diff --git a/cgroups/utils.go b/cgroups/utils.go
index 111c8714..0d19b3ea 100644
--- a/cgroups/utils.go
+++ b/cgroups/utils.go
@@ -2,6 +2,7 @@ package cgroups
 
 import (
 	"bufio"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -30,6 +31,80 @@ func FindCgroupMountpoint(subsystem string) (string, error) {
 	return "", ErrNotFound
 }
 
+type Mount struct {
+	Mountpoint string
+	Subsystems []string
+}
+
+func (m Mount) GetThisCgroupDir() (string, error) {
+	if len(m.Subsystems) == 0 {
+		return "", fmt.Errorf("no subsystem for mount")
+	}
+
+	return GetThisCgroupDir(m.Subsystems[0])
+}
+
+func GetCgroupMounts() ([]Mount, error) {
+	mounts, err := mount.GetMounts()
+	if err != nil {
+		return nil, err
+	}
+
+	all, err := GetAllSubsystems()
+	if err != nil {
+		return nil, err
+	}
+
+	allMap := make(map[string]bool)
+	for _, s := range all {
+		allMap[s] = true
+	}
+
+	res := []Mount{}
+	for _, mount := range mounts {
+		if mount.Fstype == "cgroup" {
+			m := Mount{Mountpoint: mount.Mountpoint}
+
+			for _, opt := range strings.Split(mount.VfsOpts, ",") {
+				if strings.HasPrefix(opt, "name=") {
+					m.Subsystems = append(m.Subsystems, opt)
+				}
+				if allMap[opt] {
+					m.Subsystems = append(m.Subsystems, opt)
+				}
+			}
+			res = append(res, m)
+		}
+	}
+	return res, nil
+}
+
+// Returns all the cgroup subsystems supported by the kernel
+func GetAllSubsystems() ([]string, error) {
+	f, err := os.Open("/proc/cgroups")
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	subsystems := []string{}
+
+	s := bufio.NewScanner(f)
+	for s.Scan() {
+		if err := s.Err(); err != nil {
+			return nil, err
+		}
+		text := s.Text()
+		if text[0] != '#' {
+			parts := strings.Fields(text)
+			if len(parts) > 4 && parts[3] != "0" {
+				subsystems = append(subsystems, parts[0])
+			}
+		}
+	}
+	return subsystems, nil
+}
+
 // Returns the relative path to the cgroup docker is running in.
 func GetThisCgroupDir(subsystem string) (string, error) {
 	f, err := os.Open("/proc/self/cgroup")
diff --git a/mount/init.go b/mount/init.go
index 4e913ad1..e61d3c3b 100644
--- a/mount/init.go
+++ b/mount/init.go
@@ -6,9 +6,11 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"syscall"
 
 	"github.com/docker/libcontainer"
+	"github.com/docker/libcontainer/cgroups"
 	"github.com/docker/libcontainer/label"
 	"github.com/docker/libcontainer/mount/nodes"
 	"github.com/dotcloud/docker/pkg/symlink"
@@ -92,6 +94,69 @@ func mountSystem(rootfs string, container *libcontainer.Container) error {
 			return fmt.Errorf("mounting %s into %s %s", m.source, m.path, err)
 		}
 	}
+
+	// Mount all cgroup subsystems into the container, read-only. Create symlinks for each
+	// subsystem if any subsystems are merged
+	cgroupMounts, err := cgroups.GetCgroupMounts()
+	if err != nil {
+		return err
+	}
+
+	cgroupsDir := filepath.Join(rootfs, "/sys/fs/cgroup")
+
+	for _, m := range cgroupMounts {
+		dir := filepath.Base(m.Mountpoint)
+		mountpoint := filepath.Join(cgroupsDir, dir)
+
+		if err := os.MkdirAll(mountpoint, 0755); err != nil && !os.IsExist(err) {
+			return fmt.Errorf("mkdirall %s %s", mountpoint, err)
+		}
+
+		// Bind-mount the cgroup to /sys/fs/cgroup with the same name as the outer mount
+		if err := system.Mount(m.Mountpoint, mountpoint, "bind", uintptr(syscall.MS_BIND|defaultMountFlags), ""); err != nil {
+			return fmt.Errorf("mounting %s into %s %s", m.Mountpoint, mountpoint, err)
+		}
+		// Make it read-only
+		if err := system.Mount(mountpoint, mountpoint, "bind", uintptr(syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|defaultMountFlags), ""); err != nil {
+			return fmt.Errorf("remounting %s into %s %s", mountpoint, mountpoint, err)
+		}
+
+		hasName := false
+		for _, subsys := range m.Subsystems {
+			isName := strings.HasPrefix(subsys, "name=")
+			canonicalName := subsys
+			if isName {
+				hasName = true
+				canonicalName = subsys[5:]
+			}
+
+			// For the merged case dir will be something like "cpu,cpuacct", so
+			// we make symlinks for all the pure subsystem names "cpu -> cpu,cpuacct", etc
+			if canonicalName != dir {
+				if err := os.Symlink(dir, filepath.Join(cgroupsDir, canonicalName)); err != nil {
+					return fmt.Errorf("creating cgroup symlink for %s: %s", dir, err)
+				}
+			}
+		}
+
+		// For named cgroups, such as name=systemd we mount a read-write subset at the
+		// current cgroup path. This lets e.g. systemd work inside a container, as it can create subcgroups inside the
+		// current cgroup, while not being able to do anything dangerous in the real cgroups
+		if hasName {
+			cgroupPath, _ := m.GetThisCgroupDir()
+			if cgroupPath != "" && cgroupPath != "/" {
+				if err := system.Mount(filepath.Join(m.Mountpoint, cgroupPath), filepath.Join(mountpoint, cgroupPath), "bind", uintptr(syscall.MS_BIND|defaultMountFlags), ""); err != nil {
+					return fmt.Errorf("mounting %s into %s %s", filepath.Join(m.Mountpoint, cgroupPath), filepath.Join(mountpoint, cgroupPath), err)
+				}
+			}
+		}
+	}
+
+	// Make /sys/fs/cgroup read-only
+	if err := system.Mount(cgroupsDir, cgroupsDir, "bind", uintptr(syscall.MS_REMOUNT|syscall.MS_RDONLY|defaultMountFlags), ""); err != nil {
+		return fmt.Errorf("remounting %s read-only %s", cgroupsDir, err)
+	}
+
 	return nil
 }
 
@@ -193,6 +258,7 @@ func newSystemMounts(rootfs, mountLabel string, mounts libcontainer.Mounts) []mo
 		{source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaultMountFlags},
 		{source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaultMountFlags},
 		{source: "tmpfs", path: filepath.Join(rootfs, "dev"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME, data: label.FormatMountLabel("mode=755", mountLabel)},
+		{source: "tmpfs", path: filepath.Join(rootfs, "sys/fs/cgroup"), device: "tmpfs", flags: defaultMountFlags},
 		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: label.FormatMountLabel("mode=1777,size=65536k", mountLabel)},
 		{source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: label.FormatMountLabel("newinstance,ptmxmode=0666,mode=620,gid=5", mountLabel)},
 	}