IIRc docker runs as root while lxd runs as a normal user.

I think the Ubuntu wiki has some articles about lxd security.