{"id":3430,"date":"2023-03-04T15:51:53","date_gmt":"2023-03-04T20:51:53","guid":{"rendered":"https:\/\/dft.wiki\/?p=3430"},"modified":"2026-06-28T15:42:04","modified_gmt":"2026-06-28T19:42:04","slug":"leveraging-pimox-proxmox-ve-7-for-raspberry-pi","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=3430","title":{"rendered":"Leveraging Pimox &#8211; Proxmox VE 7 for Raspberry Pi"},"content":{"rendered":"<p>Proxmox officially does not run on <strong>Raspberry Pi<\/strong> but <strong>Pimox<\/strong> does [<a href=\"https:\/\/github.com\/pimox\/pimox7\">Link<\/a>].<\/p>\n<p><strong>Pimox<\/strong> is an adapted build of Proxmox tailored to work on the <strong>Raspberry Pi 4<\/strong> (ARM64 architecture).<\/p>\n<hr \/>\n<p><strong>REQUIREMENTS<\/strong><\/p>\n<ul>\n<li>Raspberry Pi 4\n<ul>\n<li>2 GB of RAM works but is limited.<\/li>\n<li>4 GB of RAM works well.<\/li>\n<li>8 GB of RAM is recommended.\n<ul>\n<li>1.5 GB must be reserved for the host system.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>Storage\n<ul>\n<li>Minimum 16 GB microSD or USB.<\/li>\n<li>Recommended: 32 GB or more of fast SSD, NVMe, or M.2 over USB.<\/li>\n<\/ul>\n<\/li>\n<li>Accessories\n<ul>\n<li>Power supply.<\/li>\n<li>A closed case.<\/li>\n<li>Heatsink (passive cooling).<\/li>\n<li>5V fan (active cooling) such as a Fanshim [<a href=\"https:\/\/dft.wiki\/?p=222\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>If necessary, update the RPi firmware to prioritize USB boot over microSD.<\/p>\n<p>Write the latest <strong>Raspberry Pi OS Lite<\/strong> image to the storage media of your choice and boot it up.<\/p>\n<hr \/>\n<p><strong>PROCEDURES<\/strong><\/p>\n<p>Do <strong>NOT<\/strong> proceed with the installation via SSH, as it will drop the connection and interrupt the installation.<\/p>\n<p>Using the <strong>console<\/strong> (physical keyboard, mouse, and monitor), run the following commands as <code>root<\/code>. Do <strong>NOT<\/strong> use sudo.<\/p>\n<pre>sudo su -\r\ncurl https:\/\/raw.githubusercontent.com\/pimox\/pimox7\/master\/RPiOS64-IA-Install.sh &gt; RPiOS64-IA-Install.sh\r\nchmod +x RPiOS64-IA-Install.sh\r\n.\/RPiOS64-IA-Install.sh<\/pre>\n<p><strong>Note:<\/strong> The installer will ask for a static IP because it <strong>does NOT work with DHCP<\/strong>. Just follow the prompts.<\/p>\n<p>The Proxmox web interface address will be shown at the end.<\/p>\n<p>To increase the default swap size on the host:<\/p>\n<pre>nano \/etc\/dphys-swapfile<\/pre>\n<pre>...\r\nCONF_SWAPSIZE=<strong>2048<\/strong>\r\n...<\/pre>\n<pre>systemctl enable dphys-swapfile<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-3450\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-03_16_12_28.png\" alt=\"\" width=\"1005\" height=\"451\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-03_16_12_28.png 1005w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-03_16_12_28-300x135.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-03_16_12_28-768x345.png 768w\" sizes=\"auto, (max-width: 1005px) 100vw, 1005px\" \/><\/p>\n<p>It is recommended to install GPU drivers and libraries to access the RPi hardware features.<\/p>\n<pre>sudo apt update &amp;&amp; sudo apt install mesa-utils libraspberrypi-bin -y\r\nvcgencmd measure_temp ; vcgencmd get_mem gpu\r\nsudo reboot<\/pre>\n<hr \/>\n<p><strong>GUEST SYSTEMS<\/strong><\/p>\n<p><strong>LXC<\/strong> (Linux Containers) are recommended over VMs to maximize performance and resource utilization. Read more at [<a href=\"https:\/\/dft.wiki\/?p=2852\">Link<\/a>].<\/p>\n<p>Make sure the LXC repository you download from is trustworthy. Only the file <code>rootfs.tar.xz<\/code> is required [<a href=\"https:\/\/jenkins.linuxcontainers.org\/view\/Images\/\">Link<\/a>].<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-3451\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_13_19.png\" alt=\"\" width=\"1361\" height=\"265\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_13_19.png 1361w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_13_19-300x58.