writing on the parent cgroup FS is exactly the solution for nested warden: sharing cgroup fs since we share one kernel among host & containers. it is possible to setup separate cgroup fs for each warden server (parent and child), but their content will be the same. so NO points to do so.

and, like nested resource groups in vCenter, child containers' cgroups should under parent containers' groups, like this:  /tmp/warden/cgroup/cpu/parent_container/child_container.