text: Title: Error starting container - failed to write to cpu.cfs_quota_us
  Body: <!-- This form is for bug reports and feature requests ONLY! 
  
  If you're looking for help check [Stack Overflow](https://stackoverflow.com/questions/tagged/kubernetes) and the [troubleshooting guide](https://kubernetes.io/docs/tasks/debug-application-cluster/troubleshooting/).
  -->
  
  **Is this a BUG REPORT or FEATURE REQUEST?**:
  
  /kind bug
  
  **What happened**:
  Create a Pod with a single container with CPU requests and limits of `51m`.  When the container is run, it generates the following error:
  ```
  'invalid header field value "oci runtime error: container_linux.go:247:
            starting container process caused \"process_linux.go:327: setting cgroup
            config for procHooks process caused \\\"failed to write 5100 to cpu.cfs_quota_us:
            write /sys/fs/cgroup/cpu,cpuacct/kubepods.slice/kubepods-pod5383ae7e_22e2_11e8_9323_005056888407.slice/docker-154ab5a8cd23771c42db005a12cef3791ca672b8a1a9181e2939e6ea0e205d2b.scope/cpu.cfs_quota_us:
            invalid argument\\\"\"\n"'
  ```
  
  **What you expected to happen**:
  The container runs properly.
  
  **How to reproduce it (as minimally and precisely as possible)**:
  docker and kubelet must be configured to use the systemd cgroup driver.
  Create a pod with cpu limits that any contain a non-zero millicore digit (e.g. 51m).
  
  **Anything else we need to know?**:
  The bug lies in [runc](https://github.com/opencontainers/runc).  The systemctl set-property rounds the cpu limit on the parent cgroup to the nearest percent (e.g. 5%).  The child cgroup is then created by docker with a cpu.cfs_quota_us with a greater value than the parent cgroup, which causes an error.
  
  The bug seems to have been fixed in [this commit](https://github.com/opencontainers/runc/commit/bca53e7b49208db35fcda418a45655fd2f8ea5bb#diff-e99e0d455975094fba0f58dcd6a84522) and included in [runc 1.0.0-rc5](https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc5) which was released Feb. 27, 2018.
  
  **Environment**:
  - Kubernetes version (use `kubectl version`):
  Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.3", GitCommit:"d2835416544f298c919e2ead3be3d0864b52323b", GitTreeState:"clean", BuildDate:"2018-02-07T12:22:21Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"linux/amd64"}
  Server Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.3", GitCommit:"d2835416544f298c919e2ead3be3d0864b52323b", GitTreeState:"clean", BuildDate:"2018-02-07T11:55:20Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"linux/amd64"}
  
  - Cloud provider or hardware configuration:
  - OS (e.g. from /etc/os-release):
  NAME="CentOS Linux"
  VERSION="7 (Core)"
  ID="centos"
  ID_LIKE="rhel fedora"
  VERSION_ID="7"
  PRETTY_NAME="CentOS Linux 7 (Core)"
  ANSI_COLOR="0;31"
  CPE_NAME="cpe:/o:centos:centos:7"
  HOME_URL="https://www.centos.org/"
  BUG_REPORT_URL="https://bugs.centos.org/"
  
  CENTOS_MANTISBT_PROJECT="CentOS-7"
  CENTOS_MANTISBT_PROJECT_VERSION="7"
  REDHAT_SUPPORT_PRODUCT="centos"
  REDHAT_SUPPORT_PRODUCT_VERSION="7"
  
  - Kernel (e.g. `uname -a`):
  3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 20 20:32:50 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
  
  - Install tools:
  - Others:
  the systemd cgroup driver must be used for kubelet.
  
  @kubernetes/sig-node-bugs