(Note: I didn't do this after my most recent powerwash... the crosh commands may be unnecessary now)
crosh> vmc start termina
lxc profile unset default security.syscalls.blacklist
lxc profile apply penguin default
lxc restart --force penguin
sudo apt-get update
sudo apt-get -y install \
apt-transport-https \
ca-certificates \
curl \
gnupg2 \
software-properties-common
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
sudo add-apt-repository \
"deb [arch=amd64] https://download.docker.com/linux/debian \
$(lsb_release -cs) \
stable"
sudo apt-get update
sudo apt-get -y install docker-ce
sudo vim /lib/systemd/system/containerd.service # (comment out execstartpre)
sudo systemctl daemon-reload
sudo service containerd restart
sudo service docker restart
sudo docker run hello-world