lxc.container.conf(5) lxc.container.conf(5) (NAME) lxc.container.conf - LXC (DESCRIPTION) LXC . 2008 . . LXC (VM) . (namespaces) (mandatory access control) (control groups) . LXC (unprivileged) . . (user namespaces) . LXC . UID GID . (mapping) UID GID () UID GID . UID GID . UID GID 0 UID GID 100000 . user_namespaces . UID GID lxc.idmap . . key = value . <<#>> () . (capabilities) cgroups . LXC . lxc.net.0 lxc.net.0.type lxc.net.0.link lxc.net.0.ipv6.address . (CONFIGURATION) . . . lxc.include . lxc . (ARCHITECTURE) . . . lxc.arch . : x86, i686, x86_64, amd64 (HOSTNAME) utsname . . . lxc.uts.name . (HALT SIGNAL) init . init . kill(1) SIGPWR SIGRTMIN+14 SIGRTMAX-10 . SIGPWR . lxc.signal.halt (REBOOT SIGNAL) . kill(1) SIGTERM SIGRTMIN+14 SIGRTMAX-10 . SIGINT . lxc.signal.reboot (STOP SIGNAL) . kill(1) SIGKILL SIGRTMIN+14 SIGRTMAX-10 . SIGKILL . lxc.signal.stop (INIT COMMAND) init . lxc.execute.cmd rootfs . lxc-execute . lxc.init.cmd rootfs init. lxc-start . /sbin/init . (INIT WORKING DIRECTORY) . LXC init . lxc.init.cwd . (INIT ID) UID/GID init . UID (non-root) . UID/GID . : UID(0), GID(0) lxc.init.uid UID init. lxc.init.gid GID init. (CORE SCHEDULING) . . (cross hyper thread attacks) . lxc.sched.core 0 1 . 1 0 . . (PROC) proc . lxc.proc.[proc file name] proc . /proc/PID/ . : lxc.proc.oom_score_adj = 10 (EPHEMERAL) . lxc.ephemeral 0 1 . 1 . (NETWORK) . . . . lxc.net . lxc.net.[i].type . . i lxc.net.* . lxc.net.0.type = veth lxc.net.1.type = veth . i . lxc.net.0.link = br0 lxc.net.0.type . : empty: loopback . veth: . lxc.net.[i].veth.mode veth . bridge router . bridge . bridge lxc.net.[i].link . veth . . lxc . router IP veth . Proxy ARP Proxy NDP veth IP . lxc lxc.net.[i].veth.pair lxc ( ). lxc.net.[i].veth.ipv4.route lxc.net.[i].veth.ipv6.route . . x.y.z.t/m 192.168.1.0/24. bridge VLAN lxc.net.[i].veth.vlan.id . 'none' VLAN . lxc.net.[i].veth.vlan.tagged.id VLAN . vlan: vlan lxc.net.[i].link . vlan lxc.net.[i].vlan.id . macvlan: macvlan lxc.net.[i].link . lxc.net.[i].macvlan.mode macvlan macvlan (upper device) . private vepa bridge passthru. private upper_dev (). vepa Virtual Ethernet Port Aggregator (VEPA) macvlan (reflective relay) . (Broadcast) upper_dev VEPA macvlan (flood) . bridge macvlan . . . MAC macvlan bridge STP . passthru macvlan . macvlan passthru . ipvlan: ipvlan lxc.net.[i].link . lxc.net.[i].ipvlan.mode ipvlan ipvlan . l3 l3s l2. l3 . l3 TX L3 L2 . multicast / broadcast . l3s TX L3 iptables (conn-tracking) L3 (L3s) . L3 conn-tracking . l2 TX . multicast broadcast ( ) RX/TX . lxc.net.[i].ipvlan.isolation . bridge private vepa. bridge . bridge . private . vepa VEPA 802.1Qbg . phys: lxc.net.[i].link . lxc.net.[i].flags . up: . lxc.net.[i].link . lxc.net.[i].l2proxy IP lxc.net.[i].link IP . 0 1 . 0 . IPv4 sysctl : net.ipv4.conf.[link].forwarding=1 IPv6 sysctl : net.ipv6.conf.[link].proxy_ndp=1 net.ipv6.conf.[link].forwarding=1 lxc.net.[i].mtu (MTU) . lxc.net.[i].name eth0 . lxc.net.[i].hwaddr mac mac link-local ipv6 . "x" hwaddr . lxc.net.