lxc/lxc

Features

• Unprivileged Container Execution - Provides a runtime that maps container root users to unprivileged host users to protect the host system.
• Virtual Machine Containers - Runs isolated Linux environments that emulate virtual machines to separate services without the overhead of a full kernel.
• Namespace-Based Isolation - Isolates system resources like networks and process trees using kernel-level namespaces to create independent environments.
• Linux Container Managers - Provides a comprehensive tool for creating and managing system containers using namespaces and control groups.
• System-Call Access Controllers - Restricts access to the host kernel by intercepting and blocking unauthorized system calls using security profiles.
• Container Security Hardening - Filters system calls and maps user identifiers to restrict how containers interact with the host kernel.
• Root User Mapping and Filesystem Virtualization - Maps container root users to unprivileged host users and virtualizes system files to harden isolation.
• Container Isolation - Isolates entire operating system environments using kernel namespaces and control groups to emulate virtual machines.
• Rootless Container Runtimes - Provides a runtime that allows containers to execute without requiring root or administrative privileges on the host.
• User ID Mapping Configurations - Maps container root users to unprivileged host users to prevent administrative access to the host operating system.
• OS-Level Virtualization - Implements an OS-level virtualization framework to run multiple isolated Linux systems on a single host without a hypervisor.
• Container Cgroup Resource Limits - Enforces memory, CPU, and I/O limits on containers using Linux control groups to prevent host resource exhaustion.
• Control Group Resource Limiting - Limits CPU and memory usage through Linux control groups to ensure fair resource distribution and host stability.
• Container Command Executors - Provides an API to execute arbitrary commands and interactive shells inside running containers for administrative tasks.
• Container Lifecycle Management - Ships a stable API and language bindings to programmatically control container creation, startup, shutdown, and destruction.
• Container Bridge Networks - Creates isolated network bridges and interfaces to manage traffic and prevent address spoofing between containers.
• Per-User Network Bridges - Implements dedicated network bridges per user or group to prevent MAC and IP spoofing between untrusted containers.
• Container Configuration - Provides a hierarchical system for defining container runtime parameters, resource limits, and security settings.
• Virtual Network Bridging - Connects isolated container network namespaces to a host bridge for managed external communication.
• Container Management - Userspace interface for Linux kernel containment features.
• Container Engines - Low-level tools and libraries for managing Linux containers.
• Container Runtimes - Linux container management and execution.

Star history