Running a fanless industrial computer as both a software router and a Docker host — this is a demand that keeps growing in retail stores, workshops, and edge sites. One device, one power feed; the router, firewall, and application server all live in a single box. The setup is not complicated, but a few points are worth settling up front.

1. Settle the architecture first: virtualized routing is an x86 world

OPNsense is built on FreeBSD, and Proxmox VE on Debian. Both officially target x86_64. The selection logic is therefore straightforward:

• To run Proxmox + OPNsense as a virtualized firewall on an industrial computer, choose an x86 model;

• For Docker containers and edge applications only, an ARM model works just as well.

Getting the direction right first saves a lot of pain later.

2. Port count dictates the network topology

The most overlooked part of virtualized routing is port planning. A single box typically needs to cover:

• 1 WAN port for the upstream network;

• 1 LAN port to the switch; the management interface can share the LAN port;

• 1 more port for passthrough or backup.

The PUSR USR-EC500 comes with 5 Gigabit ports, leaving WAN, LAN, management, and backup each in its own place. A NIC can even be passed through to OPNsense so the firewall directly owns physical ports. The USR-EC300 and USR-EC100 have 2 ports; a "single LAN + VLAN sub-interfaces" setup can still work, though the configuration is more involved.

3. The deployment path

• Install Proxmox: boot from a USB drive. The EC series uses a standard AMI UEFI BIOS, no different from a regular PC. The bundled 128GB wide-temperature SSD is enough for the host plus two VMs.
• Create the OPNsense VM: start with 2 cores and 2GB RAM. Pass the WAN NIC through, and bridge the LAN.
• Put Docker in an LXC container: Proxmox has native LXC (CT) support. Running Docker inside a container saves memory compared with another VM layer.
• Enable power-on auto boot: the EC series supports power-on after a power restore, so one outage does not mean a prolonged network loss at an unattended site.

4. What to check on the hardware side

• RAM: start at 8GB; go straight to 16/32GB if the budget allows. Once Docker services pile up, memory runs out before CPU does.

• Power: around 15W at idle, comparable to a router; the cost of running 24/7 is negligible.

• Environment: all-aluminum fanless enclosure, -20~60℃ operating temperature, IP50 dust protection, ESD protection — things ordinary mini PCs do not offer.

• Certifications: 3C, CE, FCC, ROHS, WEEE among others; several PUSR devices also pass the EU EN 18031 (RED) cybersecurity standard.

5. The non-virtualized alternative: ARM gateways running Docker

If the need is edge computing plus containers, without touching virtualized firewalls, ARM options are more economical:

• USR-EG628: RK3562J quad-core A53, ships with Ubuntu and Node-RED, Docker installation supported;

• USR-EG928A: RK3588J octa-core with a 6 TOPS NPU — AI inference on top of Docker;

• USR-M300: dual-core gateway with Modbus protocol conversion, a fit for on-site data acquisition.

These machines run Docker applications without issue. But OPNsense has no official ARM build, and Proxmox's ARM support is still experimental, so virtualized routing remains an x86 world for now.

The selection logic in one line: for virtualized routing, go with an x86 multi-port model — the USR-EC500 is the least hassle; for containers and edge computing only, an ARM gateway is enough. One industrial computer doing the work of two devices, provided the architecture is chosen right.