clean up cgroup setup; prefer nested mount