Linux Containers (LXC) is a userspace interface for operating system-level virtualization features in the mainline Linux kernel, such as kernel namespaces and control groups (cgroups). These allow multiple distinct user space instances to be run on a single kernel.

learn more… | top users | synonyms

34
votes
1answer
22k views

Linux LXC vs FreeBSD jail

Are there any notable differences between LXC (Linux containers) and FreeBSD's jails in terms of security, stability & performance? On first look, both approaches look very similar.
21
votes
2answers
11k views

What is the difference between Docker, LXD, and LXC [closed]

What is the difference between Docker, LXD, and LXC. Do they offer the same services or different.
21
votes
1answer
6k views

User permissions inside and outside of LXC containers?

I'm running some services inside of Docker LXC containers on my server and I'm beginning to actually do serious things with them. One thing I'm not clear on is how user permissions work inside and ...
18
votes
5answers
19k views

LXC: How do I mount a folder from the host to the container?

I'm trying to mount a folder on the host to an LXC container. The host has a folder /mnt/ssd/solr_data created (this is currently on the root filesystem, but later I'll mount an SSD drive there, so I'...
15
votes
3answers
26k views

How to configure external IP addresses for LXC guests?

I'm exploring the LXC features in Ubuntu 12.04 and I really want to set up a network like this: client1: 192.168.56.101/24 lxc-host: 192.168.56.102/24 guest1 192.168.56.201/24 guest2 192....
15
votes
3answers
2k views

What are benefits and downsides of unprivileged containers?

The technical explanation of what is unprivileged container is quite good. However, it is not for ordinary PC user. Is there a simple answer when and why people should use unpriviliged containers, and ...
15
votes
2answers
7k views

Executing a command inside a running LXC

I want to execute a command inside an existing lxc without going through the regular Linux init. lxc-execute command is for that I guess but I get the following error when I run this command on my ...
15
votes
5answers
21k views

Why doesn't docker container start at boot w/ upstart script on Ubuntu 12.04?

Using instructions for Docker auto-start on Linode VPS running Ubuntu 12.04 and Docker 0.8.1, the specified container does not start on reboot. Once booted, I am able to ~$ sudo start [service-name] ...
15
votes
1answer
5k views

What makes systemd-nspawn still “unsuitable for secure container setups”?

This is stated in the man page for systemd-nspawn Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security ...
14
votes
1answer
3k views

What is an unprivileged LXC container?

What does it mean if a Linux container (LXC container) is called "unprivileged"?
14
votes
2answers
1k views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
10
votes
1answer
621 views

Linux: Is there handy way to exec a program binding it to IP-address of choice?

In FreeBSD 4.9 it was very easy to accomplish with just a single command like jail [-u username] path hostname ip-number command if path was / you had running just the same program as usual but ...
10
votes
2answers
4k views

AppArmor profiles in Docker/LXC

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be ...
9
votes
2answers
4k views

Fast X for LXC guest on localhost?

How can I run X apps inside an LXC container efficiently? ssh -Y guest is too slow - there is no graphics acceleration with ssh -Y - everything has to travel over the virtual network with the ...
9
votes
1answer
3k views

How to list namespaces in Linux?

Is there any method in Linux to list all namespaces on the running host? I need to check namespaces for particular processes (e.g. processes running in LXC-container and all other processes on the ...
8
votes
2answers
5k views

Application updates inside of Docker containers?

Typically on a server, automatic updates of security-related patches are configured. Therefore, if I'm running MySQL 5.5 and a new security patch comes out, Ubuntu Server will apply the upgrade and ...
8
votes
1answer
4k views

userns container fails to start, how to track down the reason?

When creating a userns (unprivileged) LXC container on Ubuntu 14.04 with the following command line: lxc-create -n test1 -t download -- -d $(lsb_release -si|tr 'A-Z' 'a-z') -r $(lsb_release -sc) -a $(...
8
votes
2answers
2k views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
7
votes
3answers
5k views

How to create user cgroups with systemd

I use unprivileged lxc containers in Arch Linux. Here are the basic system infos: [chb@conventiont ~]$ uname -a Linux conventiont 3.17.4-Chb #1 SMP PREEMPT Fri Nov 28 12:39:54 UTC 2014 x86_64 GNU/...
7
votes
2answers
853 views

replicate and isolating user environments on the fly

I will be using Ubuntu Linux for this project. For training of a particular application at a conference I need: To have each student be able to ssh into the same user account on a server Upon each ...
7
votes
2answers
2k views

What is a Linux container and a Linux hypervisor?

