Add authenticated TLS support for API

Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
move git clone from daemon to client

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)

add a little doc
if client has no git, use server

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
retry to retrieve metadata on failure during pull

This makes Docker retry to retrieve the JSON metadata for the layers.
Docker will make 5 attempts to retrieve the metadata before failing and
it will increase the delay between attempts after each failed attempt.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Fix issue when /etc/apparmor.d does not exists

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
use mock for search

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Update to double-dash everywhere

These were found using `git grep -nE '[^-a-zA-Z0-9<>]-[a-zA-Z0-9]{2}'` (fair warning: _many_ false positives there).

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Merge pull request #4387 from unclejack/multiple_metadata_retrieval_attempts

retry to retrieve layer metadata on failure during pull
Use BSD raw mode on darwin. Fixes nano, tmux and others

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
Move .dockerenv parsing to lxc driver

This is not needed for e.g. the native driver

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Move all bind-mounts in the container inside the namespace

This moves the bind mounts like /.dockerinit, /etc/hostname, volumes,
etc into the container namespace, by setting them up using lxc.

This is useful to avoid littering the global namespace with a lot of
mounts that are internal to each container and are not generally
needed on the outside. In particular, it seems that having a lot of
mounts is problematic wrt scaling to a lot of containers on systems
where the root filesystem is mounted --rshared.

Note that the "private" option is only supported by the native driver, as
lxc doesn't support setting this. This is not a huge problem, but it does
mean that some mounts are unnecessarily shared inside the container if you're
using the lxc driver.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Don't use separate bind mount for container

Since we're not not mounting anything but the base filesystem outside
the container we no longer need the separate bind mount at
/var/lib/docker/container/$id/root in order to see the base filesystem
without extra mounts. So, we drop this and mount (again) the container
root directly at the real basefs mountpoint.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Merge pull request #4648 from creack/fix_raw_mode_darwin

Use BSD raw mode on darwin. Fixes nano, tmux and others
add a breakathon for testing

Docker-DCO-1.1-Signed-off-by: Charlie Lewis <charliel@lab41.org> (github: cglewis)
Merge pull request #4649 from cglewis/release_add_breakathon

Add a "breakathon" for a testing/QA period to the release checklist
Fix EXPOSE cache miss issue

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
Merge pull request #4624 from creack/fix_apparmor_init

Fix issue when /etc/apparmor.d does not exists
Always symlink /dev/ptmx for libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Merge pull request #4422 from alexlarsson/internal-mounts

Move all bind-mounts in the container inside the namespace
Merge pull request #4656 from crosbymichael/fix-ptmx-link

Always symlink /dev/ptmx for libcontainer