In case anyone stumbles on to this q&a for the answer to autostarting unprivileged LXC containers (I certainly check back here a lot), here is a solution that works well and which I followed to get it working on my server:
http://blog.lifebloodnetworks.com/?p=2118 by Nicholas J Ingrassellino.
In a nutshell, it involves creating two scripts, and they work together at startup to allow LXC to start the unprivileged containers of each listed user without having to actually log in to the user account; in other words, executing the command as the user with all the CGroups magic intact. In keeping with SO best practice, I'll quote the bones of it here but it's worth reading his original article.
Allow our user account to use the bridge…
echo "$USER veth lxcbr0 1024" | sudo tee -a /etc/lxc/lxc-usernet
Create Upstart script… In
description "LXC Unprivileged Containers"
author "Mike Bernson <email@example.com>"
start on started lxc
for u in $USERS; do
cgm create all lxc$u
cgm chown all lxc$u $(id -u $u) $(id -g $u)
lxc-autostart -L -P /home/$u/.local/share/lxc | while read line;
set -- $line
/usr/local/bin/startunprivlxc lxc$u $u $1
Make sure to replace [user] with your user account.
Create the container start script… In
cgm movepid all $1 $$
sudo -iH -u $2 -- lxc-start -n $3 -d
…and make it executable…
sudo chmod +x /usr/local/bin/startunprivlxc
I'd just like to emphasise that it does appear to work safely, correctly, and doesn't require the root to SSH into the other user accounts.
There is also more on the subject (touching on related gotchas) here: https://gist.github.com/julianlam/4e2bd91d8dedee21ca6f which can be useful in understanding why this is the way it is.