What are containers?
LXC (LinuX Containers) provide an isolated operating system environment with its own file system, network, process and block I/O space. A favorite way to describe containers is that they are like “chroot on steroids”, since they provide the file system isolation that chroot jails provide but they go beyond that by also providing an IP address, a separate process domain, user ids and dedicated access to the host’s physical resources (i.e. memory, CPU) which chroot jails do not provide.
There are two Linux kernel features that make LXC containers possible:
- Namespaces: It isolates an application’s view of the operating system so that it thinks it has its own isolated instance of a global resource. There are several types of namespaces: process (pid), networking (net), inter-process communication (ipc), file system (mnt), hostname (uts) and user IDs (user).
- Control Groups: Also known as cgroups, it provides task grouping and controls and isolates container access to physical resources such as memory, CPU and disk I/O.
The kernel in Ubuntu Server 14.04 LTS has built-in support for namespaces and cgroups so you can readily deploy LXC containers on day one.
What can I do with containers?
One of the main advantages of containers is process and system isolation, which is ideal for developers who need to experiment by installing test libraries or binaries and for system administrators who want to run applications in an isolated environment for management or security purposes.
In Ubuntu Server 14.04 LTS, you can deploy containers that run other Linux distributions such as RHEL and CentOS, so containers can also be used if you need quick access to an alternate Linux distribution than what’s running on your host.