Nextcloud AIO Collabora repeatedly restarts with enterMountingNS / bind-mount Permission denied

Hello,

I am running Nextcloud AIO with the built-in Collabora container, and I am facing a persistent permission/mount issue that seems to affect both startup stability and document editing.

I already tried the following:

Recreated the entire AIO stack.

Removed the master container completely and deployed the stack again.

Set COLLABORA_SECCOMP_DISABLED=true in the AIO master container environment.

Even after that, Collabora still logs the same errors.
Relevant log output

wsd-00011-00011 ERR enterMountingNS, root mount failed (EACCES: Permission denied) wsd-00010-00010 ERR creating usernamespace for mount user failed. coolmount: mount failed to bind [/opt/cool/systemplate] ... Permission denied. ERR Failed to bind-mount [/opt/cool/systemplate] -> [/opt/cool/child-roots/.../cool_test_mount] ERR Bind-Mounting fails and will be disabled for this run. To disable permanently set mount_jail_tree config entry in coolwsd.xml to false. WRN File not found: Private key file: /etc/coolwsd/proof_key ERR Security: Running without the ability to filter system calls is ill advised.

The container does start and eventually says:
Ready to accept connections on port 9980.

but the log continues to show repeated kit disconnects and mount/jail warnings.
What I observe

In addition to the startup issue, I also had a problem yesterday while editing a spreadsheet in Collabora:

I edited a table.

Then a timeout occurred.

My changes were lost.

I am not sure whether this is caused by the Collabora restarts or by the same underlying permission issue, but it seems related because Collabora appears to be unstable.

My setup

Nextcloud AIO

Collabora started by AIO

Docker-based deployment

COLLABORA_SECCOMP_DISABLED=true is set in the AIO master container environment

My question

What is still misconfigured in my setup?

More specifically:

Why does Collabora still fail with enterMountingNS / bind-mount Permission denied even after disabling seccomp?

Is mount_jail_tree the next thing I need to disable or adjust in AIO?

Could these errors explain the timeouts and lost spreadsheet changes?

Is this something I should fix in my container/host setup, or is it an AIO/Collabora bug?

My Docker compose:
`
name: nextcloud-aio

services:
nextcloud-aio-mastercontainer:
image: Package all-in-one · GitHub
init: true
restart: always
container_name: nextcloud-aio-mastercontainer
volumes:

  • nextcloud_aio_mastercontainer:/mnt/docker-aio-config
  • /var/run/docker.sock:/var/run/docker.sock:ro
    network_mode: bridge
    ports:
  • 8080:8080 # AIO Interface
    environment:
    APACHE_PORT: 11000 # Port für Domaincheck / Apache intern
    APACHE_IP_BINDING: 0.0.0.0
    SKIP_DOMAIN_VALIDATION: “false”
    NEXTCLOUD_MEMORY_LIMIT: 7168M
    TALK_PORT: 3480
    BORG_RETENTION_POLICY: “–keep-within=5d --keep-weekly=4 --keep-monthly=3”
    COLLABORA_SECCOMP_DISABLED: “true”

volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer
`

Thank you for any hints.

Hi, I am not sure if that is an option for you but you could try to enable EuroOffice via the AIO interface and check if that works for you.

Hi, yes, I could try that.

But that doesn’t solve the problem. I use the Collabora offline app on my PC and Android phone, and I don’t want to give it up because I only work with .odf files, which aren’t very compatible with EuroOffice.

It would be great if someone could help me figure out why Collabora keeps restarting and what I can do about it.

Thanks in advance for your reply!

I see that same errors on my nextcloud-aio-collabora startup, except the last line:

There are also a lot of this messages while using it: “WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date.”

But despite this messages, nextcloud office is working here.

Nextcloud Collabora restarts regularly (every five to ten minutes).

Unfortunately, I don’t know what might be causing this.

I had previously reactivated EuroOffice and run a prune.

Then I reactivated Collabora and ran prune again.

Unfortunately, that didn’t help either.

Here is another log documenting the restart.

