{ lib, ... }:

{
  boot.isContainer = true;

  boot.loader.grub.enable = false;
  boot.loader.systemd-boot.enable = false;

  # LXC containers share the host kernel — Proxmox starts them by exec'ing
  # /sbin/init directly, no bootloader/initrd involved. Without this, that
  # file doesn't correctly launch the current generation, so even a
  # correctly-installed system can fail to come up after reboot.
  boot.loader.initScript.enable = true;

  # boot.isContainer disables services.udev (see nixpkgs'
  # virtualisation/container-config.nix), and NetworkManager depends on a
  # running udevd to enumerate/classify devices. That leaves NM unable to
  # reliably manage the container's veth interface, which is what broke
  # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
  # kernel over rtnetlink directly and doesn't have that dependency.
  networking.networkmanager.enable = lib.mkForce false;
  networking.useNetworkd = true;

  # container-config.nix also defaults this to true, which assumes a
  # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
  # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
  # forces this false for the same reason), so leaving it true silently
  # breaks DNS instead of falling back to networkd/DHCP-provided servers.
  networking.useHostResolvConf = lib.mkForce false;
}