attach to cgroup first, then mount namespace
Merge pull request #391 from cdburkard/patches/fix_popen

workaround: attach to cgroup first, then mount namespace