Use a cgroup for command execution

See DefaultSettings.php after Ic8362cab for the rationale.

Change-Id: I3f6a8b0ae9f0be149e51fa935848346c34de343a