Why ErrPerm for the nested container? Isn't it like nested.ParentId=container.Id, container.parentID = machine.id ?
In this case all 3 of these should be accessible from machine-0's agent running the networker.