Added cgroups support (to forbid access to extra devices)