Description

Now that cgroup namespace support has been added to runc, I'd like to add support to docker. I'm happy to do the work, but I'd like some input as to which of these approaches would work the best:

1. Always enable cgroup namespaces for all containers, provided that the currently running kernel supports it.
2. Enable for all containers, but only when the docker daemon was started with a flag to enable it (similar behaviour to --userns-remap).
3. Enable cgroup namespaces per-container (not for all containers), by passing a flag at container start time.

Thoughts?

CC: @cpuguy83, @stevvooe, @sargun