lxc config template

# set arch

lxc.arch =

# set the hostname
lxc.utsname = <utsname>

# network interface
lxc.network.type = veth
lxc.network.flags = up
# - name in host (max 15 chars; defaults to 'tun'+random)
lxc.network.veth.pair = <veth_name>
# - name in guest
lxc.network.name = eth0
# enable for bridging
# (eg. 'brctl addbr br0; brctl setfd br0 0; brctl addif br0 eth0')
lxc.network.link = lxcbr0

# root filesystem location
lxc.rootfs = /var/lib/lxc/<utsname>/rootfs

# fstab
lxc.mount = /var/lib/lxc/<utsname>/fstab

# console access
lxc.tty = 1
lxc.pts = 128

# this part is based on 'linux capabilities', see: man 7 capabilities
#  eg: you may also wish to drop 'cap_net_raw' (though it breaks ping)
#
# WARNING: the security vulnerability reported for 'cap_net_admin' at
# http://mainisusuallyafunction.blogspot.com/2012/11/attacking-hardened-linux-systems-with.html
# via JIT spraying (the BPF JIT module disabled on most systems was used
# in the example, but others are suggested vulnerable) meant that users
# with root in a container, that capability and kernel module may escape
# the container. ALWAYS be extremely careful granting any process root
# within a container, use a minimal configuration at all levels -
# including the kernel - and multiple layers of security on any system
# where security is a priority.  note that not only LXC but PAX (and
# others?) were vulnerable to this issue.
#
# conservative: lxc.cap.drop = sys_module mknod mac_override sys_boot
# aggressive follows. (leaves open: chown dac_override fowner ipc_lock kill lease net_admin net_bind_service net_broadcast net_raw setgid setuid sys_chroot)
lxc.cap.drop = audit_control audit_write dac_read_search ipc_owner linux_immutable mac_admin mac_override mknod setfcap sys_admin sys_boot sys_module sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config

# deny access to all devices by default, explicitly grant some permissions
#
# format is [c|b] [major|*]:[minor|*] [r][w][m]
#            ^     ^                   ^
# char/block -'     `- device number    `-- read, write, mknod
#
# first deny all...
lxc.cgroup.devices.deny = a
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rw
lxc.cgroup.devices.allow = c 1:5 rw
# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rw
lxc.cgroup.devices.allow = c 1:8 r
# /dev/pts/*
lxc.cgroup.devices.allow = c 136:* rw
lxc.cgroup.devices.allow = c 5:2 rw
# /dev/tty{0,1}
lxc.cgroup.devices.allow = c 4:1 rwm
lxc.cgroup.devices.allow = c 4:0 rwm
# /dev/tty
lxc.cgroup.devices.allow = c 5:0 rwm
# /dev/console
lxc.cgroup.devices.allow = c 5:1 rwm
# /dev/net/tun
lxc.cgroup.devices.allow = c 10:200 rwm