lxc.container.conf(5) lxc.container.conf(5) NAME lxc.container.conf - LXC LXC Linux LXC 2008 Linux LXC VM (namespace)cgroup LXC (user namespace) LXC UIDGID UIDGID UIDGID UIDGID UIDGID UIDGID 0 UIDGID 100000 man UID GID lxc.idmap Linux key = value '#' cgroup value LXC lxc.net.0 lxc.net.0.typelxc.net.0.linklxc.net.0.ipv6.address include 1 lxc.include include include lxc 64 32 32 lxc.arch x86, i686, x86_64, amd64 utsname lxc.uts.name init init kill(1) SIGKILL, SIGRTMIN+14, SIGRTMAX-10 SIGPWR lxc.signal.halt kill(1) SIGKILL, SIGRTMIN+14, SIGRTMAX-10 SIGINT lxc.signal.reboot kill(1) SIGKILL, SIGRTMIN+14, SIGRTMAX-10 SIGKILL lxc.signal.stop INIT init lxc.execute.cmd root lxc- execute lxc.init.cmd init root lxc-start /sbin/init INIT LXC init lxc.init.cwd INIT ID init UID/GID root UID UID/GID : UID(0)GID(0) lxc.init.uid init UID lxc.init.gid init GID lxc.sched.core 0 1 1 0 PROC proc lxc.proc.[proc file name] proc /proc/PID/ : lxc.proc.oom_score_adj = 10 lxc.ephemeral 0 1 1 2 lxc.net lxc.net.[i].type lxc.net.* i lxc.net.0.type = veth lxc.net.1.type = veth 2 lxc.net.0.link = br0 lxc.net.0.type : empty: veth: lxc.net.[i].veth.mode veth bridge router bridge bridge lxc.net.[i].link veth lxc router veth IP IP Proxy ARP Proxy NDP veth lxc lxc.net.[i].veth.pair lxc () lxc.net.[i].veth.ipv4.routelxc.net.[i].veth.ipv6.route x.y.z.t/m : 192.168.1.0/24 bridge VLAN lxc.net.[i].veth.vlan.id VLAN 'none' VLAN lxc.net.[i].veth.vlan.tagged.id vlan: vlan lxc.net.[i].link vlan lxc.net.[i].vlan.id macvlan: macvlan lxc.net.[i].link lxc.net.[i].macvlan.mode macvlan macvlan privatevepabridgepassthru private () (Virtual Ethernet Port Aggregator (VEPA)) vepa macvlan reflective relay VEPA macvlan bridge macvlan reflective relay MAC macvlan STP passthru macvlan passthru macvlan ipvlan: ipvlan lxc.net.[i].link lxc.net.[i].ipvlan.mode ipvlan ipvlan l3l3sl2 l3 l3 L3 TX () L2 l3s TX () L3 iptables (conn- tracking) L3 (symmetric) (L3s) conn- tracking () L3 l2 TX () RX/TX () lxc.net.[i].ipvlan.isolation bridgeprivatevepa bridge bridge private vepa VEPA 802.1Qbg phys: lxc.net.[i].link lxc.net.[i].flags up: lxc.net.[i].link lxc.net.[i].l2proxy 2 IP IP lxc.net.[i].link 0 1 0 IPv4 sysctl : net.ipv4.conf.[link].forwarding=1 IPv6 sysctl : net.ipv6.conf.[link].proxy_ndp=1 net.ipv6.conf.[link].forwarding=1 lxc.net.[i].mtu MTU lxc.net.[i].name ( eth0 ) lxc.net.[i].hwaddr MAC MAC IPv6 "x" hwaddr lxc.net.[i].ipv4.address ipv4 ipv4 x.y.z.t/m ) 192.168.1.123/24 IP 192.168.1.123/24 255.255.255.255 IP lxc.net.[i].ipv4.gateway IPv4 x.y.z.t ) 192.168.1.123 auto (lxc.net.[i].link ) auto vethmacvlanipvlan dev IPVLAN 3 lxc.net.