docker rmi -f works with stopped containers + revamped error messages

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
update message

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Update hack/dind to match the rest of our scripts

No functional changes here, just coding style and maintainability.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Add notes about git commit messages

This improves readability of commits a lot and is easy to
follow. I think most people follow those rules already. They are based
on http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html

Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
Make Jerome Petazzoni a maintainer for dind

In the spirit of getting more contributors to maintain their
components.. I nominate @jpetazzo ot maintain dind (he's the original
author).

@jpetazzo I don't expect this to be too much load, but it's a good and
symbolic start :)

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Improve code/comment/output markings & display consistency

This PR aims to increase the consistency across the docs for
code blocks and code/comment/output markings.

Rule followed here is "what's visible on the screen should be reflected"

Issue:

 - Docs had various code blocks showing: comments, commands & outputs.
 - All three of these items were inconsistently marked.

Some examples as to how this PR aims to introduce improvements:

1. Removed `> ` from in front of the "outputs". Eg,
`    > REPOSITORY                 TAG       ID              CREATED` replaced with:
`    REPOSITORY                 TAG       ID              CREATED`.

2. Introduced `$` for commands. Eg,
`    sudo chkconfig docker on` replaced with:
`    $ sudo chkconfig docker on`

3. Comments:
`    > # ` replaced with:
`    # `.

> Please note:
> Due to a vast amount of items reviewed and changed for this PR, there
> might be some individually incorrect replacements OR patterns of incorrect
> replacements. This PR needs to be reviewed and if there is anything missing,
> it should be improved or amended.

Closes:
https://github.com/dotcloud/docker/issues/5286

Docker-DCO-1.1-Signed-off-by: O.S. Tezer <ostezer@gmail.com> (github: ostezer)
Mount /proc and /sys read-only, except in privileged containers.

It has been pointed out that some files in /proc and /sys can be used
to break out of containers. However, if those filesystems are mounted
read-only, most of the known exploits are mitigated, since they rely
on writing some file in those filesystems.

This does not replace security modules (like SELinux or AppArmor), it
is just another layer of security. Likewise, it doesn't mean that the
other mitigations (shadowing parts of /proc or /sys with bind mounts)
are useless. Those measures are still useful. As such, the shadowing
of /proc/kcore is still enabled with both LXC and native drivers.

Special care has to be taken with /proc/1/attr, which still needs to
be mounted read-write in order to enable the AppArmor profile. It is
bind-mounted from a private read-write mount of procfs.

All that enforcement is done in dockerinit. The code doing the real
work is in libcontainer. The init function for the LXC driver calls
the function from libcontainer to avoid code duplication.

Docker-DCO-1.1-Signed-off-by: Jérôme Petazzoni <jerome@docker.com> (github: jpetazzo)
Update to enable cross compile
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Update restrictions for better handling of mounts

This also cleans up some of the left over restriction paths code from
before.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Mount attr and task as rw for selinux support
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Fix /proc/kcore mount of /dev/null
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Adding Rohit Jnagal and Victor Marmol to pkg/libcontainer maintainers.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
Merge pull request #5524 from ostezer/docs-fix-codeblocks

Improve code/comment/output markings & display consistency
Bring back archived remote API versions

- git mv archived/* .
- put the links back into the summary document
- reduce the header depth by 1 so the TOC lists each API version
- update the mkdocs.yaml to render the archived API docs, but not add
  them to the menu/nav

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Merge pull request #5517 from SvenDowideit/5267-make-archived-docs-hidden-but-linkable

Bring back archived remote API versions
make sure the intermediate index.html files are generated consistently

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Merge pull request #5521 from SvenDowideit/doc-auto-section

make sure the intermediate index.html files are generated consistently
Force the older API docs to be generated.

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Merge pull request #5541 from SvenDowideit/docs-generate-all-api-docs

Force the older API docs to be generated.
Apply apparmor before restrictions

There is not need for the remount hack, we use aa_change_onexec so the
apparmor profile is not applied until we exec the users app.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)