This patch will reserve MCS Labels in /run/docker/selinux

It will generate a new random SELinux label when a container starts,
and remove it when the container is removed.  The MCS Reservations will
not survive a reboot.

A potential problem would be conflicts if you setup thousands of containers,
current scheme would handle ~500,000 containers.
Fix SELinux errors caused by multi-threading