Is there a possiblity, to restrict a cgroup to a specific network interface? All packets from the cgroup should only be routed via a VPN connection, while other packets use the default route.
With unix users its possible with iptables "-m owner --set-mark" and then routing with "ip rule".
Is it possible to match a cgroup? iptables seems to have no support for this.