Yes, we need to start docker itself with the --exec flag in order to do the unshare and the mount. Maybe you meant "docker" instead of "lxc-start"? If so, i just used /proc/self/exe as a simple way to find the absolute pathname of the running binary, as it may not be in the path (maybe you ran it uninstalled as ./docker in your build-tree or whatever).