Update libcontainer dec8

This updates the config with a namespace struct that allows any of the namespaces to be joined at the create of a container instead of one off fields for NET and IPC.  

This also adds support of cpuset.mems being implemented in #9536
`getNamespaceIndex` can return `-1`, which cause panic, I don't think that this is good way to use this API.