cgroups aren't even the main thing. The main thing is the mount namespace.