pdm-docker

Proxmox Datacenter Manager (PDM) packaged as a single systemd-based Docker container based on Debian 13 (trixie).

Use it to stand up PDM without provisioning a separate Proxmox VE host — ideal for evaluation, homelabs, or running PDM alongside an existing Proxmox cluster from a different machine.

Features

• Pre-installs proxmox-datacenter-manager, proxmox-mail-forward, and proxmox-offline-mirror-helper from the official PDM trixie repository.
• Runs an unmodified systemd init (/sbin/init) inside the container, so the units you know from Proxmox VE work as-is.
• OpenSSH preconfigured for root PAM auth — set PASSWORD and you are in.
• APT-pinning keeps proxmox-default-kernel and the matching firmware out of the image, keeping it slim.
• Built and published automatically by Woodpecker CI on every push to main and weekly via cron.

Architecture

linux/amd64 only. Proxmox Datacenter Manager and the supporting proxmox-mail-forward / proxmox-offline-mirror-helper packages are not published for arm64, so multi-arch manifests are not produced.

Environment variables

Name	Description
PASSWORD	Root password applied on the first boot only, for SSH / PAM auth to PDM.

If PASSWORD is unset, no password change ever happens. After the first boot (i.e. once /etc/machine-id exists) the existing root password is preserved — change it inside the container if you need to rotate it later.

Volumes

PDM keeps state under the following paths. Mount them somewhere persistent to keep data across container restarts and rebuilds.

Path	Purpose
/etc/pdm	PDM configuration
/var/log/pdm	PDM service logs
/var/log/journal	systemd journal

Ports

Container port	Publish as	Purpose
8443/tcp	8443:8443	PDM web UI (HTTPS)
22/tcp	2222:22	SSH (root login)

Quick start

docker compose

services:
  pdm:
    image: git.hackmi.ch/phil/pdm-docker:latest
    container_name: pdm
    restart: unless-stopped
    stdin_open: true
    tty: true
    cgroup: private
    cap_add:
      - SYS_ADMIN
      - NET_ADMIN
    security_opt:
      - seccomp=unconfined
      - apparmor=unconfined
    ports:
      - "2222:22"     # SSH on the host
      - "8443:8443"   # PDM web UI
    environment:
      - PASSWORD=change-me
    volumes:
      - pdm-config:/etc/pdm
      - pdm-logs:/var/log/pdm
      - pdm-journal:/var/log/journal

volumes:
  pdm-config:
  pdm-logs:
  pdm-journal:

docker run

docker run -d \
  --name pdm \
  --restart unless-stopped \
  --cgroupns private \
  --cap-add SYS_ADMIN \
  --cap-add NET_ADMIN \
  --security-opt seccomp=unconfined \
  --security-opt apparmor=unconfined \
  -p 2222:22 \
  -p 8443:8443 \
  -e PASSWORD=change-me \
  -v pdm-config:/etc/pdm \
  -v pdm-logs:/var/log/pdm \
  -v pdm-journal:/var/log/journal \
  git.hackmi.ch/phil/pdm-docker:latest

Once the container reports healthy (docker inspect --format '{{.State.Health.Status}}' pdm prints healthy):

• Open https://localhost:8443/ and log in as root with the password you set above.
• SSH is reachable on ssh root@localhost -p 2222.

Tags

Tag	When
latest	Built on every push to main and weekly via cron.

Versioned tags are not published. Pin to latest for rolling updates, or to a specific image digest if you need reproducibility.

Building locally

docker build -t pdm-docker:dev .

The build pulls from the public PDM trixie mirror at build time — no secrets or registry accounts are required.

Security notes

• The container intentionally runs with SYS_ADMIN, NET_ADMIN, seccomp=unconfined, and apparmor=unconfined. Proxmox tooling expects to mount cgroups, netfilter tables, and so on; sandboxing it more aggressively tends to break PDM. Do not expose the container on an untrusted network.
• Change PASSWORD from the placeholder before deploying anywhere reachable.
• The image enables root password login over SSH for parity with a fresh Proxmox VE install. For production, disable it (PermitRootLogin no in /etc/ssh/sshd_config) and use SSH keys.
• PDM ships with a self-signed TLS certificate by default; the included HEALTHCHECK probes with curl -k accordingly.

License

GPL-3.0-or-later. See LICENSE for the full text.