# LXC containers

Sort of Linux virtual host without virtualization.

* LXC containers **use the host Linux kernel.**
* But they use other namespaces for isolation.
  * Processes.
  * Network.
  * Mount.

An LXC container is a small Linux distribution that boots on top of a running kernel, and has an API to be controlled from host applications.

## Privileged and unprivileged

### Privileged

When the containers’ UID 0 is mapped to the host’s UID 0.

Protection of container’s abuses relies on the proper tuning of extra protections on the host’s kernel.

* AppArmor, SELinux, capabilities, etc.

### Unprivileged

When the containers’ UID 0 is mapped to a host’s UID different from 0.

Processes escaping from the containers’ sandboxing will have no special privileges in the host.
