Scenario: A 'gateway' machine functioning as a router and firewall, connecting a small LAN to the internet. The machine also runs a webserver (hosting a simple website) and an SSH server, providing (non-root) SSH access from the internet.

Goal: Mitigate the damage caused by a malicious hacker who breaks into the machine via the internet (only ports exposed to internet are for webserver and SSH server). A key concern is break-in via SSH server should not compromise webserver and vice versa.

Proposed Approach: Configure two unprivileged LXC containers, one each for the web and SSH servers, router/firewall running on the main machine. The containers use virtual network interfaces on a separate bridge to connect to the main machine, with port forwarding and firewall rules configured to enable SSH/web functionality.

Questions: Would above approach provide better security against external threats compared to running SSH and web servers directly on the machine? Any flaws, issues to address? Would security improve if the router/firewall itself is run in a third container (mapped to physical network interfaces)? Please feel free to provide additional related comment/advise if you have experience.

  • 1
    It's probably reasonable to run the web server inside a container, though I don't know if that is common. I don't know if it makes much sense to run ssh inside a separate container. It would not be easy to break in via openssh - it's a pretty paranoid and well-maintained piece of software - modulo issues with ssl and other helper software. Jan 28, 2016 at 8:19

1 Answer 1


Its a good idea: that is the point of containers.

Its quite common, before containers webservers were often run in chroots.

If you don't use a bridge, and use router mode for the lxc networking

lxc.net.0.veth.mode = router

The web server will not have a network path to the SSH server either, and will not be able to snoop traffic. OpenSSL has a bug that made snooping traffic a real issue (heart bleed). It is worth having an extra layer of security, even if its pretty unlikely your www server gets pwnd, inside an lxc container there is less damage they can do. Critical remote exec bugs in common software do happen occasionally, (e.g. shell shock)

  • No that's not the point of containers. It's worth noting that there are many exploits which allow malathion's behaviour to break out of containers. Nov 6, 2022 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .