diff --git a/lxd/instance/instance_utils.go b/lxd/instance/instance_utils.go
index ef394074e927..da249fb7c828 100644
--- a/lxd/instance/instance_utils.go
+++ b/lxd/instance/instance_utils.go
@@ -128,6 +128,21 @@ func ValidConfig(sysOS *sys.OS, config map[string]string, expanded bool, instanc
 }
 
 func validConfigKey(os *sys.OS, key string, value string, instanceType instancetype.Type) error {
+	if shared.StringHasPrefix(key, instancetype.ConfigKeyPrefixesContainer...) &&
+		instanceType == instancetype.VM {
+		return fmt.Errorf("%s isn't supported for VMs", key)
+	}
+
+	_, exists := instancetype.InstanceConfigKeysContainer[key]
+	if !exists && instanceType == instancetype.Container {
+		return fmt.Errorf("%s isn't supported for containers", key)
+	}
+
+	_, exists = instancetype.InstanceConfigKeysVM[key]
+	if !exists && instanceType == instancetype.VM {
+		return fmt.Errorf("%s isn't supported for VMs", key)
+	}
+
 	f, err := instancetype.ConfigKeyChecker(key, instanceType)
 	if err != nil {
 		return err
@@ -137,10 +152,6 @@ func validConfigKey(os *sys.OS, key string, value string, instanceType instancet
 		return err
 	}
 
-	if strings.HasPrefix(key, "limits.kernel.") && instanceType == instancetype.VM {
-		return fmt.Errorf("%s isn't supported for VMs", key)
-	}
-
 	if key == "raw.lxc" {
 		return lxcValidConfig(value)
 	}