Container based sandboxing.

This uses a cannibalized version of Brian Swetland's mkbox demo.

Simplifies termite in the following ways:

* obviates root permissions, as mkbox takes over the chroot capability.

* obviates FUSE based /proc and /dev: we can remount the actual /proc
  filesystem.