2026-06-23T10:06:18.661461585Z [nextcloud-aio-collabora] frk-00020-00020 2026-06-23 10:06:18.661358 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:06:18.669040987Z [nextcloud-aio-collabora] frk-00020-00020 2026-06-23 10:06:18.665760 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:06:18.677053289Z [nextcloud-aio-collabora] frk-00020-00020 2026-06-23 10:06:18.671590 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:08:31.826649009Z [nextcloud-aio-collabora] frk-00020-00020 2026-06-23 10:08:31.826405 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:12:49.562537750Z [nextcloud-aio-collabora] frk-00255-00255 2026-06-23 10:12:49.562291 [ subforkit_001 ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:12:49.569063650Z [nextcloud-aio-collabora] frk-00255-00255 2026-06-23 10:12:49.566934 [ subforkit_001 ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:12:49.573460699Z [nextcloud-aio-collabora] frk-00255-00255 2026-06-23 10:12:49.573234 [ subforkit_001 ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:12:49.581602045Z [nextcloud-aio-collabora] frk-00255-00255 2026-06-23 10:12:49.580068 [ subforkit_001 ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:12:49.587469838Z [nextcloud-aio-collabora] frk-00255-00255 2026-06-23 10:12:49.587255 [ subforkit_001 ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:15:06.500405744Z [nextcloud-aio-collabora] wsd-00007-00007 2026-06-23 10:15:06.500249 [ coolwsd ] SIG Shutdown signal received: SIGTERM

2026-06-23T10:15:06.503977653Z [nextcloud-aio-collabora] frk-00257-00257 2026-06-23 10:15:06.503452 [ kit_spare_014 ] ERR #31: Kit for DocBroker [] connection lost without exit arriving from wsd. Setting TerminationFlag|kit/KitWebSocket.cpp:215

2026-06-23T10:15:06.504013932Z [nextcloud-aio-collabora] frk-00161-00161 2026-06-23 10:15:06.503452 [ kit_spare_010 ] ERR #31: Kit for DocBroker [] connection lost without exit arriving from wsd. Setting TerminationFlag|kit/KitWebSocket.cpp:215

2026-06-23T10:15:06.504212852Z [nextcloud-aio-collabora] frk-00260-00260 2026-06-23 10:15:06.504030 [ kit_spare_017 ] ERR #31: Kit for DocBroker [] connection lost without exit arriving from wsd. Setting TerminationFlag|kit/KitWebSocket.cpp:215

2026-06-23T10:15:06.504429756Z [nextcloud-aio-collabora] frk-00258-00258 2026-06-23 10:15:06.504260 [ kit_spare_015 ] ERR #31: Kit for DocBroker [] connection lost without exit arriving from wsd. Setting TerminationFlag|kit/KitWebSocket.cpp:215

2026-06-23T10:15:06.504455173Z [nextcloud-aio-collabora] frk-00259-00259 2026-06-23 10:15:06.504386 [ kit_spare_016 ] ERR #31: Kit for DocBroker [] connection lost without exit arriving from wsd. Setting TerminationFlag|kit/KitWebSocket.cpp:215

2026-06-23T10:15:06.504855094Z [nextcloud-aio-collabora] frk-00255-00255 2026-06-23 10:15:06.504707 [ subforkit_001 ] ERR #12: ForKit connection lost without exit arriving from wsd. Setting TerminationFlag|kit/ForKit.cpp:225

2026-06-23T10:15:06.505441985Z [nextcloud-aio-collabora] frk-00190-00190 2026-06-23 10:15:06.505036 [ kit_spare_012 ] ERR #31: Kit for DocBroker [] connection lost without exit arriving from wsd. Setting TerminationFlag|kit/KitWebSocket.cpp:215

2026-06-23T10:15:06.505596915Z [nextcloud-aio-collabora] frk-00162-00162 2026-06-23 10:15:06.505447 [ kit_spare_011 ] ERR #31: Kit for DocBroker [] connection lost without exit arriving from wsd. Setting TerminationFlag|kit/KitWebSocket.cpp:215

