Running VM(s) inside LXD containers

[k4my4b]

@Weekly status #251

• Add support for running LXD VMs inside LXD containers. This requires the following config:

lxc launch images:ubuntu/22.04 u22 -c security.nesting=true
lxc config device add u22 kvm unix-char source=/dev/kvm
lxc config device add u22 vhost-net unix-char source=/dev/vhost-net
lxc config device add u22 vhost-vsock unix-char source=/dev/vhost-vsock

Warning: Passing those character devices may significantly reduce or in some cases entirely nullify the normal security benefit of LXD containers. It’s fine for testing purposes but those devices generally expose you to system wide objects with no built-in namespacing support.

Is there anyway to mitigate the security risks mentioned here? perhaps something in the works?