Linux Containers (LXC) is a userspace interface for operating system-level virtualization features in the mainline Linux kernel, such as kernel namespaces and control groups (cgroups). These allow multiple distinct user space instances to be run on a single kernel.

learn more… | top users | synonyms

1
vote
0answers
15 views

Dedicate USB hardware to LXC container

Reading the LXC documentation, it seems possible to dedicate the physical network port eth2 to an LXC container with config something like: lxc.network.type = phys lxc.network.link = eth2 I'm ...
1
vote
0answers
13 views

How do I conserve the userns UID/GID mappings when archiving an LXC guest?

I'd like to archive an existing LXC container that has been configured to run as unprivileged LXC container (see this question). How can I conserve all the file system meta-data that is used to store ...
1
vote
1answer
32 views

lxc-start: No cgroup mounted on the system

Trying to start a Linux container, I get the following: lxc-start: No cgroup mounted on the system OS is Debian 7.
4
votes
0answers
28 views

Migrate an unprivileged LXC container between users

I have an Ubuntu 14.04 server installation which acts as an LXC host. It has two users: user1 and user2. user1 owns an unprivileged LXC container, which uses a directory (inside ...
9
votes
1answer
297 views

Linux: Is there handy way to exec a program binding it to IP-address of choice?

In FreeBSD 4.9 it was very easy to accomplish with just a single command like jail [-u username] path hostname ip-number command if path was / you had running just the same program as usual but ...
0
votes
2answers
50 views

No qemu-debootstrap in Arch Linux

I just installed lxc in Arch Linux, but the qemu-debootstrap binary seems missing, This command sudo lxc-create -n test -t ubuntu -P /run/shm/1 complains about that. I couldn't find it with either ...
0
votes
0answers
103 views

Can a process running in a linux container communicate with another process running on the host OS via IPC?

I have 2 processes A and B. Currently, both A and B are running on the same OS (RHEL6.2) and the processes can intercommunicate via TCP sockets. My objective is to run process B in a Linux Container ...
0
votes
1answer
43 views

How root can make sure that this time sudo will not prompt for password a specific user?

I am writing a script, that will setup lxc on the host, and then configure a container. I want this script to be unattended. After the container is created and run, there is a moment, when I want to ...
8
votes
1answer
545 views

What makes systemd-nspawn still “unsuitable for secure container setups”?

This is stated in the man page for systemd-nspawn Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security ...
1
vote
2answers
160 views

Do all Linux processes write EOF to stdout when they are terminating/have finished terminating?

I'm having trouble with sending shutdown -h 0 to a lxc Debian container (i.e. executing this command in the lxc) with with the python pexpect module (in a python script). In this module the user can ...
0
votes
0answers
470 views

Unable to mount cgroup

I've been searching for a solution to this problem but none was working. I would like to start my LXC container but i need to mount cgroup before. [root@stag-devCentOs ~]# lxc-start -n debianLxc ...
2
votes
1answer
537 views

USB passthrough for LXC containers

PROBLEM: So I've been trying to get a usb device (primesense - the OEM reference for the Kinect) to passthrough to an LXC container so I can develop without worrying about polluting my stable system ...
3
votes
1answer
128 views

Is it possible to run a 10.04 or 12.04 or earlier LTS containerized under LXC or Docker on Trusty?

Is it possible to have a vanilla installation of Ubuntu 14.04 (Trusty) and run inside it containerized older Ubuntu versions that originally came with older kernels? For example for 12.04 I'd assume ...
1
vote
0answers
82 views

MIT Shared Memory Extension or MIT-SHM over ssh

I successfully created a privileged lxc archlinux container on an archlinux host with lxc. I set up a static ip via dnsmasq and ssh into it and I use xauth to forward X11. I then call programs like ...
0
votes
0answers
240 views

What problems to expect when running Docker with libcontainer and lxc on the same host?

