4

Debian 8.3, LXC 1:1.0.6-6+deb8u2

When LXC downloads the base packages for a Debian container, are the packages verified? Verifying a Debian CD involves comparing signed checksum files against the checksum of the downloaded file (and also that the signature itself is valid) as described here. Apt also verifies packages automatically. Does the following LXC command download the base packages 'outside' of the apt system, making LXC a security weakness to the host with LXC installed?

lxc-create -n mycontainer -t debian
2

No. debian template for lxc-create internally uses debootstrap which certainly verifies downloaded packages against release signatures in the repository just like apt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.