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_13_19-1024x199.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_13_19-768x150.png 768w\" sizes=\"auto, (max-width: 1361px) 100vw, 1361px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-3452\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_10_56.png\" alt=\"\" width=\"1363\" height=\"273\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_10_56.png 1363w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_10_56-300x60.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_10_56-1024x205.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_10_10_56-768x154.png 768w\" sizes=\"auto, (max-width: 1363px) 100vw, 1363px\" \/><\/p>\n<p><strong>Note:<\/strong> VMs (Virtual Machines) do not work on this platform. CTs are much better anyway.<\/p>\n<hr \/>\n<p><strong>ONLINE REPOSITORY OF LXC TEMPLATES<\/strong><\/p>\n<p>Unfortunately, Pimox does not include a custom repository for ARM64 templates, likely because it requires hosting infrastructure and ongoing maintenance.<\/p>\n<p>I have developed and maintained a single source for an updated list of ARM64 images on GitHub called Pimox7 LXC Images [<a href=\"https:\/\/github.com\/davift\/pimox7-lxc-images\">Link<\/a>].<\/p>\n<p>Installation of the Templates Repository:<\/p>\n<pre>wget https:\/\/raw.githubusercontent.com\/davift\/pimox7-lxc-images\/main\/install.sh -O install.sh &amp;&amp; chmod +x install.sh &amp;&amp; sudo .\/install.sh<\/pre>\n<p>It will download the latest version of the installation script and prompt for confirmation before each task:<\/p>\n<ul>\n<li>Replace\/Update the LXC list of templates (y\/N)?\n<ul>\n<li>If confirmed, it will back up the original files (incompatible) and download the repository list with ARM64 images.<\/li>\n<\/ul>\n<\/li>\n<li>Download the templates from linuxcontainers.org (y\/N)?\n<ul>\n<li>All images can be downloaded from linuxcontainers.org at once. This may require approximately 1.2 GB.<\/li>\n<\/ul>\n<\/li>\n<li>Download custom templates (y\/N)?\n<ul>\n<li>It will ask to download all custom images I produced and shared.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>What are the custom images?<\/p>\n<ul>\n<li><strong>Kali CLI<\/strong>\n<ul>\n<li>Includes the full Kali command prompt look and feel, plus all basic tools.<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-4408 size-full\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-46-41.png\" alt=\"\" width=\"699\" height=\"364\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-46-41.png 699w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-46-41-300x156.png 300w\" sizes=\"auto, (max-width: 699px) 100vw, 699px\" \/><\/li>\n<\/ul>\n<\/li>\n<li><strong>Kali Desktop with XRDP<\/strong>\n<ul>\n<li>After creating and starting a CT with this image, use any RDP client to connect to a full virtual desktop.<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-4409 size-full\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-49-42.png\" alt=\"\" width=\"921\" height=\"572\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-49-42.png 921w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-49-42-300x186.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-49-42-768x477.png 768w\" sizes=\"auto, (max-width: 921px) 100vw, 921px\" \/><\/li>\n<\/ul>\n<\/li>\n<li><strong>Tor Gateway<\/strong>\n<ul>\n<li>This appliance works as a gateway to route all traffic through the Tor Network.\n<ul>\n<li>The first network adapter <code>eth0<\/code> on <code>vmbr0<\/code> (Internet) with DHCP.<\/li>\n<li>Create a secondary adapter <code>eth1<\/code> on <code>vmbr2<\/code> (isolated network) with the IP <code>10.10.10.1<\/code>.<\/li>\n<li>All inbound traffic on <code>eth1<\/code> will be routed through Tor.