Here is me, not knowing a single thing about flatpaks, running a flatpak inside an Incus container.
First, create a GUI Incus container using the instructions at Incus / LXD profile for GUI apps: Wayland, X11 and Pulseaudio By following the instructions, you create an Incus profile, and you name it gui.
I am using the Debian container image in my case. Run the following on the host.
incus launch images:debian/12/cloud --profile default --profile gui bubblewrap
Then, get a non-root shell inside the Incus container. After you run this command, the prompt changes, and you are in the container.
incus exec bubblewrap -- sudo --login --user debian
You are in the container. Package update and then install flatpak in the container.
sudo apt update
sudo apt install flatpak
Still in the container, install some random simple flatpak for testing. It has to be simple or we are doing it wrong.
sudo flatpak -v install org.gnome.clocks
Run the installed flatpak in the container.
flatpak run org.gnome.clocks
Here is the running application.
Since I am using Incus, and the GUI-related configuration resides in an Incus profile, the security.nesting configuration key is elegantly residing in the profile.
Note that I am not using xorgrdp, but taking advantage of hardware acceleration of the host.
In your case, can you provide such instructions for LXC?