2026-06-23T10:15:06.508041089Z [nextcloud-aio-collabora] frk-00160-00160 2026-06-23 10:15:06.507004 [ kit_spare_00f ] ERR #31: Kit for DocBroker [] connection lost without exit arriving from wsd. Setting TerminationFlag|kit/KitWebSocket.cpp:215

2026-06-23T10:15:12.837924918Z [nextcloud-aio-collabora] wsd-00011-00011 2026-06-23 10:15:12.836978 [ coolwsd ] ERR enterMountingNS, root mount failed (EACCES: Permission denied)|common/JailUtil.cpp:103

2026-06-23T10:15:12.838561720Z [nextcloud-aio-collabora] wsd-00010-00010 2026-06-23 10:15:12.837944 [ coolwsd ] ERR creating usernamespace for mount user failed.|wsd/COOLWSD.cpp:1366

2026-06-23T10:15:12.838598153Z [nextcloud-aio-collabora] wsd-00010-00010 2026-06-23 10:15:12.838447 [ coolwsd ] WRN Jails root directory [/opt/cool/child-roots/] is not empty. Will not remove it.|common/JailUtil.cpp:458

2026-06-23T10:15:12.844977164Z [nextcloud-aio-collabora] wsd-00010-00010 2026-06-23 10:15:12.844834 [ coolwsd ] WRN Cleaned legacy jail without pid prefix after upgrade /opt/cool/child-roots/7-6E6225CD/systmp|common/JailUtil.cpp:445

2026-06-23T10:15:12.861154784Z [nextcloud-aio-collabora] /usr/bin/coolmount: mount failed to bind [/opt/cool/systemplate] to [/opt/cool/child-roots/7-6E6225CD/cool_test_mount]: Permission denied.

2026-06-23T10:15:12.861808822Z [nextcloud-aio-collabora] wsd-00010-00010 2026-06-23 10:15:12.861611 [ coolwsd ] ERR Failed to bind-mount [/opt/cool/systemplate] → [/opt/cool/child-roots/7-6E6225CD/cool_test_mount]|common/JailUtil.cpp:171

2026-06-23T10:15:12.861824857Z [nextcloud-aio-collabora] wsd-00010-00010 2026-06-23 10:15:12.861645 [ coolwsd ] ERR Bind-Mounting fails and will be disabled for this run. To disable permanently set mount_jail_tree config entry in coolwsd.xml to false.|common/JailUtil.cpp:502

2026-06-23T10:15:20.999042260Z [nextcloud-aio-collabora] wsd-00007-00007 2026-06-23 10:15:20.998113 [ coolwsd ] WRN File not found: Private key file: /etc/coolwsd/proof_key

2026-06-23T10:15:20.999096487Z [nextcloud-aio-collabora] No proof-key will be present in discovery.

2026-06-23T10:15:20.999101184Z [nextcloud-aio-collabora] If you need to use WOPI security, generate an RSA key using this command:

2026-06-23T10:15:20.999105022Z [nextcloud-aio-collabora] sudo coolconfig generate-proof-key

2026-06-23T10:15:20.999108058Z [nextcloud-aio-collabora] or if your config dir is not /etc, you can run ssh-keygen manually:

2026-06-23T10:15:20.999111309Z [nextcloud-aio-collabora] ssh-keygen -t rsa -N “” -m PEM -f “/etc/coolwsd/proof_key”

2026-06-23T10:15:20.999114709Z [nextcloud-aio-collabora] Note: the proof_key file must be readable by the coolwsd process.|wsd/ProofKey.cpp:136

2026-06-23T10:15:21.032313271Z [nextcloud-aio-collabora] frk-00027-00027 2026-06-23 10:15:21.032108 [ coolforkit-caps ] ERR Security: Running without the ability to filter system calls is ill advised.|kit/ForKit.cpp:977

2026-06-23T10:15:21.032377550Z [nextcloud-aio-collabora] coolforkit version details: 26.04.1.3 - f0f0f2a66a

