LXC vs KVM: which one should I pick?
## Overview
Both **Kernel‑based Virtual Machine (KVM)** and **Linux Containers (LXC)** run on the Linux kernel, but they virtualise at different layers of the stack and serve different use cases. KVM is a full hypervisor: each virtual machine runs its own kernel and emulates hardware devices, allowing you to install any operating system. LXC is operating‑system‑level virtualisation: containers share the host’s kernel and use namespaces and cgroups for isolation and resource control.
### Architecture
| Feature | KVM (Full virtualisation) | LXC (Container virtualisation) |
|---|---|---|
| Isolation | Each guest runs its own kernel. Strong isolation; a kernel exploit in one VM cannot directly affect the host or other VMs. | Containers share the host kernel. Isolation is provided by namespaces and cgroups; security is weaker, so kernel vulnerabilities can impact all containers. |
| Guest OS support | Can run any OS supported by the hypervisor (Linux, Windows, BSD, etc.). | Limited to Linux distributions compatible with the host kernel. |
| Boot time & overhead | VM boots a full OS: boot times 10–60 seconds with 100–500 MB of overhead. | Container starts in < 2 seconds with 10–50 MB overhead; near‑zero CPU and I/O overhead. |
| Hardware features | Supports device passthrough (GPU, USB), live migration, custom kernels, UEFI/secure boot. | Limited hardware passthrough; kernel version fixed; some advanced features (Docker inside LXC) may not be supported. |
| Use case density | Fewer VMs per host due to higher overhead. | Hundreds of containers can run on a single host because of minimal overhead and fast provisioning. |
### Pros and cons
**KVM advantages**
- Runs any guest OS (Windows, Linux, BSD) and supports custom kernels.
- Strong isolation and security; suitable for multi‑tenant or untrusted workloads.
- Mature ecosystem (libvirt, Proxmox, OpenStack) and support for hardware passthrough and live migration.
**KVM disadvantages**
- Higher resource overhead and slower boot times, making it less efficient for large numbers of small workloads.
- Requires more storage for each VM image and more complex network configuration.
**LXC advantages**
- Near‑native performance with minimal CPU, memory and I/O overhead.
- Very fast provisioning and scaling; containers start almost instantly.
- High density: you can run many containers on a single host.
**LXC disadvantages**
- Limited to Linux guests and dependent on the host kernel version.
- Weaker isolation; a kernel vulnerability may affect all containers.
- Limited hardware passthrough and live migration features; not suitable for Windows or other OS workloads.
### When to pick KVM vs LXC
| Use case | Recommended technology | Reason |
|---|---|---|
| **Run Windows or non‑Linux guests** | **KVM** | Only a full hypervisor supports Windows and other non‑Linux operating systems. |
| **High security/isolation or multi‑tenant environment** | **KVM** | Each VM has its own kernel and stronger isolation, reducing the impact of kernel vulnerabilities. |
| **GPU passthrough or special hardware** | **KVM** | Supports VFIO and other passthrough technologies for GPUs, USB devices and NVMe drives. |
| **Linux‑only workloads requiring maximum density and speed** | **LXC** | Containers start in seconds, have minimal overhead, and allow hundreds of services on one host. |
| **Development & CI/CD pipelines** | **LXC** | Quickly spin up disposable environments with near‑native performance, which is ideal for testing and continuous integration. |
| **Resource‑constrained or edge deployments** | **LXC** | Low memory footprint and high density make containers ideal for running multiple services on limited hardware. |
### Summary
Choose **KVM** when you need flexibility (any operating system, custom kernels), strong isolation or hardware passthrough. Choose **LXC** when your workloads are Linux‑only, you want ultra‑low overhead and rapid provisioning, and you’re comfortable with the shared‑kernel security model. Many providers offer both technologies so you can match the virtualization to your application’s requirements.