config-linux: allow lazy cgroup handling

Make explicit that runtimes only have to attach to the bare minimum
number of cgroups in order to fulfil the users' requirements. However,
runtimes are of course allowed to attach to more than the bare minimum.

Signed-off-by: Aleksa Sarai <asarai@suse.de>

Author: cyphar

config-linux.md

@@ -182,6 +182,9 @@ You can configure a container's cgroups via the `resources` field of the Linux c
 Do not specify `resources` unless limits have to be updated.
 For example, to run a new process in an existing container without updating limits, `resources` need not be specified.
 
+A runtime MUST at least use the minimum set of cgroup controllers required to fulfil the `resources` settings.
+However, a runtime CAN decide to not attach to any additional cgroup controllers supported by the system.
+
 #### Device whitelist
 
 `devices` is an array of entries to control the [device whitelist][cgroup-v1-devices].