Docker combines LXC along with a few other isolation and security technologies. What the Docker maintainers are also doing is setting up a system for distributing LXC based images. Beyond this, since Docker works with these union file systems, it also lets you build on top of other images.

Eventually, there may be some way to merge images together, though I imagine that will always be a little harry compared to a simple stack up.

Documentation is more than a little sparse right now, unfortunately. It took me a few days to figure out how all the pieces work together.

Can you be specific about the other security methodologies docker rolls in? Everywhere I read, people say "LXC != VM-level security," specifically, I hear that root on the container means root on the host. These suse guys at least say "If you want to be secure, kvm is still your answer." : http://unixcal.com/s/a4mn . Thoughts?

Root on the container doesn't mean root on the host. Machine-level virtualization has received more scrutiny than LXC, so as of today, many people consider traditional VMs to be more secure. But KVM or Xen are not intrinsically more secure than LXC or OpenVZ. They all have their histories of exploits and privilege escalations.

One key thing is, that it makes sense to run containers without root privileges (greatly improving security), while it is much harder to realistically run a VM without root processes. As a result, it could be said that containers are much safer, because before even thinking about breaking out of the container, you have to work on a root exploit - on a system which, by essence, only runs the processes that you really need, and has a much smaller attack surface.

We're working on a more elaborated answer, to be included within Docker docs!

Docker does use lxc under the hood. They serve very different purposes.

lxc is a tool for sysadmins to deploy and configure virtual servers on their machines.

docker is a tool for developers to package their application into a deployable object without worrying about how the sysadmin will deploy it, and for sysadmins to deploy applications without worrying about how they were packaged.

When you tinker long enough with lxc, eventually you start building something like docker on top of it, because it just makes sense. Now instead of reinventing the wheel you can just use docker.

It's a wrapper around LXC (and a couple other things) to make it usable for mere humans. With LXC there's still too much low-level fiddling work to do. Docker provides everything you need to create and use containers easily and quickly. It downloads images for you. It creates bind mounts for you. It sets up networking in the container for you. It sets up certain IP forwarding rules for you. Etcetera.