It also allows you to mount the cgroupfs in an unprivileged user namespace (useful for rootless containers, something I'm working on in runC). It's not entirel

It also allows you to mount the cgroupfs in an unprivileged user namespace (useful for rootless containers, something I'm working on in runC). It's not entirely useful at the moment to be honest, since all it does is mask /proc/self/cgroup. But it could be extended later to also virtualise /proc/meminfo and /proc/cpuinfo to reflect the cgroup limits. I'm currently trying to get a patch merged into cgroup core to allow for processes in a cgroup namespace to manage their own cgroups (without compromising the hierarchy limits). Hopefully it gets into 4.7. This will be exceptionally useful for cgroup hierarchies.