LXC
linuxcontainers.org
What it is
LXC is free software for creating and managing Linux system or application containers through Linux kernel containment features. It aims to make each container resemble a standard Linux installation without a separate kernel. The project includes the liblxc library, container control tools, distribution templates and API bindings for Python 3, Lua, Go, Ruby and Haskell. Process containment uses kernel namespaces, AppArmor and SELinux profiles, seccomp policies, chroots, kernel capabilities and cgroups. Unprivileged containers map container root to an unprivileged host user. LXC is included in most Linux distributions and is generally installed through the distribution package manager. Listed requirements include a supported C library and Linux kernel 2.6.32 or later. LXC 7.0 and 6.0 are listed as long-term support releases through June 1, 2031 and June 1, 2029. Most code uses GNU LGPLv2.1+, with some BSD 2-clause or GNU GPLv2 components.
Spec sheet
- Purpose
- LXC is a userspace interface to Linux kernel containment features for creating and managing system or application containers.Read 8 Oct 2026 · linuxcontainers.org
- Founded
- 2008Read 28 Sep 2026 · linuxcontainers.org
- Components
- LXC includes the liblxc library, standard container control tools, distribution templates, and API bindings for Python 3, Lua, Go, Ruby, and Haskell.Read 8 Oct 2026 · linuxcontainers.org
- Container model
- LXC aims to provide an environment close to a standard Linux installation without requiring a separate kernel.Read 8 Oct 2026 · linuxcontainers.org
- Installation
- LXC is included in most Linux distributions and is generally installed through the distribution package manager.Read 8 Oct 2026 · linuxcontainers.org
- Licensing
- LXC is free software, with most code under GNU LGPLv2.1+ and some components under BSD 2-clause or GNU GPLv2 licenses.Read 8 Oct 2026 · linuxcontainers.org
- Minimum requirement
- The listed hard requirements include a supported C library and a Linux kernel version 2.6.32 or later.Read 8 Oct 2026 · linuxcontainers.org
- Privileged container caution
- The documentation warns that privileged containers run processes as host root and should not give untrusted parties access to container root.Read 8 Oct 2026 · linuxcontainers.org
- Release support
- The project lists LXC 7.0 and 6.0 as long term support releases, with support through June 1, 2031 and June 1, 2029 respectively.Read 8 Oct 2026 · linuxcontainers.org
- Security features
- LXC uses kernel namespaces, AppArmor and SELinux profiles, seccomp policies, chroots, kernel capabilities, and cgroups to contain processes.Read 8 Oct 2026 · linuxcontainers.org
- Security limits
- LXC says it does not prevent denial-of-service attacks by default and advises configuring cgroup limits when running untrusted containers.Read 8 Oct 2026 · linuxcontainers.org
- Security model
- The project describes unprivileged containers as safe by design because container root maps to an unprivileged user outside the container.Read 8 Oct 2026 · linuxcontainers.org
- Security reporting
- Security issues can be reported by email to the project security address or through a private GitHub security advisory.Read 8 Oct 2026 · linuxcontainers.org
Plans and prices
LXC Free Free software; no charge stated Linux kernel required · No separate kernel for containers Read 8 Oct 2026 · linuxcontainers.org
Strong points and limits
Strong points
- Free software
- No separate kernel per container
- Rootless containers supported
- Multiple language API bindings
- Included in most Linux distributions
Limits
- Linux kernel required
- Denial-of-service protection is not default
- Privileged containers run as host root
- Linux host platform only
Who it suits
LXC suits Linux users who need system or application containers and developers using its libraries, tools or language bindings. It is relevant where rootless operation and Linux kernel containment are required.
Verdict
LXC supplies a broad Linux container interface with rootless support and several containment controls. Operators must configure cgroup limits for untrusted workloads and treat privileged containers carefully.
Where Specifiction places it
- Container Engines#15 of 317.6
- Container Runtime Software#17 of 287.6
