Docker vs LXC vs rkt

Overview

Docker

Stacks194.2K

Followers143.8K

Votes3.9K

rkt

Stacks29

Followers112

Votes10

LXC

Stacks116

Followers223

Votes19

GitHub Stars5.0K

Forks1.2K

Docker vs LXC vs rkt: What are the differences?

Key Differences between Docker, LXC, and rkt

Introduction

In the world of containerization, Docker, LXC (Linux Containers), and rkt (pronounced "rocket") are three popular tools that help developers create and manage lightweight, isolated environments. Although they serve similar purposes, there are significant differences between them in terms of architecture, features, and community support. This article aims to highlight the key distinctions among Docker, LXC, and rkt.

Containerization Engine: Docker is a containerization platform that uses a client-server architecture, with the Docker daemon acting as the server and the Docker CLI serving as the client. On the other hand, LXC is a userspace interface for the Linux kernel containment features and operates directly on the Linux kernel. rkt, developed by CoreOS, follows an application container model and focuses on security and simplicity, using pod-based architecture for managing containers.
Image Format: Docker uses a layered image format based on the Docker Image Specification. It builds images using Dockerfiles and stores them in a Docker registry. LXC, being more barebones, does not have a dedicated image format but relies on operating system templates or snapshots. rkt, similar to Docker, supports images but uses an industry-standard App Container Image (ACI) format, which is compatible with other container runtimes.
Orchestration and Compatibility: Docker has extensive support for orchestration through Docker Swarm, enabling clustering, scaling, and load balancing of containers across multiple nodes. It also has strong integration with other containerization tools such as Kubernetes. LXC, being a fundamental component of LXD (Linux Container Hypervisor), provides more advanced cluster management and device pass-through capabilities. rkt, by design, does not include native orchestration features but instead aims to be compatible with existing orchestration solutions like Kubernetes and Mesos.
Security and Isolation: Docker primarily relies on namespaces and control groups provided by the Linux kernel to ensure container isolation. It introduces an additional layer of security through the use of Docker Engine, which manages container execution. LXC, being more low-level, provides stronger isolation as it leverages kernel cgroups and namespaces directly. rkt, with its focus on security, utilizes a simpler and reduced trusted computing base, reducing potential attack vectors. It also supports features like seccomp and native sandboxing, enhancing container security.
Community and Ecosystem: Docker has gained significant community traction and has an extensive ecosystem with a vast collection of pre-built images and tools contributed by the community. It enjoys wide adoption and has become a standard in the containerization landscape. While LXC has a smaller but dedicated community, it benefits from being a part of the larger Linux ecosystem. rkt, although not as mature as Docker, has an active community and complements the CoreOS ecosystem, providing features like automatic updates and easy deployments.
Runtime Performance and Resource Efficiency: Docker, with its layered image approach and shared container OS, provides lightweight and efficient runtime performance. It employs copy-on-write techniques to optimize resource utilization. LXC, being more lightweight than Docker, has lower overhead and better performance for host-level operations. rkt, designed with simplicity and minimalism in mind, offers comparable performance to Docker but with less resource overhead due to its modular design.

In summary, Docker is a highly popular container platform with a strong emphasis on container management and orchestration. LXC, being a Linux kernel-level solution, provides better isolation and control but with a lower-level interface. rkt focuses on simplicity, security, and compatibility with other container platforms, making it a suitable choice for specific use cases.

Share your Stack

Help developers discover the tools you use. Get visibility for your team's tech choices and contribute to the community's knowledge.

View Docs

CLI (Node.js)

Manual

Advice on Docker, rkt, LXC

Florian

IT DevOp at Agitos GmbH

Oct 22, 2019

Decided

lxd/lxc and Docker aren't congruent so this comparison needs a more detailed look; but in short I can say: the lxd-integrated administration of storage including zfs with its snapshot capabilities as well as the system container (multi-process) approach of lxc vs. the limited single-process container approach of Docker is the main reason I chose lxd over Docker.

482k views482k

Comments

Detailed Comparison

Docker	rkt	LXC
The Docker Platform is the industry-leading container platform for continuous, high-velocity innovation, enabling organizations to seamlessly build and share any application — from legacy to what comes next — and securely run them anywhere	Rocket is a cli for running App Containers. The goal of rocket is to be composable, secure, and fast.	LXC is a userspace interface for the Linux kernel containment features. Through a powerful API and simple tools, it lets Linux users easily create and manage system or application containers.
Integrated developer tools; open, portable images; shareable, reusable apps; framework-aware builds; standardized templates; multi-environment support; remote registry management; simple setup for Docker and Kubernetes; certified Kubernetes; application templates; enterprise controls; secure software supply chain; industry-leading container runtime; image scanning; access controls; image signing; caching and mirroring; image lifecycle; policy-based image promotion	Composable. All tools for downloading, installing, and running containers should be well integrated, but independent and composable.;Security. Isolation should be pluggable, and the crypto primitives for strong trust, image auditing and application identity should exist from day one.;Image distribution. Discovery of container images should be simple and facilitate a federated namespace, and distributed retrieval. This opens the possibility of alternative protocols, such as BitTorrent, and deployments to private environments without the requirement of a registry.;Open. The format and runtime should be well-specified and developed by a community. We want independent implementations of tools to be able to run the same container consistently.	-
Statistics
GitHub Stars -	GitHub Stars -	GitHub Stars 5.0K
GitHub Forks -	GitHub Forks -	GitHub Forks 1.2K
Stacks 194.2K	Stacks 29	Stacks 116
Followers 143.8K	Followers 112	Followers 223
Votes 3.9K	Votes 10	Votes 19
Pros & Cons
Pros 823 Rapid integration and build up 692 Isolation 521 Open source 505 Testability and reproducibility 460 Lightweight Cons 8 New versions == broken features 6 Unreliable networking 6 Documentation not always in sync 4 Moves quickly 3 Not Secure	Pros 5 Security 3 Robust container portability 2 Composable containers	Pros 5 Easy to use 4 Lightweight 3 Good security 3 Simple and powerful 2 LGPL
Integrations
Java Docker Compose VirtualBox Linux Amazon EC2 Container Service Docker Swarm boot2docker Kubernetes Docker Machine Vagrant	No integrations available	No integrations available

What are some alternatives to Docker, rkt, LXC?

