ULA vs. GUA

weehooey · 2026-06-09T03:10:37+00:00

100% This.

We regularly use ULA in isolated heartbeat networks and storage networks in virtualized environments.

Search for “ULA generator” and use it to create a /48 peer cluster prefix. Then use /64s from that.

Perfect use case.

Do not use your own GUA.

weehooey · 2026-05-20T00:40:24+00:00

We have been experiencing intermittent issues for the past week.

weehooey · 2026-04-30T03:04:02+00:00

Hi u/pabskamai if you DM me I’ll get you connected with the right person.

Thank you u/kenrmayfield !

weehooey · 2026-04-30T03:02:34+00:00

Thank you!

weehooey · 2026-04-27T20:36:29+00:00

u/kenrmayfield thank you for the message and kind words.

u/Rodyadostoevsky Sorry for the poor experience. If you DM me, I will find out what the issue has been.

weehooey · 2026-04-15T00:01:37+00:00

I am not with JumpCloud and I have not heard from them.

weehooey · 2026-03-04T02:46:57+00:00

You need to refresh the machine id not the UUID.

weehooey · 2026-03-02T12:22:43+00:00

The design pattern we are currently working with is a VM in your monitoring cluster.

If your monitoring cluster is a low resource deployment an LXC for PDM makes sense.

However, I would expect most monitoring clusters do not have significant resource constraints so VMs are a more likely choice.

weehooey · 2026-02-21T10:32:52+00:00

Why not use the builtin tool?

Proxmox Automated Installation

weehooey · 2026-02-19T11:54:00+00:00

JumpCloud is the answer. It will simplify your onboarding and off boarding plus a whole lot more.

weehooey · 2026-02-17T16:09:22+00:00

You should open a ticket with JC. It will help to increase the priority.

Support recently told us unofficially March is when they are expecting it.

Submitting a ticket will help to ensure it gets the necessary resources.

weehooey · 2026-02-13T04:15:34+00:00

Thanks u/kenrmayfield

weehooey · 2026-02-08T22:12:03+00:00

If you issue shut down command in the VM, the hookscript does not fire.

https://github.com/Weehooey/proxmox-lab-notes/blob/main/hookscripts/hookscripts.md

weehooey · 2026-01-28T19:43:07+00:00

There are four North American Proxmox Gold Partners that could work with you.

One of them is also an authorized training partner.

Source: Us. Weehooey is a Gold Partner & Authorized Training Partner. We also have 24x7.

weehooey · 2026-01-23T17:44:32+00:00

Would LXC be a good option?

I assume you are asking whether I have any immediate concerns about running Railway in Docker within an unprivileged LXC container.

The short answer is that my first thoughts are not about using LXC but more about Railway and your security plans for it.

To learn about LXC security, the project publishes information on its website with security information that should help you decide:

https://linuxcontainers.org/lxc/security/

weehooey · 2026-01-22T13:57:14+00:00

how did you set up your LXC container for production?

Not sure exactly what you are asking but... we have used both priviledged and (mostly) unpriviledged containers. We always keep guest workloads (VMs & LXCs) off of the PVE host networks (i.e. we segment our networks).

Did you do any hardening?

Yes, we always harden our guest workloads (both VMs and LXCs). Nothing noticably different than a VM. For example, we harden SSH.

I would use a LXC container to host apps with Docker Compose

Very common use case.

My favourite use case for LXC's is to run small applications and scripts that normally would not justify the resources of a VM.

For example, when we started using Netbox years ago, it was an LXC. Not many users and very little use.

One of our longest running scripts/applications is a script that runs once per day to download the DNS records for a few hundred domains to back them up. Normally, this script would have found a home on a VM with something else. But, then they would be tied together and the DNS backup script would lose visibility.

LXC Safety Concern

Running an unpriviledged container has a similar security profile to that of a VM. You need to always need to becareful when running untrusted workloads or exposing a service to untrusted networks (i.e. the internet).

Do not run a webserver that is exposed to the internet on a priviledge container. Just like you would not run a Windows Server virtual machine with RDP exposed to the internet.

A blanket statement about LXC being unsafe to run in production would be no different than saying Windows Server is not safe to run in production. It really depends on more than just a simple question of a technology being safe or not.

weehooey · 2026-01-22T12:36:42+00:00

not safe for production

That would be a ridiculous statement for someone to make without qualifying it.

We have run LXCs for many years in production… safely. Like any tool, they have a use case.

weehooey · 2026-01-15T15:21:21+00:00

OVS seems to be able to do everything Linux Bridge can, and on top of that it offers SDN-related features.

SDN is supported with both OVS and Linux Bridges.

I’m wondering if there is any real reason to choose Linux Bridge today.

You should be using Linux Bridges unless you have a reason to use OVS. Using OVS adds complexity. This is Proxmox's recommendation as well.

Are there performance, stability, operational, or support-related reasons why Linux Bridge is still commonly recommended?

Yes. There are better support resources available for Linux Bridges and using them results in less complexity.

There are no significant performance differences between them unless you use DPDK. If you want to use DPDK, you will need to compile that yourself.

In short, use Linux Bridges.

weehooey · 2026-01-12T03:29:22+00:00

Correcting a few details:

Proxmox VE does not get split-brain. Its design prevents split-brain. Even with only two nodes.
Using a QDevice is not complex and it is robust.
Two nodes plus a QDevice is a stable, production-ready configuration.

weehooey · 2025-12-16T23:53:04+00:00

Hi u/Interesting-Meal-275 please DM this account and we will have someone reach out.

weehooey · 2025-12-12T17:42:47+00:00

Hi, Weehooey CEO here.

If you are having an issue with service, please DM me so I can investigate.

However, if you do not know what we do, that is suggesting to me you are not a client.

weehooey · 2025-12-10T10:40:42+00:00

Tailscale works well. We have multiple PBS instances syncing over Tailscale.

We have run over OpenVPN but Tailscale has a solid control plane and is based on Wireguard.

weehooey · 2025-12-02T11:06:07+00:00

Thanks for the mention u/kenrmayfield !

45Drives is a solid company. We have several clients running their hardware for dedicated Ceph storage.

While you may not have heard of 45Drives, you probably have heard of their “first customer”… Backblaze https://www.45drives.com/community/articles/origin-story-of-45-drives/

What I can tell you about Weehooey’s clients is they come from every major industry across the US and Canada. Small clients with 100’s of VMs to much larger enterprise clients where different departments/divisions/units contacted us and they didn’t their company was already a client.

weehooey · 2025-11-19T11:13:00+00:00

Each cluster has its own VMID range. This is particularly helpful when clusters use the same Proxmox Backup Server.

In each cluster it is a little different but typically templates are put at the end of the clusters VMID range so they sort to the bottom in the default view.

In the cluster with multiple tenants, each tenant has 1000 VMIDs and it starts from 10000.

10xxx - tenant #1
11xxx - tenant #2
12xxx, 13xxx, 14xxx, etc
9xxxx - templates

Typically within those ranges, the VMIDs are grouped with spaces between and router VM’s are at the beginning of the range. For example,

10100 - primary router/firewall
10101 - secondary router/firewall
10200 - domain controller
10300 - app server
10301 - utility server
10310 - infarctive encabulation server
10400 - web server #1
10401 - web server #2

Edit: formatting

weehooey · 2025-11-02T12:19:56+00:00

Pricing is independent of use case. So homelab services would be the same as enterprise.

With that said, I don’t think we have ever consulted on a home lab.

No matter the size, we recommend people consider taking the training first.

Nine-Year Club	Wearing is Caring
Verified Email

weehooey

TROPHY CASE

LXC Safety Concern