Canonical release of the toolkit for organizing work of isolated containers , container manager and virtual file system for simulating in containers /proc, /sys, and a virtual representation of cgroupfs for distributions without namespace support for cgroup. Branch 4.0 is categorized as a long-term support release, with updates provided for 5 years
LXC is a runtime for running both system containers and containers for individual applications (OCI). It includes the liblxc library, a set of utilities (lxc-create, lxc-start, lxc-stop, lxc-ls, etc.), templates for building containers, and a set of bindings for various programming languages. Isolation is achieved using the native mechanisms of the Linux kernel. The namespaces mechanism is used for isolating processes, network stack ipc, uts, user IDs, and mount points. Cgroups are used for resource limitation. To lower privileges and restrict access, kernel features such as Apparmor profiles, SELinux policies, Seccomp, Chroots (pivot_root), and capabilities are employed. The LXC code is written in C and released under the GPLv2 license.
LXD is an extension on top of LXC, CRIU, and QEMU used for centralized management of containers and virtual machines on one or multiple servers. While LXC is a low-level toolkit for manipulating at the level of individual containers, LXD is implemented as a background process that accepts requests over the network via a REST API and allows the creation of scalable configurations deployed on a cluster of multiple servers.
Various storage backends are supported (directory tree, ZFS, Btrfs, LVM), snapshots with state capture, live migration of running containers from one machine to another, and tools for organizing image storage. The LXD code is written in Go and released under the Apache 2.0 license.
Key in LXC 4.0:
- The driver for cgroup operations has been completely rewritten. Support for the unified hierarchy of cgroup (cgroup2) has been added. Functionality for the freezer controller has been introduced, which allows stopping operations in cgroup and temporarily freeing up certain resources (CPU, I/O, and potentially even memory) for other tasks;
- Infrastructure has been implemented for intercepting system calls;
- Support has been added for the kernel subsystem "pidfd," designed to handle situations involving PID reuse (pidfd is linked to a specific process and does not change, while PID can be associated with a different process after the current one associated with that PID finishes);
- Improved creation and deletion of network devices, as well as their movement between network subsystem namespaces;
- The ability to move wireless network devices (nl80211) into containers has been implemented.
Key in LXD 4.0:
- Support has been added for launching not only containers but also virtual machines;
- For segmenting LXD servers, the concept of projects has been proposed, simplifying the management of groups of containers and virtual machines. Each project can include its own set of containers, virtual machines, images, profiles, and storage pools. Custom limits and settings can be defined in relation to projects;
- Support for intercepting system calls for containers has been added;
- The creation of environment backups and restoration from them has been implemented;
- Automated creation of snapshots for environments and storage pools has been ensured, with options for specifying snapshot retention time;
- An API has been added for monitoring the state of the network (lxc network info);
- Support added , a virtual FS for mapping mount points to user ID namespace;
- New types of network adapters "ipvlan" and "routed" have been proposed;
- A backend for using CephFS-based storage has been added;
- Support for image replication and multi-architecture configurations has been implemented for clusters;
- The ability to manage access based on roles (RBAC) has been added;
- Support for CGroup2 has been added;
- The ability to configure MAC addresses and define the source address for NAT has been added;
- An API for managing DHCP bindings (leases) has been added;
- Support for Nftables has been added.
Source: opennet.ru
