Support hairpin NAT without going through docker server

Hairpin NAT is currently done by passing through the docker server.  If
two containers on the same box try to access each other through exposed
ports and using the host IP the current iptables rules will not match the
DNAT and thus the traffic goes to 'docker -d'

This change drops the restriction that DNAT traffic must not originate
from docker0.  It should be safe to drop this restriction because the
DOCKER chain is already gated by jumps that check for the destination
address to be a local address.

Docker-DCO-1.1-Signed-off-by: Darren Shepherd <darren.s.shepherd@gmail.com> (github: ibuildthecloud)
Add mention of mounting cgroupfs properly to PACKAGERS.md

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Promote btrfs
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Docker-DCO-1.1-Signed-off-by: Ryan Thomas <rthomas@atlassian.com> (github: rthomas)
check if working dir is a directory and raise corresponding errors when making dir.

Docker-DCO-1.1-Signed-off-by: Liang-Chi Hsieh <viirya@gmail.com> (github: viirya)
Return error when existing bridge does not match ip
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Fix fish completion when having alias on awk or grep

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
This patch adds SELinux labeling support.

docker will run the process(es) within the container with an SELinux label and will label
all of  the content within the container with mount label.  Any temporary file systems
created within the container need to be mounted with the same mount label.

The user can override the process label by specifying

-Z With a string of space separated options.

-Z "user=unconfined_u role=unconfined_r type=unconfined_t level=s0"

Would cause the process label to run with unconfined_u:unconfined_r:unconfined_t:s0"

By default the processes will run execute within the container as svirt_lxc_net_t.
All of the content in the container as svirt_sandbox_file_t.

The process mcs level is based of the PID of the docker process that is creating the container.

If you run the container in --priv mode, the labeling will be disabled.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Follow symlinks inside container root for build's ADD
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Strip comments before parsing line continuations

Fixes #3898
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Fix commit and import when no repository is specified
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Merge pull request #4211 from rhatdan/master

Add SELinux support
Adjust TestOnlyLoopbackExistsWhenUsingDisableNetworkOption to ignore "DOWN" interfaces

This fixes the following, which I've been seeing on all my machines for as long as I can remember:

--- FAIL: TestOnlyLoopbackExistsWhenUsingDisableNetworkOption (0.36 seconds)
	container_test.go:1597: Wrong interface count in test container: expected [*: lo], got [1: lo 2: sit0]

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
upstart: use exec here so upstart can monitor the process and not just a shell

Docker-DCO-1.1-Signed-off-by: Michael Gorsuch <michael.gorsuch@gmail.com> (github: gorsuch)
Merge pull request #4838 from crosbymichael/btrfs-ftw

Promote btrfs
Merge pull request #4879 from gorsuch/exec-upstart

Use "exec" in the upstart script to let upstart manage the docker process instead of a shell
Merge pull request #4818 from viirya/fix_working_dir_not_dir

fix the problem when setting existing file as working dir
Merge pull request #4865 from creack/fix_fish_completion

Fix fish completion when having alias on awk or grep
Merge pull request #4613 from tianon/add-cgroupfs-mention-to-packagers

Add mention of mounting cgroupfs properly to PACKAGERS.md
Docker-DCO-1.1-Signed-off-by: Ryan Thomas <rthomas@atlassian.com> (github: rthomas)