bump fpm to 1.3.2

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Fix deadlock in ps exited filter

Fixes #8909

Signed-off-by: Alexandr Morozov <lk4d4@docker.com>

Conflicts:
	integration-cli/docker_cli_ps_test.go
		fixed merge issue caused by missing tests
removed redundant Clean

The doc (or src) says: The result is Cleaned.

http://golang.org/pkg/path/filepath/#Join

Signed-off-by: shuai-z <zs.broccoli@gmail.com>
pkg/symlink: avoid following out of scope

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Move security opts to HostConfig

These settings need to be in the HostConfig so that they are not
committed to an image and cannot introduce a security issue.

We can safely move this field from the Config to the HostConfig
without any regressions because these settings are consumed at container
created and used to populate fields on the Container struct.  Because of
this, existing settings will be honored for containers already created
on a daemon with custom security settings and prevent values being
consumed via an Image.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Add AppArmorProfile to container inspect json

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
pkg/reexec: move reexec code to a new package

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)

Conflicts:
	integration/runtime_test.go
		fixed imports
Use archive.CopyWithTar in vfs.Create

The vfs storage driver currently shells out to the `cp` binary on the host
system to perform an 'archive' copy of the base image to a new directory.
The archive option preserves the modified time of the files which are created
but there was an issue where it was unable to preserve the modified time of
copied symbolic links on some host systems with an outdated version of `cp`.

This change no longer relies on the host system implementation and instead
utilizes the `CopyWithTar` function found in `pkg/archive` which is used
to copy from source to destination directory using a Tar archive, which
should correctly preserve file attributes.

Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
pkg/archive: add interface for Untar

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
add pkg/chrootarchive and use it on the daemon

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
pkg/chrootarchive: pass TarOptions via CLI arg

Signed-off-by: Tibor Vass <teabee89@gmail.com>
don't call reexec.Init from chrootarchive

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Fix: Failed Start breaks VolumesFrom

Running parseVolumesFromSpec on all VolumesFrom specs before initialize
any mounts endures that we don't leave container.Volumes in an
inconsistent (partially initialized) if one of out mount groups is not
available (e.g. the container we're trying to mount from does not
exist).

Keeping container.Volumes in a consistent state ensures that next time
we Start() the container, it'll run prepareVolumes() again.

The attached test demonstrates that when a container fails to start due
to a missing container specified in VolumesFrom, it "remembers" a Volume
that worked.

Fixes: #8726

Signed-off-by: Thomas Orozco <thomas@orozco.fr>

Conflicts:
	integration-cli/docker_cli_start_test.go
		cli integration test
archive: add breakout tests

Signed-off-by: Tibor Vass <teabee89@gmail.com>

Conflicts:
	pkg/archive/archive.go
		fixed conflict which git couldn't fix with the added BreakoutError
archive: prevent breakout in Untar

Signed-off-by: Tibor Vass <teabee89@gmail.com>
archive: prevent breakout in ApplyLayer

Signed-off-by: Tibor Vass <teabee89@gmail.com>
registry: refactor registry.IsSecure calls into registry.NewEndpoint

Signed-off-by: Tibor Vass <teabee89@gmail.com>

Conflicts:
	registry/endpoint.go
	registry/endpoint_test.go
	registry/registry_test.go
Put mock registry address in insecureRegistries for unit tests

Signed-off-by: Tibor Vass <teabee89@gmail.com>

Conflicts:
	registry/registry_mock_test.go
registry: parse INDEXSERVERADDRESS into a URL for easier check in isSecure

Signed-off-by: Tibor Vass <teabee89@gmail.com>
Add the possibility of specifying a subnet for --insecure-registry

Signed-off-by: Tibor Vass <teabee89@gmail.com>

Conflicts:
	registry/endpoint.go