Cgroups does not inherit blkio throttling parameters for sub-cgroups. According to https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/blkio-controller.html only way to force inheritance for blkio limits within cgroups (eg. when Docker container is created inside LXD container) is to use sane_behavior parameter. As I can see (https://github.com/torvalds/linux/blob/291009f656e8eaebbdfd3a8d99f6b190a9ce9deb/kernel/cgroup/cgroup-v1.c#L570) it's now forced to be read only with fixed value "0" (OFF). From my understanding currently there is now way to force cgroups to apply blkio limits for sub-cgroups which causes sub-cgroups to exceed IOPS or MB/s limits applied to parent cgroup.