4

Debian 8.3, LXC 1:1.0.6-6+deb8u2

When LXC downloads the base packages for a Debian container, are the packages verified? Verifying a Debian CD involves comparing signed checksum files against the checksum of the downloaded file (and also that the signature itself is valid) as described here. Apt also verifies packages automatically. Does the following LXC command download the base packages 'outside' of the apt system, making LXC a security weakness to the host with LXC installed?

lxc-create -n mycontainer -t debian
Improve this question

1 Answer 1

Reset to default
2

No. debian template for lxc-create internally uses debootstrap which certainly verifies downloaded packages against release signatures in the repository just like apt.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .