Detection is sometimes inadequate

[Jason R. Coombs]

In this comment, I learned that in some situations, the current use of /.dockerfile or looking in cgroup is insufficient.

Gemini suggested another option, and that's to check the filesystems for an overlay.

Let's add that for added fidelity.