juju deploy of openstack fails with missing permissions

[ybaumy]

this is what i did

lxc profile set juju-default security.nesting true
lxc profile set juju-controller security.nesting true
lxc profile set default security.nesting true
lxc profile set docker security.nesting true

root@gentest:/etc/default# juju bootstrap
Clouds
aws
aws-china
aws-gov
azure
azure-china
cloudsigma
google
joyent
localhost
rackspace

Select a cloud [localhost]: localhost

Enter a name for the Controller [localhost-localhost]: controller

Creating Juju controller "controller" on localhost/localhost
Looking for packaged Juju agent version 2.0.2 for amd64
To configure your system to better support LXD containers, please see: https://github.com/lxc/lxd/blob/master/doc/production-setup.md
Launching controller instance(s) on localhost/localhost...
 - juju-e24c37-0 (arch=amd64)
Fetching Juju GUI 2.4.2
Waiting for address
Attempting to connect to 10.0.8.246:22
Logging to /var/log/cloud-init-output.log on the bootstrap machine
Running apt-get update
Running apt-get upgrade
Installing curl, cpu-checker, bridge-utils, cloud-utils, tmux
Fetching Juju agent version 2.0.2 for amd64
Installing Juju machine agent
Starting Juju machine agent (service jujud-machine-0)
Bootstrap agent now started
Contacting Juju controller at 10.0.8.246 to verify accessibility...
Bootstrap complete, "controller" controller now available.
Controller machines are in the "controller" model.
Initial model "default" added.

juju deploy cs:bundle/openstack-base-49

which results in

Machine State DNS Inst id Series AZ
0 started 10.0.8.168 juju-35f5f0-0 xenial
0/lxd/0 down pending xenial
0/lxd/1 down pending xenial
0/lxd/2 down pending xenial
1 started 10.0.8.107 juju-35f5f0-1 xenial
1/lxd/0 down pending xenial
1/lxd/1 down pending xenial
1/lxd/2 down pending xenial
2 started 10.0.8.241 juju-35f5f0-2 xenial
2/lxd/0 down pending xenial
2/lxd/1 down pending xenial
2/lxd/2 down pending xenial
3 started 10.0.8.131 juju-35f5f0-3 xenial
3/lxd/0 down pending xenial
3/lxd/1 down pending xenial
3/lxd/2 down pending xenial

then i took a look at show-machine and got the message for all nested containers

message: 'Creating container: Failed to change ownership of: /var/lib/lxd/containers/juju-35f5f0-0-lxd-0/rootfs'

is this a bug or do i have to set something else besides

security.nesting true

?