Make docker run in it's own mount and pid namespace

This allows all child processes to be removed and mounts to be cleaned
automatically.  It also keeps the mounts from showing up on the host for
containers.

This needs testing with the devicemapper cleanup scripts.  It also allows us to remove the PID kill on boot for ghosts because it is impossible to get ghost containers with this.  

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)