vz: support a new interface of child file descriptors
vz: set resource limits in one place
debug