What are the minimum capabilities to update cgroup inside a container?

Question

I\'d like to update cgroup inside a container. E.g. create a sub-cgroup inside current container\'s cgroup. I found cgroups are mounted as \'ro\' unless I create the contain