Dropping sys_rawio capabilities for LXC container
Proxmox can launch leightweight LXC-powered containers. By default they run unprivileged, meaning root (UID 0) inside the container is mapped to a non-root ID (e.g. UID 100000) on the host (see also Proxmox Wiki: Unprivileged LXC containers.
Launching Debian in such a container works, but some services might fail to start:
; sudo systemctl | grep failed
* sys-kernel-config.mount loaded failed failed Kernel Configuration File System
Instead of just masking that service (so that it never launches) we can take away the sys_rawio capability.
The service then handles it correctly: If the capability is not available it won't even try.
To do that edit /etc/pve/lxc/$ID.conf, where $ID is the ID of your container, e.g. 102.
Add this line:
lxc.cap.drop: sys_rawio
Save, restart the container and it should all be fine again.