2026-06-23T10:15:21.271800667Z [nextcloud-aio-collabora] Init vcl

2026-06-23T10:15:22.944466485Z [nextcloud-aio-collabora] preload: merged testuno vbaswobj swd sw sm msword pdfimport sdui sd vbaobj scd sc pcr migrationoo2 sdd smd PresentationMinimizer stocservices invocation sw_writerfilter io reflection calc uuresolver bootstrap scn scfilt introspection deploymentgui writer binaryurp LanguageTool namingservice migrationoo3 invocadapt proxyfac

2026-06-23T10:15:22.944883452Z [nextcloud-aio-collabora] Disabled: cmdmail dbp abp

2026-06-23T10:15:23.862533153Z [nextcloud-aio-collabora] Preload textencodings

2026-06-23T10:15:23.880345488Z [nextcloud-aio-collabora] Allowlisted languages: de_De

2026-06-23T10:15:23.927201770Z [nextcloud-aio-collabora] Preloading local dictionaries:

2026-06-23T10:15:23.932743669Z [nextcloud-aio-collabora] Preloading local thesauri:

2026-06-23T10:15:23.936163142Z [nextcloud-aio-collabora] Preloading local hyphenators:

2026-06-23T10:15:23.936335084Z [nextcloud-aio-collabora] Preloading breakiterator

2026-06-23T10:15:23.936339707Z [nextcloud-aio-collabora] Preload icons

2026-06-23T10:15:23.975800102Z [nextcloud-aio-collabora] Preload short cut accelerators

2026-06-23T10:15:24.212366862Z [nextcloud-aio-collabora] Preload languages

2026-06-23T10:15:24.369153444Z [nextcloud-aio-collabora] Preload fonts

2026-06-23T10:15:24.369187944Z [nextcloud-aio-collabora] Preload config

2026-06-23T10:15:25.793480770Z [nextcloud-aio-collabora] frk-00027-00027 2026-06-23 10:15:25.793300 [ coolforkit-caps ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:15:25.793595122Z [nextcloud-aio-collabora] frk-00027-00027 2026-06-23 10:15:25.793401 [ coolforkit-caps ] WRN Failed to update the dynamic files in [/opt/cool/systemplate]. Will clone dynamic elements of systemplate to the jails.|common/JailUtil.cpp:703

2026-06-23T10:15:25.794157287Z [nextcloud-aio-collabora] frk-00027-00027 2026-06-23 10:15:25.794067 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:15:28.945998573Z [nextcloud-aio-collabora] frk-00031-00031 2026-06-23 10:15:28.945838 [ kit_spare_001 ] WRN Linking/copying files from /opt/collaboraoffice to /opt/cool/child-roots/7-6E6225CD/RHeqdK7023o8dqgw/lo/ is taking too much time. Enabling verbose link/copy logging.|kit/Kit.cpp:528

