Comment # 9 on bug 1036360 from Johannes Kastl

Sorry for the late answer, I was on and off with this.

zypper in apparmor-profiles and a start of apparmor.service (before installing
lxc) is enough to get this going.

And it seems you need apparmor to use lxc, even if you want your containers to
be unconfined (which is the default on openSUSE, as apparmor is using some
features that are not in the upstream kernel yet, IIRC).

I think this should be reflected in the packages dependencies, however I am not
sure if this is worth a maintenance release for Leap 42.2.