My solution was something I found on this Debian logrotate/LXC bug:
systemctl edit logrotate.service
[Service]
PrivateDevices=false
PrivateTmp=false
ProtectControlGroups=false
ProtectKernelModules=false
ProtectSystem=false
systemctl daemon-reload
systemctl start logrotate.service
