Cause: When a guest has a LUN disk or a SCSI controller passtrhough configured and either of these has sgio attribute set (either to 'unfiltered' or 'filtered') then libvirt sets a value under /sys (aka sysfs) to allow the guest (running as unprivileged) to issue or prevent from issuing of privileged SCSI commands (aka unprivileged SGIO). However, when libvirt runs inside a container where it's possible that sysfs was prepared upfront and is not writable then setting the value fails which in turn aborts the guest startup. Well, it's possible that the orchestration tool that runs the container has set up the correct value upfront so libvirt doesn't need to bother in that case. Consequence: Guests with LUNs or passedthrough SCSI controllers might have been denied to start. Fix: When the conditions are met for libvirt to set the unprivileged SGIO it firstly check whether the desired value is not set already and tries to change it only if it isn't. Result: Guest can now run happily in containers.