You are absolutely free to fuck yourself over by using a niche option plagued by weird problems.

Or you could, like, not do that.

Docker inside LXC adds not only the overhead they’d individually add — probably not significant enough for it to matter in a homelab setting — but with it also the added layer of complexity that you’re going to hit when it comes to debugging anything. You’re much better off dropping docker in a full fledged VM instead of running it inside LXC. With a full VM, if nothing else, you can allow the virtual networking to be treated as it’s own separate device on your network, which should reduce a layer of complexity in the problem you’re trying to solve.

As for your original problem… it sounds like you’re not exposing the docker container layer’s network to your host. Without knowing exactly how you’re launching them (beyond the quirky docker inside LXC setup), it is hard to say where the issue may be. If you’re using compose, try setting the network to external, or bridge, and see if you can expose the service’s port that way. Once you’ve got the port exposure thing figured out, you’re probably better off unexposing the service, setup a proper reverse proxy, and wiring the service to go through your reverse proxy instead.

Jim’s Garage on YT, he recently did a video about running Docker in an LXC. I think you’ll find the info you need there. It can be done, but if you’re new to Docker and/or LXCs, it adds an additional layer of complexity you will have to deal with for every container/stack you deploy.

Add a new VM, install docker-ce on it and slowly migrate all the other containers/vm‘s to docker. End result is way less overhead, way less complexity and way better sleep.

I did it that way for years. It’s not worth the hassle my man. I did the same, told people that it’d be fine, that it was more performant and so it was worth it. But then the problems, oh lord the problems. Every proxmox update brought hours or days of work trying to figure how how it broke this time. Docker updates would make it completely bork. Random freezes, permission errors galore. I threw in the towel on it, figuring I was hacking it making it work anyway.

Now I do vms on proxmox. Specifically I swapped to k3s which is a whole other thing, but docker in vms runs fine for how much less annoyance there is. Selfhosting became a lot less stressful.

Learn from our mistakes, OP

Can you reach other services on that vm? If you don’t know that then test this first. ( May be run a python http service to test this?)

That all seems correct, the way to expose services with a docker-compose is by using the:

ports:
  - 2283:3001

That means that you expose whatever is at port 3001 in the cointainer (in this case the Immich server inside the docker container, which is exposed by default to 3001) to port 2283 of the host machine (in this case, your LXC container). So it should work if everything else is set up correctly.

The 172.x.x.x networks are normal internal networks for docker to use, normally you needn’t care about them because you just expose whichever port you need via the ports command above.

Are you following this step by step to set it all up? is your .env file properly set up? did you check the containers logs?

[Nest] 7  - 04/08/2024, 9:53:08 AM     LOG [SystemConfigService] LogLevel=log (set via system config)
node:fs:1380
  const result = binding.mkdir(
                         ^

Error: EACCES: permission denied, mkdir 'upload/library'
    at mkdirSync (node:fs:1380:26)
    at StorageRepository.mkdirSync (/usr/src/app/dist/repositories/storage.repository.js:112:37)
    at StorageService.init (/usr/src/app/dist/services/storage.service.js:30:32)
    at ApiService.init (/usr/src/app/dist/services/api.service.js:72:29)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async ApiModule.onModuleInit (/usr/src/app/dist/app.module.js:58:9)
    at async callModuleInitHook (/usr/src/app/node_modules/@nestjs/core/hooks/on-module-init.hook.js:51:9)
    at async NestApplication.callInitHook (/usr/src/app/node_modules/@nestjs/core/nest-application-context.js:223:13)
    at async NestApplication.init (/usr/src/app/node_modules/@nestjs/core/nest-application.js:100:9)
    at async NestApplication.listen (/usr/src/app/node_modules/@nestjs/core/nest-application.js:169:33) {
  errno: -13,
  code: 'EACCES',
  syscall: 'mkdir',
  path: 'upload/library'

    volumes:
      - /mnt/NAS-immich-folder:/mnt/immich
      - ${UPLOAD_LOCATION}:/mnt/immich
      - /etc/localtime:/etc/localtime:ro

# The location where your uploaded files are stored
UPLOAD_LOCATION=/media/immich