A mature low-level Linux container runtime focused on system containers with strong security features and kernel integration.
LXC is a low-level Linux container runtime that provides system containers offering VM-like environments without the overhead of separate kernels. It leverages kernel security features like namespaces, mandatory access control, and control groups to create isolated, production-ready environments. It has been in active development since 2008 and is proven in critical production environments worldwide.
System administrators, DevOps engineers, and developers who need lightweight, secure, and stable containerization on Linux systems, particularly those requiring VM-like isolation without the performance overhead of virtualization.
Developers choose LXC for its production-proven stability, strong security focus with unprivileged container support, and strict backwards compatibility since release 1.0.0. It provides direct access to Linux kernel containerization features with extensive configuration options for experienced users.
LXC - Linux Containers
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
LXC has been in active development since 2008 and is proven in critical production environments worldwide, ensuring high reliability for long-term deployments.
Pioneered unprivileged containers using Linux user namespaces, allowing containers to run without root privileges and reducing the attack surface significantly.
Leverages kernel features like namespaces, control groups, and mandatory access control for deep isolation and near-native performance without separate kernels.
Maintains API stability since release 1.0.0, making it safe for long-term infrastructure without breaking changes.
Runs on various architectures including x86_64, ARM, RISC-V, and PowerPC, ideal for diverse hardware environments from servers to embedded systems.
Requires manual setup of intricate keys like lxc.net.0.type for networking, which can be time-consuming and error-prone compared to higher-level tools with defaults.
Full unprivileged container functionality depends on setuid binaries like lxc-user-nic, introducing potential security risks and additional setup steps that may not align with all security policies.
Lacks built-in image management and has a smaller community tooling ecosystem than Docker, making tasks like image sharing and dependency resolution more manual.
The low-level nature demands deep knowledge of Linux kernel features and container internals, which can be daunting for users accustomed to more abstracted runtimes.