<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4410\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-59-22.png\" alt=\"\" width=\"741\" height=\"400\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-59-22.png 741w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-59-22-300x162.png 300w\" sizes=\"auto, (max-width: 741px) 100vw, 741px\" \/><\/li>\n<\/ul>\n<\/li>\n<li>Any other CT connected to vmbr2 needs the following network configuration:\n<ul>\n<li>IPv4 <code>10.10.10.2\/24<\/code> to <code>10.10.10.254\/24<\/code>.<\/li>\n<li>Gateway <code>10.10.10.1<\/code>.<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4411\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-19-01-31.png\" alt=\"\" width=\"741\" height=\"400\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-19-01-31.png 741w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-19-01-31-300x162.png 300w\" sizes=\"auto, (max-width: 741px) 100vw, 741px\" \/><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>INTERNAL NETWORKS<\/strong><\/p>\n<p>Out of the box, Proxmox creates a bridge network <code>vmbr0<\/code> linked to the physical port <code>eth0<\/code>. The wireless adapter <code>wlan0<\/code> becomes unusable (a workaround is coming soon).<\/p>\n<p>Additional private networks may be useful:<\/p>\n<ul>\n<li><code>vmbr0<\/code>\n<ul>\n<li>Each CT or VM gets its own MAC address and will receive an IP from the network attached to the Ethernet port.<\/li>\n<\/ul>\n<\/li>\n<li><code>vmbr1<\/code>\n<ul>\n<li>A private network with <strong>NAT<\/strong> to provide internet access while reusing the host IP address. See steps below.<\/li>\n<\/ul>\n<\/li>\n<li><code>vmbr2<\/code>\n<ul>\n<li>An isolated network with no internet access, useful for sandboxing applications or local workloads.<\/li>\n<\/ul>\n<\/li>\n<li><code>vmbr3<\/code>\n<ul>\n<li>(In progress: a network linked to the wireless interface.)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>NAT NETWORK WITH DHCP <code>vmbr1<\/code><\/strong><\/p>\n<p>On the <strong>Pimox<\/strong> host, navigate to <strong>System &gt; Network<\/strong> and click <strong>Create &gt; Linux Bridge<\/strong>.<\/p>\n<p>Enter <strong>172.16.0.1\/24<\/strong> in the IPv4\/CIDR field. No other fields are required.<\/p>\n<p>This creates a private network that can communicate with the host, but traffic will not be routed out yet.<\/p>\n<p>Setting up the <strong>DHCP<\/strong> server via SSH or Shell on the host:<\/p>\n<pre>sudo apt-get update &amp;&amp; sudo apt-get install isc-dhcp-server -y\r\nsudo nano \/etc\/default\/isc-dhcp-server<\/pre>\n<p>Bind the DHCP server to <code>vmbr1<\/code> for IPv4 only (disable IPv6):<\/p>\n<pre>INTERFACESv4=\"vmbr1\"\r\n#INTERFACESv6=\"\"<\/pre>\n<p>Specify the DHCP parameters:<\/p>\n<pre>sudo nano \/etc\/dhcp\/dhcpd.conf<\/pre>\n<p>Append the following to the file:<\/p>\n<pre>default-lease-time 600;\r\nmax-lease-time 7200;\r\noption subnet-mask 255.255.255.0;\r\noption broadcast-address 172.16.0.255;\r\noption routers 172.16.0.1;\r\noption domain-name-servers 9.9.9.9;\r\noption domain-name \"host.local\";\r\nsubnet 172.16.0.0 netmask 255.255.255.0 {\r\nrange 172.16.0.10 172.16.0.100;\r\n}<\/pre>\n<p>Apply the changes:<\/p>\n<pre>sudo systemctl restart isc-dhcp-server\r\nsudo systemctl enable isc-dhcp-server\r\nsudo systemctl status isc-dhcp-server<\/pre>\n<p>Any new CT or VM attached to this network will now receive an IP automatically.<\/p>\n<p>Setting up <strong>Forwarding \/ Routing<\/strong> via SSH or Shell on the host:<\/p>\n<pre>sudo ufw enable\r\nsudo nano \/etc\/ufw\/sysctl.conf<\/pre>\n<p>Uncomment or add the following line:<\/p>\n<pre>net\/ipv4\/ip_forward=1<\/pre>\n<p>Do the same in <strong>\/etc\/sysctl.conf<\/strong>.<\/p>\n<p>Edit or create the startup script:<\/p>\n<pre>sudo nano \/etc\/rc.local<\/pre>\n<p>Add the following content:<\/p>\n<pre>#!