新手求助：能否基于自定义Unix内核创建LXC容器及相关问题咨询

Great question! Let’s break this down step by step since you’re diving into custom kernels and LXC as a newbie—this is a solid use case for LXC, so let’s start with your core questions:

1. Is using lxc-create with custom cross-architecture Unix kernels feasible? #

Absolutely, but with two key prerequisites:

• Kernel support: Your custom kernel must have essential LXC/OS-level virtualization features enabled, including namespaces (PID, UTS, mount, network, user, IPC), cgroups (v1 or v2), overlayfs (for rootfs layering), and binfmt_misc (if you’re running cross-architecture containers, e.g., x86 host → ARM container).
• Architecture matching: If you’re running containers on the same architecture as your host (e.g., ARM64 kernel on ARM64 hardware), no extra hoops. For cross-architecture, you’ll need the host kernel to support binfmt_misc and have the QEMU user-mode emulator installed (e.g., qemu-user-static) to translate instructions between architectures.

2. How to create a custom container with your own kernel? #

Since you’re using lxc-create, the best approach is to use the none template (which skips pre-built distro templates) and supply your own root filesystem tailored to your custom kernel. Here’s a step-by-step workflow:

• Prepare a custom root filesystem:
  • For distro-based rootfs: Use tools like debootstrap (Debian/Ubuntu), pacstrap (Arch Linux), or dnf --installroot (RHEL/Fedora) to build a minimal rootfs matching your target architecture. Example for ARM64 Debian:

    debootstrap --arch=arm64 bookworm ./my-custom-rootfs http://deb.debian.org/debian
    

  • For a fully custom rootfs: Build from source (e.g., using Buildroot) or unpack a pre-compiled rootfs tarball that’s compatible with your kernel.
• Create the container with lxc-create:
  Use the none template and point to your rootfs:

  lxc-create -n my-custom-container -t none -- --rootfs ./my-custom-rootfs
  

• Initialize the rootfs:
  Chroot into the rootfs to set up essential system files:

  chroot ./my-custom-rootfs
  passwd root  # Set root password
  echo "my-custom-container" > /etc/hostname
  cp /etc/resolv.conf /etc/resolv.conf.bak  # Preserve DNS config
  echo "nameserver 8.8.8.8" > /etc/resolv.conf
  # Install basic tools (e.g., bash, coreutils, init system like systemd or openrc)
  apt update && apt install -y bash coreutils systemd
  exit
  

3. Do you need to modify the container config after creation? #

Yes—out-of-the-box, the none template creates a minimal config, so you’ll need to tweak it for functionality and compatibility with your custom kernel. Key edits to /var/lib/lxc/my-custom-container/config:

• Networking: Set up a virtual ethernet interface (veth) connected to a bridge:

  lxc.net.0.type = veth
  lxc.net.0.link = lxcbr0
  lxc.net.0.flags = up
  lxc.net.0.ipv4.address = 10.0.3.10/24
  

• Resource limits: Enforce CPU/memory constraints via cgroups:

  lxc.cpu.weight = 500  # Relative weight (1024 is default)
  lxc.memory.max = 1G
  

• Architecture specification (for cross-arch):

  lxc.arch = arm64
  

• Kernel-specific mounts: Add any custom kernel mounts your rootfs needs (e.g., specialized filesystems your kernel supports).

4. Alternative container engines if LXC isn’t a fit? #

If LXC feels too heavy or doesn’t align with your workflow, these OS-level virtualization tools don’t require VMs or hypervisors:

• runc: The OCI-compliant runtime that powers Docker under the hood. You’ll need to create an OCI bundle (rootfs + config.json), then run it with runc run <container-id>. Great for minimal, low-overhead containers.
• crun: A lightweight, faster alternative to runc with better support for cross-architecture containers and smaller footprint.
• systemd-nspawn: Built into systemd, it’s perfect for quick, simple containers. You can spawn a container directly from a rootfs with systemd-nspawn -D ./my-custom-rootfs.

内容的提问来源于stack exchange，提问作者subrat