Features:
+* shutdown: don't read-only mount anything when running in container
+
+* nspawn: --read-only is not applied recursively to submounts
+
* MountFlags=shared acts as MountFlags=slave right now.
+* ReadOnlyDirectories= is not applied recursively to submounts
+
* drop PID 1 reloading, only do reexecing (difficult: Reload()
currently is properly synchronous, Reexec() is weird, because we
can't delay the response properly until we are back, so instead of
- resource control in systemd
- inhibiting
- testing with Harald's awesome test kit
+ - restart
* allow port=0 in .socket units