DEV Community

VeloxaHost
VeloxaHost

Posted on

Run Docker inside Incus system containers (profiles + cloud-init)

#docker #linux #selfhosted #devops

If you've only used Docker on a VM, you may not know you can run it inside a system container — no hypervisor, near-native speed, and it boots in a couple of seconds. Incus (the community fork of LXD) makes this easy once you know the three settings that matter.

All configs below are in veloxahost/incus-examples.

The profile 

description: Run Docker inside a system container
config:
  security.nesting: "true"
  security.syscalls.intercept.mknod: "true"
  security.syscalls.intercept.setxattr: "true"
  linux.kernel_modules: overlay,br_netfilter,ip_tables,ip6_tables,nf_nat,xt_conntrack
Enter fullscreen mode Exit fullscreen mode
  • security.nesting lets the container create its own containers.
  • The two syscall intercepts let Docker's overlay filesystem and image layers work in an unprivileged container.
  • linux.kernel_modules makes sure the host loads what Docker networking needs.

Load it:

incus profile create docker-ready
incus profile edit docker-ready < profiles/docker-ready.yaml
Enter fullscreen mode Exit fullscreen mode

Launch with cloud-init

The repo's cloud-init/docker-host.yaml installs Docker Engine and the Compose plugin from Docker's apt repo and sets sane log rotation:

incus launch images:ubuntu/24.04/cloud web-01 \
  -p default -p docker-ready \
  --config cloud-init.user-data="$(cat cloud-init/docker-host.yaml)"

incus exec web-01 -- cloud-init status --wait
incus exec web-01 -- docker run --rm hello-world
Enter fullscreen mode Exit fullscreen mode

Add limits

Don't let one container eat the host:

config:
  limits.cpu: "1"
  limits.memory: 1GiB
  limits.memory.enforce: hard
  limits.processes: "2000"
Enter fullscreen mode Exit fullscreen mode

Snapshots before every upgrade 

./scripts/snapshot-rotate.sh web-01 7   # take one, keep the newest 7
Enter fullscreen mode Exit fullscreen mode

Run it from cron and docker compose pull && docker compose up -d stops being scary.

Container or VM?

System container VM
Boot ~1–3 s ~10–30 s
Overhead near zero full kernel
Docker inside yes (nesting) yes
Custom kernel modules no yes

For web apps, databases and Compose stacks, a container is usually the better trade.

Don't want to run the host?

That's essentially what a VeloxaHost server is: a root system container that runs Docker, from $4/mo with snapshots and an API.

Disclosure: we run VeloxaHost. The repo is MIT and works on any Incus host.

Top comments (0)