doc: document jailer caveat when using --parent-cgroup

Document the issue in #4287 so customers are aware of it.

We will continue working on providing a resolution for it.

(cherry picked from commit 0b498b2)

Signed-off-by: Pablo Barbáchano <[email protected]>

Author: pb8o

CHANGELOG.md

@@ -35,6 +35,11 @@
   containing vhost-user block devices.
   See the [related doc page](./docs/api_requests/block-vhost-user.md) for details.
   The device emits metrics under the label `"vhost_user_{device}_{drive_id}"`.
+- Document [a caveat to the jailer][1] when using the `--parent-cgroup` option,
+  which results in it being ignored by the jailer. Refer to the [jailer
+  documentation](./docs/jailer.md#caveats) for a workaround.
+
+[1]: https://github.com/firecracker-microvm/firecracker/issues/4287
 
 ### Changed
 

docs/jailer.md

@@ -282,3 +282,8 @@ Note: default value for `<api-sock>` is `/run/firecracker.socket`.
 - If all the cgroup controllers are bunched up on a single mount point using
   the "all" option, our current program logic will complain it cannot detect
   individual controller mount points.
+
+- [#4287](https://github.com/firecracker-microvm/firecracker/issues/4287) When
+  starting a jailer with `--parent-cgroup` specified but no cgroup flags
+  specified, then the rules in the parent cgroup folder are ignored. To
+  work around, use a dummy cgroup parameter like `--cgroup=memory.max=max`.