Add "Should-Start" cgroupfs-mount and cgroup-lite to sysvinit-debian init script

It's fine to list both here because "Should-Start" is a loose binding (ie, if the listed service exists, it'll be started first, but otherwise, this one will start without it).

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Fix port mapping in ps display for public and private
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Move duration and size to units pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
daemon: container: ensure cp cannot traverse outside container rootfs

This patch fixes the bug that allowed cp to copy files outside of
the containers rootfs, by passing a relative path (such as
../../../../../../../../etc/shadow). This is fixed by first converting
the path to an absolute path (relative to /) and then appending it
to the container's rootfs before continuing.

Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
integration-cli: cp: added tests for cp

This patch adds integration tests for the copying of resources
from a container, to ensure that regressions in the security of
resource copying can be easily discovered.

Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
daemon: *: refactored container resource path generation

This patch is a preventative patch, it fixes possible future
vulnerabilities regarding unsantised paths. Due to several recent
vulnerabilities, wherein the docker daemon could be fooled into
accessing data from the host (rather than a container), this patch
was created to try and mitigate future possible vulnerabilities in
the same vein.

Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
Refactoring collections/orderedintset and benchmarks for it

Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
Change ip allocation logic

Now IP reuses only after all IPs from network was allocated
Fixes #5729

Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
Merge pull request #5756 from crosbymichael/move-units-to-pkg

Move duration and size to units pkg
Merge pull request #5752 from crosbymichael/fix-port-mapping-ps

Fix port mapping in ps display for public and private
Merge pull request #5720 from cyphar/5656-cp-absolute-paths

Ensure `docker cp` cannot traverse outside container rootfs
changed deprecated -rm option to --rm

changed deprecated -rm option to --rm
changed deprecated -name option to --name

changed deprecated -name option to --name
Merge pull request #5783 from LK4D4/fix_duplicate_ip_allocation_#5729

Fix duplicate ip allocation
Check channel closed state in /events loop

When listener channel is closed, it becomes always available for
reading: select becomes an active loop which writes default-constructed
events (i.e: empty strings).

Fixes #5766.

Docker-DCO-1.1-Signed-off-by: Arnaud Porterie <arnaud.porterie@gmail.com> (github: icecrime)
Setup standard /dev symlinks

After copying allowed device nodes, set up "/dev/fd", "/dev/stdin",
"/dev/stdout", and "/dev/stderr" symlinks.

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
[rebased by @crosbymichael]
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Merge pull request #5804 from joelhandwell/patch-1

changed deprecated -rm option to --rm
Merge pull request #5805 from joelhandwell/patch-2

changed deprecated -name option to --name
Merge pull request #5806 from icecrime/5766-events_endless_newlines

Issue #5766 - Check channel closed state in /events loop
Merge pull request #5807 from crosbymichael/dev-symlinks

Setup standard /dev symlinks