lxc/lxc
Lxc
LXC est un framework de virtualisation au niveau du système d'exploitation et un gestionnaire de conteneurs Linux utilisé pour exécuter plusieurs systèmes Linux isolés sur un seul hôte. Il fonctionne comme un orchestrateur d'espace de noms de noyau et un runtime de conteneur non privilégié, permettant la création et la gestion de conteneurs système sans la surcharge d'un hyperviseur.
Le projet fournit une exécution de conteneur non privilégié en mappant les utilisateurs root des conteneurs aux utilisateurs hôtes non privilégiés pour empêcher l'accès au système hôte. Il garantit la sécurité via le filtrage des appels système et l'isolation de l'utilisateur root, permettant aux conteneurs de s'exécuter sans nécessiter de privilèges root sur l'hôte.
Le framework gère l'isolation des ressources en utilisant des groupes de contrôle pour limiter l'utilisation du CPU et de la mémoire et utilise des espaces de noms de noyau pour l'isolation des processus et du réseau. Il inclut des capacités pour l'administration de pont réseau pour empêcher l'usurpation d'adresse et une API programmatique pour gérer le cycle de vie du conteneur et exécuter des commandes administratives.
Features
- Unprivileged Container Execution - Provides a runtime that maps container root users to unprivileged host users to protect the host system.
- Virtual Machine Containers - Runs isolated Linux environments that emulate virtual machines to separate services without the overhead of a full kernel.
- Namespace-Based Isolation - Isolates system resources like networks and process trees using kernel-level namespaces to create independent environments.
- Linux Container Managers - Provides a comprehensive tool for creating and managing system containers using namespaces and control groups.
- System-Call Access Controllers - Restricts access to the host kernel by intercepting and blocking unauthorized system calls using security profiles.
- Container Security Hardening - Filters system calls and maps user identifiers to restrict how containers interact with the host kernel.
- Root User Mapping and Filesystem Virtualization - Maps container root users to unprivileged host users and virtualizes system files to harden isolation.
- Container Isolation - Isolates entire operating system environments using kernel namespaces and control groups to emulate virtual machines.
- Rootless Container Runtimes - Provides a runtime that allows containers to execute without requiring root or administrative privileges on the host.
- User ID Mapping Configurations - Maps container root users to unprivileged host users to prevent administrative access to the host operating system.
- OS-Level Virtualization - Implements an OS-level virtualization framework to run multiple isolated Linux systems on a single host without a hypervisor.
- Container Cgroup Resource Limits - Enforces memory, CPU, and I/O limits on containers using Linux control groups to prevent host resource exhaustion.
- Control Group Resource Limiting - Limits CPU and memory usage through Linux control groups to ensure fair resource distribution and host stability.
- Container Command Executors - Provides an API to execute arbitrary commands and interactive shells inside running containers for administrative tasks.
- Container Lifecycle Management - Ships a stable API and language bindings to programmatically control container creation, startup, shutdown, and destruction.
- Container Bridge Networks - Creates isolated network bridges and interfaces to manage traffic and prevent address spoofing between containers.
- Per-User Network Bridges - Implements dedicated network bridges per user or group to prevent MAC and IP spoofing between untrusted containers.
- Container Configuration - Provides a hierarchical system for defining container runtime parameters, resource limits, and security settings.
- Virtual Network Bridging - Connects isolated container network namespaces to a host bridge for managed external communication.
- Container Management - Userspace interface for Linux kernel containment features.
- Container Engines - Low-level tools and libraries for managing Linux containers.
- Container Runtimes - Linux container management and execution.
