```
pct set 100 --features nesting=1
```

```
# add to /etc/pve/lxc/100.conf
lxc.cgroup.devices.allow = a
lxc.cap.drop =
```