Preserve extended attributes and acls on archlinux build

Failure to do this means that file capabilites are not preserved in the image.
Ping fails to work as a non-root user if cap_net_raw is capability is not set

Signed-off-by: Dan Griffin <dgriffin@peer1.com>
Add mention of e2fsprogs to runtime dependencies.

Signed-off-by: Marc Tamsky <mtamsky@gmail.com> (github: tamsky)
Add overlayfs graph backend

This backend uses the overlayfs union filesystem for containers
plus hard link file sharing for images.

Each container/image can have a "root" subdirectory which is a plain
filesystem hierarchy, or they can use overlayfs.

If they use overlayfs there is a "upper" directory and a "lower-id"
file, as well as "merged" and "work" directories. The "upper"
directory has the upper layer of the overlay, and "lower-id" contains
the id of the parent whose "root" directory shall be used as the lower
layer in the overlay. The overlay itself is mounted in the "merged"
directory, and the "work" dir is needed for overlayfs to work.

When a overlay layer is created there are two cases, either the
parent has a "root" dir, then we start out with a empty "upper"
directory overlaid on the parents root. This is typically the
case with the init layer of a container which is based on an image.
If there is no "root" in the parent, we inherit the lower-id from
the parent and start by making a copy if the parents "upper" dir.
This is typically the case for a container layer which copies
its parent -init upper layer.

Additionally we also have a custom implementation of ApplyLayer
which makes a recursive copy of the parent "root" layer using
hardlinks to share file data, and then applies the layer on top
of that. This means all chile images share file (but not directory)
data with the parent.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Exclude `.wh..wh.*` AUFS metadata on layer export

In an effort to make layer content 'stable' between import
and export from two different graph drivers, we must resolve
an issue where AUFS produces metadata files in its layers
which other drivers explicitly ignore when importing.

The issue presents itself like this:

    - Generate a layer using AUFS
    - On commit of that container, the new stored layer contains
      AUFS metadata files/dirs. The stored layer content has some
      tarsum value: '1234567'
    - `docker save` that image to a USB drive and `docker load`
      into another docker engine instance which uses another
      graph driver, say 'btrfs'
    - On load, this graph driver explicitly ignores any AUFS metadata
      that it encounters. The stored layer content now has some
      different tarsum value: 'abcdefg'.

The only (apparent) useful aufs metadata to keep are the psuedo link
files located at `/.wh..wh.plink/`. Thes files hold information at the
RW layer about hard linked files between this layer and another layer.
The other graph drivers make sure to copy up these psuedo linked files
but I've tested out a few different situations and it seems that this
is unnecessary (In my test, AUFS already copies up the other hard linked
files to the RW layer).

This changeset adds explicit exclusion of the AUFS metadata files and
directories (NOTE: not the whiteout files!) on commit of a container
using the AUFS storage driver.

Also included is a change to the archive package. It now explicitly
ignores the root directory from being included in the resulting tar archive
for 2 reasons: 1) it's unnecessary. 2) It's another difference between
what other graph drivers produce when exporting a layer to a tar archive.

Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
Updated the COPY directive reference: Source can't be a URL for COPY (+ formatting error fixes)

Signed-off-by: Roman Dudin <katrmr@gmail.com>
Wait for hijack on docker start command

With current implementation there was a possibility
that /start responds quicker than /attach, meaning that
some output would be clipped.

Fixed so the implementation matches with `docker run`.

This also fixes the flaky test results for TestCreateEchoStdout.

Signed-off-by: Tõnis Tiigi <tonistiigi@gmail.com> (github: tonistiigi)
Fix apparent copy paste mistake

The note under the RUN header refers to the CMD instruction. It should refer to the RUN instruction instead.

Signed-off-by: Huu Nguyen <whoshuu@gmail.com>
Remove out-of-context code block

Signed-off-by: Huu Nguyen <whoshuu@gmail.com>
proxy: Fix a potential panic handling error states.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
pkg/mount: add more sharesubtree options

Signed-off-by: Vincent Batts <vbatts@redhat.com>
pkg/mount: testing for linux sharedsubtree mounts

* shared
* shared/slave
* unbindable
* private

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Grammatical mistake in docs

Change `The team can now use this image by run their own containers.` to `The team can now use this image by running their own containers.`
Remove extra line feed typo

The removed extra line feed broke the paragraph at https://docs.docker.com/userguide/dockerizing/
pkg/mount: adding fields supported by freebsd

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Edits and refinements to 1.3.1 release notes.

Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Added missing item from Changelog

Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Remove travis CI.

Docker-DCO-1.1-Signed-off-by: Jessica Frazelle <jess@docker.com> (github: jfrazelle)
Switch travis status to drone.

Docker-DCO-1.1-Signed-off-by: Jessica Frazelle <jess@docker.com> (github: jfrazelle)
Support hairpin NAT

This re-applies commit b39d02b with additional iptables rules to solve the issue with containers routing back into themselves.

The previous issue with this attempt was that the DNAT rule would send traffic back into the container it came from. When this happens you have 2 issues.
1) reverse path filtering. The container is going to see the traffic coming in from the outside and it's going to have a source address of itself. So reverse path filtering will kick in and drop the packet.
2) direct return mismatch. Assuming you turned reverse path filtering off, when the packet comes back in, it's goign to have a source address of itself, thus when the reply traffic is sent, it's going to have a source address of itself. But the original packet was sent to the host IP address, so the traffic will be dropped because it's coming from an address which the original traffic was not sent to (and likely with an incorrect port as well).

The solution to this is to masquerade the traffic when it gets routed back into the origin container. However for this to work you need to enable hairpin mode on the bridge port, otherwise the kernel will just drop the traffic.
The hairpin mode set is part of libcontainer, while the MASQ change is part of docker.

This reverts commit 63c303eecdbaf4dc7967fd51b82cd447c778cecc.

Docker-DCO-1.1-Signed-off-by: Patrick Hemmer <patrick.hemmer@gmail.com> (github: phemmer)
fixed the way of iterating over the range of map.

Fixed the following errors:
1. Request(0) causes a dead loop when the map is full and map.last == BEGIN.
2. When map.last is the only available port (or ip), Request(0) returns ErrAllPortsAllocated (or ErrNoAvailableIPs). Exception is when map.last == BEGIN.

Signed-off-by: shuai-z <zs.broccoli@gmail.com>