@@ -59,7 +59,7 @@ clone git github.com/miekg/pkcs11 80f102b5cac759de406949c47f0928b99bd64cdf

 clone git github.com/docker/go v1.5.1-1-1-gbaf439e

 clone git github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c

-clone git github.com/opencontainers/runc ce72f86a2b54bc114d6ffb51f6500479b2d42154 # libcontainer

+clone git github.com/opencontainers/runc 2c3115481ee1782ad687a9e0b4834f89533c2acf # libcontainer

 clone git github.com/seccomp/libseccomp-golang 1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1

 # libcontainer deps (see src/github.com/opencontainers/runc/Godeps/Godeps.json)

 clone git github.com/coreos/go-systemd v4

@@ -31,6 +31,7 @@ var (

 		&NetPrioGroup{},

 		&PerfEventGroup{},

 		&FreezerGroup{},

+		&NameGroup{GroupName: "name=systemd", Join: true},

 	}

 	CgroupProcesses  = "cgroup.procs"

 	HugePageSizes, _ = cgroups.GetHugePageSize()

@@ -130,11 +131,6 @@ func (m *Manager) Apply(pid int) (err error) {

 	}

 	paths := make(map[string]string)

-	defer func() {

-		if err != nil {

-			cgroups.RemovePaths(paths)

-		}

-	}()

 	for _, sys := range subsystems {

 		if err := sys.Apply(d); err != nil {

 			return err

@@ -5,6 +5,7 @@ package fs

 import (

 	"github.com/opencontainers/runc/libcontainer/cgroups"

 	"github.com/opencontainers/runc/libcontainer/configs"

+	"github.com/opencontainers/runc/libcontainer/system"

 )

 type DevicesGroup struct {

@@ -25,6 +26,10 @@ func (s *DevicesGroup) Apply(d *cgroupData) error {

 }

 func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {

+	if system.RunningInUserNS() {

+		return nil

+	}

+

 	devices := cgroup.Resources.Devices

 	if len(devices) > 0 {

 		for _, dev := range devices {

@@ -9,6 +9,7 @@ import (

 type NameGroup struct {

 	GroupName string

+	Join      bool

 }

 func (s *NameGroup) Name() string {

@@ -16,6 +17,10 @@ func (s *NameGroup) Name() string {

 }

 func (s *NameGroup) Apply(d *cgroupData) error {

+	if s.Join {

+		// ignore errors if the named cgroup does not exist

+		d.join(s.GroupName)

+	}

 	return nil

 }

@@ -24,6 +29,9 @@ func (s *NameGroup) Set(path string, cgroup *configs.Cgroup) error {

 }

 func (s *NameGroup) Remove(d *cgroupData) error {

+	if s.Join {

+		removePath(d.path(s.GroupName))

+	}

 	return nil

 }

@@ -126,11 +126,11 @@ func getCgroupMountsHelper(ss map[string]bool, mi io.Reader) ([]Mount, error) {

 	scanner := bufio.NewScanner(mi)

 	for scanner.Scan() {

 		txt := scanner.Text()

-		sepIdx := strings.IndexByte(txt, '-')

+		sepIdx := strings.Index(txt, " - ")

 		if sepIdx == -1 {

 			return nil, fmt.Errorf("invalid mountinfo format")

 		}

-		if txt[sepIdx+2:sepIdx+8] != "cgroup" {

+		if txt[sepIdx+3:sepIdx+9] != "cgroup" {

 			continue

 		}

 		fields := strings.Split(txt, " ")