Run LXC system containers with LXD or Incus on Ubuntu

LXC system containers behave like lightweight virtual machines: each has its own init, users, packages and IP, but shares the host kernel. LXD (by Canonical) and its community fork Incus make LXC easy to manage on Ubuntu. They work even inside a normal KVM VPS, no nested virtualization needed.

Before you start

• Ubuntu 22.04 or 24.04 with sudo, on a VPS or server with a few GB of free disk.
• Understand containers vs virtual machines.
• Pick one tool. Commands below show LXD (lxc); Incus uses the same syntax with incus.

Install LXD or Incus

LXD via snap:

sudo snap install lxd

Or Incus from Ubuntu 24.04's repositories:

sudo apt install -y incus

Add your user to the group (lxd or incus-admin) and log in again:

sudo usermod -aG lxd $USER

Initialise storage and networking

lxd init

Accept defaults for a single host: a new storage pool (ZFS or btrfs on a loop file, or dir for simplicity) and a NAT bridge lxdbr0. Use incus admin init for Incus.

Launch a container

lxc launch ubuntu:24.04 web01

On Incus use image names like images:ubuntu/24.04. Then:

lxc list

lxc exec web01 -- bash

Limit resources

lxc config set web01 limits.cpu 2

lxc config set web01 limits.memory 2GiB

Limits apply live through cgroups.

Expose a service

Containers sit behind NAT on lxdbr0. Forward host port 80 to the container with a proxy device:

lxc config device add web01 http proxy listen=tcp:0.0.0.0:80 connect=tcp:127.0.0.1:80

Open the port in your firewall too; see firewall basics.

Snapshots and backups

lxc snapshot web01 before-update

lxc restore web01 before-update

lxc export web01 web01-backup.tar.gz

Run Docker inside a container

Enable nesting first, then install Docker inside:

lxc config set web01 security.nesting true

Troubleshooting

• Containers have no internet: host firewall (UFW) is blocking forwarding on lxdbr0; allow routed traffic on that bridge.
• Permission denied on socket: group membership not active; log out and in.
• Docker fails inside container: enable security.nesting and restart the container.

Frequently asked questions

LXD or Incus?

Both are similar. Incus is community-run under the Linux Containers project; LXD is maintained by Canonical. Pick whichever your distribution packages best.

Can LXD run VMs too?

Yes, with --vm, but that requires KVM on the host.

Can I run Windows in an LXC container?

No. Containers share the Linux kernel, so only Linux distributions work.

Next steps

• Containers vs virtual machines
• Install Docker and Portainer
• KVM vs OpenVZ vs LXC