use os.Environ() to set exec command's env

because `LoadContainerEnvironment` is already run, os.Environ() will return the
correct environment variables for the exec command (i.e. removed duplicated
envs, set HOME for user etc...)

Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh <dqminh89@gmail.com> (github: dqminh)
Merge pull request #264 from dqminh/fix-exec-env

Set correct env variables for `docker exec` commands
Update the path to project from hack

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #265 from crosbymichael/fix-dind

Update the path to project from hack
Provide better sethostname error message

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #268 from crosbymichael/sethostname

Provide better sethostname error message
Use SYS_SETUID32 for system.Setuid() on Linux for ARM

Besides possible other problems 16bit UIDs might be disabled by the kernel
configuration on Linux for ARM (see CONFIG_UID16).

Signed-off-by: Alexander Holler <holler@ahsoftware.de>
Merge pull request #269 from aholler/master

Use SYS_SETUID32 for system.Setuid() on Linux for ARM
Change arguments to fs.GetStats to be map[string]string

Allows us to remove systemd.GetPaths later

Signed-off-by: Donald Huang <don.hcd@gmail.com>
Remove systemd.GetStats

Because we are using the paths that are created when we initially setup
cgroups for a container we no longer have to dynamically generates them
when a user requests stats.  This allows us to fully use the fs stats
code without having system create it's paths.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Have cgroup.Apply return paths to setup cgroups

There is no reason to have a special type returned from the cgroups
Apply function for getting the paths and cleanup.  With access to the
paths we can just delete what we need.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Move RemovePaths into cgroups pkg for reuse

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Remove cgutil cli application as it is not being used

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #267 from crosbymichael/cgroup-paths

Use cgroup paths for stats and removal
libcontainer: setup cpuset cgroup by default

Currently if we don't use --cpuset, the cpuset cgroup is not
created, it's bad if we want to modify cpuset config subsequently,
change the behavior to make it right.

Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Always join fs.Cpuset reguardless of value

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #271 from crosbymichael/always-set-cpuset

libcontainer: setup cpuset cgroup by default
Introduce support for syscall filtering in containers #237

This PR introduces the ability to filter system calls on a per-container basis on Linux, using libseccomp to support multiple architectures.

This adds another layer of security between containers and the kernel. System calls which are unnecessary in a container or problematic from a security perspective can be restricted to prevent their use. Most of the truly problematic syscalls are already restricted by dropping capabilities; this adds an additional, finer-grained layer of protection.

There's a similar feature present in LXC already, with the significant difference that LXC uses a whitelist of system calls, whereas these patches use a blacklist. The blacklist approach ensures no difference in functionality to clients not explicitly aware of seccomp support (the restricted syscalls list in the container config is left empty, and the seccomp init function exits without taking action).

This PR adds a vendored library dependency (Go bindings for libseccomp) and a build dependency on libseccomp >= v2.1. The actual changes to libcontainer are fairly minimal, most of the delta is in the libseccomp bindings.

Presently missing: integration tests, documentation

Docker-DCO-1.1-Signed-off-by: Matt Heon <mheon@redhat.com> (github: mheon)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)