by: Linux/Unix

Linux Containers (LXC) are typically managed by LXD or Incus as if they were Virtual Machines, allowing them to take snapshots, have distinct IPs, and retain data when shut down.

Containers can be managed using profiles to define network settings and other configuration parameters, such as limiting the maximum CPU or RAM usage per instance.

It is worth mentioning that since Canonical took full control of the LXD project, the community created a fork called Incus [Link]. This fork has removed many of Canonical’s ecosystem-specific components and became the officially adopted option of LinuxContainers.org [Link]. So, the content of this post might interchangeably use or mention LXD or Incus as if they were synonyms, although they slightly differ for basic operations…

Internally, containers can communicate using containerName.lxd because a DNS service is configured by default.

LXD vs Docker

LXD is a system container that runs a full operating system, while Docker is an application container that typically runs a single application and abstracts storage, networking, and logs from the user.

INSTALLATION

Incus (recommended)

sudo apt update
sudo apt install incus -y
sudo usermod -aG incus-admin $USER
incus admin init

If you want to run virtual machines too and not just containers:

sudo apt install qemu-system -y

If you are planning to migrate from LXD:

sudo apt install incus-tools -y

LXD

The second command (optional) enables the Web UI.

sudo snap install lxd -y
sudo snap set lxd ui.enable=true
sudo systemctl reload snap.lxd.daemon.service
sudo usermod -aG lxd $USER
sudo lxd init

Note: Adding your user to the lxd group is optional but recommended, as it allows managing containers without using sudo each time. A logout and login may be required for the group change to take effect.

WEB UI SETUP

The Web UI is only available from LXD 5.14 or newer. Navigate to https://127.0.0.1:8443/ from the local machine, or use the network address if connecting remotely:

Completed!

MOST POPULAR COMMANDS

lxc and incus can pretty much do the same thing the same way in the examples below.

  • lxc help
    • Shows the list of available commands.
  • lxc remote list
    • Shows the list of remote repositories.
  • lxc image list ubuntu:
    • Lists available images of Ubuntu.
  • lxc image list images: ubuntu jellyfish
    • Lists all officially supported images matching the names ubuntu and jellyfish.
  • lxc image alias list images:
    • Lists images in a more user-friendly format.
  • lxc launch ubuntu:26.04 u26lts
    • Launches a container named u26lts (downloads the image first if not available locally).
  • lxc launch ubuntu:26.04 u26lts –vm
    • Launches a virtual machine.
  • lxc launch images: ubuntu/26.04 u26lts -c limits.cpu=1 -c limits.memory=256MiB
    • Launches a container with limits on maximum CPU and RAM usage.
  • lxc list
    • Lists existing containers.
  • lxc list –columns “ns4S”
    • Lists containers in a table with columns: name, status, IPv4, and number of snapshots.
      • 4 – IPv4 address
      • 6 – IPv6 address
      • a – Architecture
      • c – Creation date
      • n – Name
      • p – PID of the container’s init process
      • P – Profiles
      • s – State
      • S – Number of snapshots
      • t – Type (persistent or ephemeral)
  • lxc list security.privileged=true
    • Lists containers filtered by a property.
  • lxc exec u26lts — apt update && apt upgrade -y && apt install nginx -y
    • Executes a command inside a container.
  • lxc exec u26lts –env KEY=VALUE script.sh
    • Executes a script inside the container with an environment variable.
  • lxc exec u26lts bash
    • Opens a Bash shell inside the container.
  • lxc file edit u26lts/etc/passwd
    • Edits a file inside the container.
  • lxc stop u26lts
    • Stops the container.
  • lxc start u26lts
    • Starts the container.
  • lxc restart –force u26lts
    • Force-restarts the container.
  • lxc snapshot u26lts snapshot01
    • Creates a snapshot of the container named snapshot01.
  • lxc restore u26lts snapshot01
    • Restores the container from a snapshot.
  • lxc delete u26lts/snapshot01
    • Deletes a snapshot.
  • lxc config set u26lts boot.autostart 1
    • Configures the container to start automatically when the host boots.
  • lxc config set u26lts boot.autostart.delay 60
    • Sets the number of seconds to wait after boot before starting the container.
  • lxc config set u26lts boot.autostart.order 3
    • Sets the startup order for auto-starting containers.
  • lxc config set u26lts limits.memory 1GB
    • Sets the maximum RAM the container can use, applied on the fly without stopping it.
  • lxc config edit u26lts
    • Opens the container’s configuration file in an editor.
  • lxc info u26lts
    • Shows information about the container.
  • lxc config show –expanded u26lts
    • Shows the full expanded configuration applied to the container.
  • lxc delete u26lts
    • Deletes the container.
  • lxc copy u26lts u26lts-copy
    • Clones the container and assigns a name to the new one.
  • lxc copy u26lts/snapshot01 u26lts-from-snapshot01
    • Clones the container from a snapshot and assigns it a name.
  • lxc move u26lts u26lts-renamed
    • Renames a local container or moves it to another host.
  • lxc move u26lts/snapshot01 u26lts/snapshot01-renamed
    • Renames a snapshot of a local container.
  • lxc file push fileName.zip u26lts/root/
    • Pushes a file from the host to the container’s root filesystem.
  • lxc file pull u26lts/root/fileName.zip .
    • Pulls a file from the container’s root filesystem to the host.
  • lxc file pull u20lts/root/etc/hosts – | less
    • Pulls a file from the container and pipes it into a consecutive command.
  • lxc profile list
    • Lists existing profiles.
  • lxc profile show default
    • Shows the configuration of the default profile.
  • lxc delete –force u26lts
    • Force-deletes the container without stopping it first.
  • lxc network list
    • Lists the host’s network adapters.
  • lxc network show lxdbr0
    • Shows details of a network interface.
  • lxc network create myNetworkName –type=physical parent=br0 –target=u26lts
    • Attaches a physical network to a container.
    • Other supported network types: bridge, ovn, macvlan, and sriov.
  • lxc network set myNetworkName dns.nameservers=8.8.8.8
    • Configures the network to use a specific DNS server.
  • lxc network forward port add myNetworkName 192.168.1.2 tcp 80,8080-8088 10.1.1.2 80,8080-8088
    • Forwards ports from an external IP to an internal IP.
    • Supports TCP and UDP, with single ports, port lists, or port ranges.
  • lxc storage list
    • Lists storage pools.
  • lxc storage create myStorage btrfs
    • Creates a storage pool. btrfs is recommended for running Docker inside LXD, as it best supports the layering Docker requires.
    • Other supported types: dir, ceph, cephfs, lvm, and zfs.
  • lxc launch images:ubuntu/26.04 myContainer
    • Creates a container from the Ubuntu 26.04 image.
  • lxc storage volume create myStorage myVolume
    • Creates a volume inside a storage pool.
  • lxc storage volume list myStorage
    • Lists volumes inside a storage pool.
  • lxc config set myContainer security.nesting=true security.syscalls.intercept.setxattr=true security.syscalls.intercept.mknod=true
    • Enables the settings required to run Docker inside the container. A restart is required.

BONUS

Proxy port 2222 on all host interfaces to port 22 of the container:

incus config device add u26lts ssh proxy listen=tcp:0.0.0.0:2222 connect=tcp:127.0.0.1:22
incus config show u26lts --expanded

Create a bridge to a physical NIC for the container:

incus network create br0 bridge.external_interfaces=enp3s0
incus config device add u26lts eth0 nic network=br0

Check out Bootable Containers, also known as BootC [Link]. Interestingly, this new type of container includes a kernel and drivers.