cgroup namespaces: ignore the nsroot in cgroup namespaces

If our cgroups were mounted in a cgroup namespace rooted at /a/b,
then a task in namespaced cgroup / will see / in /proc/self/mountinfo
and /sys/fs/cgroup/freezer/x will actually point to /a/b/x - but
the 'root' field (field 3) in mountinfo will show /a/b.  So as to
not confuse the cgroup calculation, check for nsroot=/a/b in the
last field, which will allow us to disambiguate between a mount
like above, and a bind mount of the /a/b cgroup directory.

Signed-off-by: Serge Hallyn <[email protected]>

libcontainer/cgroups/utils.go

@@ -145,6 +145,12 @@ func getCgroupMountsHelper(ss map[string]bool, mi io.Reader) ([]Mount, error) {
 			if ss[opt] {
 				m.Subsystems = append(m.Subsystems, opt)
 			}
+			if strings.HasPrefix(opt, "nsroot=") {
+				nsroot := opt[7:]
+				if len(nsroot) > 1 && strings.HasPrefix(m.Root, nsroot) {
+					m.Root = m.Root[len(nsroot):]
+				}
+			}
 		}
 		res = append(res, m)
 	}