Linux Containers (LXC): Architecture, Security, and Ecosystem

ArticleWikipedia-AutorenResource

LXC provides operating system-level virtualisation on Linux by running multiple isolated systems on a single shared kernel. It combines kernel cgroups and namespaces to isolate processes and enforce resource limits.

Key points

  1. Relies on mainline Linux kernel features, specifically cgroups for resource control and namespaces for process and network isolation.
  2. Docker originally utilised LXC as its execution driver before phasing it out between versions 0.9.0 and 1.10.0.
  3. LXC 1.0 introduced unprivileged containers, enabling instances to run without host root privileges to improve security.
  4. Canonical took full control of the LXD container manager in July 2023, prompting the LinuxContainers community to establish the Incus fork.

Why it matters

LXC established the foundation for modern Linux container runtimes, providing a lightweight OS virtualization approach directly integrated into the upstream Linux kernel.

Analysis

By avoiding full hypervisor virtualisation and relying directly on native kernel features, LXC delivers high performance with minimal overhead. While early versions suffered from isolation risks comparable to chroot environments, the addition of unprivileged containers mitigated the primary privilege escalation concerns. Although replaced by custom execution engines in application container runtimes such as Docker, LXC remains widely used for persistent system containers.

Mentioned links

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Article:Docker Documentation

    Docker Fundamentals and Platform Architecture

    The official Docker documentation outlines the core concepts of the container platform, explaining its client-server architecture, image layers, containers, and the role of Linux namespaces.

    Web development· Resource

  • Link:firecracker-microvm.github.io

    Firecracker: Open Source Virtualisation for MicroVMs and Serverless

    Firecracker is an open-source virtualisation technology designed for building and managing secure, multi-tenant container and function-based services. It brings together the strong workload isolation of traditional virtual machines with the speed and efficiency of containers.

    Security· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.