Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LXC and LXD: a different container story

lwn.net

Post reply on HN
Print view View original

21–30 of 102 posts

Re: LXC and LXD: a different container story

#21

Post by discardedrefuse »

Dwedit wrote: post #18
jordemort wrote: post #12

Hi, author of the article, pleased to see it here! I'd really like to hear more from folks about how they're using LXC and/or LXD, and what they think their greatest strengths are compared to Docker or Kubernetes.

I'm using LXC just to have a painless way to have a second SSH server (for SFTP) running on the computer that has different usernames and passwords. Literally all that is installed is Alpine Linux and the SSH server. There's a symbolic link to get to the shared files.

Similar use case for me. But instead of SSH/SFTP I was running Caddy with the file_server directive!

I've since switched to podman because my installation on Alpine Edge kept breaking on updates and I don't want to use Snap. Someone mentioned OpenSuse had it in their package manager and its been stable. Maybe I'll check that out in the future.

Re: LXC and LXD: a different container story

#22

Post by discardedrefuse »

divbzero wrote: post #11

Does LXC and LXD support the functional equivalent of Dockerfile or docker-compose.yml? I appreciate how Docker has become widely accepted for defining reproducible environments but have always found it to be rather heavy on resources.

Not really. But LXD containers are built by layering commands. I use a bash script with the commands to create reproducible containers.

That said, LXD is good for containerizing OS's, not single applications. So when you say "defining reproducible environments" you can get reproducible containers, but not so much environments. In that sense, it behaves more like a VM.

Re: LXC and LXD: a different container story

#23

Post by tinus_hn »

divbzero wrote: post #11

Does LXC and LXD support the functional equivalent of Dockerfile or docker-compose.yml? I appreciate how Docker has become widely accepted for defining reproducible environments but have always found it to be rather heavy on resources.

And, newly, a licensing hassle.

Re: LXC and LXD: a different container story

#24

Post by ncphil »

My shop went from VMware to OpenShift around the time I transitioned from systems to whatever it is I do now. In my private life I've used kvm since it was first rolled out, but over the last few years have redeployed all my home services to docker. I did try lxc for a while, and think it could replace kvm for lab work. On the other hand, lxd never seemed worth the effort: especially with its snapd dependency. Podman seems like a good alternative to docker, but I'm not sure migrating to it would be worth the effort as long as docker sticks around.

Re: LXC and LXD: a different container story

#25

Post by pxc »

discardedrefuse wrote: post #15

I ran LXD for about a year in my home lab. Unfortunately, the easiest way to get it running is by installing Snap; which I didn't do. Instead I ran it on Alpine Edge (one of the few distros that actually has it in their package manager). LXD kept breaking after system updates and I got tired of troubleshooting. I suppose that's just part of the perils of running bleeding edge. When LXD was running, I found that it fe…

> Unfortunately, the easiest way to get it running is by installing Snap; which I didn't do. Instead I ran it on Alpine Edge (one of the few distros that actually has it in their package manager).

Enabling LXD is a one-liner on NixOS:

    virtualisation.lxd.enable = true;
LXC and LXD are a somewhat common approach for NixOS users who want to quickly try something out in the environment of a traditional distro. :)

Re: LXC and LXD: a different container story

#26

Post by Helmut10001 »

4oo4 wrote: post #10

I use both lxc and docker and have uses cases for both, I think it really comes down to how stateful something is or how lazy I feel about writing a Dockerfile. I had a really hard time with learning lxd and really only got into using lxc without the daemon. One trend with docker that I personally don't like is that a lot of projects prefer docker-compose over regular Dockerfiles (though some of them support both), a…

I use Docker in unprivileged LXC* for the mere benefit of separation of concerns [1]. I don't use VMs for this because I am limited memory wise, and LXC allow me to share all host resources. I use docker because I don't want to mess with the way authors expect their dependencies to be set up - which is easy to circumvent by settling on a docker-compose.yml. Nix [2] appears to be the best future successor for my setup, but it is not used as widely yet.

* Afaik, this only works on Proxmox, not LXC in bare Debian, because Proxmox uses a modified Debian Kernel with some things taken from Ubuntu.

    [1]: https://du.nkel.dev/blog/2021-03-25_proxmox_docker/
    [2]: https://nixos.org/

Re: LXC and LXD: a different container story

#27

Post by fuzzy2 »

I fucking love LXC! It allowed me to “virtualize” several physical servers on a single newer server, keeping all of the original setup (except some networking changes). Combined with ipvlan, I could even work around the MAC address restriction of my server provider, with both IPv4 and IPv6.

I also use it to host a Jitsi instance. Jitsi is rather picky about the underlying distribution.

All this without the overhead of an actual virtual machine of course.

The only pain I have with LXC is its behavior when errors occur. It’s not easy to tell what’s wrong, the error messages are worthless. Sometimes the debug log can help, sometimes not so much.

Re: LXC and LXD: a different container story

#29

Post by sreevisakh »

ncphil wrote: post #24

My shop went from VMware to OpenShift around the time I transitioned from systems to whatever it is I do now. In my private life I've used kvm since it was first rolled out, but over the last few years have redeployed all my home services to docker. I did try lxc for a while, and think it could replace kvm for lab work. On the other hand, lxd never seemed worth the effort: especially with its snapd dependency. Podman…

I use LXD these days and I love it. It's easy enough to deploy without knowing too much internal details. Its CLI is also intuitive and well designed. It's true that LXD doesn't support installation outside snap. However, many distros like Alpine, Arch and Gentoo support its installation on bare metal from their software repos.

Re: LXC and LXD: a different container story

#30

Post by weinzierl »

4oo4 wrote: post #10

I use both lxc and docker and have uses cases for both, I think it really comes down to how stateful something is or how lazy I feel about writing a Dockerfile. I had a really hard time with learning lxd and really only got into using lxc without the daemon. One trend with docker that I personally don't like is that a lot of projects prefer docker-compose over regular Dockerfiles (though some of them support both), a…

> " [..] which are just shell scripts for bootstrapping and configuring your container and pretty common between distros. "

I find it a big advantage that this builds the containers basically from scratch and you only have to trust the distro and not any other parties. I'm always feeling uneasy with images which are hard to inspect and whose provenance is opaque and potentially involved multiple parties.

That, combined with running them unprivileged, should make a fairly secure system. Unfortunately I had great difficulty to create an unprivileged Debian LXC container with this method. If I remember correctly you have to create the privileged container first and then use a tool to fix-up uid and gid. If anyone knows an easier way to do it, I would be grateful to know.

EDIT: I think I used the following to create the container:

    lxc-create -n  -t debian -- -r stretch
It uses deboostrap for the build.
Post reply on HN