{ lib, ... }:

{
  boot = {
    isContainer = true;

    loader = {
      grub.enable = false;
      systemd-boot.enable = false;

      # LXC containers share the host kernel — Proxmox starts them by exec'ing
      # /sbin/init directly, no bootloader/initrd involved. Without this, that
      # file doesn't correctly launch the current generation, so even a
      # correctly-installed system can fail to come up after reboot.
      initScript.enable = true;
    };
  };

  networking = {
    # boot.isContainer disables services.udev (see nixpkgs'
    # virtualisation/container-config.nix), and NetworkManager depends on a
    # running udevd to enumerate/classify devices. That leaves NM unable to
    # reliably manage the container's veth interface, which is what broke
    # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
    # kernel over rtnetlink directly and doesn't have that dependency.
    networkmanager.enable = lib.mkForce false;
    useNetworkd = true;

    # container-config.nix also defaults this to true, which assumes a
    # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
    # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
    # forces this false for the same reason), so leaving it true silently
    # breaks DNS instead of falling back to networkd/DHCP-provided servers.
    useHostResolvConf = lib.mkForce false;
  };
}