[i].ipv6.address ipv6 ipv6 x::y/m ) 2003:db8:1:0:214:1234:fe0b:3596/64 lxc.net.[i].ipv6.gateway IPv6 x::y ) 2003:db8:1:0::1 auto (lxc.net.[i].link ) auto vethmacvlanipvlan dev IPVLAN 3 lxc.net.[i].script.up : o LXC_HOOK_TYPE: 'up' 'down' o LXC_HOOK_SECTION: 'net' o LXC_NET_TYPE: (: 'vlan', 'macvlan', 'ipvlan', 'veth') o LXC_NET_PARENT: 'macvlan''veth''phys' o LXC_NET_PEER: 'veth' lxc.hook.version 1 lxc.hook.version lxc.hook.version 1 0 debug lxc.net.[i].script.down : o LXC_HOOK_TYPE: 'up' 'down' o LXC_HOOK_SECTION: 'net' o LXC_NET_TYPE: (: 'vlan', 'macvlan', 'ipvlan', 'veth') o LXC_NET_PARENT: 'macvlan''veth''phys' o LXC_NET_PEER: 'veth' lxc.hook.version 1 lxc.hook.version lxc.hook.version 1 0 debug (DEVPTS) pseudo tty () lxc.pty.max pseudo tty pty pseudo tty () inittab lxc.console.buffer.size liblxc liblxc 4KB 'auto' liblxc 128KB 2 'KB''MB''GB' ( 1024 'KB' == 'KiB''MB' == 'MiB''GB' == 'GiB' 'kB''KB''Kb' ) lxc.console.size liblxc lxc.console.logfile liblxc 4KB 'auto' liblxc 128KB 2 'kB''MB''GB' ( 1024 'kB' == 'KiB''MB' == 'MiB''GB' == 'GiB' 'kB''KB''Kb' ) lxc.console.size lxc.console.buffer.size lxc.console.logfile lxc.console.buffer.size lxc.console.buffer.logfile lxc.console.rotate lxc.console.logfile API ".1" lxc.console.buffer.size lxc.console.buffer.logfile lxc.console.path 'none' 'none' /dev/console /dev/console /dev/console bind mount /dev/console TTY root inittab tty getty tty inittab getty tty getty /var/log/messages lxc.tty.max tty LXC bind Unix98 PTY /dev/console /dev/ttyN bind /dev LXC bind () /dev/console /dev/ttyN lxc.tty.dir /dev LXC /dev/console bind mount /dev/console /DEV lxc /dev fd, stdin, stdout, stderr rootfs lxc.autodev 1 rootfs LXC tmpfs /dev ( 500k lxc.autodev.tmpfs.size ) "systemd" "init" /dev lxc.hook.autodev lxc.autodev LXC /dev /dev 0 lxc.autodev.tmpfs.size /dev tmpfs 500000 (500K) /etc /var /home : LXC () /home/joe path path TOCTTOU lxc.mount.fstab fstab root proc proc proc nodev,noexec,nosuid 0 0 root /proc proc 3 (fs_vfstype) mount(8) auto lxc.mount.entry fstab LXC rshared rprivate 3 optional create=dir create=file relative dev/null proc/kcore none bind,relative 0 0 dev/null ${LXC_ROOTFS_MOUNT}/dev/null proc/kcore lxc.mount.auto o proc:mixed (or proc): /proc /proc/sys /proc/sysrq-trigger o proc:rw: /proc o sys:mixed (or sys): /sys/devices/virtual/net /sys o sys:ro: /sys o sys:rw: /sys o cgroup:mixed: /sys/fs/cgroup tmpfs cgroup cgroup cgroup o cgroup:mixed:force: force LXC cgroup cgroup:mixed cgroup LXC init cgroup o cgroup:ro: cgroup:mixed o cgroup:ro:force: force LXC cgroup cgroup:ro cgroup LXC init cgroup o cgroup:rw: cgroup:mixed cgroup cgroup /sys/fs/cgroup