drop the idea of --child-pidfile and better put an emphasis on cgroups (+ setuid)