*: AppImageManifest -> ImageManifest
Merge pull request #246 from jonboulle/appimage

*: AppImageManifest -> ImageManifest
appc/ace: update name in validator
appc: fix relative paths in app validator

strings.TrimPrefix was not correct since it resulted in different
behaviour depending on whether the directory passed had a trailing slash
or not (this meant for example that `actool validate foo/` would succeed
but `actool validate foo` would fail)
Go has a function for the correct behaviour in filepath.Rel, so use it.

Also small style updates to keep up with the recent
appmanifest+filesetmanifest --> ImageManifest change
Merge pull request #249 from jonboulle/fix

appc: fix relative paths in app validator
The tar Header.Name (for example with gnu tar) can start with ./ (for example ./app and
./rootfs/).
Use filepath.Clean and use the cleaned up name. This also makes the logic similar to
ValidateLayout().
Merge pull request #252 from sgotti/fixarchivevalidation

actool: fix archive layout validation
Better gitignore rule for vim tmp files.

- Old rule didn't work for top level dir
- New rule includes not-first vim tmp files

Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Merge pull request #255 from dfarrell07/gitignore_cleanup

Better gitignore rule for vim tmp files.
rkt run: acquire lock on container directory

stage0 acquires an exclusive advisory lock on the container directory,
leaving the fd open when executing stage1/init with the fd value stored in
the environment variable RKT_LOCK_FD.

stage1's fakesdboot.so shim prevents closure of RKT_LOCK_FD in nspawn by
replacing the close with a O_CLOEXEC fcntl, retaining the lock handle until
nspawn exits.

This facilitates simple and reliable container discovery by external
processes via flock() attempts on container directories.  Consult the
flock(2) and flock(1) man pages for information on advisory file locks.

With this change some basic lifecycle features are trivial using bash:

 Identifying which containers are active:
  shopt -s nullglob
  for c in /var/lib/rkt/containers/*; do
   flock --exclusive --nonblock "$c" echo "$c inactive" || echo "$c active"
  done

 GC of inactive containers:
  shopt -s nullglob
  mkdir -p /var/lib/rkt/gc
  for c in /var/lib/rkt/containers/*; do
   [ -e "$c/stage1" ] || continue
   flock --exclusive --nonblock "$c" mv "$c" /var/lib/rkt/gc
  done

 Assuming a periodic task clears out aged contents from /var/lib/rkt/gc
stage1: record pid of container's init process in $cuuid/pid

Intercept syscall() used by systemd-nspawn for clone, writing the
newly-namespaced child's pid into /var/lib/rkt/containers/$cuuid from the
parent before returning to systemd-nspawn.

This change combined with locking enables simple status queries of running
containers, for example in bash:

 shopt -s nullglob
 for c in /var/lib/rkt/containers/*; do
  [ -e "$c/pid" ] || continue
  flock --exclusive --nonblock "$c" /bin/true || {
   echo $c
   cpid=$(cat "$c/pid")
   nsenter --mount --uts --ipc --pid --root --wd --target "${cpid}" systemctl status
  }
 done