Hacker News Reader

Comment by neckardt | Hacker News Reader

I'm surprised nobody is mentioning LXC[1]. I'm by no means a containers expert, but they claim to be more secure since they default to running as non-root. Unlike docker, I had no trouble installing LXC with apt, while with docker I often got an outdated version. I'm now using LXC for all of my basic container applications (self hosting a wiki and a few other sites).

[1]: https://linuxcontainers.org/

View on HN

Because LXC has no marketing money like Docker. For me it's just one of these cool tools I use every day without giving it a second thought.

How is the tooling compared to Docker? Genuinely interested. Are there platforms like Portainer available? Is something like docker-compose possible?

LXC is a bit more simple than that; the modus-operandi is to unpack the rootfs of your favorite distro (ie, ubuntu, alpine) into the container and it runs /bin/init in that container. It essentially behaves like a full VM without the virtualization part.

Tooling would be things like Ansible to setup the container as if you would a normal linux system. Though to be honest, not many people invested in good tooling around LXC, it should be possible without problem to run a docker rootfs in LXC.

One reason it's not very popular (from my experience): Docker Desktop for macs, which makes Docker experience on mac os feel somewhat close to native. Meanwhile, to use LXC you'd have to work inside VM (Virtualbox or similar). Last 3 companies I worked for (in London) were almost 100% mac os (which is a little sad).

If you use "kind" to create a K8S cluster on MAC, using LXC is totally transparent. You can just load regular Docker images via "kind load docker-image". It even takes less RAM than minikube, because the running Docker VM is re-used.

lxc is awesome, wondering the same thing. Also has some niches in the kubernetes space. Using lxc for development DBs and private servers.

How do you create an image for LXC?

With docker, they have the docker.io service with all types of distros you can chose from.

You can use the following:

    lxc image import metadata.tar.gz rootfs.tar.gz --alias hello

Not sure which part of the process are you referring to though.

The project provides prebuilt images for all the common distros: https://us.images.linuxcontainers.org/

Use them in one command. For example:

    lxc launch images:debian/sid/amd64

Ubuntu, which I believe is the most popular image base in Docker, ships official cloud images, and you can also use these in one command:

    lxc launch ubuntu:bionic

That sounds dangerous:

    All images available on this server are
    generated using community supported, upstream
    LXC image templates

And:

    Note that the images found on this image server are
    unofficial images. Whenever possible, you should try
    to use official images from your Linux distribution
    of choice

That's no different from Docker's community images, is it? And as I pointed out, Ubuntu ships official images, which was demonstrated in my second command.

Don't know about Ubuntu because I use Debian.

docker.io calls their Debian images "official" and says they are maintained by two Debian developers.

Docker isn't up to date on the official Ubuntu (and debian too?) repos for some odd reason. A better way is either snap (snapcraft) or adding docker's own apt repository.

Aren't those images provided by Ubuntu and Debian? Then it would not be under the control of Docker which versions are provided.

docker.io provides Debian 10 as far as I can tell.

Docker (the daemon and tooling) is generally upstream-supplied (ie: docker provides apt repos etc).

Not uncommon for rapidly moving upstream. I wouldn't recommend running distro-supplied docker in general (and neither do docker).

Curated apt repos is nicer than snaps, IMNHO.

snap never works.

How cross-platform is LXC containers? Somehow I still use Vagrant in my pet project, since I want Windows and Mac users to have a dev environment in a few steps.

Reply on news.ycombinator.com