Add overlayfs graph backend

This backend uses the overlayfs union filesystem for containers
plus hard link file sharing for images.

Each container/image can have a "root" subdirectory which is a plain
filesystem hierarchy, or they can use overlayfs.

If they use overlayfs there is a "upper" directory and a "lower-id"
file, as well as "merged" and "work" directories. The "upper"
directory has the upper layer of the overlay, and "lower-id" contains
the id of the parent whose "root" directory shall be used as the lower
layer in the overlay. The overlay itself is mounted in the "merged"
directory, and the "work" dir is needed for overlayfs to work.

When a overlay layer is created there are two cases, either the
parent has a "root" dir, then we start out with a empty "upper"
directory overlaid on the parents root. This is typically the
case with the init layer of a container which is based on an image.
If there is no "root" in the parent, we inherit the lower-id from
the parent and start by making a copy if the parents "upper" dir.
This is typically the case for a container layer which copies
its parent -init upper layer.

Additionally we also have a custom implementation of ApplyLayer
which makes a recursive copy of the parent "root" layer using
hardlinks to share file data, and then applies the layer on top
of that. This means all chile images share file (but not directory)
data with the parent.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
allow to use x-registry-auth header with enabled cors

Signed-off-by: Vladimir Bulyga <xx@ccxx.cc>
pkg/mount: include optional field

one linux, the optional field designates the sharedsubtree information,
if any.

Signed-off-by: Vincent Batts <vbatts@redhat.com>
fixed the way of iterating over the range of map.

Fixed the following errors:
1. Request(0) causes a dead loop when the map is full and map.last == BEGIN.
2. When map.last is the only available port (or ip), Request(0) returns ErrAllPortsAllocated (or ErrNoAvailableIPs). Exception is when map.last == BEGIN.

Signed-off-by: shuai-z <zs.broccoli@gmail.com>
print everything except progress in non-terminal

Instead of only checking `Progress != nil` (which is always true because
the server sends `"progressDetail":{}` when it doesnt have the progress), we
also check if `Progress.String() != ""`, which should be sufficient to filter
out the progress data.

Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh <dqminh89@gmail.com> (github: dqminh)
LXC TEMPLATE WILL CREATE MOUNT

Lxc driver was throwing errors for mounts where the mount point does not exist in the container.
This adds a create=dir/file mount option to the lxc template, to alleviate this issue.

Docker-DCO-1.1-Signed-off-by: Abin Shahab <ashahab@altiscale.com> (github: ashahab-altiscale)
makes the -s --size option documentation clearer #8950

Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au>
Improve "security reports" section in contribution docs.

Signed-off-by: Solomon Hykes <solomon@docker.com>
In contribution docs, emphasize that bug reports are appreciated!

Signed-off-by: Solomon Hykes <solomon@docker.com>
Move GOVERNANCE.md to hack/

Signed-off-by: Solomon Hykes <solomon@docker.com>
Move 'hack' to the less confusing 'project'

We might want to break it up into smaller pieces (eg. tools in one
place, documents in another) but let's worry about that later.

Signed-off-by: Solomon Hykes <solomon@docker.com>
pkg/tarsum: adding more tests

Ensuring case size of headers will still be accounted for.
https://github.com/docker/docker/pull/8869#discussion_r20114401

Signed-off-by: Vincent Batts <vbatts@redhat.com>
handle GET redirects

Signed-off-by: Victor Vieux <vieux@docker.com>
fix unix socket

Signed-off-by: Victor Vieux <vieux@docker.com>
Allow IPC namespace to be shared between containers or with the host

Some workloads rely on IPC for communications with other processes.  We
would like to split workloads between two container but still allow them
to communicate though shared IPC.

This patch mimics the --net code to allow --ipc=host to not split off
the IPC Namespace.  ipc=container:CONTAINERID to share ipc between containers

If you share IPC between containers, then you need to make sure SELinux labels
match.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Update CONTRIBUTING to reflect new PR-docs process.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
update timeout

Signed-off-by: Victor Vieux <vieux@docker.com>
Corrected description of --sig-proxy

Signal proxy does work only in non-TTY mode (--tty=false). Man pages and
commands should not lie about it.

Signed-off-by: Michal Minar <miminar@redhat.com>
Remove reference to 'ifaceName' from configureBridge comment.

The argument ifaceName was removed in a much earlier commit.

Signed-off-by: Sami Wagiaalla <swagiaal@redhat.com>
Fix AUFS silent mount errors on many layers

Fixes #1171
Fixes #6465

Data passed to mount(2) is clipped to PAGE_SIZE if its bigger. Previous 
implementation checked if error was returned and then started to append layers 
one by one. But if the PAGE_SIZE clipping appeared in between the paths, in the 
permission sections or in xino definition the call would not error and 
remaining layers would just be skipped(or some other unknown situation).

This also optimizes system calls as it tries to mount as much as possible with 
the first mount.


Signed-off-by: Tõnis Tiigi <tonistiigi@gmail.com> (github: tonistiigi)