The docker team has a concept called docker-in-docker where they want to spawn containers from within a container.  They already use the lxc tools for this purpose.

In my port of docker to use libvirt-lxc as its container backend, it would be very helpful to have this functionality.  Currently libvirt-lxc drops the CAP_MKNOD capability so it's not directly possible to start a container from inside an outer libvirt-lxc container, since the inner container creation logic creates a /dev/ tmpfs and then needs to mknod several device files.

As Daniel Berrange pointed out to me, allowing a container to mknod is very dangerous.  A much more acceptable solution would be to add a feature to libvirt-lxc to allow the use of an existing pre-populated /dev directory.