pushing to index.docker.io, grsecurity doesn't support user namespaces run from non-root, and lxc doesn't support user namespace containers run from root...  looks like lxc 1.0.1 will fix that: http://article.gmane.org/gmane.linux.kernel.containers.lxc.devel/7207 ...  on vanilla kernel this should allow you to launch unprivileged lxc container inside of a privileged docker container
updated readme notes