Linux Containers (LXC) is a userspace interface for operating system-level virtualization features in the mainline Linux kernel, such as kernel namespaces and control groups (cgroups). These allow multiple distinct user space instances to be run on a single kernel.

learn more… | top users | synonyms

13
votes
1answer
692 views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
10
votes
1answer
332 views

Linux: Is there handy way to exec a program binding it to IP-address of choice?

In FreeBSD 4.9 it was very easy to accomplish with just a single command like jail [-u username] path hostname ip-number command if path was / you had running just the same program as usual but ...
10
votes
1answer
2k views

User permissions inside and outside of LXC containers?

I'm running some services inside of Docker LXC containers on my server and I'm beginning to actually do serious things with them. One thing I'm not clear on is how user permissions work inside and ...
9
votes
4answers
8k views

Why doesn't docker container start at boot w/ upstart script on Ubuntu 12.04?

Using instructions for Docker auto-start on Linode VPS running Ubuntu 12.04 and Docker 0.8.1, the specified container does not start on reboot. Once booted, I am able to ~$ sudo start [service-name] ...
8
votes
2answers
6k views

LXC: How do I mount a folder from the host to the container?

I'm trying to mount a folder on the host to an LXC container. The host has a folder /mnt/ssd/solr_data created (this is currently on the root filesystem, but later I'll mount an SSD drive there, so ...
8
votes
3answers
12k views

How to configure external IP addresses for LXC guests?

I'm exploring the LXC features in Ubuntu 12.04 and I really want to set up a network like this: client1: 192.168.56.101/24 lxc-host: 192.168.56.102/24 guest1 192.168.56.201/24 guest2 ...
8
votes
1answer
1k views

What makes systemd-nspawn still “unsuitable for secure container setups”?

This is stated in the man page for systemd-nspawn Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security ...
7
votes
1answer
5k views

Linux LXC vs FreeBSD jail

Are there any notable differences between LXC (Linux containers) and FreeBSD's jails in terms of security, stability & performance? On first look, both approaches look very similar.
7
votes
2answers
3k views

Application updates inside of Docker containers?

Typically on a server, automatic updates of security-related patches are configured. Therefore, if I'm running MySQL 5.5 and a new security patch comes out, Ubuntu Server will apply the upgrade and ...
7
votes
2answers
804 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
7
votes
1answer
669 views

How to list namespaces in Linux?

Is there any method in Linux to list all namespaces on the running host? I need to check namespaces for particular processes (e.g. processes running in LXC-container and all other processes on the ...
6
votes
2answers
3k views

Fast X for LXC guest on localhost?

How can I run X apps inside an LXC container efficiently? ssh -Y guest is too slow - there is no graphics acceleration with ssh -Y - everything has to travel over the virtual network with the ...
6
votes
2answers
2k views

Executing a command inside a running LXC

I want to execute a command inside an existing lxc without going through the regular Linux init. lxc-execute command is for that I guess but I get the following error when I run this command on my ...
5
votes
2answers
1k views

AppArmor profiles in Docker/LXC

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be ...
5
votes
1answer
2k views

How do I disable udevd in systemd?

I'm trying to boot a Fedora Rawhide LXC container from a Fedora 16 host, and it's not working - systemd just keeps dropping into emergency mode. Because udevd doesn't work in LXC containers, I thought ...
5
votes
1answer
772 views

Noninteractive script running over ssh is interrupted as apt-get finishes

When I run the following non interactive script on Ubuntu Server 13.04 it's interrupted when lxc-docker package finishes installation. Script : ssh -o StrictHostKeychecking=no -t -t -i $CERT ...
5
votes
1answer
496 views

SquashFS image as rootfs in LXC

Is it possible to use a SquashFS filesystem as an LXC rootfs? I can mount an ext3 image as a rootfs just by setting lxc.rootfs to the filename, but if it's any other type of image, lxc-start just says ...
4
votes
3answers
730 views

Can LXC be used to jail instances of an installed browser?

Is it possible to use LXC on a desktop system to confine browsers and other pieces of software that have in the past been shown to be prone to certain kinds of exploits. So what I want to achieve is ...
4
votes
2answers
628 views

How can I use Skype with lxc?

