Fish Wang
says to
YSITD
lxc profile set default security.syscalls.blacklist "keyctl errno 38"