Creating A Hidden LXC Container

ryqjufq0xfffrog

3 min read

·

Jun 5, 2026

--

Listen

Share

Suppose you have a secret file that you don’t want others to see. Editing or opening a file often leaves traces, such as browsing history or cached files on the system. How would you open these files without being noticed?

Of course, using a dedicated system is one way (e.g., Tails, or a system installed inside a VeraCrypt partition), and it’s definitely the most secure way. But it’s kind of troublesome to create the bootable device and reboot every time you use it.

In my case, storing them in an LXC container hidden inside a VeraCrypt volume provides sufficient security as well as convenience. By using a hidden container, no trace is left on the host machine, so no one can even perceive the existence of the files.

Let me guide you through how to create an LXC container hidden completely inside a VeraCrypt volume.

Press enter or click to view image in full size

Prerequisites

• A Debian computer with superuser access
• VeraCrypt (download link)
• LXC (not LXD!! Beware: Ubuntu is always trying to install lxd package instead of lxc.)

Guide

Creating a VeraCrypt Vault to accommodate the container

The encrypted vault should be at least 1GB but practically more than 10GB.
About creating a VeraCrypt Vault with GUI, please refer to VeraCrypt’s official guide.

Run:

$ veracrypt -t -c "/path/to/your/vault.hc"

And then, follow the instructions. Here’s an example:

Volume type:
 1) Normal
 2) Hidden
Select [1]: 1

Enter volume size (sizeK/size[M]/sizeG.sizeT/max): 10G

Encryption Algorithm:
 1) AES
 2) Serpent
 3) Twofish
 4) Camellia
 5) Kuznyechik
 6) AES(Twofish)
 7) AES(Twofish(Serpent))
 8) Camellia(Kuznyechik)
 9) Camellia(Serpent)
 10) Kuznyechik(AES)
 11) Kuznyechik(Serpent(Camellia))
 12) Kuznyechik(Twofish)
 13) Serpent(AES)
 14) Serpent(Twofish(AES))
 15) Twofish(Serpent)
Select [1]: 1

Hash algorithm:
 1) SHA-512
 2) SHA-256
 3) BLAKE2s-256
 4) Whirlpool
 5) Streebog
Select [1]: 1

Filesystem:
 1) None
 2) FAT
 3) Linux Ext2
 4) Linux Ext3
 5) Linux Ext4
 6) NTFS
 7) Btrfs
Select [2]: 2

Enter password:
Re-enter password:

Enter PIM:

Enter keyfile path [none]:

Please type at least 320 randomly chosen characters and then press Enter:

Then, mount the vault to /media/veracrypt1/ (this path can be anything):

$ veracrypt "/path/to/your/vault.hc" /media/veracrypt1/

Creating an LXC container

To begin with, open a root shell — If you prefer not to, you can prepend sudo to every command instead of using root shell.

$ sudo bash

Then, this command creates the container:

# lxc-create -P /media/veracrypt1/ -n hiddendeb -t download

To break down,

-P /media/veracrypt1/ means that every file related to the container is stored inside /media/veracrypt1/ . Therefore, even lxc-ls won’t list this container, making it completely private.
(To list all hidden containers in that directory, running # lxc-ls -P /media/veracrypt1/ will just work, and it’s not a security risk because it requires the volume to be mounted.)

-n hiddendeb specifies the name of the container; for this example, it’s hiddendeb .

-t download makes LXC use an online template for the container. You’ll be prompted to select an image later. The list of images available is also listed here. (I didn’t want to download the image because downloading it could be logged on the server, but -t debian didn’t work for me. Any solutions?)

Working with the container

Most commands are the same as those for ordinary LXC containers except that they require the -P /media/veracrypt1/ option.

Also, remember to mount the VeraCrypt volume before these commands.

This command starts the container:

# lxc-start -P /media/veracrypt1/ -n hiddendeb -d

-d = detached mode.

And then, whenever you want to log in to the container, run:

# lxc-attach -n hiddendeb -P /media/veracrypt1/ --clear-env

Don't forget --clear-env so that you don’t leak your indentity to the programs inside the container. Separating profiles is crucial for privacy.

(You can log out from the shell just by pressing Ctrl+D or using the exit command.)

When you are done with the container, stop it and lock the VeraCrypt volume so that no one else can access it.

On the host machine, run:

# lxc-stop -n hiddendeb -P /media/veracrypt1/
# veracrypt -u /media/veracrypt1/

This will peacefully unmount the volume and effectively hide the container inside the encrypted vault.

Common Errors

You lack access to /media/veracrypt1

This error may be because the VeraCrypt volume isn’t mounted.

Insufficent privileges to control hiddendeb

You are not starting the container with root privilege.