detect if inside Docker container

The theoretically backward compat concern would be that if you were using docker and it's reporting docker in /etc/self/cgroup, so virtualization[:system] is getting set to lxc, and you've got recipes that are switching on that. Once we ship this, virtualization[:system] is going to report docker instead and that code won't run.