stage1/init: create a new mount ns for each app
stage1/init: create a new mount ns for each app

Up to this point, you could escape the app's chroot easily by using a
simple program downloaded from the internet [[1]][1]. To avoid this, we
now create a new mount namespace per each app.

You can still escape the chroot if you have CAP_SYS_PTRACE and access
`/proc/1/root` but this fixes the issue for images that don't need this
capability.

[1]: http://www.unixwiz.net/techtips/chroot-practices.html

ybubnov/rkt,shobhit85/rkt,mike1729/rkt,joshix/rkt,akshaykarle/rkt,shobhit85/rkt,monstermunchkin/rkt,tmrts/rkt,yifan-gu/rocket,jonboulle/rkt,sstabellini/rkt,Wilybald/rkt,sgotti/rkt,cab105/rkt,mike1729/rkt,yifan-gu/rkt,cab105/rkt,dgonyeo/rkt,yifan-gu/rocket,lucasallan/rkt,akshaykarle/rkt,nhlfr/rkt,yifan-gu/rkt,euank/rkt,Wilybald/rkt,dgonyeo/rkt,intelsdi-x/rkt,squeed/rkt,shobhit85/rkt,rkt/rkt,achanda/rkt,Wilybald/rkt,alban/rkt,jakon89/rkt,kinvolk/rkt,kinvolk/rkt,coreos/rkt,matthaias/rkt,jonboulle/rkt,cab105/rkt,Shashwatsh/rkt,jjlakis/rkt,joshix/rkt,ybubnov/rkt,dgonyeo/rkt,alban/rkt,rkt/rkt,intelsdi-x/rkt,kinvolk/rkt,monstermunchkin/rkt,sgotti/rkt,achanda/rkt,Shashwatsh/rkt,jjlakis/rkt,jjlakis/rkt,rkt/rkt,rkt/rkt,matthaias/rkt,coreos/rkt,sstabellini/rkt,kinvolk/rkt,s-urbaniak/rkt,ybubnov/rkt,squeed/rkt,intelsdi-x/rkt,tmrts/rkt,Wilybald/rkt,joshix/rkt,sstabellini/rkt,lucasallan/rkt,s-urbaniak/rkt,Shashwatsh/rkt,yifan-gu/rkt,monstermunchkin/rkt,achanda/rkt,yifan-gu/rocket,euank/rkt,tmrts/rkt,lucasallan/rkt,jakon89/rkt,euank/rkt,nhlfr/rkt,lucasallan/rkt,jonboulle/rkt,joshix/rkt,squeed/rkt,sgotti/rkt,alban/rkt,mike1729/rkt,s-urbaniak/rkt,akshaykarle/rkt,jakon89/rkt,matthaias/rkt,coreos/rkt,nhlfr/rkt