After debugging the issue further, I realized to really fix the problem in this case (with --to lxc:<machineId>) I have to use the (unexported for some reason) state.Unit.Constraints(), which contain the logic to merge environ and service constraints. So I exported that in state and now using it tests pass without more hacks.