cgroup ownership (delegation chown) is only implemented in the systemd cgroup manager, not the fs driver

The OCI runtime-spec "cgroup ownership" semantics (chown the container's cgroup to the host UID mapping container root, when the container has a private cgroup namespace and cgroupfs is mounted rw) are only implemented for the systemd cgroup driver. With the default fs driver, the cgroup is left owned by init-ns root, so a userns container gets an rw cgroupfs mount whose files are all owned by an unmapped user (nobody:nogroup) and cannot use the delegation it was seemingly granted.

This makes containerd's cgroup_writable CRI option (containerd 2.1+) non-functional for hostUsers: false Kubernetes pods on any host using the fs driver - e.g. distros without systemd (Talos Linux), where the systemd driver is not available at all.

I imagine more users will run into this, given that this flag (cgroup_writable) will soon land in Kubernetes's securityContext as well.

Relevant chunk of code:

https://github.com/opencontainers/cgroups/blob/bedc0485914021ee8c23c9b0005445ccb43508ac/systemd/v2.go#L368-L387

Start with systemd/v2.go around lines 368-387, then locate the corresponding ownership and delegation path for the fs driver. Compare the OCI cgroup ownership conditions described in the issue and make the fs driver apply them; done means cgroup_writable works for private user-namespace containers without systemd.