LXD,LXC containers security

Question

I just want to know dose the Linux containers (LXD) provide security?

Such that if on container get infected with a virus will that effect the entire system (kernel+other containers) Or it will effect just that container ?

Answer 1

As with all packages, LXC has had security issues, see Where are lxc containers security borderlines?

and https://wiki.ubuntu.com/LxcSecurity

There are vulnerabilities reported with some regularity - http://www.ubuntu.com/search?q=LXC+USN

Basically, in a nut shell, as LXC uses the host kernel, any kernel vulnerabilities will exist in LXC as well.

IMHO you should confine your containers with apparmor. https://help.ubuntu.com/12.04/serverguide/apparmor.html

Otherwise, IMHO, your question is quite broad.

Answer 2

It will affect just the container as the container will run having its own namespaces:

• PID namespace

• Mount namespace

• IPC namespace

• Network namespace

• UTS namespace

• User namespace

Unless a vulnerability has the ability to break out of this namespace boundary to get into the host system, it won't affect the host system by any means.

Note that, in the past, several vulnerabilities were discovered in lxc, so you should look out for lxc related CVEs regularly to be on the safer side.

Also, as an extra layer of security lxc uses apparmor for resource confinement, the relevant AppArmor profiles are defined in /etc/apparmor.d/lxc/.