Learn LXC - Installation & Kernel Verification

#Introduction

Now that we understand LXC's architecture from episode 2, it's time for real action: installing LXC on the host and verifying the kernel. In episode 3 we install the lxc 7.0 LTS package, get to know the components that come along with it (the lxc-* tooling, templates, and the Python3 binding), then run lxc-checkconfig to make sure the kernel is ready.

Why is kernel verification important? LXC runs on top of kernel features — namespaces, cgroups, and overlayfs. A kernel with missing configuration will make containers run half-heartedly: they can be created, but isolation or certain features silently stay off. Verify first, then continue — that's a good SRE habit.

#Installation

#Ubuntu and Debian

On Ubuntu (recommended for full unprivileged support) and Debian:

sudo apt update
sudo apt install lxc

This package pulls in important dependencies, including liblxc1 (the core library), lxcfs (which makes accurate pseudo-filesystems /proc and /sys inside containers), and the lxc-net scripts for the lxcbr0 bridge.

#Other Distributions

Fedora/RHEL and Arch use their respective package commands:

sudo dnf install lxc lxc-templates lxc-extra

sudo pacman -S lxc

#Installed Components

After installation, you get three groups of components:

#lxc-* Tooling

All the CLI tools: lxc-create, lxc-start, lxc-stop, lxc-attach, lxc-ls, lxc-info, lxc-snapshot, lxc-copy, lxc-autostart, and lxc-checkconfig. Check their availability:

which lxc-create lxc-start lxc-attach lxc-checkconfig
lxc-ls --version

#Templates

Templates (scripts that generate a rootfs) are installed in /usr/share/lxc/templates/. For modern distros, the download template is the main path because it fetches images from the official image server. Legacy templates like lxc-ubuntu or lxc-debian are still available for offline cases or special needs.

ls /usr/share/lxc/templates/

#Python3 Binding (Optional)

liblxc also provides a Python3 binding (python3-lxc) — useful if you want to automate containers via scripts rather than the CLI. It's optional for this series, but practical for programming tasks later.

sudo apt install python3-lxc

#Kernel Verification with lxc-checkconfig

lxc-checkconfig reads the active kernel configuration and prints the status of every feature:

lxc-checkconfig

The output shows statuses like:

Example lxc-checkconfig output (abridged)

--- Namespaces ---
Namespaces: enabled
User namespace: enabled
...
--- Control groups ---
Cgroup: enabled
Cgroup v2 mount points:
/sys/fs/cgroup
...
--- Misc ---
Veth pair device: enabled
Macvlan (kernel module): enabled
...

Pay attention to three important areas:

• Namespaces — everything must be enabled, especially the User namespace for unprivileged containers.
• Control groups — make sure the cgroup2 mount point (/sys/fs/cgroup) is detected. This is what lxc.cgroup2.* uses (episode 7).
• Overlayfs — active if you plan to use the overlay storage backend (episode 8).

#If a Feature Is Missing

Some features can be enabled without a reboot:

sudo modprobe overlay
sudo modprobe veth

Other features (e.g. user namespaces on old kernels) require a newer kernel or the boot flag kernel.unprivileged_userns_clone. Check the sysctl:

sysctl kernel.unprivileged_userns_clone

#Verifying Version and Services

Finally, make sure all components are consistent:

lxc --version
lxc-checkconfig > /dev/null && echo "kernel ready"
systemctl is-active lxc-net

If lxc-net is active, the lxcbr0 bridge is already available for container networking (episode 6).

#Closing

Key takeaways:

• Install the lxc package (7.0 LTS) per your distro; Ubuntu is the most recommended.
• The components consist of the lxc-* tooling, templates (especially download), and an optional Python3 binding.
• lxc-checkconfig is a must-have tool: make sure namespaces, cgroups (cgroup2), and overlayfs are active.
• Load missing modules via modprobe, or fix the kernel/sysctl.
• lxc --version and the lxc-net status round out the verification.

In the next episode 4 we'll create your first container — lxc-create -n c1 -t download -- -d ubuntu -r 24.04 -a amd64, inspect it with lxc-ls -f and lxc-info, then start it with lxc-start, log in via lxc-attach and lxc-console, and run commands with lxc-execute. It's the moment your first container comes alive!