System containers with LXC and Incus
You build lightweight containers that behave like a full Linux system, manage them with profiles, storage, networking, snapshots and limits, and measure how they differ from VMs.
Level 301 · 15 lessons · 12 practice labs
Lessons
Concepts
- System containers versus application containers
- A first container with LXC
- Incus: setup and first instances
- Short task: start instances of three distributions
Management
- Profiles and configuration
- Storage pools and volumes
- Instance networking: bridged and routed
- Resource limits
- Images and remotes: picking a ready image and publishing your own
- Short task: give each developer an environment with set limits
Operations
- Snapshots, backups and exports
- Unprivileged containers and ID mapping
- Running VMs with Incus too
- Moving instances between servers
- Capstone: split an old ten-service server into system containers
Practice labs
- Launch a first system container: Launch a system container from a ready image, enter it and show it runs its own init process.
- Compare a container and a VM by measuring: Launch the same image as a container and as a VM and compare boot time, memory use and kernel version.
- Work out ID mapping in an unprivileged container: Show which host ID the container's root maps to and solve a permission problem on a shared directory with mapping.
- Put CPU and memory limits on a container: Apply a two-core and one-gigabyte limit to a running container and verify with the values seen from inside.
- Attach a persistent data volume to a container: Create a volume in the storage pool, attach it and show the data survives deleting and recreating the container.
- Expose a container service in a controlled way: Expose a container's web service on a host port with a proxy device and restrict inter-container access to what is needed with a network rule.
- Snapshot and restore a container: Take a snapshot before an update, break the container and restore it from the snapshot.
- Export a container and move it to another host: Export a container to a backup file, import it on a second host and verify its services run.
- Publish an organisation image from a prepared container: Clean a container with baseline settings, publish it as an image and show three containers launched from it get unique identities.
- Find containers running privileged: List the security settings of all containers and mark those that are privileged or allow nesting.
- Review devices and directories passed to a container: Review host directories and devices attached to containers and turn unnecessary write access into read-only.
- Set up isolated projects and restrictions for teams: Create separate projects for two teams with restrictions that forbid privileged containers and host directory mounts, and show a violation is refused.
About this course
You build lightweight containers that behave like a full Linux system, manage them with profiles, storage, networking, snapshots and limits, and measure how they differ from VMs.
What you will learn
- Concepts
- Management
- Operations
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.