My understanding is that recent (13.10+) Ubuntu ships with an AppArmor profile that blocks known ways of escalating out of the container. So, LXC under Ubuntu

My understanding is that recent (13.10+) Ubuntu ships with an AppArmor profile that blocks known ways of escalating out of the container. So, LXC under Ubuntu is in better shape than LXC on other distros, where you can use the uevent_helper trick[1] to easily escape the container. It sounds like your use case could also use the new unprivileged containers[2] feature, which is going to be a dramatic increase in security (since even if you somehow get access to run a command on the host container, it would not be as root). [1]: http://blog.bofh.it/debian/id_413 http://blog.bofh.it/debian/id_413 [2]: https://www.stgraber.org/2014/01/17/lxc-1-0-unprivileged-containers/ https://www.stgraber.org/2014/01/17/lxc-1-0-unprivileged-con...