Can LXC load additional kernel modules in case of immutable host?

LXC
1

So if I understand LXC container correctly you are using the same kernel as host but you can have any userspace you want.
On the other hand if you want your own kernel your only option is using VM.

I was thinking if its technically possible to have something in the middle with kernel modules. Basically using the same kernel as host but adding kernel modules on top.

Imagine you have immutable OS like IncusOS. You are using LXC containers and you want to run some software/hardware which needs additional kernel module. For example Coral Edge TPU PCIe which needs gasket-dkms.

I imagine it kinda like overlayfs in Docker where you take immutable image and place your additional changes on top of it. So I was wondering if something like this would be possible for LXC and kernel modules.

Only similar thing I found is systemd-sysext.

So, any idea if something like this is even possible? I guess if Linux was microkernel it would be :smiley: Thanks.

2

Not possible. There is only one instance of the kernel with containers. Any module that one container could load would be available to the entire system and so is an obvious massive security issue which explains why module loading from containers is generally blocked.

2 Likes