Fork me on GitLab


An init system for LXC

And a few other tools for building LXC containers by hand.

Install the .deb into a debian|ubuntu server that will host LXC containers. This will install the tools to /bin but will not modify the boot of the host server.

Then create lxinitd based containerized instances with...

lxc-create -t lxinitd -n mycontainer
This will copy lxinitd as /sbin/init and minimal tools from the host to the container. This gives you a Linux instance with /lib managed by the distribution (ubuntu|debian) and without systemd.

The resulting container has paractically no tools; not even ls or ps, and specifically does not have bash or any interactive shell or sshd. You can then add just the tools you wish by copying them to the rootfs in /var/lib/lxc/mycontainer/rootfs. This makes it easy to create "full OS" containers that have as little or less attack suface than an Dockerized app.

A base lxinitd container with lxinitd tools, lxmenu, pam, /bin/login and /sbin/getty wieghs in at...

root@mybox:/var/lib/lxc/lxinitd/rootfs# du -sh .
568K	.

More details in the manual


Without bash its quite hard to configure the Linux boot process. lxinitd includes rosh (a read only shell) that can exectue commands but has no built-in features to write to the file system. There is no way to redirect output to a file. This enables scripting the boot of servers without adding a full shell into the container. If you need to, say, touch a file, you can copy /bin/touch to /var/lib/lxc/mycontainer/rootfs/bin, there is not too much damage you can do with touch.
You cant pipe commands into rosh so its quite difficult to abuse it.


Ubuntu|Debian installers are published here download .deb files

Launchpad install

sudo add-apt-repository ppa:teknopaul/lxinitd
sudo apt-get update
sudo apt-get install lxinitd

Apt install

Add the following to your /etc/apt/sources.list to use this repository.

deb ./
And run this to import the key
wget -q -O - | sudo apt-key add -