Basement Uptime

About

Thu, 06 Aug 2026 00:00:00 +0000

Basement Uptime is a small, focused set of notes on self-hosting and homelab operations — Proxmox, LXC, DNS, backups, and the specific, often-undocumented gotchas that show up when you actually run this stuff long-term rather than just following a setup tutorial once.

Posts here come from real operational work: things that broke, why they broke, and what fixed them. No sponsored placement, no product seeded by a PR firm — where a link to a specific piece of hardware or software is useful, it’s linked because it’s genuinely what was used, and some of those links may be affiliate links (see the note in the footer).

Fixing UID/GID Permission Hell When Bind-Mounting Host Storage Into Unprivileged LXC

Thu, 06 Aug 2026 00:00:00 +0000

If you’ve ever bind-mounted a host directory into an unprivileged LXC container and watched every file inside turn into nobody:nogroup (or worse, 65534:65534), you’ve run into the UID mapping problem. It’s one of those things that seems like a bug the first time you hit it, but it’s actually the container isolation working exactly as designed — just not the way most people expect.

Why this happens

Unprivileged LXC containers remap UIDs/GIDs so that root inside the container (UID 0) is not root on the host. Instead, container UID 0 maps to some high UID on the host — by default something like 100000. The whole UID range inside the container (0-65535) gets shifted up by that offset on the host side.

ip neigh show Lies: Always arping Before You Assign a Static LAN IP

Thu, 06 Aug 2026 00:00:00 +0000

You’re spinning up a new container or VM and you need a free static IP. The instinctive check is:

ip neigh show

If the candidate address isn’t in the table, it looks free. It isn’t necessarily. The neighbor table (ARP cache) only holds entries for hosts your machine has actually exchanged traffic with recently — usually within the last few minutes to a few hours, depending on the kernel’s gc_stale_time and related sysctls. A device that’s been quietly sitting on the network without talking to this particular host simply won’t show up, stale entry or not.

Passing a USB Serial or Webcam Device Into an Unprivileged Proxmox LXC

Thu, 06 Aug 2026 00:00:00 +0000

Unprivileged LXC containers are the right default on Proxmox — root inside the container isn’t root on the host. But that same UID remapping breaks the instinct most people have for granting device access: “just add the service user to dialout/video/whatever group.” It won’t work the way you expect, and it’s worth understanding why before you spend an hour staring at a permission-denied error.

Why group membership fails

When an unprivileged container bind-mounts a host device node, the container’s view of that device’s ownership goes through the same UID/GID remapping as everything else. A device owned by root:dialout on the host shows up inside the container as owned by some remapped, meaningless UID:GID pair — typically rendered as nobody:nogroup. Adding your service user to a group inside the container does nothing, because the group the device actually belongs to (from the container’s point of view) isn’t a group that exists in any meaningful sense inside that namespace.

The Stale Search-Domain Bug That Silently Breaks DNS in Fresh LXC Containers

Thu, 06 Aug 2026 00:00:00 +0000

Symptom: a brand-new container fails a apt-get install with a resolution error, or some app inside it can’t reach the outside world, even though the container clearly has a route out and ping <ip> to a raw address works fine. The instinct is to blame the app. Check /etc/resolv.conf first.

What was actually happening

If you’ve ever run Tailscale on a Proxmox host or one of its containers — even briefly, even just to test something — and then removed it, it can leave behind a stale search directive in the resolver config: