replace NULL with nullptr
fix usage information for timeout
use MS_PRIVATE, not MS_SLAVE
chdir to the user's home directory
Makefile: add an install target
move epoll_fd into main
use `cgroup.procs`, not the deprecated `tasks` API
Makefile: avoid some duplication
fix usage of [[noreturn]]
switch set{gid,uid} to setres{gid,uid}
code style fix
Makefile: respect the environment, a bit
fix missing parameter check
switch execve -> execvpe
friendlier error for a missing passwd entry
set HOME, USER and LOGNAME in the env
--syscalls-file works with -s
add -m as a shortcut for --memory-limit
add basic device whitelisting
only run kill_group in the parent

this fixes an infinite loop in the child process if it exits upon an
error before exec