add license
add a devices cgroup
override the system's hostname
close stdin, stdout and stderr

Otherwise it causes havok with programs trying to print to the screen.
Eventually restore this with pipes.
replace waitpid with signalfd
move to use epoll for polling
send stdout over a pipe
introduce a reliable timeout

Defaults to 5 seconds.
hook up stderr with a pipe
mount home only if its in the passwd entry
slightly friendlier error message for mounts

Makes it easier to tell which command failed.