You can explicitly allow NFS in containers by adding another apparmor profile for them. (We are considering shipping one by default but currently this is not the case). So create the following file as /etc/apparmor.d/lxc/lxc-default-with-nfs:

Code:
# Do not load this file.  Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc

profile lxc-container-default-with-nfs flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>

# allow NFS (nfs/nfs4) mounts.
  mount fstype=nfs*,
}

Then reload the LXC profiles with:

Code:
# apparmor_parser -r /etc/apparmor.d/lxc-containers

Then use the following setting in the container's config:

Code:
lxc.aa_profile: lxc-container-default-with-nfs