[i].ipv4.address ipv4 . ipv4 . x.y.z.t/m 192.168.1.123/24. (broadcast) IP 192.168.1.123/24 255.255.255.255. IP . lxc.net.[i].ipv4.gateway ipv4 . x.y.z.t 192.168.1.123. auto ( lxc.net.[i].link) . auto veth macvlan ipvlan . dev (device route) . IPVLAN . lxc.net.[i].ipv6.address ipv6 . ipv6 . x::y/m 2003:db8:1:0:214:1234:fe0b:3596/64 lxc.net.[i].ipv6.gateway ipv6 (gateway) . x::y 2003:db8:1:0::1 auto ( lxc.net.[i].link ) . auto veth macvlan ipvlan . dev (device route) . IPVLAN . lxc.net.[i].script.up . (hooks) : o LXC_HOOK_TYPE: . 'up' 'down' . o LXC_HOOK_SECTION: 'net'. o LXC_NET_TYPE: . ( 'vlan' 'macvlan' 'ipvlan' 'veth'). o LXC_NET_PARENT: . 'mavclan' 'veth' 'phys' . o LXC_NET_PEER: (peer) . 'veth' . lxc.hook.version 1 . lxc.hook.version . 1 . 0 . (Standard output) (debug) . (Standard error) . lxc.net.[i].script.down . : o LXC_HOOK_TYPE: . 'up' 'down'. o LXC_HOOK_SECTION: 'net'. o LXC_NET_TYPE: . ( 'vlan' 'macvlan' 'ipvlan' 'veth'). o LXC_NET_PARENT: . o LXC_NET_PEER: . lxc.hook.version 1 . lxc.hook.version . 1 . 0 . (debug) . . TTY (NEW PSEUDO TTY INSTANCE - DEVPTS) pseudo tty . lxc.pty.max pseudo tty . pseudo tty pty ( ). (CONTAINER SYSTEM CONSOLE) inittab . lxc.console.buffer.size liblxc ringbuffer . ringbuffer . ringbuffer (page size) . liblxc ringbuffer . 4KB . 'auto' liblxc ringbuffer 128KB . ringbuffer . 'KB' 'MB' 'GB'. ( . 'KB' == 'KiB' 'MB' == 'MiB' 'GB' == 'GiB'. 'kB' 'KB' 'Kb' .) lxc.console.size liblxc lxc.console.logfile . . liblxc . 4KB . 'auto' liblxc 128KB . . 'KB' 'MB' 'GB'. ( . 'KB' == 'KiB' 'MB' == 'MiB' 'GB' == 'GiB'. 'kB' 'KB' 'Kb' .) ringbuffer (mirror) lxc.console.size lxc.console.buffer.size . lxc.console.logfile . ringbuffer (rotate) . ringbuffer lxc.console.buffer.size lxc.console.buffer.logfile . lxc.console.rotate lxc.console.logfile . API . <<.1>> . . ringbuffer lxc.console.buffer.size lxc.console.buffer.logfile . lxc.console.path . 'none' . 'none' /dev/console bind-mount /dev/console /dev/console /dev/console . . TTY (CONSOLE THROUGH THE TTYS) inittab getty tty . tty . getty inittab tty getty /var/log/messages . lxc.tty.max tty . (CONSOLE DEVICES LOCATION) LXC Unix98 PTY bind-mount . /dev/console /dev/ttyN (bind-mount). . ( /dev) LXC bind-mount . (symbolic link) /dev/console /dev/ttyN . . lxc.tty.dir /dev . LXC bind-mount (device node) /dev/console . /DEV (/DEV DIRECTORY) lxc (fd,stdin,stdout,stderr) /dev . /dev rootfs . lxc.autodev 1 rootfs LXC tmpfs /dev ( 500K lxc.autodev.tmpfs.size ) . "init" "systemd" . /dev lxc.hook.autodev . lxc.autodev 0 /dev LXC . lxc.autodev.tmpfs.size tmpfs /dev . 500000 (500K) . . (MOUNT POINTS) . . /etc /var /home . - LXC bind-mount . ( ) ( /home/joe) path path TOCTTOU . lxc.mount.fstab fstab . . proc proc proc nodev,noexec,nosuid 0 0 proc /proc . . (image file) (fs_vfstype) mount(8) auto . lxc.mount.entry fstab . lxc (mount propagation) rshared rprivate . optional . create=dir create=file ( ) . relative . dev/null proc/kcore none bind,relative 0 0 dev/null ${LXC_ROOTFS_MOUNT}/dev/null proc/kcore . lxc.mount.auto . . : o proc:mixed ( proc): /proc - /proc/sys /proc/sysrq-trigger - / . o proc:rw: /proc - o sys:mixed ( sys): /sys - /sys/devices/virtual/net. o sys:ro: /sys - / . o sys:rw: /sys - o cgroup:mixed: tmpfs /sys/fs/cgroup cgroup cgroup bind-mount . cgroup . o cgroup:mixed:force: force LXC cgroup . cgroup:mixed . cgroup LXC cgroup init . o cgroup:ro: cgroup:mixed . o cgroup:ro:force: force LXC cgroup . cgroup:ro . cgroup LXC cgroup init . o cgroup:rw: cgroup:mixed - . cgroup cgroup tmpfs /sys/fs/cgroup . o cgroup:rw:force: force LXC cgroup . cgroup:rw . cgroup LXC cgroup init . o cgroup ( ): CAP_SYS_ADMIN cgroup:rw cgroup:mixed . o cgroup-full:mixed: tmpfs /sys/fs/cgroup bind-mount cgroup . cgroup cgroup tmpfs /sys/fs/cgroup/$hierarchy cgroup cgroup . . o cgroup-full:mixed:force: force LXC cgroup . cgroup-full:mixed . cgroup LXC cgroup init . o cgroup-full:ro: cgroup-full:mixed . o cgroup-full:ro:force: force LXC cgroup . cgroup-full:ro . cgroup LXC cgroup init . o cgroup-full:rw: cgroup-full:mixed - . cgroup . ( CAP_SYS_ADMIN cgroup .) o cgroup-full:rw:force: force LXC cgroup . cgroup-full:rw . cgroup LXC cgroup init . o cgroup-full ( ): CAP_SYS_ADMIN cgroup-full:rw cgroup-full:mixed. cgroup cgroup init . cgroup tmpfs /sys/fs/cgroup - ( :mixed :ro /sys/fs/cgroup/$hierarchy - ). mountall(8) /sys/fs/cgroup - CAP_SYS_ADMIN - . : lxc.mount.auto = proc sys cgroup lxc.mount.auto = proc:rw sys:rw cgroup-full:rw (ROOT FILE SYSTEM) . lxc.rootfs.path . . . . rootfs nbd nbd:file:1 file nbd rootfs . nbd:file nbd . overlayfs:/lower:/upper rootfs overlay /upper - /lower . overlay /lower . loop:/file lxc /file loop loop . lxc.rootfs.mount (recursive bind) lxc.rootfs.path (pivot). pivot_root(8) . . lxc.rootfs.options (mount options) rootfs . fstab . LXC idmap= . LXC (idmapped mount) rootfs . chown rootfs idmapping (user namespace) . idmapped mount . idmap= LXC rootfs "container" LXC rootfs . lxc.rootfs.managed 0 LXC LXC . 1 . ("CGROUPS") . lxc . . cgroups . 4.5 cgroup <> << >> (unified hierarchy) . cgroup <> << >> (legacy hierarchies) . cgroups . LXC . lxc.cgroup. lxc.cgroup2. . LXC lxc.cgroup. . lxc.cgroup2. . lxc.cgroup. ( ) . cgroup . cgroup <<>> . <<>> cgroup . <> <> <> . <<>> (utility) . (device) . . . <> <> . << >> (allowlists) << >> (denylists) . . << >> (allow rules) . . << >> (deny rules) . cgroup . eBPF BPF_PROG_TYPE_CGROUP_DEVICE cgroup . LXC cgroup eBPF . eBPF . eBPF cgroup . cgroup lxc.cgroup.devices.allow lxc.cgroup.devices.deny eBPF cgroup2 lxc.cgroup2.devices.allow lxc.cgroup2.devices.deny . o (denylist) lxc.cgroup2.devices.deny = a LXC . lxc.cgroup2.devices.allow . << >> (allowlist) . o (allowlist) lxc.cgroup2.devices.allow = a LXC . lxc.cgroup2.devices.deny . << >> (denylist) . o . o . o . : lxc.cgroup2.devices.deny = a lxc.cgroup2.devices.allow = c *:* m lxc.cgroup2.devices.allow = b *:* m lxc.cgroup2.devices.allow = c 1:3 rwm . /dev/null . : lxc.cgroup2.devices.allow = a lxc.cgroup2.devices.deny = c *:* m lxc.cgroup2.devices.deny = b *:* m lxc.cgroup2.devices.deny = c 1:3 rwm LXC . /dev/null . << >> ( ) : lxc.cgroup2.devices.allow = a lxc.cgroup2.devices.deny = c *:* m lxc.cgroup2.devices.deny = b *:* m lxc.cgroup2.devices.deny = c 1:3 rwm lxc.cgroup2.devices.allow = a LXC . : lxc.cgroup2.devices.allow = a lxc.cgroup2.devices.deny = c *:* m lxc.cgroup2.devices.deny = b *:* m lxc.cgroup2.devices.deny = c 1:3 rwm lxc.cgroup2.devices.deny = a LXC . lxc.cgroup.