Support hairpin NAT

This re-applies commit b39d02b with additional iptables rules to solve the issue with containers routing back into themselves.

The previous issue with this attempt was that the DNAT rule would send traffic back into the container it came from. When this happens you have 2 issues.
1) reverse path filtering. The container is going to see the traffic coming in from the outside and it's going to have a source address of itself. So reverse path filtering will kick in and drop the packet.
2) direct return mismatch. Assuming you turned reverse path filtering off, when the packet comes back in, it's goign to have a source address of itself, thus when the reply traffic is sent, it's going to have a source address of itself. But the original packet was sent to the host IP address, so the traffic will be dropped because it's coming from an address which the original traffic was not sent to (and likely with an incorrect port as well).

The solution to this is to masquerade the traffic when it gets routed back into the origin container. However for this to work you need to enable hairpin mode on the bridge port, otherwise the kernel will just drop the traffic.
The hairpin mode set is part of libcontainer, while the MASQ change is part of docker.

This reverts commit 63c303eecdbaf4dc7967fd51b82cd447c778cecc.

Docker-DCO-1.1-Signed-off-by: Patrick Hemmer <patrick.hemmer@gmail.com> (github: phemmer)
made getDefaultNetworkMtu private

Signed-off-by: Blake Geno <blakegeno@gmail.com>
unify `–`(en dash) to `-` when specifying options

Signed-off-by: Xie Shi <georgexsh@gmail.com>
Removed fixme from utils_test.go

Signed-off-by: Blake Geno <blakegeno@gmail.com>
Fix vet errors

Signed-off-by: Alexandr Morozov <lk4d4@docker.com>
Merge pull request #8977 from LK4D4/vet_fixes

Fix vet errors
Merge pull request #8963 from blakery/master

Cleanup: made GetDefaultNetworkMtu private
Add import/pull events to the stream

Closes #8160

Signed-off-by: Doug Davis <dug@us.ibm.com>
Merge pull request #8711 from duglin/Issue8160

Add import/pull events to the stream
Merge pull request #8970 from georgexsh/hyphen

unify `–`(en dash) to `-` when specifying options
Not fail on updating parent links

Fixes #8796

Signed-off-by: Alexandr Morozov <lk4d4@docker.com>
Fix Docker Hub tags list specification

The current implementation of the Docker Hub returns a list of objects
containing the tag name and the layer id.

Docker-DCO-1.1-Signed-off-by: Vincent Giersch <vincent.giersch@ovh.net>
pkg/mount: mountinfo from specified pid

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Merge pull request #8931 from vbatts/vbatts-mount_pid_mountinfo

pkg/mount: mountinfo from specified pid
Revise Docs Maintainers list

Removing Sonat from docs maintainers because he no longer has time to complete all the responsibilities. Many thanks to Sonat for his help.

Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Use the HTTP Last-Modified http header as the mtime value for ADD cmd when present

Closes #8331

Signed-off-by: Doug Davis <dug@us.ibm.com>
vendor: update vendor'd libcontainer version

This patch updates the vendor'd libcontainer version, so that Docker can
take advantage of the updates to the `user` API.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
*: transition to new libcontainer/user API

This patch fixes the compilation errors in Docker due to changes in the
libcontainer/user API. There is no functionality change due to this
patch.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
Merge pull request #9023 from cyphar/libcontainer-update-to-new-interface

Update vendor'd `libcontainer` and update to use new `user` interface.
pkg/namesgenerator: add Yeong-Sil Jang

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)