Simple question. Can I use the lxc userland tools and docker with its new "native" libcontainer in parallel on the same host? I can see how for some scenarios I could benefit from the docker way of ...
4
votes
1answer
403 views

X and xdotool in LXC instead of KVM

So far I am using various xautomation/xdotool scripts in a KVM virtual machine (linux guest) in order to let them do their work and let me work uninterruptedly. I am using a VirtIO disk, but still the ...
3
votes
0answers
87 views

Host system keyboard layout changes when starting LXC container

I successfully created an archlinux container on an archlinux host with lxc. However, whenever I start a container via lxc-start -n GUESTNAME the keyboard layout changes to the default ...
1
vote
1answer
84 views

Is an LXC guest load average the same as the host's load average?

If I run top on the guest, the load average values seem to be exactly the same as running top on the host. Is a Docker (LXC) guest's load average the same as the host's load average?
2
votes
1answer
57 views

Is there a way to share a service listening on loopback of the host with an LXC guest?

I'm trying to provide a service to the LXC guests, but do not want to expose it from the host. I also don't want to put up firewall rules for the service, so loopback appears to be the most ...
4
votes
1answer
428 views

LXC container to use “virtual” interface from host (namespace semantics)

So according to the documentation on the Ubuntu LXC documentation the following statement can be found at the time of this writing: A NIC can only exist in one namespace at a time, so a physical ...
4
votes
2answers
936 views

AppArmor profiles in Docker/LXC

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be ...
2
votes
1answer
936 views

Building unprivileged (userns) LXC container from scratch, by migrating a privileged container to be unprivileged

How can I build a privileged LXC (1.0.3) container (that part I know) and then migrate it successfully to be run unprivileged? That is, I'd like to debootstrap it myself or adjust the lxc-ubuntu ...
7
votes
1answer
3k views

Linux LXC vs FreeBSD jail

Are there any notable differences between LXC (Linux containers) and FreeBSD's jails in terms of security, stability & performance? On first look, both approaches look very similar.
3
votes
2answers
192 views

replicate and isolating user environments on the fly

I will be using Ubuntu Linux for this project. For training of a particular application at a conference I need: To have each student be able to ssh into the same user account on a server Upon each ...
7
votes
2answers
2k views

Application updates inside of Docker containers?

Typically on a server, automatic updates of security-related patches are configured. Therefore, if I'm running MySQL 5.5 and a new security patch comes out, Ubuntu Server will apply the upgrade and ...
9
votes
1answer
902 views

User permissions inside and outside of LXC containers?

I'm running some services inside of Docker LXC containers on my server and I'm beginning to actually do serious things with them. One thing I'm not clear on is how user permissions work inside and ...
2
votes
1answer
1k views

Creating a Vagrant box with Docker installed

I'm trying create a nice playground for Docker in Vagrant based on Vagrant's precise64 box. (Code is available at GitHub: rfkrocktk/docker-vagrant-playground) Here's my Puppet provisioning ...
0
votes
2answers
818 views

WordPress installation with Docker

I have to migrate my WordPress installation to my own server in order to get SSL working properly. (It was originally on GoDaddy shared hosting, which doesn't allow for external SSL cert ...
2
votes
1answer
369 views

How to automatically launch a lxc container on ssh connection?

I'm attempting to setup a system that automatically creates a new sandbox on a ssh login to use as a temporary jump box into my server. So to do this I was wonder how to setup lxc to spin up a new ...
0
votes
1answer
218 views

SSH to Linux Container from Other Machine

I am trying to learn about Linux Containers and this is my first encounter with servers, ssh and many other things that I do not know the terms yet. I create five different containers and authorized ...
8
votes
4answers
5k views

Why doesn't docker container start at boot w/ upstart script on Ubuntu 12.04?

Using instructions for Docker auto-start on Linode VPS running Ubuntu 12.04 and Docker 0.8.1, the specified container does not start on reboot. Once booted, I am able to ~$ sudo start [service-name] ...
2
votes
1answer
75 views

Can you use LXC through C?

