resource "proxmox_virtual_environment_container" "cattle" {
  for_each = var.lxc_inventory

  node_name    = each.value.node
  vm_id        = each.key
  unprivileged = false # Changed to match your .conf reality

  # This allows Docker to run inside
  features {
    nesting = true
    keyctl  = true # Added because 116.conf has this
  }

  initialization {
    hostname = each.value.hostname
    user_account {
      password = var.lxc_root_password
    }
    ip_config {
      ipv4 {
        address = each.value.ip
        gateway = each.value.gw
      }
    }
    # Matching your 1.1.1.1 DNS
    dns {
      servers = ["1.1.1.1"]
    }
  }

  operating_system {
    template_file_id = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
    type             = "debian"
  }

  # ... cpu, memory, disk, network blocks same as before ...

  lifecycle {
    # This is the magic. It stops the "Destroy" for these specific things.
    ignore_changes = [
      operating_system[0].template_file_id,
      initialization[0].user_account[0].password,
    ]
  }
}