lxc/lxc
FreeLXC - Linux Containers
FreeFree tier
About lxc/lxc
LXC is a well-known and heavily tested low-level Linux container runtime. It has been in active development since 2008 and has proven itself in critical production environments world-wide. LXC focuses on system containers, providing an environment as close as possible to a VM but without the overhead of a separate kernel. It leverages kernel security features such as namespaces, mandatory access control, and control groups. LXC also pioneered unprivileged containers using user namespaces, allowing containers to run without root privileges. Its configuration management enables experienced users to tune container security intricately.
Key Features
System containers offering near-VM isolation without kernel overhead
Unprivileged containers via user namespaces
Leverages kernel security features (namespaces, mandatory access control, cgroups)
Pioneering support for unprivileged containers since kernel support
Extensive configuration management for advanced tuning
Uses setuid helpers (lxc-user-nic, newuidmap, newgidmap) for unprivileged networking
Pros & Cons
Pros
- Heavily tested and proven in critical production environments since 2008
- Kernel-level security isolation with namespaces, cgroups, and MAC
- First container runtime to support unprivileged containers
- Actively developed by contributors who also work on Linux kernel container features
- Mature project with extensive documentation and community support
Cons
- Requires kernel support for user namespaces for unprivileged mode
- Some restrictions and limitations due to kernel-enforced security
- Requires setuid helpers (lxc-user-nic) for full networking functionality
- Not as simple as Docker for application containers; focused on system containers
Best For
Running production workloads in isolated environmentsReplacing virtual machines with lighter-weight containersSecurity-sensitive deployments requiring unprivileged executionDeveloping and testing Linux system configurations
FAQ
What is LXC?
LXC is a low-level Linux container runtime for system containers, providing an environment as close as possible to a virtual machine but without the overhead of a separate kernel. It has been in active development since 2008.
What are unprivileged containers?
Unprivileged containers run without any root privileges on the host by using user namespaces. LXC was the first runtime to support them after user namespaces were merged into the mainline kernel.
What security features does LXC use?
LXC uses kernel security features such as namespaces, mandatory access control (e.g., SELinux, AppArmor), and control groups (cgroups) to isolate containers. It also supports unprivileged containers for enhanced security.