I looked at the stackexchange site but couldn't find anything. I looked at the wikipedia entry on Linux container https://en.wikipedia.org/wiki/LXC and as well as hypervisor https://en.wikipedia.org/...
7
votes
1answer
5k views

docker - how to run x desktop in a container?

I'm trying to set up my Linux machine to run multiple guest OSes, one of those being a Windows VM, and another a Linux container. The goal here is to prevent me from messing up the host system, while ...
6
votes
2answers
1k views

Is it possible to run a 10.04 or 12.04 or earlier LTS containerized under LXC or Docker on Trusty?

Is it possible to have a vanilla installation of Ubuntu 14.04 (Trusty) and run inside it containerized older Ubuntu versions that originally came with older kernels? For example for 12.04 I'd assume ...
6
votes
4answers
2k views

Can LXC be used to jail instances of an installed browser?

Is it possible to use LXC on a desktop system to confine browsers and other pieces of software that have in the past been shown to be prone to certain kinds of exploits. So what I want to achieve is ...
6
votes
1answer
3k views

How do I disable udevd in systemd?

I'm trying to boot a Fedora Rawhide LXC container from a Fedora 16 host, and it's not working - systemd just keeps dropping into emergency mode. Because udevd doesn't work in LXC containers, I thought ...
6
votes
1answer
1k views

Noninteractive script running over ssh is interrupted as apt-get finishes

When I run the following non interactive script on Ubuntu Server 13.04 it's interrupted when lxc-docker package finishes installation. Script : ssh -o StrictHostKeychecking=no -t -t -i $CERT $USER@...
5
votes
2answers
4k views

Building unprivileged (userns) LXC container from scratch, by migrating a privileged container to be unprivileged

How can I build a privileged LXC (1.0.3) container (that part I know) and then migrate it successfully to be run unprivileged? That is, I'd like to debootstrap it myself or adjust the lxc-ubuntu ...
5
votes
2answers
3k views

How to assign an additional IP/hostname to a chrooted environment?

While I can simply have e.g. sshd in a chroot environment ("chrootenv") listen to a different port than its parent ("parentenv"), it would be more convenient to have that environment have an ...
5
votes
1answer
4k views

LXC migrate between hosts

I had setup a testsystem with LXC and installed a webserver etc. that all was not the problem. But now I want to swich to another host system also I compressed /var/lib/lxc/webserver and copied it to ...
5
votes
1answer
1k views

Which one is lighter security- and CPU-wise: LXC versus UML

I'm trying to decide between "jailing" certain applications and I know the trade-offs of KVM versus LXC and how I can use them both. Lately I came across UML (User-Mode Linux) again and was wondering ...
5
votes
2answers
974 views

How can I use Skype with lxc?

Under Scientific-linux? https://en.wikipedia.org/wiki/LXC I just want to separate Skype, because I don't trust it. We are using it only to call/chat with people, no file transfers!
5
votes
1answer
2k views

LXC container to use “virtual” interface from host (namespace semantics)

So according to the documentation on the Ubuntu LXC documentation the following statement can be found at the time of this writing: A NIC can only exist in one namespace at a time, so a physical ...
5
votes
1answer
267 views

Subordinate GIDs/UIDs with LXC and userns for unprivileged user?

