problem is that default templates from Proxmox (Ubuntu, Debian…) are “bare-bones”—clean but empty. We need a “Golden Image” pre-configured with security settings, SSH keys, and project-specific tools.
The secret lies in Custom LXC Templates. In my Homelab system, which manages over 15 different services, building templates saves 90% of the time. Instead of waiting, it takes me exactly 30 seconds to have a standardized environment ready for action, especially when you optimize Proxmox VE in 5 minutes with helper scripts to automate the initial host configuration.
5-Minute Workflow: Creating Your First Custom Template
If you want immediate results, follow these 5 condensed steps:
- Get the ingredients: Go to Proxmox Web UI -> Storage -> CT Templates. Download the
debian-12-standardimage. - Build the frame: Create a new LXC Container (CT) from the downloaded image. Use ID
9000to distinguish it from running VMs. - Upgrade the software: Access the CT 9000 Console and run:
apt update && apt upgrade -y apt install -y vim curl git htop build-essential sudo - Lean down (Cleanup): Remove redundant files to keep the template as small as possible:
apt clean rm -rf /var/lib/apt/lists/* cat /dev/null > /var/log/lastlog; cat /dev/null > /var/log/wtmp - Package it: Right-click CT 9000 in the Proxmox interface -> Select Convert to template.
From now on, whenever you need a new machine, just Clone from template 9000. Everything is served on a silver platter. If your workflow requires full virtual machines rather than containers, you can follow a similar logic for creating a Windows VM template on Proxmox to save time on OS installations.
Pro Upgrades: Cloud-init and Security
The quick method above is convenient, but for Production environments, you need to address two key factors. It is also highly recommended to master KVM/Proxmox snapshot management before you begin modifying your base templates to ensure you have a rollback point.
1. Remove SSH Host Keys (Mandatory)
If you skip this step, every cloned container will share the same SSH identifiers. This is extremely dangerous as it opens the door to Man-in-the-middle attacks. Run the following command inside the container before converting:
# Remove old keys
rm -f /etc/ssh/ssh_host_*_key*
# Set up new key generation on first boot
cat <<EOF > /etc/rc.local
#!/bin/sh -e
test -f /etc/ssh/ssh_host_ed25519_key || dpkg-reconfigure openssh-server
exit 0
EOF
chmod +x /etc/rc.local2. Leverage the Power of Cloud-init
Since Proxmox 8.1, Cloud-init for LXC has been rock solid. It helps you assign static IPs, create users, and push SSH public keys into the container the moment you hit Clone. No more entering the Console for manual IP configuration.
3. Pre-install Docker (For Devs)
If you’re a Docker fan, install it in the template. Pro tip: LXC running Docker requires special permissions. Go to Options -> Features of the container and check keyctl=1 and nesting=1 before converting it into a template. To further harden your environment, you might also look into how to install and use gVisor to secure containers.
Tip: Exporting Template files (.tar.zst) for Sharing
Want to move this template to another Proxmox server? Don’t use the standard Clone feature. Use the vzdump command to create an official template file.
Run this command in the Proxmox node Shell (assuming ID is 9000):
vzdump 9000 --compress zstd --dumpdir /var/lib/vz/template/cache/ --mode stopThe resulting file will appear in the CT Templates list in Proxmox, ready to be copied anywhere.
Real-world Pro Tips
- Version numbering: Don’t use generic names. Use
debian12-docker-v1.1. If an update fails, you’ll have a rollback path. - Keep templates minimal: Only install what 90% of projects need. An ideal template should have a compressed size under 200MB to ensure the fastest cloning speed.
- Regular maintenance: Once a month, I “unfreeze” the template, run
apt upgradeto patch security vulnerabilities, and then repackage it. - Safety first: Always prioritize Unprivileged containers. Only use Privileged when you truly need deep hardware access or need to mount NFS network drives.
Standardizing with LXC Templates not only makes your life easier but also completely eliminates silly configuration errors. To maintain visibility over your infrastructure, consider setting up enterprise-grade VM monitoring once your containers are deployed. Good luck building a lean and efficient Proxmox system!
