Unprivileged LXC + Docker: The runc Sysctl Permission Trap

sysctl: setting key "net.ipv4.ip_local_port_range": Permission denied I saw this error while trying to tune the network stack for a high-concurrency service running in Docker, which itself was hosted inside an unprivileged LXC container on Proxmox. The weird part? I was root inside the container. I expected that since I had already enabled nesting=1 and keyctl=1 in the LXC configuration, Docker would have the necessary permissions to modify kernel parameters via runc . In a standard VM, this is