I have a bunch of ubuntu containers at work, none of them self update by default, I know that because I had to enable unattended upgrades manually in all of them. Maybe it's a lxc template thing?