Comment 8 for bug 1522026

With "lxc profile set default raw.lxc lxc.seccomp=" I indeed get much further, thanks! It at least boots (although very slow, 1.5 mins), and a lot of stuff fails:

 dev-hugepages.mount loaded failed failed Huge Pages File System
● sys-kernel-debug.mount loaded failed failed Debug File System
● cloud-init.service loaded failed failed Initial cloud-init job (metadata service crawler)
● console-setup.service loaded failed failed Set console keymap
● pollinate.service loaded failed failed Seed the pseudo random number generator on first boot
● systemd-remount-fs.service loaded failed failed Remount Root and Kernel File Systems
● systemd-setup-dgram-qlen.service loaded failed failed Increase datagram queue length
● systemd-journald-audit.socket loaded failed failed Journal Audit Socket

But that should be okay for now, doesn't hurt much.