Learn LXC - Creating Your First Container

#Introduction

The environment is ready (episodes 0-3), and the concepts are understood (episodes 1-2). Now it's time for action: creating your first container. In episode 4 we create an Ubuntu 24.04 container named c1, inspect its status, start it, and get inside it through several methods. By the end of the episode, you'll have a complete Linux system running inside a container — no VM, no hypervisor.

#Creating a Container with lxc-create

#The Create Command

Run:

Create an Ubuntu 24.04 container

lxc-create -n c1 -t download -- -d ubuntu -r 24.04 -a amd64

Let's break down the flags:

-n c1 — container name (c1).
-t download — uses the download template, which fetches images from the official image server.
-d ubuntu — target distro.
-r 24.04 — release (Ubuntu 24.04).
-a amd64 — host architecture.

On first run, the template will ask about the mirror and key — accept the defaults. The process downloads the rootfs, extracts it to /var/lib/lxc/c1/rootfs, and writes the config to /var/lib/lxc/c1/config.

Tip

The download template uses the official image server from linuxcontainers.org. To look for image candidates, you can type lxc-create -n c1 -t download -- --list to see the list of available distros and releases. This is also the best way to validate your -d, -r, and -a values before running.

#Inspecting the Result: lxc-ls and lxc-info

List the containers:

List containers with full format

lxc-ls -f

The output shows columns like NAME, STATE, AUTOSTART, and IPV4. For details on a single container:

Container details

lxc-info -n c1

At this point the state is still STOPPED. Also check the generated directory structure:

Container structure in the lxcpath

ls -la /var/lib/lxc/c1/
cat /var/lib/lxc/c1/config

#Starting and Entering the Container

#lxc-start

Start the container:

Start container c1

lxc-start -n c1

lxc-start runs the container in the background (daemonized). After a few seconds, check its status:

Check status after start

lxc-info -n c1
lxc-ls -f

A container with systemd will need a few seconds to fully boot. The state should change to RUNNING.

lxc-attach runs a command directly inside the container's namespaces, without a login process:

Enter the container and check hostname

lxc-attach -n c1 -- hostname

For an interactive shell:

Interactive shell inside the container

lxc-attach -n c1

Once inside, verify that you're really "inside":

Verify isolation from inside the container

hostname
cat /etc/os-release
ps aux | head -10
exit

The hostname and ps must belong to the container, not the host. That's proof that the PID and UTS namespaces are working.

#lxc-console: Like a VM Monitor

lxc-console connects you to the container's serial console — like plugging a monitor into a virtual machine. Great for watching the boot log or logging in on a tty:

Container console

lxc-console -n c1

To exit the console, press Ctrl+A then Q (not Ctrl+D).

Caution

lxc-attach doesn't log in — it directly executes commands as the user configured in the container (usually root). This is very practical for administration, but don't misuse it as "user access": for non-root accounts, use lxc-console and log in normally, or ssh to the container's IP.

#lxc-execute: One-Shot Execution

Unlike lxc-attach, which enters a running container, lxc-execute creates a fresh container environment to run a single command and then stops:

One-shot execution

lxc-execute -n c1 -- ls /

Since it creates a new environment every time, lxc-execute is better suited for short jobs and testing, not for interacting with a running container.

#Stopping the Container

To shut it down:

Stop the container

lxc-stop -n c1
lxc-info -n c1

The state returns to STOPPED. Don't delete the container yet — we'll use it again in episodes 5 and 6.

Warning

Containers don't restart automatically after a host reboot unless lxc.start.auto is enabled (episode 10). Don't be surprised if a container "disappears" after a reboot — check lxc-ls -f before panicking, and bring it back up with lxc-start.

#Closing

Key takeaways:

lxc-create -n c1 -t download -- -d ubuntu -r 24.04 -a amd64 creates an Ubuntu 24.04 container.
lxc-ls -f and lxc-info -n c1 are your eyes into container status.
lxc-start starts the container; lxc-stop stops it.
lxc-attach enters without login; lxc-console is like a VM monitor; lxc-execute is for one-shot execution.
hostname and ps inside the container prove namespace isolation.

In the next episode 5 we'll compare privileged vs unprivileged containers — why root inside a privileged container is the same as root on the host, and how unprivileged containers map users via user namespaces + idmapping to become the safe modern default for multi-tenant environments.