don't duplicate output on error in with_container_netns
This does not cause any problems right now, since all the call sites
swallow stdout on error. But it is wrong nevertheless.
keep stdout and stderr separate in with_container_netns
so we don't end up swallowing warnings when redirecting stdout

Fixes #285.