Allow IPC namespace to be shared between containers or with the host

Some workloads rely on IPC for communications with other processes.  We
would like to split workloads between two container but still allow them
to communicate though shared IPC.

This patch mimics the --net code to allow --ipc=host to not split off
the IPC Namespace.  ipc=container:CONTAINERID to share ipc between containers

If you share IPC between containers, then you need to make sure SELinux labels
match.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Automatically relabel volume mounts if user passes :Z with --volume

When you volume mount into a labeled container, we want to allow the
administrator/user the ability to tell docker to fix the labels on the mount.
Using the same basic syntax as the :ro and :rw options on the --volume command

:Z will set the labels so that only the processes within the container can
read/write content.  Since the labels change on creation, this can not be done
by the administrator prior to running the container

:z will change the labels so all containers could read/write content.

drwxr-xr-x. root root system_u:object_r:svirt_sandbox_file_t:s0 /var/run/dan

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
engine: Make Engine threadsafe

This allows registering handlers after you've started using the engine,
as well as setting hack envs.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
On Red Hat Registry Servers we return 404 on certification errors.

We do this to prevent leakage of information, we don't want people
to be able to probe for existing content.

According to RFC 2616, "This status code (404) is commonly used when the server does not
wish to reveal exactly why the request has been refused, or when no other response i
is applicable."

https://www.ietf.org/rfc/rfc2616.txt

10.4.4 403 Forbidden

   The server understood the request, but is refusing to fulfill it.
   Authorization will not help and the request SHOULD NOT be repeated.
   If the request method was not HEAD and the server wishes to make
   public why the request has not been fulfilled, it SHOULD describe the
   reason for the refusal in the entity.  If the server does not wish to
   make this information available to the client, the status code 404
   (Not Found) can be used instead.

10.4.5 404 Not Found

   The server has not found anything matching the Request-URI. No
   indication is given of whether the condition is temporary or
   permanent. The 410 (Gone) status code SHOULD be used if the server
   knows, through some internally configurable mechanism, that an old
   resource is permanently unavailable and has no forwarding address.
   This status code is commonly used when the server does not wish to
   reveal exactly why the request has been refused, or when no other
   response is applicable.

When docker is running through its certificates, it should continue
trying with a new certificate even if it gets back a 404 error code.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Set container_uuid environment

If you are running with systemd as init 1 and specify the container_uuid environment
variable, systemd will create /etc/machine-id with the correct data.

Then on the host you can setup journald to watch the container.

systemd only allows 32 chars in the UUID stored in /etc/machine-id

Then we can later apply a different patch to setup journald to watch
containers from the host and log all syslog/stdout/stderr data together
int the hosts journal.

The following link explains what systemd expects to be setup.

http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/

This should replace

https://github.com/docker/docker/issues/3506

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Allow COMMENT to be specified in the DockerFile

This will allow a user to save COMMENT data into an image, which
can later be retrieved using:

docker inspect IMAGEID

Copied the test example and some description data from Erik Hollensbe
<github@hollensbe.org>

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Add generic /cmd entrypoint w/ cli support

If you do
  docker devmapper:resize -o Key=Value -o Foo=Bar plugin:op arg1 arg2

This will do a GET http request to /cmd/devmapper/resize with the
arguments and options as keys. This will then try to spawn a job on
the engine called "devmapper:resize" with the arg1, arg2, etc as
arguments and the -o options as environment.

Also, any graph driver implementing the engine.Installer interface
will get installed on the engine when the daemon is created.

This will be used by e.g. the devicemapper to allow driver-specific
operations like pool resizing.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Remove TestUsage, since Usage will no longer be shown on failure to parse

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
devicemapper: Add resize-pool operation

This lets you live-resize the devicemapper loopback files for the pool.
Use it like this:
 docker dm:resize-pool 140G

Also, it changes the way pool sizes are reported to use the units.HumanSize
call which uses base 1000, not 1024, to match the FromHumanSize call.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
devicemapper: Add docker driver resize operations

This lets you resize individual images or containers like:

docker dm:resize f4eff8c9f36d3114c3a16fc7b213512153a2d25caef6f11f385020e6558600f1 12G

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
devicemapper: Split out BlockDeviceDiscard

This adds a BlockDeviceDiscardAll which discards everything on the device,
and makes BlockDeviceDiscard take offset and length arguments.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
devicemapper: Add dm:trim-pool command

This command suspends the pool, extracts all metadata from the
metadata pool and then manually discards all regions not in use on the
data device. This will re-sparsify the underlying loopback file and
regain space on the host operating system.

This is required in some cases because the discards we do when
deleting images and containers isn't enought to fully free all space
unless you have a very new kernel.  See:
https://github.com/dotcloud/docker/issues/3182#issuecomment-32888284

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
devicemapper: TrimPool: Sync pool before suspending

Calling sync() on a suspended pool blocks if there were outstanding
writes, so do the sync before suspending. There is of course a race
where we may get more dirty data between the sync and the suspend,
but that should be fine. We read metadata at the suspended state
and do the discards on that before we resume it allowing the
new dirty bits to be written.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: rhatdan)
Allow setting of environment variables when importing docker images

We want to be able to set the container=docker environment
variable when we build RHEL docker images.  I believe there
will be other use cases where you might want to set
environment in base images.

Since you can do this in layered image, I see no reason not
to allow it in base images.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
--help option and help command should print to stdout not stderr

    --help and help are successful commands so output should not go to error.

    QE teams have requested this change, also users doing docker help | less
    or docker run --help | less would expect this to work.

    Usage statement should only be printed when the user asks for it.
    Errors should print error message and then suggest the docker COMMAND --help
    command to see usage information.

    The current behaviour causes the user to have to search for the error message
    and sometimes scrolls right off the screen.  For example a error on a
    "docker run" command is very difficult to diagnose.

    Finally erros should always exit with a non 0 exit code, if the user
    makes a CLI error.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Super Secrets Patch

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
 New implementation of /run support

    This mounts a /run tmpfs into the container, with the initial contents
    copies from the /run in the base image, unless NoRunFs is set in the
    HostConfig.

    Additionally NoRunFs is always set during a docker build, which means
    any setup of /run in a Dockerfile is saved in the image to be copied
    into the final /run tmpfs when a container is started.

    Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Allow docker import -m to specify the COMMENT field.

This will allow a user to save COMMENT data into an image, which
can later be retrieved using:

docker inspect IMAGEID

Copied the test example and some description data from Erik Hollensbe
<github@hollensbe.org>

Add support to allow docker import to populate Comment field

This patch allows base image builder to populate docker images with more comments then
just imported from FOOBAR.  This matches the docker commit -m functionality.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Save "META" field in Dockerfile into image content.

This will allow a user to save META data into an image, which
can later be retrieved using:

docker inspect IMAGEID

I have copied this from the "Comment" handling in docker images.

We want to be able to add json data to an image to describe the image, and
then be able to use other tools to look at this data, to be able to do
security checks based on this data.

We are thinking about adding version names, Perhaps listing the content of the dockerfile.
Descriptions of where the code came from etc.

One option is to call this flag Meta, another would be to call it Vendor.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Record the content of the dockerfile in the Meta Data

This will allow someone looking at an image to see the Dockerfile used to build
it.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)