my guess is that the lxc container does not have all the permission to allow docker to change networks and iptables