tmpfs o cgroup:rw:force: force LXC cgroup cgroup:rw cgroup LXC init cgroup o cgroup (): CAP_SYS_ADMIN cgroup:rw cgroup:mixed o cgroup-full:mixed: /sys/fs/cgroup tmpfs cgroup cgroup cgroup tmpfs cgroup /sys/fs/cgroup/$hierarchy cgroup o cgroup-full:mixed:force: force LXC cgroup cgroup-full:mixed cgroup LXC init cgroup o cgroup-full:ro: cgroup-full:mixed o cgroup-full:ro:force: force LXC cgroup cgroup-full:ro cgroup LXC init cgroup o cgroup-full:rw: cgroup-full:mixed cgroup ( CAP_SYS_ADMIN cgroup ) o cgroup-full:rw:force: force LXC cgroup cgroup-full:rw cgroup LXC init cgroup o cgroup-full (): CAP_SYS_ADMIN cgroup-full:rw cgroup-full:mixed cgroup cgroup init cgroup /sys/fs/cgroup tmpfs ( :mixed :ro /sys/fs/cgroup/$hierarchy ) Ubuntu mountall(8) /sys/fs/cgroup CAP_SYS_ADMIN /sys/fs/cgroup : lxc.mount.auto = proc sys cgroup lxc.mount.auto = proc:rw sys:rw cgroup-full:rw lxc.rootfs.path rootfs nbd nbd:file:1 file nbd 1 rootfs nbd:file nbd overlayfs:/lower:/upper rootfs /lower /upper overlayfs /lower loop:/file /file loop loop lxc.rootfs.mount root lxc.rootfs.path pivot_root(8) lxc.rootfs.options rootfs fstab LXC idmap= LXC rootfs idmapped ID rootfs chown idmapped idmap= LXC rootfs idmap "container" "container" rootfs idmap LXC lxc.rootfs.managed LXC 0 0 LXC 1 CONTROL GROUP ("CGROUP") CONTROL GROUP (lxc ) lxc cgroup Linux 4.5 cgroup "cgroup2" "unified hierarchy" cgroup "cgroup1" "legacy hierarchies" 2 cgroup LXC cgroup1 cgroup2 cgroup1 lxc.cgroup. cgroup2 lxc.cgroup2. LXC cgroup2 lxc.cgroup. cgroup1 lxc.cgroup2. cgroup cgroup 1 cgroup "pids" "cpu" "memory" 1 cgroup1 "devices.allow" "devices.deny" allowlistsdenylists allowlistallow rules denylistdeny rules cgroup2 BPF_PROG_TYPE_CGROUP_DEVICE eBPF cgroup LXC cgroup1 cgroup2 eBPF cgroup2 eBPF cgroup2 eBPF cgroup1 cgroup1 lxc.cgroup.devices.allow lxc.cgroup.devices.deny cgroup2 eBPF lxc.cgroup2.devices.allow lxc.cgroup2.devices.deny o denylist lxc.cgroup2.devices.deny = a LXC lxc.cgroup2.devices.allow o allowlist lxc.cgroup2.devices.allow = a LXC lxc.cgroup2.devices.deny o 2 o o lxc.cgroup2.devices.deny = a lxc.cgroup2.devices.allow = c *:* m lxc.cgroup2.devices.allow = b *:* m lxc.cgroup2.devices.allow = c 1:3 rwm allowlist /dev/null lxc.cgroup2.devices.allow = a lxc.cgroup2.devices.deny = c *:* m lxc.cgroup2.devices.deny = b *:* m lxc.cgroup2.devices.deny = c 1:3 rwm LXC denylist /dev/null lxc.cgroup2.devices.allow = a lxc.cgroup2.devices.deny = c *:* m lxc.cgroup2.devices.deny = b *:* m lxc.cgroup2.devices.deny = c 1:3 rwm lxc.cgroup2.devices.allow = a LXC lxc.cgroup2.devices.allow = a lxc.cgroup2.devices.deny = c *:* m lxc.cgroup2.devices.deny = b *:* m lxc.cgroup2.devices.deny = c 1:3 rwm lxc.cgroup2.devices.deny = a LXC allowlistdenylist lxc.cgroup.