Data sharing between different containers (LXC)

#server #software #proxmox

This blog post explains the folder structure I use to store user data on my ZFS storage, allowing all containers to access shared data in a consistent and predictable way.

The setup runs on a Proxmox server. You can find details about the hardware in a separate post here .

Goal

I want services in different containers (for example Immich and Nextcloud) to access the same files without permission conflicts. In this setup, shared photos are stored in /datapool/immich/data.

Prerequisites

  • A Proxmox host with shell access
  • Unprivileged LXC containers
  • ZFS storage for shared data
  • Access to /etc/pve/lxc/CONTAINERID.conf

Create the ZFS pool

For my active server data, I use two 2 TB M.2 PCIe 3.0 SSDs. While M.2 drives are often considered overkill for general data storage, I already had them available. Using them allowed me to avoid buying additional SSDs, so I decided to put them to use.

I configured a striped ZFS pool across the two drives (comparable to RAID 0). In Proxmox, ZFS pools can be created under:

Node → Disks → ZFS

The UI supports several vdev layouts such as single disk, mirror, and RAIDZ.

Note: A striped pool (RAID-0-like configuration) is not available in the Proxmox UI and must be created manually from the node shell.

BASH 
# Check existing ZFS pools
zpool status

# Create a striped ZFS pool (RAID 0-like)
zpool create datapool <disk0> <disk1>

Create the dataset and folder layout

I use the following dataset and folder structure on the ZFS pool:

TEXT 
/datapool
├── immich
│   ├── data
│   └── database
├── nextcloud
└── media
    ├── movies
    └── series

Each top-level directory can be created as its own ZFS dataset if different properties are required (for example, compression, recordsize, or snapshot policies).

Configure a shared identity on the Proxmox host

Create a shared group on the host (use another GID if 1000 is already in use):

BASH 
groupadd -g 1000 data-share

Set the ownership of your stored data to the data-share group:

BASH 
chown -R :data-share /datapool/immich/data

Next, adjust the entries in /etc/subuid and /etc/subgid. Adding the group with groupadd may have created a data-share line in these files. Remove it and add the following line to both files instead, so UID/GID 1000 can be mapped into the containers:

BASH 
root:1000:1

Configure ID mapping in each LXC config

Add these lines to each container config in which you want to use the shared data. You can find the files here: /etc/pve/lxc/CONTAINERID.conf

TEXT 
lxc.idmap: u 0 100000 1000
lxc.idmap: u 1000 1000 1
lxc.idmap: u 1001 102001 63535
lxc.idmap: g 0 100000 1000
lxc.idmap: g 1000 1000 1
lxc.idmap: g 1001 102001 63535

If you want to learn more about these mappings:
Unprivileged LXC containers

Create the same user/group inside each container

Create the data-share user and group inside each container with UID/GID 1000:

BASH 
groupadd -g 1000 data-share
useradd -u 1000 -g 1000 -m -s /bin/bash data-share

Mount datasets into each container

Mount the shared host directories into each container via its config file.

Example:

TEXT 
mp0: /datapool/immich/data,mp=/mnt/immich-data

Tip: If you have nested mounts inside immich/data, use a recursive bind mount instead so they are carried into the container:

TEXT 
lxc.mount.entry: /datapool/immich/data mnt/immich-data none rbind,create=dir 0 0

Verify permissions

Inside the container, verify that UID/GID mappings and ownership are correct:

BASH 
id data-share
ls -ln /mnt/immich-data

If everything is configured correctly, containers can read and write the same files without permission conflicts.

Troubleshooting

If file owners appear as nobody inside the container, the host usually has no matching user for that UID/GID, or the mapping is incomplete.

In that case, create a matching user on the Proxmox host and verify the ID mapping again:

BASH 
useradd -u 1000 -g 1000 -M -s /usr/sbin/nologin data-share

I also recommend setting the setgid bit on the created ZFS dataset. This forces new files in the main folder to inherit the group of the parent folder.

BASH 
chmod -R g+w,g+s /datapool/immich/data
Back to top ↑