I think the misunderstanding is that I’m running every single service as Docker inside its own LXC. That’s not actually what I’m doing.

I split things by service boundary. For example, Pi-hole + Unbound has its own LXC, Lemmy has its own LXC, Immich has its own LXC, etc. Most of those run natively in LXC without Docker at all.

Docker is only there where the application actually expects/benefits from it. I’m not adding a Docker layer everywhere just for the sake of it.

The reason I prefer this over one giant LXC with everything docker- inside is the management side.

Yes, there is some overhead. But LXC containers are much lighter than VMs. They share the host kernel and use Linux namespaces/cgroups for isolation, so you’re not paying the cost of a full virtualized OS. The extra memory/CPU overhead is minimal compared to the management benefits I get from separating services.

The Docker overhead only exists on the services that actually need Docker. A lot of my services run directly in their own LXC without Docker at all.

Could I put everything into one LXC and run Docker Compose? Sure. It would probably work fine. But for a homelab, ease of maintenance and recovery is just as important as raw resource efficiency.