Serge Hallyn

Several new kernel features are under development which will improve the container experience. We will go over these features, explain how they benefit containers, and demonstrate each.

Several new kernel features are under development which, if successful will improve the container experience. These include cgroup namespaces, loopback namespaces, fuse mounts in unprivileged containers, targeted file capabilities, stacked apparmor profiles, and udev message namespacing. These would allow containers without a "true" root user to create and mount filesystems, use file capabilities to reduce the root privilege used in the container, better virtualize cgroup usage, protect containers from their own workloads using apparmor, and better delegate hotplugged devices to containers.

In this talk we'll go over these features and their current status (at the time of FOSDEM).

LXC is a production-ready container management toolset focused on flexible container management. Its container management API has language bindings for many languages including C, python, Go, lua, and more.

LXD is a new project by the LXC community. It provides a REST API for LXC, an improved command line interface and OpenStack integration plugin. The command line interface lets you control both local and remote LXD in a perfectly transparent way including live migration. LXD is also strongly focused on security, uses user namespaces by default, integrates with apparmor, selinux, seccomp and any other security mechanism available.

This talk will present the most exciting features of LXD, including a walk-through of the new command line tool.