cgroup cleanup slightly misordered
only the user running envoyd daemon should create cgroups