Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Right now I'm using Linux VServer for VPS hosting. But it's lacking some functionality I need (ex. cpu usage virtualization, quota support for guests, etc.) so I'm thinking about switching to OpenVZ or directly to LXC. I somewhere read LXC is not considered secure yet (ex - is this still true? As I don't know the persons who run the guests I really have to take care of security.

share|improve this question
there were (are?) also problems with /proc filtering -- see "lxc container can power-off host machine" – sendmoreinfo Mar 12 '12 at 22:15
not exactly an answer to your question, but have you considered using an hypervisor? eg. Xen or KVM – Luke404 Aug 6 '12 at 20:58
Xen and kvm have a much higher overhead and thus lower performance. I'd only use a hypervisor when I need a custom kernel in a guest, different host/ guest os or other "special requirements". – gucki Aug 7 '12 at 8:24
up vote 5 down vote accepted

To the best knowledge at the time of this writing there were still critical issues with /proc filtering. They ought to be addressed in Linux Kernel 3.6 or later.

Since I'm facing the same problem as you I've done some investigation and I'm not yet convinced that LXC is an alternative to Linux VServer.

If you decide not to switch to LXC have a look at the cgroup support of Linux Vserver which is based on the same code as LXC and may be an option for your setup.

share|improve this answer
+1 with cgroups, +selinux. Still KVM is better alternative. – GioMac Aug 21 '12 at 8:20

LXC added unprivileged containers support from 1.0 version, and Ubuntu appended more apparmor rules from release 14.04 LTS (5 years) that use 3.13 kernel, (LTS will append support for kernels from utopic now, vivid in some months, etc)

many things about security with LXC are OLD now (the same applies to Docker, that is based in linux container tech based in cgroups) to me at least appear that lxc under Ubuntu is now a good alternative. I imagine that the same applies to Debian.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.