Is it possible to start LXC container inside another LXC container?
Is it possible to start LXC container inside LXC container
lxc
Related Topic
- Running systemd based container in LXC
- LXC – quota inside container
- LXC Container Networking
- Openvpn – How to create /dev/tun device inside unprivileged LXC container
- How to migrate a regular LXC container to a Proxmox LXC container
- Iptables – ip_conntrack_ftp inside LXC
- Docker Inside LXC: Starting Container Process Caused ‘Apply Caps: Operation Not Permitted’
Best Answer
I'm going to dispel a few myths here.
I don't see how this is a bad idea. It's really just a chroot inside a chroot. On one hand, it could possibly decrease performance in some negligible manner (nothing compared to running a VM inside a VM). On the other hand, it's likely to be more secure (e.g. more isolated from the root host system and it's constituents).
I agree 100% with the poster's following comment. Furthermore, I think it's safe to assume that everybody who posts a question on here likely thinks that they have a real reason to do [ it ]..
I actually came across this question back in June when I was first diving into LXC for PaaS/IaaS projects, and I was particularly interested in the ability to allow users to emulate cloud environments for development purposes.
I laughed a little bit when I read this one, but that's not, at all, the case :)
Anyway, I eventually set up a VirtualBox environment with a stock install of Ubuntu 12.04 LTS Server Edition after reading all this, thinking that this was 100% possible. After installing LXC, I created a new container, and installed LXC inside the container with apt-get. Most of the installation progressed well, but resulted in error eventually due to a problem with the cgroup-lite package, whose upstart job failed to start after the package had been installed.
After a bit of searching, I came across this fine article at stgraber.org (the goodies are hiding under the "Container Nesting" section):
Installing that AppArmor policy and restarting the daemon did the trick (don't forget to change the network ranges, though!). In fact, I thought that particular snippet was so important that I mirrored it @ http://pastebin.com/JDFp6cTB just in case the article ever goes offline.
After that,
sudo /etc/init.d/cgroup-lite start
succeeded and it was smooth sailing.So, yes, it is possible to start an LXC container inside of another LXC container :)