n8n on Proxmox: Setting Up LXC or VM Correctly

Anyone who wants to self-host n8n and already runs a Proxmox VE environment faces the question of whether the workflow automation should run in an LXC container or in a full virtual machine. For most small and medium-sized businesses, an unprivileged LXC container with nesting and keyctl enabled is the most pragmatic approach, because it ties up significantly fewer resources than a VM and can run n8n inside a Docker container. Anyone who needs maximum isolation without compromises should instead choose the VM. As of: July 2026.

LXC or VM: The Fundamental Decision

n8n itself does not impose any Proxmox-specific requirements; the decision is made purely at the level of virtualization technology. An LXC container shares the kernel with the Proxmox host, starts very quickly, and requires noticeably less memory than a comparable VM. The drawback: two layers of containers, LXC and Docker, share the same kernel, so a kernel update on the host can, in doubt, affect both layers at once. A VM fully encapsulates n8n and the Docker daemon running inside it from the host, but costs more memory and processing power for its own kernel. For a single n8n server in a small business, the difference in resources is in practice usually more decisive than the theoretical question of isolation.

Docker in the LXC Container: Setting Nesting and Keyctl Correctly

For a Docker daemon to work at all inside an LXC container, the container must be equipped with additional kernel interfaces. In the Proxmox documentation on container options the nesting feature is described as follows: "Allow nesting. Best used with unprivileged containers with additional id mapping. Note that this will expose procfs and sysfs contents of the host to the guest." Without this flag, the Docker daemon in the container regularly fails to start. In addition, Docker in an unprivileged container needs the keyctl option, which Proxmox documents as follows: "For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container." Important: according to the Proxmox documentation, anyone who enables keyctl for Docker cannot simultaneously use systemd-networkd in the same configuration, because both features claim the same system call handling. Both options can be set in the container configuration under "Features". A privileged container is not recommended for production use, because Proxmox explicitly does not treat new escape exploits from privileged containers with the same priority as those from unprivileged containers.

Installing n8n via Docker

Once the LXC container is prepared, the actual n8n installation follows the same steps as on any other Docker host. According to the official n8n Docker documentation a Docker volume is first created and n8n is started with port mapping to 5678, the time zone variables TZ and GENERIC_TIMEZONE, and a mounted data directory. According to the documentation, this directory under /home/node/.n8n contains "encryption keys, instance logs, and source control feature assets" and, in the default configuration, additionally the SQLite database with all workflows and credentials. Anyone who instead wants to connect an external PostgreSQL database adds the matching environment variables for host, port, database name, and credentials; according to n8n, the data directory nonetheless remains relevant even then, because important data continues to reside there. In the same place, n8n explicitly points out that self-hosting requires technical knowledge in server operation, resource management, and security, and is intended for experienced users. Anyone who does not want to manage this setup themselves can get help from NordFlux with n8n setup and support.

Backup: Proxmox Snapshots as a Complement to n8n's Own Backup

An LXC container can be backed up using Proxmox's own backup function, which for containers, according to the Proxmox backup documentation optionally operates in Stop, Suspend, or Snapshot mode. In Snapshot mode, the container is briefly paused, a temporary storage snapshot is created, and the content is then backed up as an archive before the snapshot is deleted again. This reliably backs up the complete container state, including the Docker daemon and the n8n data directory, but does not replace an application-level backup. Anyone who specifically wants to back up only workflows and credentials should additionally export n8n's own data directory regularly, because a Proxmox snapshot always backs up the entire container and, in an emergency, takes longer than restoring individual workflows in a targeted way. In practice, a combination is recommended: scheduled Proxmox backups for the complete restoration of the server, and an additional, more frequent export of the n8n workflows for the quick individual case.

Frequently Asked Questions About n8n on Proxmox

Do I absolutely need nesting and keyctl if I want to use Docker in an LXC container?

Yes, according to the Proxmox documentation, both options are necessary for Docker in an unprivileged LXC container, otherwise the Docker daemon does not start reliably or individual functions fail.

Is a privileged container the easier solution?

Technically, often yes; from a security perspective, no. Proxmox does not treat new escape exploits from privileged containers with the same priority as those from unprivileged containers. For a production n8n server with stored credentials, that is a risk that most businesses should not take.

Is a Proxmox snapshot sufficient as the sole backup for n8n?

A snapshot reliably backs up the entire container, but is coarse-grained and impractical for restoring individual workflows. A combination of regular Proxmox backups and an additional, targeted export of the n8n workflows makes more sense.

Does n8n run more stably in a VM than in the LXC container?

Not fundamentally more stable, but more isolated. A VM fully encapsulates the Docker daemon from the host kernel, which costs resources but reduces the risk that a kernel update on the Proxmox host affects both container layers at the same time.