Chroot seals off parts of a directory tree against a break-out, thus isolating users, groups, or special services in an area that is harmless for the rest of the system. FreeBSD refined the concept with "Jails," Solaris with "Zones," and Linux with container services such as LXC [1]. LXC does not use virtual machines, like VMware, but creates a virtual environment with its own processes, but using a shared kernel on the host system.

Getting Started

The following exercise uses Debian 8.0 "jessie" as the host, but it can also be transferred to other systems like openSUSE or Ubuntu with minor changes.

To begin, you need to install the lxc, lxctl, and libvirt-bin packages, including the dependencies required by the package manager (e.g., debootstrap). If you have a custom kernel, you need to enable control groups (cgroups), which you can check with the command:

lxc-checkconfig

Depending on the installation source, creating the root filesystem for a container can take some time. On Debian, perform this task with the command:

$ LANG=en_US.UTF-8 SUITE=jessie MIRROR=http://httpredir.debian.org/debian lxc-create -n debian8 -t debian

The LANG switch defines the language settings, and SUITE defines the desired template. The -n option lets you assign the container name (Figure 1). Subsystem templates created with the -t option come from the /usr/share/lxc/templates/ directory. However, you have shorter way to accomplish the same thing, as an alternative proposal from the Debian wiki [2] for creating the container shows:

Figure 1: When you create a new container, LXC downloads all the required elements and more or less sets up a turnkey system.

$ lxc-create -n debian8 -t debian -- -r jessie

After successful installation, the procedure ends by outputting a randomly generated root password, which you should write down and change with the passwd command when you first log in to the container. Entering lxc-ls lists all existing containers.

To access the container you just created at a local level, launch it with the

lxc-start -n debian8 -d

command. As with almost all lxc commands, you use the -n option to name the container (Figure 2). Make sure you enter the -d option when starting; otherwise, the login prompt appears, and you cannot kill it in the same terminal! Now request a console with the login prompt:

Figure 2: After launching the container, you can log in via a terminal.

lxc-console -n debian8

To help you discover the status and process ID of an active container and to stop the current container, use the

lxc-info -n <container>
lxc-stop -n <container>

commands. For a selection of the most important control programs, see Table 1.

Network

To access the container on the network, you need to adjust the network settings on the host and guest. In both cases you need to edit the /etc/network/interfaces file. Additionally, you need to configure the network settings for the container in /var/lib/lxc/<Container>/config. To address the container with its own name on the LAN, add an entry to /etc/hosts (see the box "Network Configuration"); then, run adduser <user> to create a user in the container. Now enter

/etc/init.d/networking restart

systemctl status sshd.service

to check whether the SSH server is running in the container (Figure 3). When you pop up a new terminal, log in with

Figure 3: Checking the status of the SSH daemon inside the container.

ssh <user>@<container>

and respond to the prompt for the new SSH keys; the login to the shell should work. You can log off again by typing exit.

Cloning Containers

To create a clone of the debian8 container, you just type:

lxc-clone -o original -n new

But this only works if you stop the guest system first. Cloning in our lab took about 20 seconds. Next, change the IP address under /var/lib/lxc/debian_clone/config and /var/lib/lxc/debian_clone/rootfs/etc/network/interfaces to suit your needs. You also need to add an appropriate entry for the cloned container to the hosts files. When you start the cloned container, try to open a connection via SSH. The configuration file of the clone might have more entries than those of the original – this is normal.