nested containers



nested containers(cgmanager)


As of Ubuntu 14.04, LXC uses the cgroup manager (cgmanager) to administer cgroups.

The cgroup manager receives D-Bus requests over the Unix socket /sys/fs/cgroup/cgmanager/sock.

vps config:

lxc.aa_profile = lxc-container-default-with-nesting = cgroup

causing the /sys/fs/cgroup/cgmanager directory to be bind-mounted into the container.

The container in turn should start the cgroup management proxy



specify which standard kernel file systems should be automatically mounted.

This may dramatically simplify the configuration.


proc:mixed (or proc):

mount /proc as read-write, but remount /proc/sys and /proc/sysrq-trigger read-only for security / container isolation purposes.

sys:mixed (or sys):

mount /sys as read-only but with /sys/devices/virtual/net writable.


Mount a tmpfs to /sys/fs/cgroup
create directories for all hierarchies to which the container is added,
create subdirectories in those hierarchies with the name of the cgroup,
and bind-mount the container's own cgroup into that directory.
The container will be able to write to its own cgroup directory,
but not the parents, since they will be remounted read-only.