This happens in the container's namespace, but before the rootfs is
setup and mounted.  This gives us a chance to mangle the rootfs - i.e.
ecryptfs-mount it.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>