LXC

LXC
Linux Containers (LXC) is an operating-system-level virtualization method for running multiple isolated Linux systems (containers) on a control host using a single Linux kernel.
The Linux kernel provides the cgroups functionality that allows limitation and prioritization of resources (CPU, memory, block I/O, network, etc.) without the need for starting any virtual machines, and also the namespace isolation functionality that allows complete isolation of an application's view of the operating environment, including process trees, networking, user IDs and mounted file systems.
LXC combines the kernel's cgroups and support for isolated namespaces to provide an isolated environment for applications. Early versions of Docker used LXC as the container execution driver, though LXC was made optional in v0.9 and support was dropped in Docker v1.10. References to Linux containers commonly refer to Docker containers running on Linux.
Overview
LXC was initially developed by IBM, as part of a collaboration between several parties looking to add namespaces to the kernel. It provides operating system-level virtualization through a virtual environment that has its own process and network space, instead of creating a full-fledged virtual machine. LXC relies on the Linux kernel cgroups functionality that was released in version 2.6.24. It also relies on other kinds of namespace isolation functionality, which were developed and integrated into the mainline Linux kernel.
Security
Originally, LXC containers were not as secure as other OS-level virtualization methods such as OpenVZ: in Linux kernels before 3.8, the root user of the guest system could run arbitrary code on the host system with root privileges, just as they can in chroot jails. Starting with the LXC 1.0 release, it is possible to run containers as regular users on the host using "unprivileged containers". Unprivileged containers are more limited in that they cannot access hardware directly. However, even privileged containers should provide adequate isolation in the LXC 1.0 security model, if properly configured.
Alternatives
LXC is similar to other OS-level virtualization technologies on Linux such as OpenVZ and Linux-VServer, as well as those on other operating systems such as FreeBSD jails, AIX Workload Partitions and Solaris Containers. In contrast to OpenVZ, LXC works in the vanilla Linux kernel requiring no additional patches to be applied to the kernel sources. Version 1 of LXC, which was released on 20 February 2014 as a long-term supported version, was supported for five years. LXC 4.0 will be supported until June 1, 2025 and LXC 5.0 until June 1, 2027.
LXD
LXD is an alternative Linux container manager. It is built on top of LXC and aims to provide a better user experience. It is a container hypervisor providing an API to manage LXC containers. The LXD-project was started in 2015 and was sponsored from the start by Canonical Ltd., the company behind Ubuntu Linux. On 4 July 2023, the LinuxContainers project announced that Canonical had decided to take over the LXD-project.On August 25, 2023, LXD version 5.17 was officially released under the control of Canonical, providing support for OpenZFS 2.2 delegation capabilities.
See also
Open Container Initiative
Container Linux (formerly CoreOS Linux)
Docker, a project automating deployment of applications inside software containers
Apache Mesos, a large-scale cluster management platform based on container isolation
Operating system-level virtualization implementations
Proxmox Virtual Environment, an open-source server virtualization management platform supporting LXC containers and KVM
Anbox, uses LXC to execute Android applications in other Linux distributions
References
External links
and
IBM developerworks article about LXC
"Evading from Linux Containers" by Marco D'Itri
Presentation about cgroups and namespaces, the underlying technology of Linux containers, by Rami Rosen
Presentation about Linux Containers and the future cloud, by Rami Rosen
LXC : Install and configure the Linux Containers
LSS: Secure Linux containers (LWN.net)
Introduction to Linux Containers
, April 2013
Free virtualization software
Linux kernel features
Linux-only free software
Operating system security
Virtualization software for Linux