Docker suddenly stopped working in my Proxmox LXC
Here is why and how I fixed it
Over the last few days I noticed something strange in my Proxmox setup. After applying the usual updates on an Ubuntu 24.04 LXC container, Docker suddenly stopped working. Even the simple hello world container started failing with this real error that I saw on my own system
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission denied.
At first glance it looked like Proxmox had broken something.
But this is not a Proxmox issue and it is not a Docker issue either.
The real cause is a security patch that landed in containerd.io version 1.7.28 2 around November 5 fixing CVE 2025 52881 which is a serious container escape vulnerability. As part of the patch containerd changed how it reopens certain procfs file descriptors. This behaviour is fine on a full virtual machine or bare metal Linux system. Inside a nested LXC container it triggers AppArmor and the LXC security model which then causes Docker and runc to fail with the error above.
After some troubleshooting and not wanting to waste time guessing I used AI tools to help analyse the error trail and track what actually changed. This is exactly where AI is helpful. It spots patterns and checks version updates far quicker than I can.
Thankfully I follow proper change control even in my home lab. I rolled back using backups stored on my Proxmox Backup Server which I run on an NFS share on my Synology. That confirmed instantly that the update was the cause. This also reminded me to take snapshots before updates because rolling back a snapshot is often faster than restoring a full backup over the LAN.
I am not claiming this is the official fix. I am simply sharing what worked for me. I prefer using Docker inside LXC containers because they are lighter faster and easier to manage directly in the Proxmox interface without needing to SSH into everything. So keeping them stable is important in my setup.
What actually broke
Docker relies on three main components
Docker which you run as the command
containerd which manages containers
runc which actually starts them at system level
The update to containerd.io 1.7.28 2 changed how runc reopens procfs descriptors as part of the CVE fix. This is fine inside a virtual machine because a VM has its own kernel. An LXC container shares the kernel of the Proxmox host and that means LXC cannot allow every kernel level action.
One of the settings containerd interacts with is
net.ipv4.ip_unprivileged_port_start
Inside an LXC container this is blocked by LXC and AppArmor. Because of this the entire chain fails and you see errors like
failed to create shim task
runc create failed
permission denied
There is nothing wrong with your container and nothing wrong with your configuration. The update simply made containerd perform an action that LXC is not allowed to permit.
Why this only affects LXC and not virtual machines
A virtual machine has its own kernel so any sysctl or procfs operation is allowed. Docker continues to work normally.
An LXC container shares the Proxmox host kernel and is restricted by namespaces cgroups and AppArmor. If an operation could affect the host kernel it is blocked. The new containerd behaviour touches one of those restricted areas so LXC refuses it and Docker fails.
This is why virtual machines continue to work and LXC containers suddenly break. Proxmox did not cause the problem. Docker did not cause the problem. It is simply a compatibility issue between the updated containerd behaviour and the LXC security model.
How I fixed it
Once I understood why Docker had stopped working the fix became very clear. The problem began when containerd.io was updated to version 1.7.28 2. This version and every version after it breaks Docker inside a Proxmox LXC container because of a security patch that LXC does not allow. The solution was to install and keep the last known good version which is containerd.io 1.7.28 1.
I rolled back to containerd.io 1.7.28 1 and then placed it on hold so it can never update to one of the broken versions. After that I tested updating Docker CE and Docker CLI to confirm that they do not cause any issues as long as containerd.io stays pinned. Docker updated successfully and continued to work which confirmed that containerd.io is the only package that needs to remain frozen.
For any new LXC containers that I build I now start with a fresh Ubuntu 24.04 template on Proxmox, add the Docker repository, install Docker normally, and force containerd.io to stay on version 1.7.28 1. This ensures that Docker will remain stable and any future updates to Docker will not break anything as long as containerd is locked.
Below are the exact commands that I used. If you run Docker inside an LXC container and you are seeing the same error these steps should get everything working again quickly.
Conclusion
This whole issue was a good reminder of why proper change control is important even in a home lab. If I did not have backups in Proxmox Backup Server and snapshots ready to roll back I would have lost far more time trying to recover from something that was completely outside my control. Backups saved me but snapshots would have saved me even faster and I will be using them before updates from now on.
Patching is important and security fixes matter but they can still cause unexpected problems just like this one. Nothing was wrong with Proxmox and nothing was wrong with Docker. It was simply a change in containerd that clashed with how LXC works. The fix was easy once I found it but working out the cause was not. It took time patience and a lot of digging.
If you run Docker inside LXC containers on Proxmox then hopefully this post saves you from the same nightmare. Test updates take snapshots keep backups and understand that even a simple package update can break things in ways that are not obvious at first. With a good process in place you can recover quickly and keep your lab running without stress