Removing LXD/LXC from container

Hi All,

I am trying to build a very lean, purpose-built container. I started with a xenial image from ubuntu repo and see that it comes with lxd installed.

Is it safe to remove lxd,lxc,liblxc1 etc?

I am also seeing that trying to remove lxcfs from the container OS, I get some “device busy” while trying to remove /var/lib/lxcfs from the container filesystem.

root@c1:~# apt purge lxcfs Reading package lists... Done Building dependency tree Reading state information... Done The following packages will be REMOVED: lxcfs* 0 upgraded, 0 newly installed, 1 to remove and 16 not upgraded. After this operation, 138 kB disk space will be freed. Do you want to continue? [Y/n] y (Reading database ... 25291 files and directories currently installed.) Removing lxcfs (2.0.8-0ubuntu1~16.04.2) ... dpkg: warning: while removing lxcfs, unable to remove directory '/var/lib/lxcfs': Device or resource busy - directory may be a mount point? Purging configuration files for lxcfs (2.0.8-0ubuntu1~16.04.2) ... dpkg: warning: while removing lxcfs, unable to remove directory '/var/lib/lxcfs': Device or resource busy - directory may be a mount point? Processing triggers for man-db (2.7.5-1) ...

I also see lxcfs mounts within the container. Are these created from the host?

lxcfs on /proc/cpuinfo type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other) lxcfs on /proc/diskstats type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other) lxcfs on /proc/meminfo type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other) lxcfs on /proc/stat type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other) lxcfs on /proc/swaps type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other) lxcfs on /proc/uptime type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other) lxcfs on /var/lib/lxcfs type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)

The device busy would be because of your running container actively using lxcfs, with lxcfs removed now, those /proc files in the container will be broken until you next reboot the container (at which point they’ll just show the host values).

I see. Are there implications to this? Security or otherwise?

The basic premise of the question is, do I lose anything by removing lxcfs from within my containers if I am not interested in nesting?