I want to use LXC to 'container' plugins my application is loading. Am I able to do this through C? I have been Googling a lot about it, but there don't seem to be any headers, only scripts that can ...
2
votes
0answers
188 views

Vagrant-lxc container not starting

Firstly I'd like to say that I'm new to LXC and I may have some problems getting the right idea of how the things should work. The thing is I'm trying to start a previously download vagrant-lxc box ...
1
vote
0answers
175 views

Making an Android container with Ubuntu 12.04 on the Samsung ARM Chromebook : initrd file not found

I'm trying to run Android as guest OS with LXC containers on Ubuntu 12.04 LTS on the ARM Chromebook, reading this tutorial. At some point of the tutorial, it says: Then get the initrd for your ...
2
votes
1answer
160 views

How to move process from one namespace to other?

This question is similar to my question about how to list namespaces. So in addtition, I'd like to know some information about moving processes from one namespace to other? E.g. I have processes of ...
0
votes
0answers
39 views

LXC and deployment of web application code

l'm currently in the learning stage of using LXC. Now I'm at the point where I'm ready to deploy my application (written in PHP) to my containers. I've been using DeployHQ (deploying over ssh 2) to ...
3
votes
0answers
160 views

LXC with both GUI apps and snapshots on unmodified Fedora kernel

I am looking for a tool or library to run LXC that supports: running X applications conveniently snapshotting root filesystems (using a Fedora system with an unmodified kernel), so that I don't have ...
7
votes
1answer
569 views

How to list namespaces in Linux?

Is there any method in Linux to list all namespaces on the running host? I need to check namespaces for particular processes (e.g. processes running in LXC-container and all other processes on the ...
0
votes
2answers
187 views

ARM LXC Container template

I've been trying to run LXC on an ARM architecture (arm6l - Raspberry Pi) but with no luck. After some research, I found that maybe trying to run a x86 template on my ARM was causing the problem (bash ...
1
vote
0answers
86 views

Containers running on ARM

I've been doing some research and decided to implement OpenVZ since it allows each container to be isolated from other containers, unlike LXC. However, OpenVZ is still not supported for ARM ...
0
votes
1answer
137 views

Container lockdown

I was reading about LXC vs OpenVZ and was wondering if this issue has already been solved in more recent updates: OpenVZ has done quite a good job at this, but LXC still has issues here. Even ...
2
votes
1answer
1k views

Bridged network with different subnets

I want to virtualize my webserver with lxc/virsh for this reason, I want to pass a IP to the lxc container. But my IPs are from different subnets, what I tried (but not successfully): Virsh network: ...
6
votes
2answers
1k views

Executing a command inside a running LXC

I want to execute a command inside an existing lxc without going through the regular Linux init. lxc-execute command is for that I guess but I get the following error when I run this command on my ...
2
votes
1answer
1k views

How to assign an additional IP/hostname to a chrooted environment?

While I can simply have e.g. sshd in a chroot environment ("chrootenv") listen to a different port than its parent ("parentenv"), it would be more convenient to have that environment have an ...
2
votes
1answer
186 views

Manage LXC containers from host in puppet

Is there any puppet modules for manage nodes in LXC containers from local host? E.g.: I have host with 50 LXC containers and I want to manage all those containers from host directly, not from another ...
12
votes
1answer
632 views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
7
votes
2answers
708 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
3
votes
1answer
2k views

LXC migrate between hosts

I had setup a testsystem with LXC and installed a webserver etc. that all was not the problem. But now I want to swich to another host system also I compressed /var/lib/lxc/webserver and copied it to ...
4
votes
3answers
591 views

Can LXC be used to jail instances of an installed browser?

Is it possible to use LXC on a desktop system to confine browsers and other pieces of software that have in the past been shown to be prone to certain kinds of exploits. So what I want to achieve is ...
2
votes
1answer
579 views

Which one is lighter security- and CPU-wise: LXC versus UML

I'm trying to decide between "jailing" certain applications and I know the trade-offs of KVM versus LXC and how I can use them both. Lately I came across UML (User-Mode Linux) again and was wondering ...