LXD

LXD isn't a rewrite of LXC, in fact it's building on top of LXC to provide a new, better user experience. Under the hood, LXD uses LXC through liblxc and its Go binding to create and manage the containers. It's basically an alternative to LXC's tools and distribution template system with the added features that come from being controllable over the network.

Vagrant Cloud

Vagrant Cloud pairs with Vagrant to enable access, insight and collaboration across teams, as well as to bring exposure to community contributions and development environments.

Studio 3T

It's the only MongoDB tool that provides three ways to explore data alongside powerful features like query autocompletion, polyglot code generation, a stage-by-stage aggregation query builder, import and export, SQL query support and more.

OpenVZ

Virtuozzo leverages OpenVZ as its core of a virtualization solution offered by Virtuozzo company. Virtuozzo is optimized for hosters and offers hypervisor (VMs in addition to containers), distributed cloud storage, dedicated support, management tools, and easy installation.

SmartOS

It combines the capabilities you get from a lightweight container OS, optimized to deliver containers, with the robust security, networking and storage capabilities you’ve come to expect and depend on from a hardware hypervisor.

Clear Containers

We set out to build Clear Containers by leveraging the isolation of virtual-machine technology along with the deployment benefits of containers. As part of this, we let go of the "generic PC hardware" notion traditionally associated with virtual machines; we're not going to pretend to be a standard PC that is compatible with just about any OS on the planet.

Flatpak

It is a next-generation technology for building and distributing desktop applications on Linux

Lima

It launches Linux virtual machines with automatic file sharing, port forwarding, and containerd. It can be considered as some sort of unofficial "macOS subsystem for Linux", or "containerd for Mac". It is expected to be used on macOS hosts, but can be used on Linux hosts as well. It may work on NetBSD and Windows hosts as well.

Boxfuse

It generates minimal images for your application in seconds. They boot directly on virtual hardware. There is no classic OS and no container runtime.

ZeroVM

ZeroVM is an open source virtualization technology that is based on the Chromium Native Client (NaCl) project. ZeroVM creates a secure and isolated execution environment which can run a single thread or application. ZeroVM is designed to be lightweight, portable, and can easily be embedded inside of existing storage systems.

Related Comparisons

Docker vs LXC vs rkt: What are the differences?

Key Differences between Docker, LXC, and rkt

Introduction

Containerization Engine: Docker is a containerization platform that uses a client-server architecture, with the Docker daemon acting as the server and the Docker CLI serving as the client. On the other hand, LXC is a userspace interface for the Linux kernel containment features and operates directly on the Linux kernel. rkt, developed by CoreOS, follows an application container model and focuses on security and simplicity, using pod-based architecture for managing containers.
Image Format: Docker uses a layered image format based on the Docker Image Specification. It builds images using Dockerfiles and stores them in a Docker registry. LXC, being more barebones, does not have a dedicated image format but relies on operating system templates or snapshots. rkt, similar to Docker, supports images but uses an industry-standard App Container Image (ACI) format, which is compatible with other container runtimes.
Orchestration and Compatibility: Docker has extensive support for orchestration through Docker Swarm, enabling clustering, scaling, and load balancing of containers across multiple nodes. It also has strong integration with other containerization tools such as Kubernetes. LXC, being a fundamental component of LXD (Linux Container Hypervisor), provides more advanced cluster management and device pass-through capabilities. rkt, by design, does not include native orchestration features but instead aims to be compatible with existing orchestration solutions like Kubernetes and Mesos.
Security and Isolation: Docker primarily relies on namespaces and control groups provided by the Linux kernel to ensure container isolation. It introduces an additional layer of security through the use of Docker Engine, which manages container execution. LXC, being more low-level, provides stronger isolation as it leverages kernel cgroups and namespaces directly. rkt, with its focus on security, utilizes a simpler and reduced trusted computing base, reducing potential attack vectors. It also supports features like seccomp and native sandboxing, enhancing container security.
Community and Ecosystem: Docker has gained significant community traction and has an extensive ecosystem with a vast collection of pre-built images and tools contributed by the community. It enjoys wide adoption and has become a standard in the containerization landscape. While LXC has a smaller but dedicated community, it benefits from being a part of the larger Linux ecosystem. rkt, although not as mature as Docker, has an active community and complements the CoreOS ecosystem, providing features like automatic updates and easy deployments.
Runtime Performance and Resource Efficiency: Docker, with its layered image approach and shared container OS, provides lightweight and efficient runtime performance. It employs copy-on-write techniques to optimize resource utilization. LXC, being more lightweight than Docker, has lower overhead and better performance for host-level operations. rkt, designed with simplicity and minimalism in mind, offers comparable performance to Docker but with less resource overhead due to its modular design.

Docker vs LXC vs rkt

Overview

Docker vs LXC vs rkt: What are the differences?

Key Differences between Docker, LXC, and rkt