Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to provide a service to the LXC guests, but do not want to expose it from the host. I also don't want to put up firewall rules for the service, so loopback appears to be the most straightforward solution.

Is there a way to have a service listening on lo (loopback) shared with LXC guests, e.g. similar to bind-mounting directories into place?

share|improve this question
What service are you talking about? What's your lxc network configuration? – mreithub May 17 '14 at 19:09
@mreithub: In this particular case I am talking about apt-cacher-ng, but I intend to add others (like the postfix instance running on the host). Generally I am only interested in TCP-based services. – 0xC0000022L May 17 '14 at 20:02
up vote 3 down vote accepted

There are different ways to achieve your goal.

If the guests share a virtual network (i.e. are not just bridged to the physical interface) it's easy. Just tell your services to listen on that interface - or create a new guest and let that one host the service.

If the guests are bridged to ethX, you might still want to consider creating a virtual guest+host-only interface as that kind of encapsulation makes sense for all kinds of services (internal mail-server, any database server, local DNS, etc.)

(And obviously there's the way you already discarded for some reason: firewall rules)

As for lo: each lxc host has its own, and that's good imo

My lxc guests all share a virtual interface and for each service that should be exposed to the public internet, I create port forwarding rules on the host's iptables. And I try to run as few services as possible on the host itself. That way there's little to no rist accidentally exposing any services.

And for the sake of completeness, here's my config:

My interfaces file (debian stable):

auto br0
iface br0 inet static
    bridge_maxwait 0
    bridge_fd 0
    bridge_ports dummy0
    address 192.168.x.1
    # if there are lxc clients that need a public IP, add something like this (a.b.c.d being the public IP) and set the client's `lxc.network.ipv4` config parameter to the same address:
    #post-up route add a.b.c.d dev br0

The relevant part of the client config:

lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0
lxc.network.veth.pair = lxc-apache # each client gets their own .pair name
lxc.network.ipv4 = 192.168.x.y/24 # ... and of course their own address
share|improve this answer
Nothing is wrong with this, it's just a Debian/Ubuntu only method, at least wrt the interfaces file. – slm May 17 '14 at 22:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.