I’ve done my research on that, and from what I gathered, LXCs share the host kernel, meaning: if the LXC is compromised, so is the host system. So if I go with Proxmox, I’ll probably swallow the (somewhat) larger overhead of running a full VM.