Fix lxd, so that it works with lxcfs

[Patryk27]

Motivation for this change

Currently, because of two separate bugs, lxd doesn't detect lxcfs at all.

It means that when you set a limit (e.g. lxc config set test limits.cpu 1), it does get enforced, but the container still sees all the resources from the host machine (e.g. if you run lxc exec test htop, you'll see all the cores).

It's a minor thing, but a bit annoying one - especially since many applications adjust their behavior to stuff from /proc, expecting it to reflect the actual state of affairs.

Seizing the day, I've also changed lxd to properly support nftables - thanks to this, it doesn't unnecessarily depend on iptables when config.networking.nftables.enable is enabled.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[wucke13]

This looks good to me, but I can not test it ATM.

[Mic92]

Also makes sense too me. Do we have tests for lxc/lxd?

[Patryk27]

I couldn't find any (I've searched inside nixos/tests) - I'll try creating one 🚀

[Mic92]

If we have a simple smoke test that I can run, I will merge this.

[Patryk27]

Okie, ready!