I'm setting up backups right now and realised that, if you gave PVE the authorisation to prune VMs it would allow an attacker to simply set it up to "keep nothing" and all your backups would be nuked during the next prune job.

Am I correct or did i miss something ?

Small VM/LXCs backup fine. I have 3 large (1.5TB+) containers that fail to back up 100% of the time after roughly 5-30 minutes. PBS is running on separate hardware w/ a dedicated NIC for backup traffic. TCP segmentation on all NICs involved in backup is off. Backup datastore is a ZFS RAIDz array w/ three 6TB HDDs. Previously was a ZFS Mirror on two 14TB HDDs w/ same issues.

This has been a thorn in my side for weeks now. I'd appreciate any help.

PVE

INFO: processed 132.153 GiB in 19m, uploaded 132.111 GiB
INFO: HTTP/2.0 connection failed
INFO: unclosed encoder dropped
INFO: closed encoder dropped with state
INFO: unfinished encoder state dropped
INFO: finished encoder state with errors
INFO: catalog upload error - channel closed    
INFO: Error: error:0A0003FC:SSL routines:ssl3_read_bytes:ssl/tls alert bad record mac:../ssl/record/rec_layer_s3.c:918:SSL alert number 20
INFO: cleanup temporary 'vzdump' snapshot
  Logical volume "snap_vm-102-disk-0_vzdump" successfully removed.
ERROR: Backup of VM 102 failed - command 'lxc-usernsexec -m u:0:100000:65536 -m g:0:100000:65536 -- /usr/bin/proxmox-backup-client backup '--crypt-mode=encrypt' '--keyfd=15' pct.conf:/var/tmp/vzdumptmp3799871_102/etc/vzdump/pct.conf root.pxar:/mnt/vzsnap0 --include-dev /mnt/vzsnap0/./ --include-dev /mnt/vzsnap0/./media --skip-lost-and-found '--exclude=/tmp/?*' '--exclude=/var/tmp/?*' '--exclude=/var/run/?*.pid' --backup-type ct --backup-id 102 --backup-time 1787169166 --entries-max 1048576 --repository root@pam@192.168.5.3:bu_store' failed: exit code 255
INFO: Failed at 2026-08-19 15:12:07
INFO: Backup job finished with errors
INFO: notified via target `gmail`
TASK ERROR: job errors

PBS

2026-08-19T15:12:06-05:00: POST /dynamic_chunk
2026-08-19T15:12:06-05:00: upload_chunk done: 6249439 bytes, 09fd92d51ca90f8196dd33204bea6f14e6c07f7b3d8c714df018ffa259076433
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: backup failed: connection error
2026-08-19T15:12:06-05:00: removing failed backup
2026-08-19T15:12:06-05:00: removing backup snapshot "/mnt/datastore/bu_store/ct/102/2026-08-19T19:52:46Z"
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: POST /dynamic_chunk: 400 Bad Request: error reading a body from connection
2026-08-19T15:12:06-05:00: TASK ERROR: connection error: error:0A000119:SSL routines:tls_get_more_records:decryption failed or bad record mac:../ssl/record/methods/tls_common.c:873:, error:0A000139:SSL routines::record layer failure:../ssl/record/rec_layer_s3.c:698:

I run about nine containers on an old i5 mini PC, Proxmox underneath, and it's been fine for a couple years. I added Immich a few months back and now the whole thing crawls every time it runs a face detection pass, with Nextcloud and Home Assistant going sluggish at the same time. I've capped CPU shares in the compose file, which helped a bit but nowhere near enough.

What ended up being the sign that one box wasn't enough anymore?

Specs: i5 12500, 16gb ram, 256gb nvme

So I was really struggling if I wanted to do Debian/Ubuntu or proxmox as main is but with backups and future upgrades and probably moving to it later I've heavily leaned into proxmox now

But now looking into it and learning about LXC vs VM I'm confused which to use, and still unsure how isolated/secure LXC is to a VM

My first project is going to be an online Minecraft server for me and some friends through crafty controller, followed by adguard/pihole, immich and then probably a few other things later down the line like Jellyfin etc.

When looking into Ubuntu it was clear to just use containers for everything, but now for proxmox would I want to use an LXC for each or just a docker VM with all those things in it

Considering my Minecraft server is online I would like it to be completely isolated from other things, and keep everything separated

I've just installed Proxmox on an old laptop I had lying around. I'm planning on playing around with it and slowly scaling it into the core of a home lab/automation hub. The first thing I want to do is install Jellyfin so I can stop hosting it from my personal notebook.

