Container: Inject into the mount, not the rwPath

For device-mapper setups we can't just push the file into the rwPath.
Utils: Add ShellQuoteArguments
lxc: Work around lxc-start need for private mounts

lxc-start requires / to be mounted private, otherwise the changes
it does inside the container (both mounts and unmounts) will propagate
out to the host.

We work around this by starting up lxc-start in its own namespace where
we set / to rprivate.

Unfortunately go can't really execute any code between clone and exec,
so we can't do this in a nice way. Instead we have a horrible hack that
use the unshare command, the shell and the mount command...
devmapper: Move init layer to top rather than bottom

The init layer needs to be topmost to make sure certain files
are always there (for instance, the ubuntu:12.10 image wrongly
has /dev/shm being a symlink to /run/shm, and we need to override
that). However, previously the devmapper code implemented the
init layer by putting it in the base devmapper device, which meant
layers above it could override these files (so that ubuntu:12.10
broke).

So, instead we put the base layer in *each* images devmapper device.
This is "safe" because we still have the pristine layer data
in the layer directory. Also, it means we diff the container
against the image with the init layer applied, so it won't show
up in diffs/commits.
RootIsShared() - Fix array out of bounds error

This happened for me on the last (empty) line, but better safe than sorry
so we make the check general.
Change how ChangesDirs() works

Rather than scan the files in the old directory twice to detect the
deletions we now scan both directories twice and then do all the
diffing on the in-memory structure.

This is more efficient, but it also lets us diff more complex things
later that are not exact on-disk trees.
Image.applyLayer: Be better at creating identical files

There are some changes here that make the file metadata better match
the layer files:

* Set the mode of the file after the chown, as otherwise the per-group/uid
  specific flags and e.g. sticky bit is lost
* Use lchown instead of chown
* Delay mtime updates to after all other changes so that later file
  creation doesn't change the mtime for the parent directory
* Use Futimes in combination with O_PATH|O_NOFOLLOW to set mtime on symlinks
Changes: Better metadata comparison

Change the comparison to better handle files that are copied during
container creation but not actually changed:

* Inode - this will change during a copy
* ctime - this will change during a copy (as we can't set it back)
* blocksize - this will change for sparse files during copy
* size for directories - this can change anytime but doesn't
  necessarily reflect an actual contents change
* Compare mtimes at microsecond precision (as this is what utimes has)
Add Changes.ChangesLayers()

This calculates the difference between a set of layers and a
directory tree.
Add trivial copy-based CoW backend

This creates a container by copying the corresponding files
from the layers into the containers. This is not gonna be very useful
on a developer setup, as there is no copy-on-write or general diskspace
sharing. It also makes container instantiation slower.

However, it may be useful in deployment where we don't always have a lot
of containers running (long-running daemons) and where we don't
do a lot of docker commits.
Remove accidental commit that enabled MountMethodFilesystem
Add CopyFile that can use btrfs reflinks if availible
applyLayer() use btrfs reflinks if availible

We use the new file copy helper which uses btrfs reflinks if availible.
devmapper: Fix loopback mount code

Typo in the loop-control code made it always fall back to the
old method of opening loopback devices.
image: Handle systems that don't support O_PATH when updating timestamp

Older kernel can't handle O_PATH in open() so this will
fail on dirs and symlinks. For dirs wa can fallback to
the normal Utimes, but for symlinks there is not much to do
but ignore their timestamps.
Image: unmount device before removing it on failures

If we don't do this the remove will fail due to EBUSY
ShellQuoteArguments: Fix quoting

This accidentally used two quotes to start/end each quoted string.
runtime test: Ensure all containers are unmounted at nuke()

Otherwise we may leave around e.g. devmapper mounts
image: Unmount before removing device in error paths

The device remove fails unless we unmount first
Add DeviceSet.HasActivatedDevice()

This lets you see if a device has been activated