attach to cgroup first, then mount namespace