Add overlayfs graph backend

This backend uses the overlayfs union filesystem for containers
plus hard link file sharing for images.

Each container/image can have a "root" subdirectory which is a plain
filesystem hierarchy, or they can use overlayfs.

If they use overlayfs there is a "upper" directory and a "lower-id"
file, as well as "merged" and "work" directories. The "upper"
directory has the upper layer of the overlay, and "lower-id" contains
the id of the parent whose "root" directory shall be used as the lower
layer in the overlay. The overlay itself is mounted in the "merged"
directory, and the "work" dir is needed for overlayfs to work.

When a overlay layer is created there are two cases, either the
parent has a "root" dir, then we start out with a empty "upper"
directory overlaid on the parents root. This is typically the
case with the init layer of a container which is based on an image.
If there is no "root" in the parent, we inherit the lower-id from
the parent and start by making a copy if the parents "upper" dir.
This is typically the case for a container layer which copies
its parent -init upper layer.

Additionally we also have a custom implementation of ApplyLayer
which makes a recursive copy of the parent "root" layer using
hardlinks to share file data, and then applies the layer on top
of that. This means all chile images share file (but not directory)
data with the parent.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
fixed the way of iterating over the range of map.

Fixed the following errors:
1. Request(0) causes a dead loop when the map is full and map.last == BEGIN.
2. When map.last is the only available port (or ip), Request(0) returns ErrAllPortsAllocated (or ErrNoAvailableIPs). Exception is when map.last == BEGIN.

Signed-off-by: shuai-z <zs.broccoli@gmail.com>
Make test-unit runnable without parallel

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
Export envvars necessary for unit-test

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
Improve "security reports" section in contribution docs.

Signed-off-by: Solomon Hykes <solomon@docker.com>
In contribution docs, emphasize that bug reports are appreciated!

Signed-off-by: Solomon Hykes <solomon@docker.com>
Move GOVERNANCE.md to hack/

Signed-off-by: Solomon Hykes <solomon@docker.com>
Move 'hack' to the less confusing 'project'

We might want to break it up into smaller pieces (eg. tools in one
place, documents in another) but let's worry about that later.

Signed-off-by: Solomon Hykes <solomon@docker.com>
handle GET redirects

Signed-off-by: Victor Vieux <vieux@docker.com>
fix unix socket

Signed-off-by: Victor Vieux <vieux@docker.com>
Allow IPC namespace to be shared between containers or with the host

Some workloads rely on IPC for communications with other processes.  We
would like to split workloads between two container but still allow them
to communicate though shared IPC.

This patch mimics the --net code to allow --ipc=host to not split off
the IPC Namespace.  ipc=container:CONTAINERID to share ipc between containers

If you share IPC between containers, then you need to make sure SELinux labels
match.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Update CONTRIBUTING to reflect new PR-docs process.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
update timeout

Signed-off-by: Victor Vieux <vieux@docker.com>
Fix AUFS silent mount errors on many layers

Fixes #1171
Fixes #6465

Data passed to mount(2) is clipped to PAGE_SIZE if its bigger. Previous 
implementation checked if error was returned and then started to append layers 
one by one. But if the PAGE_SIZE clipping appeared in between the paths, in the 
permission sections or in xino definition the call would not error and 
remaining layers would just be skipped(or some other unknown situation).

This also optimizes system calls as it tries to mount as much as possible with 
the first mount.


Signed-off-by: Tõnis Tiigi <tonistiigi@gmail.com> (github: tonistiigi)
pkg/devicemapper: cleanup removeDevice differences

Fixes failure on RemoveDevice when host is AUFS, and running
devicemapper test docker-in-docker

https://gist.github.com/tonistiigi/59559cbfb3f2df26b29c

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Updated cover tool import path.

Signed-off-by: Hans Rødtang <hansrodtang@gmail.com>
Merge pull request #8999 from yoheiueda/test-unit-without-parallel

Make test-unit runnable without parallel
pkg/devicemapper: missed MAINTAINERS on split

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Merge pull request #9074 from rhatdan/shm

Allow IPC namespace to be shared between containers or with the host
use _, _ string

Signed-off-by: Victor Vieux <vieux@docker.com>