Canonical has released version 5.0 of the LXD container manager and the LXCFS 5.0 virtual file system. The LXD code is written in Go and is distributed under the Apache 2.0 license. The 5.0 branch is classified as a long-term support release, with updates being provided until June 2027.
LXC tools, used as the runtime for launching containers, include the liblxc library, a set of utilities (lxc-create, lxc-start, lxc-stop, lxc-ls, etc.), container build templates, and a set of bindings for various programming languages. Isolation is achieved using standard Linux kernel mechanisms. Namespace mechanisms are used for isolating processes, network stacks, IPC, UTS, user IDs, and mount points. Resource limits are enforced through cgroups. Kernel capabilities like Apparmor and SELinux profiles, Seccomp policies, Chroots (pivot_root), and capabilities are utilized for privilege reduction and access control.
In addition to LXC, LXD also employs components from the CRIU and QEMU projects. While LXC serves as a low-level tool for handling individual containers, LXD provides means for centralized management of containers deployed within a multi-host cluster. serversLXD is implemented as a background process that accepts network requests via a REST API and supports various storage backends (directory trees, ZFS, Btrfs, LVM), snapshots for state capture, live migration of running containers from one machine to another, and tools for storing container images. LXCFS is used to simulate pseudo-filesystems /proc and /sys in containers, as well as a virtualized view of cgroupfs to present containers as regular independent systems.
Key Improvements:
- The capability for hot-plugging and unplugging disks and USB devices. In the virtual machine, the new disk is identified by the appearance of a new device on the SCSI bus, and a USB device is identified by the generation of a USB hotplug event.
- LXD can now be launched even when a network connection cannot be established, for example, due to the absence of a required network device. Instead of outputting an error when starting LXD, it now launches the maximum possible number of environments under the current conditions, while the remaining environments will be started once the network connection is established.
- A new role for cluster members has been added — ovn-chassis, intended for clusters that use OVN (Open Virtual Network) for network interaction (by assigning the ovn-chassis role, servers can be designated to perform OVN router functions).
- An optimized mode for updating the contents of storage sections has been proposed. In previous releases, updating involved first copying the container instance or section, for example, using the send/receive functionality in ZFS or Btrfs, after which the created copy was synchronized by launching the rsync program. To improve the efficiency of the update, of virtual machines advanced migration logic has been implemented in the new release, where, if the source and target servers use the same storage pool, snapshots and send/receive operations are applied automatically instead of rsync.
- The logic for identifying environments in cloud-init has been reworked: instead of environment names, UUID is now used as the instance-id.
- Support has been added for intercepting the system call sched_setscheduler, allowing unprivileged containers to change process priorities.
- The option lvm.thinpool_metadata_size has been implemented, which controls the size of metadata in the thinpool.
- The format of the network information file for LXC has been redesigned. Support has been added for binding interface data, network bridges, VLANs, and OVN networks.
- Minimum component version requirements have been increased: Linux kernel 5.4, Go 1.18, LXC 4.0.x, and QEMU 6.0.
- LXCFS 5 adds support for the unified cgroup hierarchy (cgroup2) and implements /proc/slabinfo and /sys/devices/system/cpu, with the meson toolchain used for assembly.
Source: opennet.ru
