I hadn't heard about CGroupsV2. Apparently it's been in the kernel since 2015. Seems like a better design.
https://thenewstack.io/linux-cgroups-v2-brings-rootless-cont...
https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2...
https://thenewstack.io/linux-cgroups-v2-brings-rootless-cont...
https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2...