3 ms·
LXC is just a set of script/interface to Linux's namespaces. Namespaces is what is actually used. There are disk namespaces, network, pid, etc. Those are not v
by zobzu 14y ago
LXC is just a set of script/interface to Linux's namespaces.
Namespaces is what is actually used. There are disk namespaces, network, pid, etc. Those are not very widely tested albeit supposed to be relatively secure.
FreeBSD jail provides a all-in-one integration instead. LXC provides the glue to achieve similar integration.
There is also rsbac_jail which provides an integration more similar to what FreeBSD does.
The major issue with LXC so far has been that it's not well integrated/easy to use.
- jws 14y agoThe major issue with LXC so far has been that it's not well integrated/easy to use. That's a bit of an understatement. LXC is to namespaces as "tc" is to traffic shaping. It should be replaced.
- zobzu 14y agoi didn't want to be that blunt ;-)
- danellis 14y agoHow is that so when the article says "NOTE: Until we have user namespaces implemented in the kernel and used by the LXC we will NOT say that LXC is root safe"?
- zobzu 14y agoa root in a namespace is a root in a namespace. if its a fs namespace, can't chroot up. if its also a network namespace, can't use network resources that aren't allowed by the namespace. and so on. but, a regular user can't create a namespace with root in it. that's what's missing for example. Note that, again, RSBAC does support fully virtual users for example (akin to namespaces for users)