Configure both ends of a pump to be blocking

Change-Id: I4a574bead8f2adea7c1c57ccac9acd85bba6880f
fcntl_set_cloexec should respect on flag

Change-Id: I581080b46a76ce6a5bce09cd525f463af0632905
Don't masquerade traffic to loopback device

If the out interface of this iptables rule includes loopback device,
when a packet is sent from lo to lo, the source address is changed to
the ethernet interface address. It could cause NFS mounting failure,
since NFS client need send packet to local portmap daemon, if the source
address is not from "local", then portmap will deny the packet.

Pormap maintain a local address list to judge whether the source adress
is from "local". But sometimes portmap starts earlier than ethernet
interface starts, then the local address list don't include ethernet
address, so it denies the packet from NFS client.

To fix it, we use negation on loopback device.

Change-Id: I2c4e5b5526f73011998c023812542e020b03930b
Stop script should kill all processes except wshd

Change-Id: Ie32232d747e264630ed9f803dce276256bedb926
Merge "Stop script should kill all processes except wshd"
Apply SNAT only for traffic coming from containers

This change contains a hard-coded subnet to apply SNAT for, which needs
to be made configurable later.

Change-Id: Ifb54efbaff849bad41023356b38acf54f1bdd7cb
Support customizing rootfs at create time

This makes warden support warden-protocol 0.0.12

If the rootfs doesn't exist, an error will be returned

Change-Id: I02685ef42d196b11e588c26d6b62b2d5399287ad
Merge "Apply SNAT only for traffic coming from containers"
Merge branch 'upstream/cf/master' into develop