Use restriction paths with rootfs

There is an issues where this works as expected in normal containers and
the root was not needed.  However, if you drop the NET namespace from
the container the mount of sysfs on the host machines is mounted as ro
instead of only affecting the container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)