Basement Uptime

About

Thu, 06 Aug 2026 00:00:00 +0000

Basement Uptime is notes on self-hosting and homelab operations: Proxmox, LXC, DNS, backups, and the undocumented gotchas that show up once you run this stuff long-term instead of following a setup tutorial once.

Posts come from real operational work. Something broke, here’s why, here’s the fix. No sponsored placement, no product seeded by a PR firm. A link to specific hardware or software means that’s what was actually used; some of those links may be affiliate links (see the footer).

Fixing UID/GID Permission Hell When Bind-Mounting Host Storage Into Unprivileged LXC

Thu, 06 Aug 2026 00:00:00 +0000

Bind-mount a host directory into an unprivileged LXC container and watch every file inside turn into nobody:nogroup, or worse, 65534:65534. That’s the UID mapping problem. It looks like a bug the first time you hit it. It’s actually the container isolation working exactly as designed, just not the way most people expect.

Why this happens

Unprivileged LXC containers remap UIDs/GIDs so that root inside the container (UID 0) is not root on the host. Container UID 0 maps to some high UID on the host, by default something like 100000. The whole UID range inside the container (0-65535) shifts up by that offset on the host side.

ip neigh show Lies: Always arping Before You Assign a Static LAN IP

Thu, 06 Aug 2026 00:00:00 +0000

You’re spinning up a new container or VM and need a free static IP. The instinctive check:

ip neigh show

If the candidate address isn’t in the table, it looks free. It isn’t necessarily. The neighbor table only holds entries for hosts your machine has actually exchanged traffic with recently, usually within the last few minutes to a few hours depending on the kernel’s gc_stale_time and related sysctls. A device that’s been quietly sitting on the network without talking to this particular host won’t show up. Stale entry or not, it just isn’t there.

Passing a USB Serial or Webcam Device Into an Unprivileged Proxmox LXC

Thu, 06 Aug 2026 00:00:00 +0000

Unprivileged LXC containers are the right default on Proxmox. Root inside the container isn’t root on the host. That same UID remapping breaks the usual instinct for granting device access: add the service user to dialout or video or whatever group. It won’t work, and it’s worth knowing why before an hour goes into staring at a permission-denied error.

Why group membership fails

When an unprivileged container bind-mounts a host device node, the container’s view of that device’s ownership goes through the same UID/GID remapping as everything else. A device owned by root:dialout on the host shows up inside the container as some remapped, meaningless UID:GID pair, typically rendered as nobody:nogroup. Adding your service user to a group inside the container does nothing. The group the device actually belongs to, from the container’s point of view, isn’t a group that exists in any meaningful sense inside that namespace.

The Stale Search-Domain Bug That Silently Breaks DNS in Fresh LXC Containers

Thu, 06 Aug 2026 00:00:00 +0000

Symptom: a brand-new container fails an apt-get install with a resolution error, or some app inside it can’t reach the outside world, even though the container clearly has a route out and ping <ip> to a raw address works fine. The instinct is to blame the app. Check /etc/resolv.conf first.

What was actually happening

Run Tailscale on a Proxmox host or one of its containers, even briefly, even just to test something, then remove it, and it can leave behind a stale search directive in the resolver config: