LXD, Incus and Proxmox all build on LXC, but you can also use the low-level LXC tools directly. This is lightweight, scriptable and needs no extra daemon, ideal for a few system containers on a Debian or Ubuntu server.
Before you start
- A Debian or Ubuntu server or KVM VPS with root.
- For a friendlier tool, see LXD and Incus.
Install LXC
sudo apt install -y lxc lxc-templates debootstrapCheck kernel support:
lxc-checkconfigNetworking with lxc-net
LXC can provide a NAT bridge lxcbr0 with DHCP. In /etc/default/lxc-net set USE_LXC_BRIDGE="true", then:
sudo systemctl enable --now lxc-netContainers attach to it through /etc/lxc/default.conf:
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = upFor public IPs, link to a host bridge such as br0 instead; see virtual networking.
Create a container
Using the download template (prebuilt images):
sudo lxc-create -n web01 -t download -- -d debian -r bookworm -a amd64sudo lxc-start -n web01sudo lxc-attach -n web01Set a password or add SSH keys inside, and install what you need.
Unprivileged containers
Root-created containers above are privileged. For better isolation, create containers as an unprivileged user with subordinate UID/GID ranges (/etc/subuid, /etc/subgid) and an ~/.config/lxc/default.conf containing lxc.idmap lines. See the LXC documentation for the full setup on your distribution.
Resource limits
Add to /var/lib/lxc/web01/config (cgroup v2):
lxc.cgroup2.memory.max = 1G
lxc.cgroup2.cpu.max = 100000 100000The CPU line allows one CPU's worth of time. Restart the container to apply.
Autostart and management
lxc.start.auto = 1Add that to the container config, then use these commands:
| Task | Command |
|---|---|
| List | lxc-ls -f |
| Stop | lxc-stop -n web01 |
| Snapshot | lxc-snapshot -n web01 |
| Copy | lxc-copy -n web01 -N web02 |
| Destroy | lxc-destroy -n web01 |
Troubleshooting
- No IP in container: lxc-net not running or firewall blocks DHCP on lxcbr0.
- Download template fails: network or image server unreachable; check DNS and proxies.
- Limits ignored: use the cgroup2 keys on cgroup v2 systems.
Frequently asked questions
Plain LXC or LXD/Incus?
Plain LXC is minimal and scriptable; LXD/Incus add images, clustering, a REST API and easier storage and networking.
Can I run Docker in an LXC container?
Yes with nesting enabled, though a VM is more robust for heavy Docker use.
Is LXC secure for untrusted users?
Use unprivileged containers, and prefer VMs for untrusted multi-tenant workloads; see containers vs VMs.