{"id":170095,"date":"2026-04-30T12:24:29","date_gmt":"2026-04-30T10:24:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-instrumentariev-dlya-upravleniya-kontejnerami-lxc-7-0-i-lxd-6-8"},"modified":"2026-04-30T12:24:29","modified_gmt":"2026-04-30T10:24:31","slug":"vypusk-instrumentariev-dlya-upravleniya-kontejnerami-lxc-7-0-i-lxd-6-8","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-instrumentariev-dlya-upravleniya-kontejnerami-lxc-7-0-i-lxd-6-8","title":{"rendered":"Release of LXC 7.0 and LXD 6.8 container management tools","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Linux Containers community has released the 7.0 toolset for managing isolated LXC containers, providing a runtime suitable for both running containers with a full system environment, similar to virtual machines, and for executing unprivileged containers for individual applications (OCI). LXC is a low-level tool that operates on the container level. For centralized management of containers deployed in a cluster of multiple servers, systems like Incus and LXD are being developed based on LXC. The LXC 7.0 branch is classified as a long-term support release, with updates provided over a period of 5 years (until 2031). The LXC code is written in C and distributed under the GPLv2 license.<\/p>\n
LXC includes the liblxc library, a set of utilities (lxc-create, lxc-start, lxc-stop, lxc-ls, etc.), templates for building containers, and a set of bindings for various programming languages. Isolation is implemented using the standard mechanisms of the Linux kernel. The namespace mechanism is used for isolating processes, network stacks, ipc, uts, user IDs, and mount points. Resource limits are enforced using cgroups. Kernel features such as Apparmor and SELinux profiles, Seccomp policies, Chroots (pivot_root), and capabilities are utilized to reduce privileges and restrict access. <\/p>\n
Key Changes:<\/p>\n
\n
Process monitoring isolation is implemented using the Landlock mechanism, which allows unprivileged programs to drop unnecessary privileges for their operation, voluntarily limiting their further access to the system for enhanced security. Landlock is used to restrict monitoring API handlers to operate only with the container and prohibit access to files outside of it. Protection is applied during the assembly of landlock-monitor.\n
The configuration of handlers (hook) and containers (runtime) has been separated. New settings lxc.environment.hooks and lxc.environment.runtime have been added, allowing selective assignment of environment variables only for the containers, without passing them to hook handlers, and vice versa.\n
Support for cgroup v1 has been discontinued, as well as for Linux kernels that do not support PIDFD and the new mount management API.\n
A vulnerability (CVE-2026-39402) has been fixed that allows bypassing authorization and achieving the deletion of OVS (OpenVswitch) ports through manipulation with the command «lxc-user-nic delete». This vulnerability enables an unprivileged user to disable network interfaces for containers run by other users.\n<\/ul>\n
![\"Release](\"\/wp-content\/uploads\/2026\/04\/793d803652f3b43fe3b19b005e7b649b.jpg\")
<\/p>\n![\"Release](\"\/wp-content\/uploads\/2026\/04\/66f6f05644f4a917bb54c908c66ad553.png\")
<\/p>\n![\"Release](\"\/wp-content\/uploads\/2026\/04\/37b68c4c5fae475940a7aa8494e0febc.png\")
<\/p>\n![\"Release](\"\/wp-content\/uploads\/2026\/04\/5647d5327697521591fe7d198c0c63a3.png\")
<\/p>\n<\/ul>\n