Proxmox — Reset LXC Container Root Password

You locked yourself out of an LXC container and don't have the password. As long as you have access to the Proxmox host, this takes under a minute — no rescue mode, no rebooting, no old password required.

Why This Works

An LXC container is not a virtual machine. It has no kernel of its own — its processes run directly on the Proxmox host's kernel, isolated through namespaces. The consequence: root on the host controls every container completely. Commands like pct enter spawn a shell directly inside the container's namespaces, skipping the container's login process — and with it, password authentication — entirely.

This is by design, not a vulnerability: it is the same trust relationship as having physical access to a server. It is also worth remembering the other way around — anyone with root on your Proxmox host owns every container on it.

Pre-requisites

Root access to the Proxmox host (via SSH or the web UI's node shell)
The container must be running
The container ID

If you don't know the ID, list all containers from the host shell:

pct list

VMID       Status     Lock         Name
301        running                 mycontainer
302        running                 adguard

In the web UI, the ID is the number next to the container name in the left sidebar, e.g. mycontainer (301).

Reset the Password

From the Proxmox host shell, enter the container (replace 301 with your container ID):

pct enter 301

The prompt changes to a root shell inside the container — no password was asked, for the reason explained above. Now reset the password:

passwd

To reset a non-root user's password instead:

passwd username

Enter and confirm the new password, then leave the container:

exit

Log in with the new credentials to confirm — via the container's console in the web UI, or SSH if the container runs an SSH server.

The LXC Access Methods, Compared

pct enter is one of three ways into a container from the host — knowing the other two helps when one of them misbehaves:

Command	What it does	Use when
`pct enter 301`	Root shell inside the container, no login	Day-to-day admin from the host, password resets
`pct exec 301 -- <command>`	Run a single command inside, non-interactive	Scripting across containers
`pct console 301`	Attach to the container's console (login prompt!)	Network is broken and you want to see boot/getty output

Note the difference: pct console connects you to the container's terminal and does present a login prompt — it will not help with a lost password. pct enter bypasses login. (lxc-attach -n 301 is the underlying LXC tool that pct enter wraps; both work on a Proxmox host.)

Common Issues

Symptom	Cause	Fix
`Configuration file ... does not exist` or attach fails	Container is stopped	`pct start 301`, then retry
`passwd: Authentication token manipulation error`	Container filesystem mounted read-only	Inside the container: `mount -o remount,rw /`, then `passwd` again
New password works in console but SSH still refuses	SSH blocks password login	Check `PasswordAuthentication` in the container's `/etc/ssh/sshd_config`, or use SSH keys instead
Stuck inside `pct console`	Console needs an escape sequence to exit	Press `Ctrl`+`A` then `Q`