\/bin\/bash\r\nWAN=\"vmbr0\"\r\nLAN=\"vmbr1\"\r\niptables -A INPUT -i lo -j ACCEPT\r\niptables -A OUTPUT -o lo -j ACCEPT\r\n# Port forwarding rules must be placed here\r\niptables -A FORWARD -i $LAN -o $WAN -j ACCEPT\r\niptables -A FORWARD -i $WAN -o $LAN -m state --state RELATED,ESTABLISHED -j ACCEPT\r\niptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE\r\nexit 0<\/pre>\n<p>Apply the changes:<\/p>\n<pre>sudo chmod +x \/etc\/rc.local\r\nsudo \/etc\/rc.local<\/pre>\n<p>Guests on <code>vmbr1<\/code> should now be able to reach the Internet.<\/p>\n<p>Optionally, install a <strong>DNS<\/strong> server on the host [<a href=\"https:\/\/dft.wiki\/?p=191\">Link<\/a>] or deploy a <strong>Pi-Hole<\/strong> in a CT [<a href=\"https:\/\/dft.wiki\/?p=1347\">Link<\/a>].<\/p>\n<hr \/>\n<p><strong>DEPLOYING USEFUL CT SYSTEMS<\/strong><\/p>\n<p><strong>Kali Remote Terminal<\/strong><\/p>\n<pre>sudo apt update &amp;&amp; apt dist-upgrade -y\r\nsudo apt install ssh wget curl nano man bind9-dnsutils inetutils-tools iputils-* kali-defaults zsh zsh-syntax-highlighting zsh-autosuggestions kali-linux-arm -y\r\nsudo apt purge network-manager -y\r\nsudo systemctl start ssh &amp;&amp; systemctl enable ssh\r\nsudo adduser kali\r\nsudo usermod -aG sudo kali<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-3449\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_12_42_11.png\" alt=\"\" width=\"605\" height=\"191\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_12_42_11.png 605w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2023-03-04_12_42_11-300x95.png 300w\" sizes=\"auto, (max-width: 605px) 100vw, 605px\" \/><\/p>\n<p><strong>Kali Remote Desktop<\/strong><\/p>\n<p>Install all the same packages from the Kali Remote Terminal section before proceeding.<\/p>\n<pre>sudo apt install kali-desktop-xfce xorg xrdp -y\r\nsudo systemctl enable xrdp\r\nsudo reboot<\/pre>\n<p>The routing rules on the host can be updated as follows to forward the RDP port to the Remote Desktop:<\/p>\n<pre>#!\/bin\/bash\r\nWAN=\"vmbr0\"\r\nLAN=\"vmbr1\"\r\niptables -A INPUT -i lo -j ACCEPT\r\niptables -A OUTPUT -o lo -j ACCEPT\r\niptables -A FORWARD -i $WAN -o $LAN -p tcp --dport 3389 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT\r\niptables -t nat -A PREROUTING -i $WAN -p tcp --dport 3389 -j DNAT --to-destination 172.16.0.13:3389\r\niptables -A FORWARD -i $LAN -o $WAN -j ACCEPT\r\niptables -A FORWARD -i $WAN -o $LAN -m state --state RELATED,ESTABLISHED -j ACCEPT\r\niptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE\r\nexit 0<\/pre>\n<p><strong>Tor Proxy Gateway<\/strong><\/p>\n<p>A Tor Proxy Gateway routes traffic through the Tor Network via a SOCKS5 proxy for maximum privacy.<\/p>\n<p>It can sit between <code>vmbr0<\/code> or <code>vmbr1<\/code> (which have internet access) and an isolated network such as <code>vmbr2<\/code>.<\/p>\n<pre>apt update &amp;&amp; apt upgrade -y &amp;&amp; apt install tor nano curl -y\r\nnano \/etc\/tor\/torrc<\/pre>\n<pre>...\r\nSocksPort 0.0.0.0:9050\r\n...<\/pre>\n<pre>systemctl restart tor &amp;&amp; systemctl enable tor\r\ncurl --socks5-hostname 127.0.0.1:9050 http:\/\/ip.me<\/pre>\n<p>Compare the output IP with your real public IP. Guest systems on the isolated network <code>vmbr2<\/code> should use the SOCKS5 proxy from the Tor Gateway.<\/p>\n<p><strong>CloudFlare Bridge<\/strong><\/p>\n<p>Navigate to CloudFlare &gt; Zero Trust &gt; Access &gt; Tunnels.<\/p>\n<pre>apt update &amp;&amp; sudo apt upgrade -y &amp;&amp; sudo apt install curl -y\r\ncurl -L --output cloudflared.deb https:\/\/github.com\/cloudflare\/cloudflared\/releases\/latest\/download\/cloudflared-linux-arm64.deb\r\ndpkg -i cloudflared.deb\r\ncloudflared service install <strong>**********<\/strong><\/pre>\n<p>Replace <strong>**********<\/strong> with your connector string.