complete container inside part of runtime validation based on runtime-spec.
Including: container inside environment, as mounts, devices, caps and error return(as @wking said in https://groups.google.com/a/opencontainers.org/forum/#!topic/dev/lSYS7RjDZjI)