use a nested, unique cgroup for each container

Closes #4