<\/p>\n<p><strong>Installing a GUI on Ubuntu 22.04<\/strong><\/p>\n<p>Prepare the system:<\/p>\n<pre>apt update &amp;&amp; apt upgrade -y<\/pre>\n<p>Choose one of the options below:<\/p>\n<p>For <strong>Xfce<\/strong> (lightweight):<\/p>\n<pre>apt install xfce4 xrdp -y<\/pre>\n<p>For <strong>Gnome<\/strong>:<\/p>\n<pre>apt install ubuntu-desktop-minimal xrdp -y<\/pre>\n<p>For <strong>KDE<\/strong> (heaviest):<\/p>\n<pre>apt install kde-plasma-desktop xrdp -y<\/pre>\n<p>Enable RDP on startup:<\/p>\n<pre>systemctl enable xrdp &amp;&amp; reboot<\/pre>\n<hr \/>\n<p><strong>CREATING CUSTOM LXC TEMPLATES<\/strong><\/p>\n<p>Deploy a new CT using the base image of your choice and customize it.<\/p>\n<p>When ready to turn the CT into a shareable template, back it up and select GZIP as the compression format.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4406\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-17-54-08.png\" alt=\"\" width=\"788\" height=\"400\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-17-54-08.png 788w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-17-54-08-300x152.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-17-54-08-768x390.png 768w\" sizes=\"auto, (max-width: 788px) 100vw, 788px\" \/><\/p>\n<p>This will produce a backup file at <code>\/&lt;PATH&gt;\/dump\/vzdump-lxc-&lt;CT_ID&gt;-&lt;TIMESTAMP&gt;.tar.gz<\/code>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4407\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-02-26.png\" alt=\"\" width=\"813\" height=\"419\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-02-26.png 813w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-02-26-300x155.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2024-09-04-18-02-26-768x396.png 768w\" sizes=\"auto, (max-width: 813px) 100vw, 813px\" \/><\/p>\n<p>Transfer the file via SCP and you are done!<\/p>\n<hr \/>\n<p><strong>FOLLOW UP<\/strong><\/p>\n<p>Over 3 years ago, I wrote this post when I started the experiment with Pimox as a replacement for 3 instances I had running on Linode. Here are my results and reflections.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-5948\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_14-47-33.png\" alt=\"\" width=\"1359\" height=\"594\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_14-47-33.png 1359w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_14-47-33-300x131.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_14-47-33-1024x448.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_14-47-33-768x336.png 768w\" sizes=\"auto, (max-width: 1359px) 100vw, 1359px\" \/><\/p>\n<ol>\n<li>Yes, it lives silently and hidden inside my wall, right below the electric panel and the internet entry point.<\/li>\n<li>It is a Raspberry Pi 4 with 4GB of RAM that boots and runs off an SSD.\n<ol>\n<li>I also have a 120GB MicroSD card for backups.<\/li>\n<li>And a PWM-controlled fan hat [<a href=\"https:\/\/dft.wiki\/?p=222\">Link<\/a>].<\/li>\n<\/ol>\n<\/li>\n<li>The USB 3.0 SSD has 512GB of storage and appears to be faster than the Pi demands.<\/li>\n<li>An unmanaged switch distributes the DMZ (untrusted) around my home for IoT devices, APs, and my isolated homelab network (that is another story).<\/li>\n<li>The Pi is directly connected to the gigabit cable modem.<\/li>\n<li>A UPS keeps everything running for up to 2.5 hours.<\/li>\n<\/ol>\n<p><strong>No need to say that I never returned to using Linode for this micro production environment, right?<\/strong><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-5949\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-05-29.png\" alt=\"\" width=\"1380\" height=\"497\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-05-29.png 1380w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-05-29-300x108.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-05-29-1024x369.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-05-29-768x277.png 768w\" sizes=\"auto, (max-width: 1380px) 100vw, 1380px\" \/><\/p>\n<ul>\n<li>The uptime goes back as far as I have lived in my new home.