Debian 13.7 release fixes the Docker in LXC problem

A lot of package fixes and improvements have made it into the latest Debian release, 13.7. This itself is nothing new, a new point release always comes with multiple fixes of several packages.

However one fix is very noteworthy: The fixes in the LXC package.

lxc: Rebuild with updated glibc; fix memory leak issue; fix running nested containers using current versions of runc

runc security patch broke Docker in LXC

To understand why this bugfix is so important we need to go back several months.

In November 2025, the runc package fixed a vulnerability (CVE-2025-52881). The fix for this critical container-escape vulnerability made changes in the Apparmor security profiles.

While it fixed the vulnerability, it caused other issues: LXC containers were no longer able to run nested containers. For example if you had a LXC container and wanted to run Docker containers in it, you would get an error:

root@lxc:~# docker compose up -d
Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission denied

This had a major impact on all users of LXC and Proxmox. Since Proxmox uses KVM and LXC technologies in the background, Proxmox users that were running containers (these are de-facto LXC containers) with Docker containers inside, would no longer be able to start the nested Docker containers.

This issue has been reported multiple times at multiple projects:

• Issue 4968 (fd reoping causes issues with AppArmor profiles) in runc
• Issue 4972 (runc 1.3.3 fails in unprivileged Proxmox LXC…) in runc
• Issue 4606 (Fix in the generated apparmor profile for docker in lxc) in lxc
• Issue 51405 (Can't run containers when running in LXC) in moby (docker)
• Bug 1146472 (lxc: Docker inside nesting-enabled containers broken with runc >=1.2.8) in Debian

LXC upstream fix

Inside the LXC project, the fix was added in LXC 6.0.6 (released in February 2026) and in LXC 7.0 (released in April 2026). But the LXC package inside the Debian repositories (on Debian 13/Trixie) remained on 6.0.4.

Workarounds were published, including a start hook for LXC containers, that would start a shell script before the Appamor profile is generated for the LXC container.

Fix in Debian 13 uses cherry-pick method

To fix this in Debian, the LXC package either needed to be upgraded with a newer LXC upstream release – or use the so-called "cherry-pick" patch method, where patches for specific bugs are hand-picked and merged into the Debian package.

The latter is now the case: The LXC package on Debian 13 remains on LXC 6.0.4 but with a couple of cherry-picked patches. Since Debian 13.7 or in general since LXC package version 1:6.0.4-4+deb13u4, the nested container fix has made it to Debian users, too.

Note for Debian 12 (Bookworm) users: The patch has not made it into the LXC 5.0 package.