When using userns (via LXC in my case), you assign a range of subordinate GIDs and UIDs to an unprivileged user. See for resources: subuid(5), subgid(5), newuidmap(1), newgidmap(1), user_namespaces(7)....
5
votes
1answer
770 views

Migrate an unprivileged LXC container between users

I have an Ubuntu 14.04 server installation which acts as an LXC host. It has two users: user1 and user2. user1 owns an unprivileged LXC container, which uses a directory (inside /home/user1/.local/......
5
votes
1answer
251 views

Host system keyboard layout changes when starting LXC container

I successfully created an archlinux container on an archlinux host with lxc. However, whenever I start a container via lxc-start -n GUESTNAME the keyboard layout changes to the default us-...
5
votes
2answers
1k views

SquashFS image as rootfs in LXC

Is it possible to use a SquashFS filesystem as an LXC rootfs? I can mount an ext3 image as a rootfs just by setting lxc.rootfs to the filename, but if it's any other type of image, lxc-start just says ...
4
votes
3answers
1k views

lxc: running virtualbox inside a container

I've install virtualbox inside an lxc container. However when I try to start a VM I get the message: kernel driver not accessible (rc=1909) ....permission problem with /dev/vboxdrv. This obviously ...
4
votes
2answers
154 views

Reference documentation for cgroups (control groups) settings

I'm looking for some reference documentation to explain what each of the settings are, for each control group. For example, there's cpuset.cpus, I think setting this to 0 means use all CPUs, setting ...
4
votes
1answer
5k views

How to setup Git server on Linux Container in Debian

I have a LXC container on my Debian system. I want to setup a public Git server on it so that it's accessible to other people. How can I do this? UPDATE #1 Link to apache2.conf: http://pastebin.com/...
4
votes
1answer
36 views

LXC: Are downloaded templates verified?

Debian 8.3, LXC 1:1.0.6-6+deb8u2 When LXC downloads the base packages for a Debian container, are the packages verified? Verifying a Debian CD involves comparing signed checksum files against the ...
4
votes
1answer
300 views

Permanent swapping with lots of free memory

We have a Linux server running Debian 4.0.5 (Kernel 4.0.0-2) with 32G RAM installed and 16G Swap configured. The system uses lxc containers for compartmentalisation, but that shouldn't matter here. ...
4
votes
1answer
3k views

How to make a local template for a linux container and point to that

I am a newbie to the world of Linux Containers. I looked at quite a few webpages, wikipedia and checked out the questions at stackexchange but without any answers. Maybe my 'keyword fu' is not strong ...
4
votes
1answer
912 views

X and xdotool in LXC instead of KVM

So far I am using various xautomation/xdotool scripts in a KVM virtual machine (linux guest) in order to let them do their work and let me work uninterruptedly. I am using a VirtIO disk, but still the ...
4
votes
0answers
48 views

LXC: Any security difference between root and end-user owned unprivileged containers?

I intend to use LXC containers to isolate most of the network facing services. As per my understanding, I have mainly two ways to do this: Create unprivileged containers owned by root. In this case,...
4
votes
0answers
90 views

How to bind an lxc container to a specific bridge?

I created a specific bridge br1 and would like to bind a specific container cont1 to that bridge. I have lxc and lxd installed, if that matters (I am not sure what the difference between them really ...
4
votes
0answers
1k views

How to setup unprivileged LXC container without reboot?

I am writing some bootstrapping scripts, and I can't get usermode LXC containers working on vanilla Ubuntu 14.04 headless without a reboot. Here is what i do. First, I download and install Ubuntu ...
4
votes
0answers
213 views

To what extent does LXC manage configuring the network interface in a container?

In the LXC config file we can specify an IP address for a container: lxc.network.type=veth lxc.network.link=br0 lxc.network.ipv4 = 10.1.0.35/16 lxc.network.flags=up lxc.network.hwaddr= 00:16:3e:24:26:...
3
votes
2answers
7k views

Extra bridge interfaces get added automatically

I have a bridge set up between eth0 and br0, the bridge works fine, but sometimes, for unknown reasons and circumstances, I keep getting these off vethXXXXXX interfaces added to the bridge. When this ...
3
votes
2answers
2k views

lxc-start: No cgroup mounted on the system

Trying to start a Linux container, I get the following: lxc-start: No cgroup mounted on the system OS is Debian 7.
3
votes
2answers
508 views

Can I have a bridged interface without an IP?

I have 2 NICs: eth0 & eth1 on a host OS which runs some VMs (LXC) under it. The hosts eth0 is connected to a private network and configured as the primary interface. The hosts eth1 is connected ...