2026-06-23T10:15:49.662549116Z [nextcloud-aio-collabora] office version details: { “ProductName”: “Collabora Office”, “ProductVersion”: “26.04”, “ProductExtension”: “.1.3”, “BuildId”: “f0f0f2a66a15a13673f64d5ad61db2369a00cb39”, “BuildConfig”: “‘–enable-hardening-flags’ ‘–enable-mpl-subset’ ‘–with-vendor=Collabora Productivity Limited’ ‘–with-branding=icon-themes/galaxy/brand_cp’ ‘–with-system-dicts’ ‘–with-myspell-dicts’ ‘–with-system-zlib’ ‘–enable-cairo-rgba’ ‘–without-system-cairo’ ‘–without-system-fontconfig’ ‘–without-system-freetype’ ‘–without-system-graphite’ ‘–without-system-harfbuzz’ ‘–without-system-openssl’ ‘–without-system-libpng’ ‘–without-system-libxml’ ‘–without-system-jpeg’ ‘–without-system-expat’ ‘–without-system-curl’ ‘–without-system-icu’ ‘–without-system-nss’ ‘–without-system-jars’ ‘–without-java’ ‘–without-junit’ ‘–without-help’ ‘–disable-xmlhelp’ ‘–with-linker-hash-style=both’ ‘–with-fonts’ ‘–with-docrepair-fonts’ ‘–enable-noto-font’ ‘–with-galleries=no’ ‘–with-theme=colibre colibre_svg’ ‘–with-external-thes-dir=/usr/share/mythes’ ‘–with-external-hyph-dir=/usr/share/hyphen’ ‘–with-external-dict-dir=/usr/share/hunspell’ ‘–disable-dbus’ ‘–disable-extension-integration’ ‘–disable-kf5’ ‘–disable-gtk3’ ‘–disable-qt5’ ‘–disable-gstreamer-1-0’ ‘–disable-evolution2’ ‘–disable-gio’ ‘–disable-gui’ ‘–disable-scripting-javascript’ ‘–disable-sdremote’ ‘–disable-sdremote-bluetooth’ ‘–disable-randr’ ‘–enable-epm’ ‘–enable-python=internal’ ‘–disable-online-update’ ‘–disable-dconf’ ‘–enable-mergelibs=more’ ‘–with-package-format=deb rpm’ ‘–enable-release-build’ ‘–with-lang=ar bg ca cs cy da de el en-US en-GB eo es eu fi fr ga gl he hr hu hy id is it ja kk ko lo nb nl oc pl pt pt-BR ro ru sk sl sq sv tr uk vi zh-CN zh-TW’ ‘–disable-lpsolve’ ‘–enable-symbols’ ‘–enable-sal-log’ ‘–without-templates’ ‘–with-buildconfig-recorded’ ‘–disable-librelogo’ ‘–without-gssapi’ ‘–disable-ldap’ ‘–enable-quickjs’ ‘–srcdir=/home/collabora/jenkins/workspace/online/engine’ ‘–enable-option-checking=fatal’ ‘PKG_CONFIG_PATH=/opt/rh/devtoolset-12/root/usr/lib64/pkgconfig’” }

2026-06-23T10:15:49.668374918Z [nextcloud-aio-collabora] wsd-00007-00026 2026-06-23 10:15:49.668221 [ prisoner_poll ] WRN ForKit not responsive for 28655ms forking 1 children. Resetting.|wsd/COOLWSD.cpp:662

2026-06-23T10:15:49.688647763Z [nextcloud-aio-collabora] frk-00027-00027 2026-06-23 10:15:49.668660 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:15:49.688660221Z [nextcloud-aio-collabora] Ready to accept connections on port 9980.

2026-06-23T10:15:49.688663347Z [nextcloud-aio-collabora]

2026-06-23T10:15:49.688665782Z [nextcloud-aio-collabora] frk-00027-00027 2026-06-23 10:15:49.673205 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:15:49.688669437Z [nextcloud-aio-collabora] frk-00027-00027 2026-06-23 10:15:49.677014 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:15:49.688673562Z [nextcloud-aio-collabora] frk-00027-00027 2026-06-23 10:15:49.682438 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/passwd] is out-of-date. Will have to clone dynamic elements of systemplate to the jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.|common/JailUtil.cpp:628

2026-06-23T10:15:50.565570716Z [nextcloud-aio-collabora] wsd-00007-00026 2026-06-23 10:15:50.565068 [ prisoner_poll ] WRN #17: Unassociated Kit (31) disconnected unexpectedly|wsd/COOLWSD.cpp:3101

Please share more details about your container environment/underlying host: OS, Docker Engine version, underlying filesystem, etc.

Also, when did this problem start?

This problem has been going on for a while, and I’ve tried to fix it time and again. But it’s been like this for months now. When I’m working on something and Collabora restarts, it’s happened quite a few times that my input has disappeared.

That’s not ideal in the long run.

Should I maybe try hosting Collabora separately to see if the problem occurs there as well?

Here’s an overview of my system:

Host: Proxmox VE 9.2.3

Proxmox VM: Debian 13.5 (Kernel: 6.12.94, File system: ext4)

Docker: v29.60

How precisely are you running Docker / your Nextcloud containers in Proxmox? Any chance you’re nesting Docker in LXC? If so, try switching to a VM instead. This sounds like it is an LXC matter to me.

Hello,

Nextcloud is running on a Debian VM on Proxmox.

I don’t use LXC containers because I’ve had problems with them on several occasions.