Fix path to cached rootfs
Add cgroup allowance for /dev/net/tun (c, 10, 200) device
Add a few capabilities dropping