[control name].[controller file] cgroup (cgroup v1) control group LXC Linux lxc.cgroup.cpuset.cpus lxc.cgroup2.[controller name].[controller file] cgroup (cgroup v2) LXC Linux lxc.cgroup2.memory.high lxc.cgroup.dir cgroup "c1" lxc.cgroup.dir = my-cgroup/first "my-cgroup" cgroup cgroup cgroup "my- user" cgroup v1 cpuset root cgroup "/sys/fs/cgroup/cpuset/my-user/my-cgroup/first/c1" cgroup cgroup LXC cgroup lxc.cgroup.dir.container lxc.cgroup.dir lxc.cgroup.dir.monitor cgroup lxc.cgroup.dir lxc.cgroup.dir.container.inner lxc.cgroup.dir.monitor lxc.cgroup.dir.container lxc.cgroup.dir.monitor.pivot PID cgroup cgroup cgroup lxc.cgroup.dir.container.inner cgroup cgroup lxc.cgroup.dir.container lxc.cgroup.dir.container lxc.cgroup.dir.container lxc.cgroup.dir.monitor lxc.cgroup.relative LXC root cgroup 1 cgroup2 systemd LXC systemd root (capabilities) lxc.cap.drop (capability) "CAP_" CAP_SYS_MODULE sys_module capabilities(7) (lxc.cap.drop ) lxc.cap.keep "none" lxc "none" clone (lxc.namespace.clone)keep (lxc.namespace.keep)share (lxc.namespace.share.[namespace identifier]) lxc.namespace.clone /proc/PID/ns lxc.namespace.clone IPC lxc.namespace.clone=mount net ipc lxc.namespace.keep () /proc/PID/ns lxc.namespace.keep IPC lxc.namespace.keep=user net ipc PID init lxc.namespace.share.[namespace identifier] [namespace identifier] /proc/PID/ns lxc.namespace.share.[namespace identifier] PID lxc.namespace.share.net=42 lxc.namespace.share.[namespace identifier] lxc.namespace.share.pid=c3 liblxc lxc.namespace.share.[namespace identifier] lxc.namespace.share.user=/opt/c3 PID init LSM + PID liblxc lxc.time.offset.boot (boottime)(h)(m)(s)(ms)(us)(ns) lxc.time.offset.monotonic monotonic(h)(m)(s)(ms)(us)(ns) lxc.prlimit.[limit name] 2 'unlimited' "RLIMIT_" "RLIMIT_" RLIMIT_NOFILE "nofile" setrlimit(2) lxc SYSCTL lxc.sysctl.[kernel parameters name] /proc/sys sysctl sysctl sysctl(8). APPARMOR lxc apparmor apparmor apparmor cgroup lxc-container-default- cgns lxc-container-default lxc.apparmor.profile apparmor apparmor lxc.apparmor.profile = unconfined apparmor ( confined ) lxc.apparmor.profile = unchanged LXC AppArmor lxc.apparmor.profile = generated lxc.apparmor.allow_incomplete apparmor upstream apparmor 0 () apparmor apparmor 1 lxc.apparmor.allow_nesting 1 generated AppArmor lxcfs /dev/.lxc/proc /dev/.lxc/sys procfs sysfs generated AppArmor lxc.apparmor.raw AppArmor generated SELINUX lxc SELinux SELinux SELinux unconfined_t lxc /usr/share/lxc/selinux/lxc.te lxc.selinux.context SELinux