I had to fix three different things. When using the official package. Cgroups were broken (as you note); networking was broken so containers couldn't find each other (firewall on default settings broke it and the package didn't bother to un-break it on install—fix non-obvious if you're not deep into modern Linux firewalling); and I had to add flags to various container launches to get around selinux so they could once again see mounted host directories (again, not obvious selinux was at fault, and given the uid weirdness of Docker generally it could have been a bunch of things). Of course googling each of these led to a mix of solutions that did nothing, ones that just turned off all security, and, if one dug enough, the actual solutions, not well-marked as such.

In short, it was the quintessential "Linux UX".