NFS server in LXC

What this does

This is the opposite of the NFS client page. The container becomes an NFS server: it exposes a folder of its filesystem to clients on the network. Other CTs, the Proxmox host, VMs or physical machines can then mount that folder.

# /etc/exports inside the CT:
/mnt/data  <network>(rw,sync,no_subtree_check,no_root_squash)

The "sharedfiles" group convention

Before exporting the folder, ProxMenux creates a group called sharedfiles with GID 101000 inside the container, adds every regular user to it, then sets the export directory to root:sharedfiles with mode 2775. The 2 at the front is the SGID bit — every file or folder created inside automatically inherits the sharedfiles group.

Default export options — read this first

Opening the tool

From ProxMenux's main menu, open Storage & Share Manager → Configure NFS Server in LXC (only privileged). ProxMenux first asks you to pick the target CT (and starts it if stopped); aborts if unprivileged. Once the CT is selected you see this sub-menu with five options:

How the script runs (Create flow)

┌─────────────────────────────────────────────┐
│  PHASE 1 — Pick CT, folder, network, opts   │
│  (nothing touched yet)                      │
└──────────────────┬──────────────────────────┘
                   ▼
      Privileged-CT gate (share-common.func)
      ├─ pct list — pick CT
      ├─ Auto-start if stopped
      └─ Aborts if "unprivileged: 1" in CT config
                   │
                   ▼
      Folder selection (2 modes)
      ├─ Auto: choose from existing folders
      │   inside /mnt of the CT
      └─ Manual: enter any absolute path
         (must already exist inside the CT)
                   │
                   ▼
      Network ACL (3 modes)
      ├─ 1. Local network (192.168.0.0/16)
      ├─ 2. Custom subnet (e.g. 192.168.10.0/24)
      └─ 3. Single host IP
                   │
                   ▼
      Export options (3 modes)
      ├─ 1. Read-write — rw,sync,no_subtree_check,
      │                  no_root_squash  (DEFAULT)
      ├─ 2. Read-only  — ro,sync,no_subtree_check,
      │                  no_root_squash
      └─ 3. Custom     — type your own option string
                   │
   ┌──────── Cancel   OR   Confirm ────┐
   ▼                                   ▼
Exit, nothing        ┌─────────────────┴─────────────────┐
was changed          │  PHASE 2 — Install + configure     │
                     └─────────────────┬─────────────────┘
                                       ▼
                       Install NFS server (in CT)
                       └─ pct exec apt-get install -y \
                              nfs-kernel-server
                              nfs-common rpcbind
                          + systemctl enable --now both
                          (skipped if already installed)
                                       ▼
                       setup_universal_sharedfiles_group
                       └─ groupadd -g 101000 sharedfiles
                          (or groupmod if exists at wrong GID)
                          For each regular user (UID >= 1000):
                            ├─ usermod -a -G sharedfiles <user>
                            └─ useradd -u <uid+100000> \
                                       -g sharedfiles \
                                       remap_<uid>
                          Same for common UIDs (33, 1000-1002)
                                       ▼
                       Apply ownership + SGID on the folder
                       └─ chown root:sharedfiles <folder>
                          chmod 2775 <folder>
                            (sticky group: new files inherit
                             the sharedfiles group)
                                       ▼
                       Update /etc/exports
                       └─ If existing entry for the folder:
                              ask "update?", remove + replace.
                          Else:
                              append the new line.
                                       ▼
                       systemctl restart rpcbind \
                                         nfs-kernel-server
                       exportfs -ra
                                       ▼
                       Print connection details:
                       • Server IP (CT hostname -I)
                       • Export path
                       • Mount options chosen
                       • Network ACL
                       • Mount examples (auto / v4 / v3)

Network ACL — who can mount the share

The network field in /etc/exports filters which clients are allowed to mount. ProxMenux offers three modes:

Export options explained

Manual equivalent

Replicate the whole flow by hand — every command runs inside the CT via pct exec <ctid> -- or pct enter <ctid>:

# 1. install the NFS server (one-time)
apt-get update
apt-get install -y nfs-kernel-server nfs-common rpcbind
systemctl enable --now rpcbind nfs-kernel-server

# 2. create the sharedfiles group convention
groupadd -g 101000 sharedfiles
# add each regular user to it
for u in $(awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd); do
  usermod -a -G sharedfiles "$u"
done

# 3. set ownership + SGID on the folder
mkdir -p /mnt/data
chown root:sharedfiles /mnt/data
chmod 2775            /mnt/data    # SGID: new files inherit group

# 4. add the export line
echo "/mnt/data 192.168.0.0/16(rw,sync,no_subtree_check,no_root_squash)" \
     >> /etc/exports

# 5. apply
systemctl restart rpcbind nfs-kernel-server
exportfs -ra

# verify
exportfs -v
showmount -e localhost

View current exports

Cats /etc/exports from inside the CT (skipping comments / blanks) and prints each export with its network ACL and option string. Useful to check which folders are exposed before sharing the CT's IP with someone.

Delete an export

Lists every line in /etc/exports for selection, removes the chosen one (sed -i), runs exportfs -ra and restarts nfs-kernel-server. The folder itself and its contents are left intact.

Check NFS status

Diagnostic pass: confirms nfs-kernel-server and rpcbind are installed and active, prints exportfs -v output, lists active NFS sessions (showmount -a) and current client connections.

Uninstall NFS server

Full clean-up after confirmation: stops + disables nfs-kernel-server and rpcbind, clears /etc/exports, apt-get purge the NFS packages, removes the sharedfiles group and the remap_* users, kills any leftover processes. The exported folders themselves are not deleted — only the NFS configuration and packages.

Troubleshooting

Related

• NFS client in LXC — the inverse: mount external NFS shares from inside a CT.
• Samba server in LXC — sibling page, same pattern with SMB / CIFS instead of NFS.
• NFS share as Proxmox storage — once your CT is exporting, register that NFS share in Proxmox so it appears under Datacenter → Storage.