Run Docker inside Incus system containers (profiles + cloud-init)

If you've only used Docker on a VM, you may not know you can run it inside a system container — no hypervisor, near-native speed, and it boots in a couple of seconds. Incus (the community fork of LXD) makes this easy once you know the three settings that matter.

All configs below are in veloxahost/incus-examples.

The profile

description: Run Docker inside a system container config: security.nesting: "true" security.syscalls.intercept.mknod: "true" security.syscalls.intercept.setxattr: "true" linux.kernel_modules: overlay,br_netfilter,ip_tables,ip6_tables,nf_nat,xt_conntrack 

• security.nesting lets the container create its own containers.
• The two syscall intercepts let Docker's overlay filesystem and image layers work in an unprivileged container.
• linux.kernel_modules makes sure the host loads what Docker networking needs.

Load it:

incus profile create docker-ready incus profile edit docker-ready < profiles/docker-ready.yaml 

Launch with cloud-init

The repo's cloud-init/docker-host.yaml installs Docker Engine and the Compose plugin from Docker's apt repo and sets sane log rotation:

incus launch images:ubuntu/24.04/cloud web-01 \ -p default -p docker-ready \ --config cloud-init.user-data="$(cat cloud-init/docker-host.yaml)" incus exec web-01 -- cloud-init status --wait incus exec web-01 -- docker run --rm hello-world 

Add limits

Don't let one container eat the host:

config: limits.cpu: "1" limits.memory: 1GiB limits.memory.enforce: hard limits.processes: "2000" 

Snapshots before every upgrade

./scripts/snapshot-rotate.sh web-01 7 # take one, keep the newest 7 

Run it from cron and docker compose pull && docker compose up -d stops being scary.

Container or VM?

For web apps, databases and Compose stacks, a container is usually the better trade.

Don't want to run the host?

That's essentially what a VeloxaHost server is: a root system container that runs Docker, from $4/mo with snapshots and an API.

Disclosure: we run VeloxaHost. The repo is MIT and works on any Incus host.