LVM snapshot-as-volume-chain means a newly created qcow2 image can reuse old guest data after VM deletion because LVM snapshots don’t zero out stale blocks. It’s a pain, but the fix is simple: zero the volume before you create the new image.
Why this happens
LVM snapshots use copy-on-write. When you delete a VM, the snapshot chain still holds the old data. If you create a new qcow2 on that same snapshot, the file system sees the old blocks as free space, but the data is still there. So the new image can end up with remnants of the old guest.
It’s not a Proxmox bug, it’s just how thin provisioning works. Annoying, I know.
The fix
Before you create the new qcow2, zero out the volume. That writes zeros to all blocks, so any old data is gone. Here’s how on Proxmox:
lvremove -f /dev/pve/vm-100-disk-0
lvcreate -L 10G -n vm-100-disk-0 pve
# zero the volume
dd if=/dev/zero of=/dev/pve/vm-100-disk-0 bs=1M status=progress
Then create your qcow2 as usual. The old data won’t bleed through.
If you’re using thin LVM, you can also use blkdiscard to discard blocks, but zeroing is more reliable across different storage backends.
My take
Honestly, this is one of those things that catches you off guard. You delete a VM, create a new one, and suddenly you see old files. It’s not a security hole unless you’re paranoid, but it’s sloppy. Just zero the volume and move on.
Related: Proxmox LVM Cache Thin Provisioning — Make It Actually Work.
