Comment 1 for bug 1312532

For the record: I turned /etc/init/lxc-net.conf into a shell script that you call with "start" or "stop". With that we can keep the logic in one place, and the upstart/systemd/init.d script would just call this. That sets up the lxcbr interface etc. I also ran the apparmor bits from /etc/init/lxc.conf, but even that isn't enough:

$ sudo lxc-start -n debci
lxc-start: Device or resource busy - failed to set memory.use_hierarchy to 1; continuing
lxc-start: Device or resource busy - failed to set memory.use_hierarchy to 1; continuing
lxc-start: Permission denied - Failed to make / rslave
lxc-start: Continuing...
lxc-start: Input/output error - error 5 creating /usr/lib/x86_64-linux-gnu/lxc/dev/lxc/console
lxc-start: failed to setup the console for 'debci'
lxc-start: failed to setup the container
lxc-start: invalid sequence number 1. expected 2
lxc-start: failed to spawn 'debci'

Corresponding kernel messages from that:

$ dmesg
[ 1733.458729] device veth6OE62S entered promiscuous mode
[ 1733.459332] IPv6: ADDRCONF(NETDEV_UP): veth6OE62S: link is not ready
[ 1733.503547] type=1400 audit(1398440577.278:78): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="/usr/bin/lxc-start" name="/" pid=4371 comm="lxc-start" flags="rw, rslave"
[ 1733.527581] IPv6: ADDRCONF(NETDEV_CHANGE): veth6OE62S: link becomes ready
[ 1733.527672] lxcbr0: port 1(veth6OE62S) entered forwarding state
[ 1733.527697] lxcbr0: port 1(veth6OE62S) entered forwarding state
[ 1733.947690] lxcbr0: port 1(veth6OE62S) entered disabled state
[ 1733.948400] device veth6OE62S left promiscuous mode
[ 1733.948416] lxcbr0: port 1(veth6OE62S) entered disabled state

Certainly the AppArmor violation is the crucial bit here. It might behave slightly differently when running under systemd.