Support cgroup namespace

[liubog2008]

Description

See opencontainers/runc#1916

Is this feature related to a specific bug?

No response

Do you have a specific solution in mind?

No response

[avagin]

@liubog2008 can you be more detailed what exactly should be supported? gVisor virtualizes cgroups, so it is effectively like a cgroup namespace.

[liubog2008]

@avagin See #11313 for more details. I think gvisor may need to virtualize the /proc/self/ns/cgroup