<\/li>\n<li><code>dns1<\/code> is a <strong>Pi-hole<\/strong> with multiple Protective DNS features to protect my entire network.<\/li>\n<li>Workloads 200+ are isolated in a network that cannot access my LAN, nor receive requests from it.\n<ul>\n<li><code>tun1<\/code> is the tunnel to CloudFlare for exposing services publicly.<\/li>\n<li><code>web1<\/code> is the web server running WP (this blog) plus a handful of other sites.<\/li>\n<li><code>db1<\/code> is a MySQL database serving the WP websites.<\/li>\n<li><code>tor1<\/code> hosts a collection of Tor hidden services [<a href=\"https:\/\/dft.wiki\/?p=694\">Link<\/a>].<\/li>\n<li><code>bkp1<\/code> pushes backups daily to my local S3-compatible object storage and to AWS S3 Deep Glacier.<\/li>\n<\/ul>\n<\/li>\n<li>All containers are based on Alpine, and CPU units (number of cores and CPU time) are capped to protect overall system health.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-5950\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-19-36.png\" alt=\"\" width=\"1352\" height=\"874\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-19-36.png 1352w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-19-36-300x194.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-19-36-1024x662.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-19-36-768x496.png 768w\" sizes=\"auto, (max-width: 1352px) 100vw, 1352px\" \/><\/p>\n<p>The Pi does not appear to be under much load, as most of the overhead is handled by CloudFlare (TLS termination and CDN cache hits).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-5951\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-28-27.png\" alt=\"\" width=\"1297\" height=\"319\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-28-27.png 1297w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-28-27-300x74.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-28-27-1024x252.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-28-27-768x189.png 768w\" sizes=\"auto, (max-width: 1297px) 100vw, 1297px\" \/><\/p>\n<p>Firewall policies (that I would reveal) isolate the <code>vmbr1<\/code> traffic from my LAN.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-5952\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-31-10.png\" alt=\"\" width=\"1297\" height=\"446\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-31-10.png 1297w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-31-10-300x103.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-31-10-1024x352.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot_2026-06-28_15-31-10-768x264.png 768w\" sizes=\"auto, (max-width: 1297px) 100vw, 1297px\" \/><\/p>\n<p>A series of custom images, including full desktop environments, can be found at <a href=\"https:\/\/github.com\/davift\/pimox7-lxc-images\">Link<\/a>.<\/p>\n<p>See also the project <strong>TorTunnel<\/strong> [<a href=\"https:\/\/github.com\/davift\/TorTunnel\">Link<\/a>].<\/p>\n<ul>\n<li>It assumes the default gateway of an isolated network (in my case <code>vmbr2<\/code>) and routes ALL traffic through the Tor Network.<\/li>\n<li>Excellent for safely deploying malware and experimenting with untrusted code.<\/li>\n<li>Offers maximum privacy for research and stealthy investigations.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Proxmox officially does not run on Raspberry Pi but Pimox does [Link]. Pimox is an [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-3430","post","type-post","status-publish","format-standard","hentry","category-raspberry-pi"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3430"}],"version-history":[{"count":19,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3430\/revisions"}],"predecessor-version":[{"id":5953,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3430\/revisions\/5953"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}