Run docker in lxc is secure?

LXC
5

@trystan First person with the RIGHT knowledge… thanks

Just to extend the response:

  1. Add “aufs” or “overlay” (or both) to /etc/modules-load.d/modules.conf in your PVE host and reboot. Check it with lsmod | grep -E 'overlay|aufs'
  2. Use a LXC image with unprivilege features (you can check them here)
  3. Create the container with unprivilege option, and “keyctl=1, nesting=1” features (Options section in proxmox).
  4. Maybe you would want to mount an external point into /var/lib/docker (Resources section in proxmox)
  5. Check this link to change your storage-driver in docker to use aufs or overlay2.
  6. Voilá…

P.S: now people please keep worring about having docker inside LXC or even in the PVE host, but now worried at all having docker in a bare production host … thats cool