rkt gc

Container directories deemed inactive by exclusive lock acquisition are
atomically renamed to /var/lib/rkt/garbage/$cuuid, the directory's ctime gets
updated as part of the rename.

The /var/lib/rkt/garbage directory is then scanned for directories having a
ctime older than --grace-period (defaults to 30m).  Qualifying directories
are deleted under another exclusive lock.

All lock acquisitions are non-blocking with failures being ignored and those
directories skipped.

Functions like gc status will have the grace period window for retrieving
statuses from inactive containers in either the containers or garbage
dirs, and should access the status files under the protection of a shared
lock.
handle err (since you're going to the trouble of locking the dir...)