Support hairpin NAT without going through docker server

Hairpin NAT is currently done by passing through the docker server.  If
two containers on the same box try to access each other through exposed
ports and using the host IP the current iptables rules will not match the
DNAT and thus the traffic goes to 'docker -d'

This change drops the restriction that DNAT traffic must not originate
from docker0.  It should be safe to drop this restriction because the
DOCKER chain is already gated by jumps that check for the destination
address to be a local address.

Docker-DCO-1.1-Signed-off-by: Darren Shepherd <darren.s.shepherd@gmail.com> (github: ibuildthecloud)
Resync the DCO text with upstream at http://developercertificate.org/

```
Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.
```

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Add authenticated TLS support for API

Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
Add proper support for relative WORKDIR instructions

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
add softlayer installation instructions

Docker-DCO-1.1-Signed-off-by: Andrea Turli <andrea.turli@gmail.com> (github: andreaturli)
address comments from @jamtur01

Docker-DCO-1.1-Signed-off-by: Andrea Turli <andrea.turli@gmail.com> (github: andreaturli)
Improve WORKDIR test to cover more edge cases

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Add some documentation about relative WORKDIR values

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Prevent dynamic allocation of previously allocated ports

Docker-DCO-1.1-Signed-off-by: Andy Kipp <andy@rstudio.com> (github: kippandrew)
Better test error message

Docker-DCO-1.1-Signed-off-by: Andy Kipp <andy@rstudio.com> (github: kippandrew)
Be more explicit in finding next port to allocate

Docker-DCO-1.1-Signed-off-by: Andy Kipp <andy@rstudio.com> (github: kippandrew)
Add err checks for port allocator tests

Docker-DCO-1.1-Signed-off-by: Andy Kipp <andy@rstudio.com> (github: kippandrew)
cleanup container.stop

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Add sudo clause if your using osx or tcp
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Merge pull request #4757 from crosbymichael/osx-duh

Add sudo clause if your using osx or tcp
Be explicit about binding to all interfaces in redis example

Fixes #4021

Moved to debian because the redis installed in ubuntu is really old
and does not support args via the cli.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Merge pull request #4753 from vieux/clean_container_stop

cleanup container.stop
Merge pull request #4758 from crosbymichael/redis-bind

Be explicit about binding to all interfaces in redis example
Merge pull request #4727 from andreaturli/master

add softlayer installation instructions
refactor($hack,$docs): be consistent in apt-key keyserver URI usage, as done in #4740

In #4740, the apt-key call in docs is changed to use the keyserver port 80 instead of
port 11371, as the previous call would fail with a restrictive firewall or proxy.
This commit extends the change to all apt-key calls in the repository.

Docker-DCO-1.1-Signed-off-by: Viktor Vojnovski <vojnovski@gmail.com> (github: vojnovski)