Proxmox hardware requirements, and a server that already meets them

What Proxmox asks of the machine, in plain words

Proxmox VE is the layer that turns one physical server into many virtual ones. Its documentation, current for version 9.2, keeps two lists: a small one for evaluating it and a fuller one for running it in production. These are the production points, translated.

• Processor: 64-bit Intel or AMD, and the chip must offer VT (Intel) or AMD-V (AMD). That flag is what lets virtual machines run at close to full speed. Proxmox also supports 64-bit ARM on a few platforms, but our Proxmox image is x86 only.
• Memory: 2 GB for Proxmox and its services, plus the memory you give each virtual machine. If you store them on ZFS or Ceph, Proxmox asks for roughly 1 GB extra per terabyte of data stored.
• Disks: either a hardware RAID card with a battery-backed write cache, or plain disks with no RAID card so ZFS can manage them. Proxmox says plainly that a RAID card and ZFS or Ceph do not mix. SSDs with power-loss protection are its recommendation; consumer SSDs are discouraged.
• Network: Proxmox recommends redundant gigabit-or-faster network cards, with extra ones if you build storage or a cluster.
• Passing a device straight to a VM (a GPU, for example) needs the chip and board to support IOMMU, called VT-d on Intel and AMD-Vi on AMD, switched on in the firmware.

If you plan on ZFS, its own chapter asks for at least 8 GB of memory before anything else and recommends ECC memory, which detects and corrects memory errors so they do not end up written to disk.

Will it fit your virtual machines?

Work memory out first, because each VM keeps what you give it. Here is a worked example; the sum is our own, built on Proxmox's published figures. Say you want five VMs of 8 GB each, stored on ZFS with about 4 TB of data:

1. Proxmox itself: 2 GB.
2. Your five VMs: 5 × 8 = 40 GB.
3. ZFS on 4 TB of data: about 4 GB.
4. Total: about 46 GB, so a 64 GB server, with the rest as room to grow.

Proxmox does not publish a cores-per-VM figure, so think about how busy each VM will really be. After setup, its built-in pveperf tool gives a fast first look at processor and disk speed; Proxmox suggests deeper disk tests for anything serious.

The servers that arrive ready

You can pick Proxmox VE 9 with a single click on our order form, and it costs nothing: no licence line on the invoice, nothing per socket or per core. We install it from the official Proxmox auto-install image, so you get root over SSH, the web panel on port 8006 and a vmbr0 bridge on the server's port. Eight rack-server lines carry the image, across five cities; you can compare them all on the dedicated server page or go straight to Proxmox servers.

Disks come one of three ways: hardware RAID 1 on the built-in controller, a ZFS mirror that the installer lays down where a line offers software RAID, or plain disks if you want to build your own pool. Every one of these rack lines has an HPE iLO or Dell iDRAC console, so a bad network change never strands you. Proxmox is not offered on our Moonshot cartridges or the Ampere ARM line.

The Opteron 6300 line stops at x86-64-v2, so RHEL 10 will not run on it, and since a virtual machine can only use instructions its host processor has (our reasoning), RHEL 10 guests will not run on it either. By our reading the same is true of both Xeon E5 v1/v2 lines (E5-2600 and E5-4600). If your guests need RHEL 10, choose an EPYC, Xeon Silver / Gold or four-socket Xeon Gold line, or the v3/v4 generation of either Xeon E5 line.

Getting your VMs onto the internet

Proxmox's networking chapter notes that most hosting providers shut a port down when they see several MAC addresses on it, which is why so many guides send you into routed or NAT setups. You can skip that here: our switch ports carry a plain access VLAN with no MAC binding, so a VM can sit on the bridge with its own MAC and its own public IPv4. Your server includes one IPv4 address and IPv6, and more IPv4 are a line on the order form. Routed setups still work if you prefer them, and VMs with only private addresses can still get online through NAT (masquerading) on the host. Our Proxmox networking guide has the files to copy.

Locking the door before the first VM

Port 8006 is the full Proxmox API, so it should never face the open internet. The service behind it listens on every address, IPv6 included, and the Proxmox firewall, which covers IPv4 and IPv6 with one set of rules, starts switched off. Do this in your first hour:

1. Log in over SSH with the details we email, replace the root password (passwd) and install your SSH key.
2. Leave that SSH window open while you work; Proxmox recommends this so a wrong rule cannot shut you out.
3. Save the firewall file below, with your server's address as local_network and your own office addresses, IPv4 and IPv6 each on its own line, in the management set. Proxmox advises the single-address alias for a lone server on a public network. Addresses in the management set reach more than the panel: SSH, the VNC and SPICE consoles (5900-5999 and 3128) plus 60000-60050, the ports used for live migration.
4. Check it with pve-firewall status, then try a fresh SSH login before closing the first one.
5. When your key works in that fresh login, switch password logins off: edit /etc/ssh/sshd_config so it reads PasswordAuthentication no, then reload the service with systemctl reload ssh. Anyone can reach SSH, so only keys should get through.
6. From anywhere else, reach the panel through an SSH tunnel with your own login.