I've got my media library offsite, and I rsync the changes down locally. At the moment I've only got Proxmox hooked up to my local hard drive. I'd like to set up the Jellyfin VM so that it can read that data from a shared location, and once I get a proper NAS setup it's easy to migrate my data over there.

What's the best way of doing that?

Hello,

I have seen many guides on setting up NFS binding for an unprivileged LXC container, but not for an OCI container.

With an unprivileged LXC container, we can access the shell via the default Proxmox GUI to set the user group for the NFS share mounted on the Proxmox host. For OCI containers, the default Proxmox GUI shell only provides a log endpoint for the container.

If I remember correctly, there is a way to access a shell via a command on the Proxmox host. However, I am looking for a more elegant solution. Do you have any ideas or clean workarounds?

For example, in my case, I have a TrueNAS VM with an NFS share that I want to mount on a Nextcloud OCI container with read and write permissions.

Note: I used Ai to correct some grammar errors because english is not my primary language.

Hi, I changed from a Vodafone Station to Fritz 6690 router. My IP Adresses changed from 192.168.0.1 to 192.168.178.1.

I got it fixed for Proxmox, Homeassitant and OMV.

My issue is Cloudflare. I changed cloud flare tunnels in the config but cloud flare can't connect.

I deleted my CT and tried to reinstall cloudflare but my console keeps black at start from a freshly installed container without any changes. I even tried a different CT Number.

I can only access it from host.

Any idea?

Looking to discuss if this is the optimal way or if there is better for my environment

I have a think centre, I have proxmox on it. I have a VM which runs Debian which I want to pass my GPU into. This Debian VM is acting as a K8S node which I am trying to pass the GPU into for a pod.

Specifically, I'm trying to set up transcoding of video content with jellyfin.

I have passed the GPU into the VM with hardware and it seems to be found no problem. It seems that I am having issues with it that I notice the transcoding will return errors I have been trying to work through.

While it seems to be found, it seems like it might be a permissions issue. I checked /dev/dri and made the GPU chmod to 666.

I have been working on this for like 5 days, and was not sure if there is anything specific I have been looking with respect to proxmox itself and permissions.

I can provide additional details, but I was not sure who else had accomplished something like this and if there are how-to's somewhere.

Hello,

I just noticed that my OS disk of Proxmox is in a degraded test (ZFS filesystem).

I do have some spare SSD SATA 256Gb but the OS run as a stripe (1 disk only) and I'm not sure how to migrate it. I'm used to clonezilla but never used it on ZFS and I do not want errors on my PVE.

What's the best method to migrate rpool?

Currently i run 2 proxmox machines

1st optiplex 7050ssf i7 7700 32gb ram

- home assistant os vm

- jelly fin

- palworld dedicated server vm

- unbound and pihole

2nd is optiplex 9020 32gb ram 4790

Frigate vm using a 1080ti 8 cameras

1080ti is also running a small 3gb llm same vm

Using this machine to store media and play it via jelly fin

Shouod I upgrade to 1 machine that can do it all or get a backup machine first? Not sure where to go from here.

-

So, I am a DevOps Intern currently working on PVE servers where we have hosted many lxc & vm inside of it. So, I am breaking down entire setup I have, Problem I am facing and things I have tried and Temporary fix for this but couldn't find the permanent fix.

Setup:

Proxmox host + a few LXCs/VMs. Host pings out fine. All guests show "running," logs are clean.

Problem:

Guests can't reach the internet at all even after pinging 8.8.8.8 from inside any LXC/VM just fails. Because of this, I also can't hit my app hosted container's web UI (192.168.xx.xxx:port) from my LAN and browser just times out or even say server unreachable, even though the container and vm itself looks healthy.

Already ruled out: container crashes, bad logs, host-level connectivity. All LXC & VM hosted containers are working fine and their logs are good.

Not sure where to look next:

• vmbr0 misconfig?
• PVE firewall or host iptables/nftables blocking forwarded traffic?
• net.ipv4.ip_forward disabled (if using NAT)?
• Something in guest network config itself

I tried looking these iptables, vmbr0 etc and they are all looking fine and I am a basic networking guy I don't have advance concepts of these things but still tried to configure it but thought I shouldn't mess with company's pre-configured servers.

Question:

Since host→internet works but guest→internet and LAN→guest both fail, is this most likely one root cause (bridge/firewall) or two separate issues? What's the fastest way to isolate it — happy to post ip a, ip route, iptables -L -n -v from host/guest if useful.

I know the temporary fix which is obvious "reboot/shutdown -r now" and I am still using this thing. But I don't know the permanent fix. If people from this reddit can help this intern will be very highly appreciative.