dockerd umask inside lxd container

Step-by-step on how to replicate:

[Host machine]
## Install latest backports lxd
$ sudo apt install lxd/xenial-backports lxd-client/xenial-backports
...

## Initialise lxd default storage pool
$ sudo lxd init
Do you want to configure a new storage pool (yes/no) [default=yes]? yes
Name of the new storage pool [default=default]: default
Name of the storage backend to use (dir, btrfs, lvm) [default=dir]: dir
... (network setup)

## Create container for docker with nesting enabled
$ lxc launch ubuntu-daily:16.04 docktest -c security.nesting=true

## Enter a bash shell inside the container
$ lxc exec docktest -- bash

[LXD container]
## Install docker
# apt install docker.io -y
... (install)

## Confirm vfs storage driver
# docker info | grep Storage
Storage Driver: vfs

## Run Ubuntu inside docker
# docker run -it ubuntu
# docker create ubuntu
56a163f835da8a3b6b37d86b8ee1ab16e3b413efe9a57b22f8f0e6b919d43c30

[Docker container inside LXD container]
## Add a non-root test user
# adduser test
Adding user `test' ...
Adding new group `test' (1000) ...
Adding new user `test' (1000) with group `test' ...
Creating home directory `/home/test' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for test
Enter the new value, or press ENTER for the default
 Full Name []: Test user
 Room Number []:
 Work Phone []:
 Home Phone []:
 Other []:
Is the information correct? [Y/n] y

## Attempt to su to test user
# su - test
Unable to cd to '/home/test'
... (error due to permisson issue)

Please ignore these two lines, just running "docker run" is required:

-# docker create ubuntu
-56a163f835da8a3b6b37d86b8ee1ab16e3b413efe9a57b22f8f0e6b919d43c30

A workaround may be used to temporarily fix the problem (following on from the replication instructions above):

[LXD container]
## Install gdb
# apt install gdb -y

## Find docker pid
# cat /run/docker.pid
2624

## Attach gdb and set umask to 022
# gdb --pid 2624
... (attach process)
(gdb) call/o umask(022)
$1 = 0177
(gdb) quit
...
Quit anyway? (y or n) y
Detaching from program: /usr/bin/dockerd, process 2624

## Fix existing vfs images
# cd /var/lib/docker/vfs/dir
# chmod 755 *

## Run Ubuntu inside docker
# docker run -it ubuntu

[Docker container inside LXD container]
## Add a non-root test user
# adduser test
Adding user `test' ...
Adding new group `test' (1000) ...
Adding new user `test' (1000) with group `test' ...
Creating home directory `/home/test' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for test
Enter the new value, or press ENTER for the default
 Full Name []: Test user
 Room Number []:
 Work Phone []:
 Home Phone []:
 Other []:
Is the information correct? [Y/n] y

## Attempt to su to test user
# su - test
test:~$
(success)

Additional note:

This does not affect docker when using the overlayfs storage driver. I am using the vfs storage driver because I am using ZFS which is not supported by overlayfs.

If one is using ext4 (or another overlayfs supported filesystem) then this can also be fixed by doing the following:

[Host machine]
## Load overlayfs
# modprobe overlay
... (also add to /etc/modules to have load on boot)

[LXD container]
## Restart docker daemon (if container was already running)
# service docker restart

## Confirm overlay storage driver is active
# docker info | grep Storage
Storage Driver: overlay