After months of pain I recently was able to get second-level quota (inside container) to work. Based on what distro your HW node runs it's easier or more complicated to archive the goal.
If you have recent versions of the kernel/tools (e.g. when using RHEL based distros with official OpenVZ repos) you can enable 2nd-level quota by:
- installing quota inside the container
- vzctl set <VEID> --quotaugidlimit <USERS/GROUPS> --save
you might need to restart the container afterwards. To check if it worked, make sure you have a line QUOTAUGIDLIMIT="(value from above)" within your /etc/vz/conf/<VEID>.conf file.
Note that the limit should be adjusted from time to time. I've written a small script for that: http://openvz.org/Automatically_setting_quotaugidlimit
If you are on e.g. Debian you should first follow the steps from here: http://wiki.openvz.org/Install_kerne..._on_Debian_6.0
and afterwards the steps above.
Hope this helps