Adds a tx_queuelen setting for veth in the network configuration and defaults it to 0.

Signed-off-by: Ye Yin <hustcat@gmail.com>
Do not check if SELinux is enabled on lowlevel calls to set processlabel

docker exec changes the mount namespace which fools selinux bindings
into thinking SELinux is disabled.  Bindings should just check if
a label is passed in and attempt to use it.  Docker will not call these
functions with a label if SELinux is disabled.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Merge pull request #222 from rhatdan/exec

Do not check if SELinux is enabled on lowlevel calls to set processlabel
Set apparmor profile in execin

The set of the apparmor profile for the setns codepath was missing.
Selinux was being called but apparmor was forgotten.  This was causing
no profiles to be applied to the extra process spawn inside an existing
container.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #224 from crosbymichael/set-apparmor-execin

Set apparmor profile in execin
xattr: Disallow build on non linux platforms

Signed-off-by: Harshavardhana <fharshav@redhat.com>
Create an ApplyDevices call.

For our work on adding dynamic device support to Docker we needed to be
able to call this to update the list of allowed devices.  This works for
both systemd and fs based cgroups implementations.

Co-Authored-By: Chris Alfonso <calfonso@redhat.com> (github: calfonso)
Docker-DCO-1.1-Signed-off-by: Ian Main <imain@redhat.com> (github: imain)
Merge pull request #219 from harshavardhana/xattr_build

xattr: Disallow build on non linux platforms
Merge pull request #221 from mrunalp/txq

Adds a tx_queuelen setting for veth in the network configuration
Merge pull request #209 from imain/publicjoin

Make joinDevices public.
Move the download of docker to top of dockerfile

We need to do this because it's a big dep.  While we remove this
recursive dep this is the best that we can do right now.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Add integration test pkg

This integration pkg adds a framework for writing integration tests
aginst the libcontainer APIs

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #226 from crosbymichael/add-tests

Add integration test framework
Adds support for Setuid/Setgid calls that has been removed from
go HEAD and won't be available in go 1.4.

Docker-DCO-1.1-Signed-off-by: Mrunal Patel <mrunalp@gmail.com> (github: mrunalp)
Merge pull request #228 from mrunalp/support_removed_syscalls

Adds support for Setuid/Setgid calls that has been removed from go 1.4
Allow IPC namespace to be shared between containers or with the host

Some workloads rely on IPC for communications with other processes.  We
would like to split workloads between two container but still allow them
to communicate though shared IPC.

This patch allows us to mimic the --net code to allow --ipc=host to not split off
the IPC Namespace.  ipc=container:CONTAINERID to share ipc between containers

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)