# /etc/pve/firewall/cluster.fw
[OPTIONS]
enable: 1
policy_in: DROP

[ALIASES]
local_network 203.0.113.10

[IPSET management]
198.51.100.25
2001:db8:10::25

[RULES]
IN SSH(ACCEPT)

# run on your laptop, keep the window open
ssh -N -L 8006:127.0.0.1:8006 root@203.0.113.10
# browse to https://127.0.0.1:8006 (expect a self-signed certificate warning)

With incoming traffic set to DROP, the panel answers only your management addresses, the server's own address and the SSH tunnel. After saving, run ipset list PVEFW-0-management-v4 and ipset list PVEFW-0-management-v6 to confirm both of your office addresses are listed. If the IPv6 one is missing, use the SSH tunnel from that address. If you do lock yourself out, the iLO or iDRAC console gives you the screen and keyboard back.

A second factor on the root account

Once you are in, add a time-based code (TOTP) to root@pam from the Two Factor panel under Datacenter, Permissions, using any authenticator app on your phone. Create recovery keys there too and keep them somewhere other than the server: eight failed codes switch the user's TOTP off until a recovery key is used. Lost those too? The command is pveum user tfa unlock followed by the user, here root@pam, typed in an SSH session as root; it lifts the lock. This protects panel logins; SSH stays protected by your key.

Updates, with or without a subscription

You do not need a Proxmox subscription, and we do not sell one; if you want it, you buy it from Proxmox. The catch is the package source. Proxmox's documentation says the enterprise repository is on by default and needs a subscription key. Without one, add Enabled: no to the entry in /etc/apt/sources.list.d/pve-enterprise.sources (do the same for the enterprise line in ceph.sources, if your server has one), then add the free source below. Proxmox says it is meant for testing and for servers that are not in production.

# /etc/apt/sources.list.d/proxmox.sources
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

Install updates with apt update followed by apt full-upgrade. Proxmox warns that plain apt upgrade can leave the system half-updated.

Backups that outlive the server

Proxmox has backups built in: vzdump, run from the panel or as a scheduled job, always saves the whole VM, settings and data together. Snapshot mode keeps the VM running while it copies, and if the QEMU guest agent is on it briefly freezes the file system for a cleaner copy. Stop mode is the most consistent but shuts the VM down for a moment. Proxmox recommends sending backups to a Proxmox Backup Server on its own machine, or to NFS. Keep them off the host they protect; backups on the same disks fail together with them.

When one Proxmox server is not enough

For high availability, Proxmox clusters want at least three servers (or two plus a small tie-breaker called a QDevice), with latency between them under 5 ms, and Proxmox recommends a separate network card for cluster traffic. Each of our servers has one public port, and we do not sell a private network between servers, so cluster traffic shares that port. The firewall file above is written for one server: before adding others, put every node's address in the management set and allow UDP 5405-5412 from them, with everything else still closed. We look after the hardware, the network, the console and reinstalls. Proxmox itself and your VMs are yours to run, and a custom build can add memory or disks to the same machine later.

Questions people ask

How much RAM does a Proxmox server need?

Start from 2 GB for Proxmox and add the memory of every VM you plan to run. If the VMs live on ZFS, add about 1 GB per terabyte stored, and remember ZFS wants at least 8 GB on its own. Five 8 GB VMs on 4 TB of ZFS data come to roughly 46 GB by our sum, which points to a 64 GB machine.

Can I try Proxmox on 1 GB of memory?

Proxmox lists 1 GB plus guest memory as the minimum, but only for evaluation, and says not to use that in production. Real hosts start at 2 GB for Proxmox plus whatever your VMs need.

Is Proxmox really free on your servers?

Yes. You choose it with one click when you order, and there is no licence line and no per-socket charge. A Proxmox subscription stays optional and is bought from Proxmox directly; without it, use the no-subscription package source.

Can every VM have its own public IP address?

Yes. VMs can be bridged with their own MAC and public IPv4, because our switch ports do no MAC binding. Your server includes one IPv4 address and IPv6; extra IPv4 are added on the order form, up to the limit of the line.

Should I use ZFS or the RAID card?

Pick one per set of disks. Proxmox rules out ZFS and Ceph on disks behind a RAID card. Take the controller's RAID 1 if you want simplicity, or a ZFS mirror or raw disks if you want ZFS snapshots and checksums.

What happens if I lock myself out with the firewall?

Every rack line that carries Proxmox has an HPE iLO or Dell iDRAC console, which shows the server's screen and power button without needing the network. Log in there, fix the rule in /etc/pve/firewall/cluster.fw, and SSH comes back.