docker-container: use /docker/buildx cgroup by default

This allows resource limits to be applied to all builds on a host.
For example to limit the total amount of CPU used by builds:

https://medium.com/@asishrs/docker-limit-resource-utilization-using-cgroup-parent-72a646651f9d

Signed-off-by: David Scott <dave@recoil.org>

docs/reference/buildx_create.md

@@ -130,7 +130,7 @@ Passes additional driver-specific options. Details for each driver:
 - `docker-container`
     - `image=IMAGE` - Sets the container image to be used for running buildkit.
     - `network=NETMODE` - Sets the network mode for running the buildkit container.
-    - `cgroup-parent=CGROUP` - Sets the cgroup parent of the buildkit container.
+    - `cgroup-parent=CGROUP` - Sets the cgroup parent of the buildkit container. Defaults to `/docker/buildx`.
     - Example:
 
       ```console

driver/docker-container/driver.go

@@ -122,6 +122,11 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
 					Target: containerBuildKitRootDir,
 				},
 			},
+			Resources: container.Resources{
+				// Place all buildkit containers inside this cgroup so limits can be attached
+				// to all build activity on the host.
+				CgroupParent: "/docker/buildx",
+			},
 		}
 		if d.netMode != "" {
 			hc.NetworkMode = container.NetworkMode(d.netMode)