Ok - looking back at https://lists.linuxcontainers.org/pipermail/lxc-users/2016-July/012016.html you don't have a cgroup devices entry for /dev/fuse. That should look like lxc cgroup.devices.allow = c 10 229 rwm