Under Scientific-linux? https://en.wikipedia.org/wiki/LXC I just want to separate Skype, because I don't trust it. We are using it only to call/chat with people, no file transfers!
4
votes
1answer
516 views

X and xdotool in LXC instead of KVM

So far I am using various xautomation/xdotool scripts in a KVM virtual machine (linux guest) in order to let them do their work and let me work uninterruptedly. I am using a VirtIO disk, but still the ...
4
votes
1answer
658 views

LXC container to use “virtual” interface from host (namespace semantics)

So according to the documentation on the Ubuntu LXC documentation the following statement can be found at the time of this writing: A NIC can only exist in one namespace at a time, so a physical ...
4
votes
0answers
45 views

Migrate an unprivileged LXC container between users

I have an Ubuntu 14.04 server installation which acts as an LXC host. It has two users: user1 and user2. user1 owns an unprivileged LXC container, which uses a directory (inside ...
3
votes
1answer
241 views

Is it possible to run a 10.04 or 12.04 or earlier LTS containerized under LXC or Docker on Trusty?

Is it possible to have a vanilla installation of Ubuntu 14.04 (Trusty) and run inside it containerized older Ubuntu versions that originally came with older kernels? For example for 12.04 I'd assume ...
3
votes
2answers
261 views

replicate and isolating user environments on the fly

I will be using Ubuntu Linux for this project. For training of a particular application at a conference I need: To have each student be able to ssh into the same user account on a server Upon each ...
3
votes
2answers
100 views

Reference documentation for cgroups (control groups) settings

I'm looking for some reference documentation to explain what each of the settings are, for each control group. For example, there's cpuset.cpus, I think setting this to 0 means use all CPUs, setting ...
3
votes
1answer
654 views

Which one is lighter security- and CPU-wise: LXC versus UML

I'm trying to decide between "jailing" certain applications and I know the trade-offs of KVM versus LXC and how I can use them both. Lately I came across UML (User-Mode Linux) again and was wondering ...
3
votes
1answer
3k views

How to setup Git server on Linux Container in Debian

I have a LXC container on my Debian system. I want to setup a public Git server on it so that it's accessible to other people. How can I do this? UPDATE #1 Link to apache2.conf: ...
3
votes
1answer
40 views

How to create user cgroups with systemd

I use unprivileged lxc containers in Arch Linux. Here are the basic system infos: [chb@conventiont ~]$ uname -a Linux conventiont 3.17.4-Chb #1 SMP PREEMPT Fri Nov 28 12:39:54 UTC 2014 x86_64 ...
3
votes
2answers
90 views

What is a Linux container and a Linux hypervisor?

I looked at the stackexchange site but couldn't find anything. I looked at the wikipedia entry on Linux container https://en.wikipedia.org/wiki/LXC and as well as hypervisor ...
3
votes
1answer
1k views

Building unprivileged (userns) LXC container from scratch, by migrating a privileged container to be unprivileged

How can I build a privileged LXC (1.0.3) container (that part I know) and then migrate it successfully to be run unprivileged? That is, I'd like to debootstrap it myself or adjust the lxc-ubuntu ...
3
votes
1answer
2k views

LXC migrate between hosts

I had setup a testsystem with LXC and installed a webserver etc. that all was not the problem. But now I want to swich to another host system also I compressed /var/lib/lxc/webserver and copied it to ...
3
votes
0answers
105 views

Host system keyboard layout changes when starting LXC container

I successfully created an archlinux container on an archlinux host with lxc. However, whenever I start a container via lxc-start -n GUESTNAME the keyboard layout changes to the default ...
3
votes
0answers
184 views

LXC with both GUI apps and snapshots on unmodified Fedora kernel

I am looking for a tool or library to run LXC that supports: running X applications conveniently snapshotting root filesystems (using a Fedora system with an unmodified kernel), so that I don't have ...
3
votes
0answers
124 views

To what extent does LXC manage configuring the network interface in a container?

