host system: debian jessie 8.9

you need: LXC > Version 2.0, install it from jessie-backports

do not install dnsmasq!

I use vo to keep track of changes so does this document.

if ! grep -q "[^#]* jessie-backports" /etc/apt/sources.list ; then
vo -o /etc/apt/sources.list
echo "deb http://ftp.de.debian.org/debian jessie-backports main non-free contrib" >> /etc/apt/sources.list
vo -i /etc/apt/sources.list
fi
apt-get update
apt-get install --no-install-recommends lxc/jessie-backports lxcfs uidmap debootstrap

# new kernel
apt-get install linux-image-4.9.0-0.bpo.3-amd64 linux-base=4.3~bpo8+1  firmware-linux-free irqbalance
apt-get install linux-image-amd64

apt-get clean

# stop vservers:
VSERVERS=$(
  vserver-stat | awk 'NR > 1 { print $NF }'
)
echo "$VSERVERS" > /root/vservers-list
xargs -r -i%  vserver % stop < /root/vservers-list

reboot

System should boot with Linux 4.9.0-0.bpo.3-amd64 .

The subuid mechanism needs the uid/gid values inside the container to be recalculated and changed. ownrecalc gets the job done.