[controller name].[controller file] (cgroup) cgroup . . LXC : lxc.cgroup.cpuset.cpus lxc.cgroup2.[controller name].[controller file] cgroup . . LXC : lxc.cgroup2.memory.high lxc.cgroup.dir cgroup . lxc.cgroup.dir = my-cgroup/first "c1" "my-cgroup" . cgroup "my-user" cgroup cpuset cgroup v1 cgroup "/sys/fs/cgroup/cpuset/my-user/my- cgroup/first/c1" . cgroup LXC . cgroup . lxc.cgroup.dir.container lxc.cgroup.dir lxc.cgroup.dir.monitor cgroup . lxc.cgroup.dir . lxc.cgroup.dir.container.inner . lxc.cgroup.dir.monitor lxc.cgroup.dir.container . lxc.cgroup.dir.monitor.pivot (PID) cgroup . cgroup cgroup . lxc.cgroup.dir.container.inner cgroup . cgroup lxc.cgroup.dir.container (privileged) . lxc.cgroup.dir.container lxc.cgroup.dir.monitor . lxc.cgroup.relative 1 LXC cgroup . cgroup2 systemd . LXC systemd . (CAPABILITIES) root (drop) . lxc.cap.drop . (space) . "CAP_" CAP_SYS_MODULE sys_module . capabilities(7). lxc . lxc.cap.keep . . "none" lxc . "none" . (NAMESPACES) (lxc.namespace.clone) (lxc.namespace.keep) (lxc.namespace.share.[namespace identifier]). lxc.namespace.clone . . /proc/PID/ns . lxc.namespace.clone . mount net ipc lxc.namespace.clone=mount net ipc . lxc.namespace.keep . . /proc/PID/ns . lxc.namespace.keep (denylist) . network user ipc lxc.namespace.keep=user net ipc . pid init . user network user . lxc.namespace.share.[namespace identifier] . [namespace identifier] /proc/PID/ns . lxc.namespace.share.[namespace identifier] PID lxc.namespace.share.net=42. lxc.namespace.share.[namespace identifier] lxc.namespace.share.pid=c3. liblxc lxc.namespace.share.[namespace identifier] lxc.namespace.share.user=/opt/c3. . pid init . user network user . LSM user+pid liblxc . lxc.time.offset.boot boottime . (h) (m) (s) (ms) (us) (ns) . lxc.time.offset.monotonic monotonic . (h) (m) (s) (ms) (us) (ns) . (RESOURCE LIMITS) (soft) (hard) . . . lxc.prlimit.[limit name] . 'unlimited'. . "RLIMIT_" "RLIMIT_" RLIMIT_NOFILE "nofile" . : setrlimit(2). lxc . . (SYSCTL) . lxc.sysctl.[kernel parameters name] . /proc/sys/ . sysctl . sysctl . sysctl(8). lxc . (APPARMOR PROFILE) lxc apparmor apparmor apparmor . lxc-container-default-cgns cgroup lxc-container-default . lxc.apparmor.profile apparmor . (unconfined) lxc.apparmor.profile = unconfined apparmor ( ) lxc.apparmor.profile = unchanged LXC apparmor lxc.apparmor.profile = generated lxc.apparmor.allow_incomplete apparmor . (mount) . . apparmor . 