executor: mount cgroups in default spec

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

executor/oci/spec_unix.go

@@ -49,6 +49,14 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou
 		withROBind(resolvConf, "/etc/resolv.conf"),
 		withROBind(hostsFile, "/etc/hosts"),
 	)
+
+	s.Mounts = append(s.Mounts, specs.Mount{
+		Destination: "/sys/fs/cgroup",
+		Type:        "cgroup",
+		Source:      "cgroup",
+		Options:     []string{"ro", "nosuid", "noexec", "nodev"},
+	})
+
 	// TODO: User
 
 	sm := &submounts{}

solver/pb/caps.go

@@ -41,6 +41,7 @@ const (
 	CapExecMountTmpfs          apicaps.CapID = "exec.mount.tmpfs"
 	CapExecMountSecret         apicaps.CapID = "exec.mount.secret"
 	CapExecMountSSH            apicaps.CapID = "exec.mount.ssh"
+	CapExecCgroupsMounted      apicaps.CapID = "exec.cgroup"
 
 	CapConstraints apicaps.CapID = "constraints"
 	CapPlatform    apicaps.CapID = "platform"
@@ -219,6 +220,12 @@ func init() {
 		Status:  apicaps.CapStatusExperimental,
 	})
 
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecCgroupsMounted,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
 	Caps.Init(apicaps.Cap{
 		ID:      CapConstraints,
 		Enabled: true,