Bealers.com

evergreen · planted · tended

Coolify on Proxmox when your LAN is 10.x

All notes, by stage

January 2026: installing Coolify in an LXC container on Proxmox, on a LAN that uses 10.0.x.0/24 VLANs. The install worked. Then my laptop on one VLAN couldn't reach the container on another.

The problem

Coolify's Docker setup uses the 10.0.0.0/8 address pool, and its coolify network came up on 10.0.x.0/24, the same range as one of my VLANs. Docker then routed that traffic into its own bridge instead of out to the LAN.

What didn't work

  • Setting DOCKER_ADDRESS_POOL_BASE and DOCKER_ADDRESS_POOL_SIZE for the installer. The config files were updated; the network still got the wrong subnet.
  • A docker-compose.custom.yml override. Not honoured for the main coolify network.
  • default-address-pools in /etc/docker/daemon.json plus a Docker restart.
  • Deleting Docker's network cache (local-kv.db). It was recreated with the wrong subnet.

What did

Coolify's installer only creates the network if it doesn't exist:

if ! docker network inspect coolify >/dev/null 2>&1; then
    docker network create --attachable --ipv6 coolify

So create it yourself first, on a range nothing else uses, then install:

docker network create --attachable --subnet=10.99.1.0/24 coolify
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

On a box where it's already wrong, stop the containers and docker network rm coolify before creating it again.

Keep default-address-pools in daemon.json pointed at the same spare range too, so the networks Coolify creates for each app don't land on your LAN either.

After every update

Coolify updates itself. Check the network afterwards:

docker network inspect coolify | grep Subnet

If it's back on 10.0.x.0/24, repeat the fix.

Two more things that caught me

  • Coolify manages Docker by SSHing into its own host. After install, add the public half of the key it generated in /data/coolify/ssh/keys/ to root's authorized_keys, then press "Check again" in the onboarding screen.
  • Inter-VLAN traffic needs an explicit firewall rule for any device that has to reach services on the server VLAN.

Linked from (2)