A few months ago I pulled an old i7-7700 box out of a closet, threw 15GB of RAM at it, and turned it into my home lab. No GPU, nothing fancy. I run Proxmox VE on it and use it for agent workloads and internal automation while my actual client sites live on Hetzner. What surprised me was how many small decisions on this box ended up mattering more than the hardware itself — mainly where I put Docker and how I locked the network down.
If you're setting up something similar, the first fork in the road is whether Docker goes inside an LXC container or inside a full VM. People treat this as a minor detail. It isn't.
LXC vs VM is really a question of what you're willing to isolate
An LXC container shares the host kernel. That's the whole trade. You get near-native performance, boot times measured in seconds, and memory overhead that's basically nothing compared to a VM — because there's no second kernel, no virtualized hardware layer, no hypervisor translating every syscall. For a home lab with 15GB total RAM, this matters a lot. Three or four VMs and you've burned half your memory on OS overhead before a single application starts.
A VM, on the other hand, gets its own kernel and a real boundary enforced by hardware virtualization extensions (VT-x/AMD-V), not just kernel namespaces. If something inside breaks out, it's breaking out of an actual virtual machine, not just a namespace boundary that a kernel exploit could theoretically punch through.
