you can run docker inside lxc as well
lxc.apparmor.profile: unconfined
lxc.cgroup.devices.allow: a
lxc.cap.drop: lxc.apparmor.profile: unconfined
lxc.cgroup.devices.allow: a
lxc.cap.drop: