Virtualisation
What is LXC?
LXC is Linux-native containerisation that isolates processes with namespaces and cgroups while sharing the host kernel. LXC is excellent inside a trust boundary you already own and weak as a multi-tenant boundary, because a kernel escape affects every container on the host.
Why LXC matters
LXC is excellent inside a trust boundary you already own and weak as a multi-tenant boundary, because a kernel escape affects every container on the host.
LXC in practice
With LXC you get a lightweight container sharing the host kernel. You manage it via the lxc command suite or the API, watching cgroup stats for CPU and memory pressure. Tuning is mostly namespace and cgroup limits: pinning processes, setting memory ceilings. The cost of getting it wrong is exposure: a kernel escape compromises every container on the host, so you treat the host as a single trust domain, and you plan failover at the host level, not per container.
What people get wrong about LXC
People treat LXC as a security boundary equivalent to KVM. It is not: containers share a kernel, so a flaw in that kernel can break out of any container. The correction is that LXC is for isolation within a trust boundary you own, not for multi-tenant hosting where tenants may be hostile.
LXC — common questions
Is LXC the same as Docker?
No. Docker builds on container primitives like LXC but adds image management, layering, and orchestration. LXC is more like a lightweight VM: you run a full distro in it, and you manage it with systemd or init directly. Docker is about packaging apps; LXC is about virtualising systems.
Can I run LXC with a custom kernel?
That depends on the host. Some providers, like OnionVPS, give full root and allow custom kernels, but with LXC you share the host kernel, so a custom kernel is not for the container itself. You would use KVM for that. LXC is tied to the kernel version and configuration the host provides.
Where LXC comes up
- What is KVM virtualisation? KVM (Kernel-based Virtual Machine) is full hardware virtualisation built into the Linux kernel, using processor extensions to run each guest with its own k…
- Can I run Docker on a VPS? On a KVM VPS, yes, without restriction — install Docker Engine from the official repository and everything works, including buildx, Compose and Docker-in-D…
- KVM vs OpenVZ: why the virtualisation type matters KVM is full hardware virtualisation: your instance runs its own kernel and cannot see the host. OpenVZ and LXC are container technologies that share the ho…
- KVM vs LXC: isolation versus density LXC containers share the host kernel and start in milliseconds with almost no overhead; KVM virtual machines boot their own kernel with 2–5% overhead and a…
- What is the cheapest VPS that is actually usable? About $4 a month buys 1 vCPU, 1 GB of RAM and 20 GB of NVMe on real KVM virtualisation. That is genuinely enough for a WireGuard VPN, a DNS resolver, a Tor…
- What makes OnionVPS different from other VPS providers? Four things: no identity verification of any kind, crypto-only payment with no card or bank involved, 138 locations in 116 countries including genuine offs…
More from virtualisation
- KVM
- KVM is full hardware virtualisation built into the Linux kernel, giving each guest its own kernel and hardware-enforced isolation from other tenants.
- OpenVZ
- OpenVZ is container-based virtualisation in which every instance shares the host kernel, so guests cannot load kernel modules or run a different operating system.
- Hypervisor
- A hypervisor is the software layer that creates and runs virtual machines, allocating physical CPU, memory and IO between them.
- Nested virtualisation
- Nested virtualisation lets a virtual machine itself run virtual machines, by exposing the processor virtualisation extensions to the guest.
- vCPU
- A vCPU is a virtual processor presented to a guest, backed by scheduling time on a physical core or thread.
- cloud-init
- cloud-init is the standard mechanism for configuring a virtual machine on first boot, using metadata supplied by the platform.