A container is locked when some operation (backup, migration, start/stop, etc) with this VE is in progress. You can determine which process is holding the VE, using the following command on the Hardware Node:
# cat /vz/lock/<CTID>.lck
You can kill that process if you are completely sure it will not cause any harm. If there is no process with the obtained PID, simply remove the lock file.
Real life example:
[root@vz ~]# cat /vz/lock/821.lck 5196 backing-up [root@vz ~]# ps -p 5196 fwww PID TTY STAT TIME COMMAND 5196 ? Dl 0:05 /opt/pva/agent/bin/vzlpl /var/opt/pva/agent/tmp.RbCurO