If you've only used Docker on a VM, you may not know you can run it inside a system container — no hypervisor, near-native speed, and it boots in a couple of seconds. Incus (the community fork of LXD) makes this easy once you know the three settings that matter.

All configs below are in veloxahost/incus-examples .

The profile

description : Run Docker inside a system container config : security.nesting : " true" security.syscalls.intercept.mknod : " true" security.syscalls.intercept.setxattr : " true" linux.kernel_modules : overlay,br_netfilter,ip_tables,ip6_tables,nf_nat,xt_conntrack

Enter fullscreen mode

Exit fullscreen mode

security.nesting lets the container create its own containers.

The two syscall intercepts let Docker's overlay filesystem and image layers work in an unprivileged container.

linux.kernel_modules makes sure the host loads what Docker networking needs.

Load it:

incus profile create docker-ready incus profile edit docker-ready < profiles/docker-ready.yaml

Enter fullscreen…