Fish Wang says to YSITD
lxc profile set default security.syscalls.blacklist "keyctl errno 38"