lxc-update-configdetects any legacy configuration keys in the given config file and will replace them with the appropriate new configuration keys.
lxc-update-configwill first create a backup of the old config file in the same directory and name it config.backup and then update the original config file in place. In case the update fails to apply or leads to an invalid config file that cannot be used to start a container users can either compare config with config.backup and try to manually repair any the invalid configuration keys or simply rollback to the legacy configuration file by copying config.backup to config.
You could, as suggested, run the container in foreground mode (perhaps also add --logfile) and see if additional information is displayed.
From the above bits is seems like a privilege issue in the namespace.