In the LXC config file we can specify an IP address for a container: lxc.network.type=veth lxc.network.link=br0 lxc.network.ipv4 = 10.1.0.35/16 lxc.network.flags=up lxc.network.hwaddr= ...
2
votes
2answers
259 views

Can I have a bridged interface without an IP?

I have 2 NICs: eth0 & eth1 on a host OS which runs some VMs (LXC) under it. The hosts eth0 is connected to a private network and configured as the primary interface. The hosts eth1 is connected ...
2
votes
1answer
98 views

Can you use LXC through C?

I want to use LXC to 'container' plugins my application is loading. Am I able to do this through C? I have been Googling a lot about it, but there don't seem to be any headers, only scripts that can ...
2
votes
2answers
3k views

Extra bridge interfaces get added automatically

I have a bridge set up between eth0 and br0, the bridge works fine, but sometimes, for unknown reasons and circumstances, I keep getting these off vethXXXXXX interfaces added to the bridge. When this ...
2
votes
1answer
76 views

Is there a way to share a service listening on loopback of the host with an LXC guest?

I'm trying to provide a service to the LXC guests, but do not want to expose it from the host. I also don't want to put up firewall rules for the service, so loopback appears to be the most ...
2
votes
1answer
1k views

Creating a Vagrant box with Docker installed

I'm trying create a nice playground for Docker in Vagrant based on Vagrant's precise64 box. (Code is available at GitHub: rfkrocktk/docker-vagrant-playground) Here's my Puppet provisioning ...
2
votes
1answer
478 views

How to automatically launch a lxc container on ssh connection?

I'm attempting to setup a system that automatically creates a new sandbox on a ssh login to use as a temporary jump box into my server. So to do this I was wonder how to setup lxc to spin up a new ...
2
votes
1answer
1k views

Bridged network with different subnets

I want to virtualize my webserver with lxc/virsh for this reason, I want to pass a IP to the lxc container. But my IPs are from different subnets, what I tried (but not successfully): Virsh network: ...
2
votes
1answer
1k views

How to assign an additional IP/hostname to a chrooted environment?

While I can simply have e.g. sshd in a chroot environment ("chrootenv") listen to a different port than its parent ("parentenv"), it would be more convenient to have that environment have an ...
2
votes
1answer
807 views

USB passthrough for LXC containers

PROBLEM: So I've been trying to get a usb device (primesense - the OEM reference for the Kinect) to passthrough to an LXC container so I can develop without worrying about polluting my stable system ...
2
votes
2answers
484 views

cgroups: blkio.weight doesn't seem to have the expected effect

I've got 2 LXC containers with these cgroup settings: lxc.cgroup.blkio.weight = 200 lxc.cgroup.cpu.shares = 200 and lxc.cgroup.blkio.weight = 800 lxc.cgroup.cpu.shares = 800 I have verified in ...
2
votes
0answers
217 views

Vagrant-lxc container not starting

Firstly I'd like to say that I'm new to LXC and I may have some problems getting the right idea of how the things should work. The thing is I'm trying to start a previously download vagrant-lxc box ...
2
votes
1answer
203 views

How to move process from one namespace to other?

This question is similar to my question about how to list namespaces. So in addtition, I'd like to know some information about moving processes from one namespace to other? E.g. I have processes of ...
2
votes
1answer
215 views

Manage LXC containers from host in puppet

Is there any puppet modules for manage nodes in LXC containers from local host? E.g.: I have host with 50 LXC containers and I want to manage all those containers from host directly, not from another ...
2
votes
0answers
53 views

LXC: Have rootfs mounted without nosuid

I have the container's rootfs in a volume mounted with the nosuid option. When I start the container, its / mounted is then also mounted nosuid, which breaks programs such as sudo. How can I avoid ...
2
votes
0answers
73 views

LXC apparmor profile limits executing scripts in /run/*

LXC is blocking a trusted container from running scripts in /run/*, how do I configure LXC to allow scripts to run here?
1
vote
1answer
102 views

Is an LXC guest load average the same as the host's load average?

If I run top on the guest, the load average values seem to be exactly the same as running top on the host. Is a Docker (LXC) guest's load average the same as the host's load average?