/tmp/warden/cgroup/* is hardcoded
/tmp/warden/rootfs can be configurable. it is for sharing rootfs between parent warden and child warden.  But we think it is better to skip it for now. because warden-cpi don't need this feature.