* nspawn:
- bind mount read-only the cgroup tree higher than nspawn
- refuses to boot containers without /etc/machine-id (OK?), and with empty /etc/machine-id (not OK).
* nspawn:
- bind mount read-only the cgroup tree higher than nspawn
- refuses to boot containers without /etc/machine-id (OK?), and with empty /etc/machine-id (not OK).