0 () apparmor . apparmor 1 . lxc.apparmor.allow_nesting 1 . apparmor . /dev/.lxc/proc /dev/.lxc/sys procfs sysfs lxcfs apparmor / . lxc.apparmor.raw AppArmor . . (SELINUX CONTEXT) lxc SELinux SELinux SELinux . unconfined_t lxc . /usr/share/lxc/selinux/lxc.te . lxc.selinux.context SELinux unconfined_t . lxc.selinux.context = system_u:system_r:lxc_t:s0:c22 lxc.selinux.context.keyring SELinux (keyring) . lxc.selinux.context lxc lxc.selinux.context . lxc.selinux.context.keyring = system_u:system_r:lxc_t:s0:c22 (KERNEL KEYRING) (Linux Keyring) . lxc . lxc.keyring.session lxc. . 1 . lxc.keyring.session = 0 SECCOMP (SECCOMP CONFIGURATION) seccomp . seccomp . 1 2 . 1 . "allowlist" () . . 2 denylist allowlist . denylist mknod 0 () : 2 denylist mknod errno 0 ioctl notify "errno" LXC seccomp errno . errno "errno" . "notify" LXC seccomp . "notify" poll . . . . seccomp . lxc.seccomp.profile seccomp . lxc.seccomp.allow_nesting 1 seccomp seccomp . seccomp . 0 . lxc.seccomp.notify.proxy LXC seccomp . unix:/path/to/socket unix:@socket . . lxc.seccomp.notify.cookie seccomp . PR_SET_NO_NEW_PRIVS PR_SET_NO_NEW_PRIVS execve() execve() ( set-user-ID set-group-ID ). . fork() clone() execve() . PR_SET_NO_NEW_PRIVS AppArmor SElinux . lxc.no_new_privs PR_SET_NO_NEW_PRIVS . 1 . (UID MAPPINGS) . userid 0 userid 200000 . root . 0 20,000 200,000 220,000 . lxc.idmap . 'u' 'g' . userid . userid . . (CONTAINER HOOKS) . . lxc.hook.version . : o . o ( 'lxc'). o ( 'clone' 'pre-mount'). o . clone . stop . : o LXC_CGNS_AWARE: cgroup. o LXC_CONFIG_FILE: . o LXC_HOOK_TYPE: ( 'clone' 'mount' 'pre-mount'). lxc.hook.version . 1 LXC_HOOK_TYPE . o LXC_HOOK_SECTION: ( 'lxc' 'net'). lxc.hook.version . 1 LXC_HOOK_SECTION . o LXC_HOOK_VERSION: . lxc.hook.version . 0 . 1 . o LXC_LOG_LEVEL: . o LXC_NAME: . o LXC_[NAMESPACE IDENTIFIER]_NS: /proc/PID/fd/ . . lxc.hook.version 1 . o LXC_ROOTFS_MOUNT: . o LXC_ROOTFS_PATH: lxc.rootfs.path . rootfs LXC_ROOTFS_MOUNT . o LXC_SRC_NAME: clone . debug . . lxc.hook.version 1 0 . . ( 'lxc' 'net') ( 'clone' 'mount' 'pre-mount') . . LXC_NAME . ( .) LXC_HOOK_SECTION LXC_HOOK_TYPE . . 1 LXC_[NAMESPACE IDENTIFIER]_NS . 0 stop . lxc.hook.pre-start tty (mounts) . lxc.hook.pre-mount fs rootfs . rootfs . ( ) . lxc.hook.mount pivot_root . lxc.hook.autodev lxc.autodev == 1 mount pivot_root . /dev autodev systemd . /dev ${LXC_ROOTFS_MOUNT} . lxc.hook.start-host init . lxc.hook.start init . . lxc.hook.stop . (:) . /proc/PID/ns . mount mnt:/proc/PID/fd/12 . lxc.hook.post-stop . lxc.hook.clone . lxc-clone(1) . lxc.hook.destroy . (CONTAINER HOOKS ENVIRONMENT VARIABLES) . . lxc.hook.start . LXC_NAME LXC . . [-n] LXC_CONFIG_FILE . . [-f] LXC_CONSOLE NULL . [-c] [lxc.console.path] LXC_CONSOLE_LOGPATH NULL . [-L] LXC_ROOTFS_MOUNT (mount) . rootfs . [lxc.rootfs.mount] LXC_ROOTFS_PATH rootfs.mount . [lxc.rootfs.path] LXC_SRC_NAME clone. . LXC_TARGET stop. "stop" "reboot" . LXC_CGNS_AWARE lxc cgroup . 1 lxc cgroup . cgroup . lxcfs . (LOGGING) . lxc ERROR ( '.log') /var/log/lxc . . lxc-start . lxc.log.level . 0..8 . 0 = trace 1 = debug 2 = info 3 = notice 4 = warn 5 = error 6 = critical 7 = alert 8 = fatal. 5 (error) . ( hook ) 1 (debug) . lxc.log.file . lxc.log.syslog syslog. lxc.log.level . facility syslog : daemon, local0, local1, local2, local3, local4, local5, local5, local6, local7. (AUTOSTART) . LXC . lxc.start.auto . 