Running Mailcow inside a TrueNAS Incus LXC

Apps and Virtualization
1

Running Mailcow inside a TrueNAS Incus LXC

I just finished standing up a full Mailcow stack inside a Debian Trixie LXC on my TrueNAS system, and it’s working beautifully. :tada:

Setup highlights:

  • Host: TrueNAS SCALE with Incus
  • Guest: Debian Trixie LXC (static IP on my LAN)
  • Storage: mounted my /mnt/vega/docker/stacks/mailcow dataset into the container at /mailcow so all configs, mail, and certs live on ZFS
  • Installed Docker + Docker Compose inside the LXC
  • Pulled and launched Mailcow as usual (docker compose up -d)

Working services so far:

  • Postfix (SMTP on 25/465/587)
  • Dovecot (IMAP/POP3 on 993/995/143/110)
  • SOGo (webmail/calendar/contacts)
  • ACME auto-renewal with Let’s Encrypt
  • Rspamd + ClamAV for filtering

Why I like this approach:

  • Keeps Mailcow totally isolated from my host
  • ZFS dataset makes backups and snapshots super easy
  • Certificates, mailboxes, and configs persist outside the container lifecycle
  • Easier to nuke/redeploy the LXC if something breaks, without touching my mail data

How I did it (5 steps):

  1. Create the LXC:
incus launch images:debian/trixie mailcow
incus config device add mailcow mailcowdata disk source=/mnt/vega/docker/stacks/mailcow path=/mailcow
incus config device add mailcow eth0 nic nictype=bridged parent=br0 name=eth0
  1. Gave it a static IP (192.168.1.8 in my case).
  2. Install Docker inside the LXC:
apt update && apt upgrade -y
apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
  1. Verified with docker run hello-world.
  2. Prepare Mailcow:
cd /mailcow
git clone https://github.com/mailcow/mailcow-dockerized .
cp mailcow.conf.example mailcow.conf
./generate_config.sh
  1. Bring it up:
docker compose pull
docker compose up -d
  1. Finish setup:
  • Pointed DNS (A + MX + SPF, DKIM, DMARC) at my static IP
  • Verified ACME pulled a Let’s Encrypt cert automatically
  • Logged into the admin UI and reset the default password

So far, I’ve been able to connect Thunderbird and iOS Mail to it, and TLS certs are valid with Let’s Encrypt.

2 Likes
2

Hopefully it survives the change from incus to libvirt…

1 Like
3

Haha, if it survives the Spamhaus lists, ClamAV updates, and my questionable DNS skills, I’m pretty sure a switch from Incus to libvirt won’t kill it. Mailcow’s basically cockroach-grade at this point. :cow2::mailbox_with_mail:

…though watch me eat these words in 6 months when it refuses to start on a random Tuesday. :sweat_smile:

4

I would say changing the whole lxc backend is somewhat different from dns problems and anti-virus scans and if iX somehow butchers the migration from incus to libvirt (granted that there will be an automatic migration) you may have to redo your whole config…

1 Like
5

Fair point — I guess I’ll keep a backup of my config handy. Worst case, if the migration eats itself, I’ll just pretend I meant to rebuild everything for “fun.” :sweat_smile:

1 Like