Add instructions for installing from scratch.

[#82581256]
Editorial changes

Signed-off-by: Steve Powell <spowell@pivotal.io>
work with latest docker

Signed-off-by: Alex Suraci <asuraci@pivotal.io>
container exposes external IP in .Info

Signed-off-by: Alex Suraci <asuraci@pivotal.io>
stop installing strace; it's now in the image

Signed-off-by: Alex Suraci <asuraci@pivotal.io>
force rebuilding of packages with -tags daemon

Signed-off-by: Alex Suraci <asuraci@pivotal.io>
Add unit test for -externalIP flag

[#83091172]
Tell README.md about need to add -tags daemon flag

needed to build docker dependencies

[#83091172]
Merge branch 'external-ip'

[#83091172]
Update README.md

[#82581256]
Allow a specific user to be selected to run a process

Assumes that user is already present in the container, and overrides the
'privileged' field if specified.

[#82838924]
apply user namespacing

this doesn't change any behavior; simply maps root to root and the container's
user to the container's user.
Fix up tests to work with user namespacing.

[#82838560]
Bump to latest garden

[#82838560]
Do mounts and networking config in host.

Once the root user is not always container root, it may not have
permissions to execute mounts and networking operations inside the
container. Therefore we have to do these operations in the host.

Also explicitly setuid and setgid to 0 so that we become container root
before running hook scripts.

We no longer have permissions to delete tmp/garden-host by the time the
container is created, so for now we're going to have to leave it.
See #83193088 which tracks figuring out how to delete this.

[#82838560]
Allow root user to be mapped to another user in the host.

This allows containers to be run as root without giving them host-level
root access (assuming no kernel bugs). It also means that containers
running as non-root users are prevented from gaining host root even if
they manage to escalate to root inside the container.

By default all containers are now created with non-host-root
permissions. The 'privileged' flag on creation has been added to
override this behaviour and permit a container's root user to also be
the host root user.

NOTE: This means that users who need to run, for example,
networking scripts within the container must now specify the
'privileged' flag on container creation (rather than just on the run
command).

* Also backfill a test for hostname being set to container ID
* Swap to using nc rather than ping in ip_test because unprivileged
  containers no longer allow ping to be run

[#82838560]
Loopback interface device link configuration

[#80656918]

Signed-off-by: Steve Powell <spowell@pivotal.io>
Ensure net-fence executable is statically linked

Without this, net-fence fails to load with an obscure "not found" error.

The problem is that net-fence uses the Go net package and this causes
the executable to become dynamically linked.

See http://blog.xebia.com/2014/07/04/create-the-smallest-possible-docker-container/
more information.

[#80656918]

Signed-off-by: Steve Powell <spowell@pivotal.io>
Move host network configuration into net fence

[#80656918]

Signed-off-by: Steve Powell <spowell@pivotal.io>
Refactor of tests in fences/network/configure_test.go

Also split security test from restarting variant.

[#80656918]

Signed-off-by: Steve Powell <spowell@pivotal.io>