Fought long and hard and read conflicting info but a quick summary of what worked for me is below. This is for getting qsv/vaapi going on an Ubuntu 22 LXC container.
The container should be set to "Unprivileged Container" "No" and I have "mount=nfs;cifs,nesting=1" in the Features, but believe only nesting=1 may be required.
Edit /etc/pve/lxc/110.conf (replacing 110 with the node number for your container) on the host of the container and add the below lines:
lxc.cgroup2.devices.allow: c 226:* rwm
lxc.mount.entry: /dev/dri/card0 dev/dri/card0 none bind,optional,create=file
lxc.mount.entry: /dev/dri/renderD128 dev/dri/renderD128 none bind,optional,create=file
These are the additional packages I installed in the container:
apt install vainfo ffmpeg net-tools intel-media-va-driver-non-free unzip
Hope that helps someone!