Merge pull request #763 from mrunalp/userns_cgroups_ro

Allow mounting cgroups as read-only when user namespace is configured

libcontainer/rootfs_linux.go

@@ -264,8 +264,10 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
 		if m.Flags&syscall.MS_RDONLY != 0 {
 			// remount cgroup root as readonly
 			mcgrouproot := &configs.Mount{
+				Source:      m.Destination,
+				Device:      "bind",
 				Destination: m.Destination,
-				Flags:       defaultMountFlags | syscall.MS_RDONLY,
+				Flags:       defaultMountFlags | syscall.MS_RDONLY | syscall.MS_BIND,
 			}
 			if err := remount(mcgrouproot, rootfs); err != nil {
 				return err