func getContainerSubCgroup(machineID string, canMachinedRegister, unified bool) (string, error) {
	var subcgroup string
	fromUnit, err := util.RunningFromSystemService()
	if err != nil {
		return "", errwrap.Wrap(errors.New("could not determine if we're running from a unit file"), err)
	}
	if fromUnit {
		slice, err := util.GetRunningSlice()
		if err != nil {
			return "", errwrap.Wrap(errors.New("could not get slice name"), err)
		}
		slicePath, err := common.SliceToPath(slice)
		if err != nil {
			return "", errwrap.Wrap(errors.New("could not convert slice name to path"), err)
		}
		unit, err := util.CurrentUnitName()
		if err != nil {
			return "", errwrap.Wrap(errors.New("could not get unit name"), err)
		}
		subcgroup = filepath.Join(slicePath, unit)

		if unified {
			subcgroup = filepath.Join(subcgroup, "payload")
		}
	} else {
		escapedmID := strings.Replace(machineID, "-", "\\x2d", -1)
		machineDir := "machine-" + escapedmID + ".scope"
		if canMachinedRegister {
			// we are not in the final cgroup yet: systemd-nspawn will move us
			// to the correct cgroup later during registration so we can't
			// look it up in /proc/self/cgroup
			subcgroup = filepath.Join("machine.slice", machineDir)
		} else {
			if unified {
				var err error
				subcgroup, err = v2.GetOwnCgroupPath()
				if err != nil {
					return "", errwrap.Wrap(errors.New("could not get own v2 cgroup path"), err)
				}
			} else {
				// when registration is disabled the container will be directly
				// under the current cgroup so we can look it up in /proc/self/cgroup
				ownV1CgroupPath, err := v1.GetOwnCgroupPath("name=systemd")
				if err != nil {
					return "", errwrap.Wrap(errors.New("could not get own v1 cgroup path"), err)
				}
				// systemd-nspawn won't work if we are in the root cgroup. In addition,
				// we want all rkt instances to be in distinct cgroups. Create a
				// subcgroup and add ourselves to it.
				subcgroup = filepath.Join(ownV1CgroupPath, machineDir)
				if err := v1.JoinSubcgroup("systemd", subcgroup); err != nil {
					return "", errwrap.Wrap(fmt.Errorf("error joining %s subcgroup", ownV1CgroupPath), err)
				}
			}
		}
	}

	return subcgroup, nil
}

func getContainerSubCgroup(machineID string) (string, error) {
	var subcgroup string
	fromUnit, err := isRunningFromUnitFile()
	if err != nil {
		return "", fmt.Errorf("could not determine if we're running from a unit file: %v", err)
	}
	if fromUnit {
		slice, err := getSlice()
		if err != nil {
			return "", fmt.Errorf("could not get slice name: %v", err)
		}
		slicePath, err := common.SliceToPath(slice)
		if err != nil {
			return "", fmt.Errorf("could not convert slice name to path: %v", err)
		}
		unit, err := getUnitFileName()
		if err != nil {
			return "", fmt.Errorf("could not get unit name: %v", err)
		}
		subcgroup = filepath.Join(slicePath, unit, "system.slice")
	} else {
		if machinedRegister() {
			// we are not in the final cgroup yet: systemd-nspawn will move us
			// to the correct cgroup later during registration so we can't
			// look it up in /proc/self/cgroup
			escapedmID := strings.Replace(machineID, "-", "\\x2d", -1)
			machineDir := "machine-" + escapedmID + ".scope"
			subcgroup = filepath.Join("machine.slice", machineDir, "system.slice")
		} else {
			// when registration is disabled the container will be directly
			// under rkt's cgroup so we can look it up in /proc/self/cgroup
			ownCgroupPath, err := cgroup.GetOwnCgroupPath("name=systemd")
			if err != nil {
				return "", fmt.Errorf("could not get own cgroup path: %v", err)
			}
			// systemd-nspawn won't work unless we're in a subcgroup. If we're
			// in the root cgroup, we create a "rkt" subcgroup and we add
			// ourselves to it
			if ownCgroupPath == "/" {
				ownCgroupPath = "/rkt"
				if err := cgroup.JoinSubcgroup("systemd", ownCgroupPath); err != nil {
					return "", fmt.Errorf("error joining %s subcgroup: %v", ownCgroupPath, err)
				}
			}
			subcgroup = filepath.Join(ownCgroupPath, "system.slice")
		}
	}

	return subcgroup, nil
}

func getContainerSubCgroup(machineID string) (string, error) {
	var subcgroup string
	fromUnit, err := isRunningFromUnitFile()
	if err != nil {
		return "", fmt.Errorf("error determining if we're running from a unit file: %v", err)
	}
	if fromUnit {
		slice, err := getSlice()
		if err != nil {
			return "", fmt.Errorf("error getting slice name: %v", err)
		}
		slicePath, err := common.SliceToPath(slice)
		if err != nil {
			return "", fmt.Errorf("error converting slice name to path: %v", err)
		}
		unit, err := getUnitFileName()
		if err != nil {
			return "", fmt.Errorf("error getting unit name: %v", err)
		}
		subcgroup = filepath.Join(slicePath, unit, "system.slice")
	} else {
		if machinedRegister() {
			// we are not in the final cgroup yet: systemd-nspawn will move us
			// to the correct cgroup later during registration so we can't
			// look it up in /proc/self/cgroup
			escapedmID := strings.Replace(machineID, "-", "\\x2d", -1)
			machineDir := "machine-" + escapedmID + ".scope"
			subcgroup = filepath.Join("machine.slice", machineDir, "system.slice")
		} else {
			// when registration is disabled the container will be directly
			// under rkt's cgroup so we can look it up in /proc/self/cgroup
			ownCgroupPath, err := cgroup.GetOwnCgroupPath("name=systemd")
			if err != nil {
				return "", fmt.Errorf("error getting own cgroup path: %v", err)
			}
			subcgroup = filepath.Join(ownCgroupPath, "system.slice")
		}
	}

	return subcgroup, nil
}