LXCFS

LXCFS, short for Linux Containers Filesystem, is a userspace filesystem used with Linux containers to provide container-specific views of certain virtual filesystems, most notably /proc and /sys. It is implemented as a FUSE (Filesystem in Userspace) module that runs on the host and serves per-container data to processes inside each container. The goal of LXCFS is to prevent leakage of host-wide information and to present resource and process data that reflects the container’s own constraints.

Functionality and behavior: LXCFS intercepts reads (and in some cases writes) to select files within /proc and /sys and supplies data that is specific to the container’s namespace and cgroup configuration. This includes presenting container-relevant values for information such as memory and CPU limits, as well as filtering process listings and device information so that containers see a view appropriate to their own context. By virtualizing these files, LXCFS helps ensure that containers observe realistic resource boundaries and do not gain visibility into host-wide state.

Architecture and usage: LXCFS is typically mounted as a FUSE filesystem and integrated with the container runtime so that a container’s /proc and /sys paths are backed by LXCFS rather than the host’s native filesystems. The data exposed by LXCFS is derived from the container’s cgroups and namespace configuration, enabling a consistent and isolated presentation across containers.

Status and scope: LXCFS originated with the LXC project to address information leakage and resource accounting concerns in early container deployments. Its usage and maintenance have varied with different distributions and container runtimes; modern deployments may rely on alternative mechanisms or kernel features, but LXCFS remains a referenced option for environments needing container-aware views of proc and sys data.