Any usage of lxc containers in enterprise environments

[Johannes S]

Hello everybody,

as we all know PVE supports VMs with KVM and Linux containers based on lxc. While lxc is great for saving resources in limited hardware environments it's also not so good isolated from the host as a vm and you need to shutdown the container before a migration in a cluster . Now this is great for homelab but I wonder whether this is actually used in (more or less ) enterprise production environments? One usecase I can imagine myself is stuff like shared hosting, because it would allow to fit more users on the same host but even then I think that KVM might be better in terms of security/isolation etc.
I have the impression, that this is mainly used in homelabs (where they are quite great, I use them myself) but not of much use in a professional context. I'm happy to be wrong and learn something new: So in which contexts lxcs and amount of deployments lxc is used in business environments?

Thanks and best regards, Johannes.

 

[Johannes S]

Since nobody answered I guess my assumption was correct Or am I missing something?

 

[Onoitsu2]

I don't think that's quite right, because you can clearly set up unprivileged LXC's so can have compartmentalization, uid gid, permissions, ACLs and more overall, as well as firewall rules in place so that they cannot "talk" to each other across the network stack. Now from a breach standpoint an LXC is of course more risky as it shares kernel space with the host, as compared to a VM, but you can still mitigate this in multiple ways, most worth the risk for the performance gains of an LXC. Not everything needs live migrations, and even a restart migration on an LXC can be nearly instantaneous to another node using ZFS replication only, over single gigabit connections. A 10GB LXC (only half used but left for future sake) carried over nodes in under 30-seconds. Using actual enterprise grade hardware and SFP+ and beyond, it could be literal single-digit seconds of downtime potentially.