b1a35783bb
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1) - Merge Web + Software + Cloud → SNS Digital (planned) - SNS Support unchanged (planned) - Add infra/ folder with 16 FOSS-first buildable designs - Update all agent knowledge, division briefs, legal structure - Restructure businesses/ from 7 to 3 operating folders
58 lines
2.1 KiB
Markdown
58 lines
2.1 KiB
Markdown
# Container Strategy — SNS Networking
|
|
|
|
**Entity:** SNS Networking · **Status:** Buildable now
|
|
|
|
## What it is
|
|
|
|
Guidelines for when to use LXC containers vs VMs vs Docker on Proxmox, keeping
|
|
things simple and predictable.
|
|
|
|
## Decision Tree
|
|
|
|
```
|
|
Need full kernel isolation or non-Linux OS?
|
|
YES → VM (KVM)
|
|
NO →
|
|
Is it a single long-running daemon (DNS, proxy, small app)?
|
|
YES → LXC container (Proxmox-native, lowest overhead)
|
|
NO →
|
|
Is it a multi-container app with a compose file?
|
|
YES → VM running Docker + Compose
|
|
NO → LXC container
|
|
```
|
|
|
|
## Rules
|
|
|
|
1. **LXC is default** for single-service workloads. Lower RAM, faster boot, native
|
|
Proxmox backup/snapshot support.
|
|
2. **Docker inside a VM** (not inside LXC) when the app ships as a compose stack.
|
|
Avoids the nested-container headaches of Docker-in-LXC.
|
|
3. **No Kubernetes.** Not until there are 20+ services that need orchestration and
|
|
auto-scaling. The ceiling is named; the upgrade path is k3s on dedicated VMs.
|
|
4. **One service per container/VM.** No multi-app VMs except dev/test throwaway boxes.
|
|
5. **Naming:** `{service}-{env}` — e.g., `gitea-prod`, `caddy-prod`, `monitoring-dev`.
|
|
|
|
## LXC Template Defaults
|
|
|
|
- **OS:** Debian 12 (official Proxmox template)
|
|
- **Resources:** 1 vCPU, 512MB RAM, 8GB disk (grow as needed)
|
|
- **Network:** static IP on service VLAN, gateway to Caddy
|
|
- **Security:** unprivileged container, nesting disabled unless Docker required
|
|
|
|
## VM Template Defaults
|
|
|
|
- **OS:** Debian 12 cloud-init (template ID 9000)
|
|
- **Resources:** 2 vCPU, 2GB RAM, 32GB disk
|
|
- **Network:** same as LXC
|
|
- **Agent:** qemu-guest-agent installed for Proxmox integration
|
|
|
|
## Upgrade Path
|
|
|
|
- **k3s:** When service count exceeds ~20 or you need rolling deploys, stand up
|
|
3 k3s nodes (VMs on Proxmox) and migrate Docker Compose apps to Helm charts.
|
|
- **Podman:** Drop-in Docker replacement if Docker licensing ever becomes a concern
|
|
(it won't for self-hosted, but Podman is rootless by default — security win).
|
|
|
|
<!-- ponytail: No k8s until 20+ services. Ceiling: manual docker-compose deploys
|
|
don't scale past ~20 without toil. Upgrade: k3s on 3 dedicated VMs. -->
|