LXC[0] is "the original" (citation needed) linux containerization effort, and LXD[1] which is the daemon built to manage it on top is a really really interestin

LXC[0] is "the original" (citation needed) linux containerization effort, and LXD[1] which is the daemon built to manage it on top is a really really interesting project. In an alternative world, it would have taken off instead of kubernetes as your container management and scheduling solution (which might have been wrong, k8s runs at a level of abstraction higher than lxd so actually I think it deserves to be where it is). The main difference between a common 'docker' container and a LXC container is user namespacing[2]. This is where the improved security claims, and ability to run "unprivileged" containers comes from. This is accomplished by uid/guid mapping[3], and docker now has it[4] though of course docker and LXD are not comprable -- not even LXC and docker are comparable. If the ends of the spectrum of abstraction are Kubernetes--<other tech>--fork(), I'd say the spectrum with these tools included looks like: Kubernetes----LXD---Docker swarm----Docker----LXC----fork(). [EDIT] - "difference between a LXC container and a LXD container" -> "difference between a common 'docker' container and a LXC container". I mis-typed and just caught it. LXD is built on LXC so obviously it does not make sense, a LXC container is a LXD container. [0]: https://linuxcontainers.org/ https://linuxcontainers.org/ [1]: https://linuxcontainers.org/lxd/ https://linuxcontainers.org/lxd/ [2]: http://man7.org/linux/man-pages/man7/user_namespaces.7.html http://man7.org/linux/man-pages/man7/user_namespaces.7.html [3]: https://linuxcontainers.org/lxd/docs/master/userns-idmap https://linuxcontainers.org/lxd/docs/master/userns-idmap [4]: https://docs.docker.com/engine/security/userns-remap/ https://docs.docker.com/engine/security/userns-remap/