I'm trying to provide a service to the LXC guests, but do not want to expose it from the host. I also don't want to put up firewall rules for the service, so loopback appears to be the most straightforward solution.

Is there a way to have a service listening on lo (loopback) shared with LXC guests, e.g. similar to bind-mounting directories into place?

  • What service are you talking about? What's your lxc network configuration?
    – mreithub
    May 17, 2014 at 19:09
  • @mreithub: In this particular case I am talking about apt-cacher-ng, but I intend to add others (like the postfix instance running on the host). Generally I am only interested in TCP-based services. May 17, 2014 at 20:02

2 Answers 2


There are different ways to achieve your goal.

If the guests share a virtual network (i.e. are not just bridged to the physical interface) it's easy. Just tell your services to listen on that interface - or create a new guest and let that one host the service.

If the guests are bridged to ethX, you might still want to consider creating a virtual guest+host-only interface as that kind of encapsulation makes sense for all kinds of services (internal mail-server, any database server, local DNS, etc.)

(And obviously there's the way you already discarded for some reason: firewall rules)

As for lo: each lxc host has its own, and that's good imo

My lxc guests all share a virtual interface and for each service that should be exposed to the public internet, I create port forwarding rules on the host's iptables. And I try to run as few services as possible on the host itself. That way there's little to no rist accidentally exposing any services.

And for the sake of completeness, here's my config:

My interfaces file (debian stable):

auto br0
iface br0 inet static
    bridge_maxwait 0
    bridge_fd 0
    bridge_ports dummy0
    address 192.168.x.1
    # if there are lxc clients that need a public IP, add something like this (a.b.c.d being the public IP) and set the client's `lxc.network.ipv4` config parameter to the same address:
    #post-up route add a.b.c.d dev br0

The relevant part of the client config:

lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0
lxc.network.veth.pair = lxc-apache # each client gets their own .pair name
lxc.network.ipv4 = 192.168.x.y/24 # ... and of course their own address
  • 1
    Nothing is wrong with this, it's just a Debian/Ubuntu only method, at least wrt the interfaces file.
    – slm
    May 17, 2014 at 22:01

Another option is bind mounted unix domian sockets.

For example you can run fcgiwrap in the outer Linux and inside container mount the directory that contains the socket.

lxc.mount.entry = /mnt/outer /var/lib/lxc/mylxc/rootfs/mnt/outer none bind,create=dir 0 0

This makes containers able to access services from the outer Linux with zero risk of accidentally exposing this on the Internet with a mis-configured firewall.

You can use fifo sockets if you only want data to flow in one direction.

  • Hehe, I wonder if this would have worked back when I asked. Anyway, I upvoted it for the effort. Last time I seriously worked with LXC was in early 2019 as part of a PVE (Proxmox) setup. Nov 6, 2022 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .