The Linux Containers community has released version 6.0 of the LXC toolkit for managing isolated LXC containers, providing a runtime suitable for both full-system environment containers akin to virtual machines and for running unprivileged containers of individual applications (OCI). LXC is considered a low-level toolkit operating at the individual container level. For centralized management of containers deployed in a multi-server cluster, the Incus and LXD systems are being developed based on LXC. The LXC 6.0 branch is classified as a long-term support release, with updates provided for 5 years (until 2029). The LXC code is written in C and distributed under the GPLv2 license.
LXC includes the liblxc library, a set of utilities (lxc-create, lxc-start, lxc-stop, lxc-ls, etc.), templates for building containers, and a set of bindings for various programming languages. Isolation is implemented using the standard mechanisms of the Linux kernel. The namespace mechanism is used for isolating processes, network stacks, ipc, uts, user IDs, and mount points. Resource limits are enforced using cgroups. Kernel features such as Apparmor and SELinux profiles, Seccomp policies, Chroots (pivot_root), and capabilities are utilized to reduce privileges and restrict access.
Key Changes:
- The ability to build a universal executable file lxc has been introduced, combining all commands previously distributed as separate 'lxc-*' utilities into one tool. For creating this consolidated executable, the option 'tools-multicall=true' can be set, under which all old separate utilities are created as symbolic links to the lxc utility. Building as a single executable file significantly reduces the tool's disk space consumption, which is relevant for embedded systems.
- The liblxc library has added the function set_timeout, allowing the setting of a timeout for any interactions with the LXC monitor.
- In the network bridge interface lxcbr0, IPv6 ULA (Unique Local Address) addresses are enabled by default. support for IPv6 with addresses from the IPv6 ULA subnet.
- In the lxc-usernsexec utility, the options '-u' and '-g' have been added to change the user and group identifiers (UID and GID).
- In the lxc-checkconfig utility, the version is displayed only if the lxc-start command is present, and information about the maximum allowable number of each type of namespace has been added.
- Support for container images in the OCI format has been added, where the Squashfs file system is used to compress information.
- For interaction with systemd via D-Bus, a separate libdbus-1 library is used instead of libsystemd.
- Support for the Upstart initialization system has been discontinued.
The release of the Incus project has been announced, in which the Linux Containers community is developing a fork of the LXD container management system, created by the original developers who once built LXD. The Incus code is written in Go and is distributed under the Apache 2.0 license. Incus 6.0 is positioned as the first stable branch for which a long-term update cycle (LTS) will be provided. Notable changes in Incus 6.0 include the ability to create network interfaces via the API bridge.external_interfaces, improved authentication support through JWT (JSON Web Token), USB support, and detailed system information display in the command 'incus info —resources', along with support for LXD 5.21 in the lxd-to-incus utility.
Incus and LXD provide tools for centralized management of containers and virtual machines deployed both on a single host and in a cluster of multiple hosts. serversThe project is implemented as a background process that accepts network requests via REST API and supports various storage backends (directory trees, ZFS, Btrfs, LVM), snapshots with state capture, live migration of running containers from one machine to another, and tools for storing container images. LXC toolkit is used as the runtime for launching containers. Isolation is achieved using standard Linux kernel mechanisms (namespaces, cgroups, Apparmor, SELinux, Seccomp).
The Linux Containers community oversaw the development of LXD until Canonical decided to transform LXD into an enterprise project. The goal of the fork is to provide a managed, community-independent alternative to the Canonical-controlled LXD project. The creation of Incus also allowed for addressing some conceptual errors made during the development of LXD, which could not be fixed before without breaking backward compatibility.
Canonical has released a new version of the container management system LXD 5.21.1. The LXD 5.21 branch is marked as LTS and will be supported until June 2029. The code added to LXD by Canonical employees is licensed under AGPLv3, but the code from third-party contributors, over which Canonical has no ownership rights, remains under Apache 2.0. Among the functional changes in LXD 5.21.1 is the migration of the LXD snap package to the LXC 6.0 and LXCFS 6.0 branches. An extension `storage_volumes_all` has been added to the API, along with the associated handler `/1.0/storage_volumes` to output a list of all storage partitions. The `instances_files_modify_permissions` extension has been added to modify access rights to existing files through the API.
The release of the virtual filesystem LXCFS 6.0 is now available, used for simulating the pseudo-filesystems `/proc` and `/sys` in containers, as well as for virtualizing the cgroupfs representation for distributions lacking namespace support for cgroups. The new version introduces the `--enable-cgroup` option, allowing control over enabling built-in functionality for creating a virtual cgroupfs tree for containers, using cgroupv1 (currently, most distributions support kernel-provided namespaces for cgroups, so enabling the built-in alternative implementation by default has lost relevance and is now optional). Additionally, CPU filtering has been removed in LXCFS 6.0 when generating the file `/sys/devices/system/cpu`, depending on the online/offline state.
Source: opennet.ru
