Make docker run in it's own mount and pid namespace

This allows all child processes to be removed and mounts to be cleaned
automatically.  It also keeps the mounts from showing up on the host for
containers.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
From ghost cleanup from runtime because it's not needed

Fixes #4575
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)