unconfined_t lxc.selinux.context = system_u:system_r:lxc_t:s0:c22 lxc.selinux.context.keyring SELinux lxc.selinux.context lxc.selinux.context LXC lxc.selinux.context.keyring = system_u:system_r:lxc_t:s0:c22 Linux LXC lxc.keyring.session LXC 1 1 LXC lxc.keyring.session = 0 SECCOMP seccomp seccomp 1 2 1 2 1 2 "allowlist" 1 1 2 mknod mknod 0() 2 denylist mknod errno 0 ioctl notify "errno" LXC seccomp errno errno "errno" "notify" LXC seccomp "notify" poll seccomp lxc.seccomp.profile seccomp lxc.seccomp.allow_nesting 1 seccomp seccomp seccomp 0 lxc.seccomp.notify.proxy LXC seccomp UNIX unix:/path/to/socket unix:@socket UNIX (abstract) UNIX lxc.seccomp.notify.cookie seccomp PR_SET_NO_NEW_PRIVS PR_SET_NO_NEW_PRIVS execve() execve() (set-user-IDset-group-ID ) fork() clone() execve() PR_SET_NO_NEW_PRIVS AppArmor SELinux lxc.no_new_privs PR_SET_NO_NEW_PRIVS 1 UID id id 0 id 200000 root id id 0 20,000 200,000 220,000 lxc.idmap 4 'u' 'g' ID ID ID ID lxc.hook.version : o o ( 'lxc') o ('clone' 'pre-mount' ) o clone lxc-clone stop o LXC_CGNS_AWARE: cgroup namespace o LXC_CONFIG_FILE: o LXC_HOOK_TYPE: ( 'clone''mount''pre- mount') lxc.hook.version 1 LXC_HOOK_TYPE o LXC_HOOK_SECTION: ( 'lxc''net') lxc.hook.version 1 LXC_HOOK_TYPE o LXC_HOOK_VERSION: lxc.hook.version 0 1 o LXC_LOG_LEVEL: o LXC_NAME: o LXC_[NAMESPACE IDENTIFIER]_NS: /proc/PID/fd/ lxc.hook.version 1 o LXC_ROOTFS_MOUNT: root o LXC_ROOTFS_PATH: lxc.rootfs.path rootfs LXC_ROOTFS_MOUNT o LXC_SRC_NAME: clone debug lxc.hook.version 1 0 (: 'lxc', 'net') (: 'clone', 'mount', 'pre-mount') LXC_NAME () LXC_HOOK_SECTION LXC_HOOK_TYPE 1 LXC_[NAMESPACE IDENTIFIER]_NS 0 stop lxc.hook.pre-start tty lxc.hook.pre-mount rootfs rootfs (mounts propagation ) lxc.hook.mount pivot_root lxc.hook.autodev lxc.autodev == 1 pivot_root systemd autodev /dev /dev ${LXC_ROOTFS_MOUNT} lxc.hook.start-host init lxc.hook.start init lxc.hook.stop /proc/PID/ns mnt:/proc/PID/fd/12 lxc.hook.post-stop lxc.hook.clone lxc-clone(1) lxc.hook.destroy lxc.hook.start LXC_NAME LXC [-n] LXC_CONFIG_FILE [-f] LXC_CONSOLE [-c] [lxc.console.path] LXC_CONSOLE_LOGPATH [-L] LXC_ROOTFS_MOUNT rootfs [lxc.rootfs.mount] LXC_ROOTFS_PATH rootfs.mount [lxc.rootfs.path] LXC_SRC_NAME clone LXC_TARGET stop "stop" "reboot" LXC_CGNS_AWARE LXC cgroup 1 cgroup cgroup lxcfs lxc ERROR /var/log/lxc ( '.log' ) lxc-start lxc.log.level 0..8 0 = trace, 1 = debug, 2 = info, 3 = notice, 4 = warn, 5 = error, 6 = critical, 7 = alert, and 8 = fatal 5 (error) () level 1 debug lxc.log.file lxc.log.syslog syslog lxc.log.level syslog facility daemon, local0, local1, local2, local3, local4, local5, local5, local6, local7 LXC