Change default label of container volumes to shared SELinux Label

Since these will be shared between containers we want to label
them as svirt_sandbox_file_t:s0.  That will allow multiple containers
to write to them.

Currently we are allowing container domains to read/write all content in
/var/lib/docker because of container volumes.  This is a big security hole
in our SELinux story.

This patch will allow us to tighten up the security of docker containers.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Merge pull request #7951 from taohu/typo

typo fix: immediatly -> immediately
Merge pull request #7953 from SvenDowideit/reformat-api-docs

Reformat the API docs so I can read them
Consolidate documentation for -H option

Signed-off-by: Ben Firshman <ben@firshman.co.uk>
fix console attribute in lxc template

commit 4aa5da278f49c889d43191f82ff42d3a95266d62 moves `Console` from Command to
ProcessConfig, but missed the change in lxc_template. Therefore creating a
container with tty using lxc driver with fail with error

template: lxc:60:20: executing "lxc" at <.Console>: Console is not a field of
struct type struct { *execdriver.Command; AppArmor bool; ProcessLabel string; MountLabel string }

This changes lxc_console template to refers to `.ProcessConfig.Console`

Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh <dqminh89@gmail.com> (github: dqminh)
Merge pull request #7958 from dqminh/fix-lxc-template-console

fix console attribute in lxc template
Update libcontainer to 84ad9386a0240acb7475429a835

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
tarsum: use Debugf, not Infof

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Merge pull request #7660 from rhatdan/selinux-volumes

Change default label of container volumes to shared SELinux Label
Merge pull request #7948 from SvenDowideit/add-more-port-specification-doc

add -p PORT as a valid format specification
Merge pull request #7960 from vbatts/vbatts-tarsum_debugf_not_infof

tarsum: use Debugf, not Infof
Add daemon flag to specify public registry mirrors

Adds support for a --registry-mirror=scheme://<host>[:port]
daemon flag. The flag may be present multiple times. If
provided, mirrors are prepended to the list of endpoints used
for image pull. Note that only mirrors of the public
index.docker.io registry are supported, and image/tag resolution
is still performed via the official index.

Docker-DCO-1.1-Signed-off-by: Tim Smith <timbot@google.com> (github: timbot)
Merge pull request #7921 from unclejack/increase_tarsum_buffer_size

pkg/tarsum: make buffer size dynamic
Deallocate port before trying to delete iptables chain

Fixes #7954
Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com>
Add IsPrivate method for NetworkMode

This method indicates that container using private network stack

Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com>
Merge pull request #7897 from LK4D4/refactoring_net_mode

Add IsPrivate method for NetworkMode
Merge pull request #7955 from LK4D4/ignore_delete_err_on_unmap_#7954

Deallocate port before trying to delete iptables chain
Fix link for configuring automated builds
TarSum: versioning

This introduces Versions for TarSum checksums.
Fixes: https://github.com/docker/docker/issues/7526

It preserves current functionality and abstracts the interface for
future flexibility of hashing algorithms. As a POC, the VersionDev
Tarsum does not include the mtime in the checksum calculation, and would
solve https://github.com/docker/docker/issues/7387 though this is not a
settled Version is subject to change until a version number is assigned.

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Fix formatting, change to markdown block for long

Signed-off-by: Joe Ferguson <joe@infosiftr.com>