0 () 1 () . lxc.start.delay ( ) . lxc.start.order . . lxc.monitor.unshare (mount namespace) ( pre- start) (unshare) . CAP_SYS_ADMIN . 0 . lxc.monitor.signal.pdeath lxc monitor init . SIGKILL lxc monitor . lxc monitor 0 . lxc.group ( ) . ( ) . (AUTOSTART AND SYSTEM BOOT) . : NULL "onboot". LXC lxc.start.auto == 1 "onboot" . lxc.start.order . lxc.start.delay . "onboot" LXC lxc.start.auto == 1 ( NULL) onboot . (CONTAINER ENVIRONMENT) ( init ) lxc.environment . /proc/PID/environ . : lxc.environment.runtime init ( ) lxc.environment.hooks . . lxc.environment init . : lxc.environment = APP_ENV=production lxc.environment = SYSLOG_SERVER=192.0.2.42 "=" . : lxc.environment = PATH lxc.environment.runtime init . lxc.environment.hooks (hooks) . (EXAMPLES) /usr/share/doc/lxc/examples . (NETWORK) veth br0 ( ) . eth0 . lxc.uts.name = myhostname lxc.net.0.type = veth lxc.net.0.flags = up lxc.net.0.link = br0 lxc.net.0.name = eth0 lxc.net.0.hwaddr = 4a:49:43:49:79:bf lxc.net.0.ipv4.address = 10.2.3.5/24 10.2.3.255 lxc.net.0.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3597 UID/GID (UID/GID MAPPING) 0-9999 100000-109999 . lxc.idmap = u 0 100000 10000 lxc.idmap = g 0 100000 10000 (CONTROL GROUP) cpuset.cpus cpus.share devices.allow . lxc.cgroup.cpuset.cpus = 0,1 lxc.cgroup.cpu.shares = 1234 lxc.cgroup.devices.deny = a lxc.cgroup.devices.allow = c 1:3 rw lxc.cgroup.devices.allow = b 8:0 rw (COMPLEX CONFIGURATION) . lxc.uts.name = complex lxc.net.0.type = veth lxc.net.0.flags = up lxc.net.0.link = br0 lxc.net.0.hwaddr = 4a:49:43:49:79:bf lxc.net.0.ipv4.address = 10.2.3.5/24 10.2.3.255 lxc.net.0.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3597 lxc.net.0.ipv6.address = 2003:db8:1:0:214:5432:feab:3588 lxc.net.1.type = macvlan lxc.net.1.flags = up lxc.net.1.link = eth0 lxc.net.1.hwaddr = 4a:49:43:49:79:bd lxc.net.1.ipv4.address = 10.2.3.4/24 lxc.net.1.ipv4.address = 192.168.10.125/24 lxc.net.1.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3596 lxc.net.2.type = phys lxc.net.2.flags = up lxc.net.2.link = random0 lxc.net.2.hwaddr = 4a:49:43:49:79:ff lxc.net.2.ipv4.address = 10.2.3.6/24 lxc.net.2.ipv6.address = 2003:db8:1:0:214:1234:fe0b:3297 lxc.cgroup.cpuset.cpus = 0,1 lxc.cgroup.cpu.shares = 1234 lxc.cgroup.devices.deny = a lxc.cgroup.devices.allow = c 1:3 rw lxc.cgroup.devices.allow = b 8:0 rw lxc.mount.fstab = /etc/fstab.complex lxc.mount.entry = /lib /root/myrootfs/lib none ro,bind 0 0 lxc.rootfs.path = dir:/mnt/rootfs.complex lxc.rootfs.options = idmap=container lxc.cap.drop = sys_module mknod setuid net_raw lxc.cap.drop = mac_override (SEE ALSO) chroot(1), pivot_root(8), fstab(5), capabilities(7) (SEE ALSO) lxc(7), lxc-create(1), lxc-copy(1), lxc-destroy(1), lxc-start(1), lxc- stop(1), lxc-execute(1), lxc-console(1), lxc-monitor(1), lxc-wait(1), lxc-cgroup(1), lxc-ls(1), lxc-info(1), lxc-freeze(1), lxc-unfreeze(1), lxc-attach(1), lxc.conf(5) 2026-08-01 lxc.container.conf(5)