Enter cgroups as part of NsEnter

I think that sounds better. We're doing the same check and want to support machines without some of these cgroups.