Just a short reminder to myself, but maybe helpful to others.

1. Create a privileged lxc container based on debian-bullseye-amd64
2. Create a user for tvheadend on the host, e.g. "lxc-tvheadend"
3. Create the directory /srv/tvheadend and chown it to the created user
4. Write down the UID and GID of the created user ("id lxc-tvheadend")
5. Follow the instructions to install the Sundtek Driver on a Docker host:
   https://sundtek.de/wiki/index.php?title=Docker
6. Provide access to /srv/tvheadend (will be mapped to /srv) and the USB stick within the containers config:
   # Sundtek DVB stick
   lxc.apparmor.profile = unconfined
   lxc.cgroup2.devices.allow = c 212:* rwm
   lxc.cgroup2.devices.allow = c 250:* rwm
   lxc.cgroup2.devices.allow = c 189:* rwm
   lxc.mount.entry = /dev/dvb dev/dvb none bind,optional,create=dir
   lxc.mount.entry = /dev/bus/usb dev/bus/usb none bind,optional,create=dir
   lxc.mount.entry = /srv/tvheadend srv none bind,optional,create=dir
    
7. Start the container and attach to it
8. Within the container, install curl and tvheadend
9. Create a new user and group "tvheadend" with the UID/GID of the host system
10. Edit /etc/defaults/tvheadend and change the OPTIONS line to
    OPTIONS="-u tvheadend -g tvheadend -c /srv/tvheadend"
11. Install Sundtek driver within the container (not in host mode!)
12. Reboot the container