lxc.start.auto 0() 1() lxc.start.delay () lxc.start.order lxc.monitor.unshare 0 (pre- start ) unshare CAP_SYS_ADMIN 0 lxc.monitor.signal.pdeath lxc init lxc SIGKILL lxc 0 lxc.group 2 1 NULL 1 "onboot" LXC "onboot" lxc.start.auto == 1 lxc.start.order lxc.start.delay "onboot" LXC lxc.start.auto == 1 (NULL ) onboot ( init )lxc.environment () /proc/PID/environ 1 lxc.environment : lxc.environment = APP_ENV=production lxc.environment = SYSLOG_SERVER=192.0.2.42 /usr/share/doc/lxc/examples br0 veth () eth0 lxc.uts.name = myhostname lxc.net.0.type = veth lxc.net.0.flags = up lxc.net.0.link = br0 lxc.net.0.name = eth0 lxc.net.0.hwaddr = 4a:49:43:49:79:bf lxc.net.0.ipv4.address = 1.2.3.5/24 1.2.3.255 lxc.net.0.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3597 UID/GID id 0-9999 100000-109999 lxc.idmap = u 0 100000 10000 lxc.idmap = g 0 100000 10000 CONTROL GROUP control group cpuset.cpus cpu cpus.share control group (cpu) devices.allow lxc.cgroup.cpuset.cpus = 0,1 lxc.cgroup.cpu.shares = 1234 lxc.cgroup.devices.deny = a lxc.cgroup.devices.allow = c 1:3 rw lxc.cgroup.devices.allow = b 8:0 rw control group lxc.uts.name = complex lxc.net.0.type = veth lxc.net.0.flags = up lxc.net.0.link = br0 lxc.net.0.hwaddr = 4a:49:43:49:79:bf lxc.net.0.ipv4.address = 10.2.3.5/24 10.2.3.255 lxc.net.0.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3597 lxc.net.0.ipv6.address = 2003:db8:1:0:214:5432:feab:3588 lxc.net.1.type = macvlan lxc.net.1.flags = up lxc.net.1.link = eth0 lxc.net.1.hwaddr = 4a:49:43:49:79:bd lxc.net.1.ipv4.address = 10.2.3.4/24 lxc.net.1.ipv4.address = 192.168.10.125/24 lxc.net.1.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3596 lxc.net.2.type = phys lxc.net.2.flags = up lxc.net.2.link = random0 lxc.net.2.hwaddr = 4a:49:43:49:79:ff lxc.net.2.ipv4.address = 10.2.3.6/24 lxc.net.2.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3297 lxc.cgroup.cpuset.cpus = 0,1 lxc.cgroup.cpu.shares = 1234 lxc.cgroup.devices.deny = a lxc.cgroup.devices.allow = c 1:3 rw lxc.cgroup.devices.allow = b 8:0 rw lxc.mount.fstab = /etc/fstab.complex lxc.mount.entry = /lib /root/myrootfs/lib none ro,bind 0 0 lxc.rootfs.path = dir:/mnt/rootfs.complex lxc.rootfs.options = idmap=container lxc.cap.drop = sys_module mknod setuid net_raw lxc.cap.drop = mac_override SEE ALSO chroot(1), pivot_root(8), fstab(5) capabilities(7) SEE ALSO lxc(7), lxc-create(1), lxc-copy(1), lxc-destroy(1), lxc-start(1), lxc- stop(1), lxc-execute(1), lxc-console(1), lxc-monitor(1), lxc-wait(1), lxc-cgroup(1), lxc-ls(1), lxc-info(1), lxc-freeze(1), lxc-unfreeze(1), lxc-attach(1), lxc.conf(5) 2024-04-28 lxc.container.conf(5)