devmapper: Maks createSnapDevice a function, not a method

No idea why this was a method. Maybe a cut and paste bug.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
devmapper: Move error detection to devmapper.go

This moves the EBUSY detection to devmapper.go, and then returns
a real ErrBusy that deviceset uses.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
devmapper: Simplify thin pool device id allocation

Instead of globally keeping track of the free device ids we just
start from 0 each run and handle EEXIST error and try the next one.

This way we don't need any global state for the device ids, which
means we can read device metadata lazily. This is important for
multi-process use of the backend.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
devmapper: Store metadata in one file per device

This allows multiple instances of the backend in different containers
to access devices (although generally only one can modify/create them).

Any old metadata is converted on the first run.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
docker rmi -f works with stopped containers + revamped error messages

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
update message

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Update hack/dind to match the rest of our scripts

No functional changes here, just coding style and maintainability.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
check if the daemon is run as root on startup

This commit makes Docker throw an error if the daemon isn't started as
root.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
update AUTHORS

Docker-DCO-1.1-Signed-off-by: Bryan Matsuo <bryan.matsuo@gmail.com> (github: bmatsuo)
Add notes about git commit messages

This improves readability of commits a lot and is easy to
follow. I think most people follow those rules already. They are based
on http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html

Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
FIXES #5398: pkg/graphdb build only dependent on cgo tag

Docker-DCO-1.1-Signed-off-by: Bryan Matsuo <bryan.matsuo@gmail.com> (github: bmatsuo)
Make Jerome Petazzoni a maintainer for dind

In the spirit of getting more contributors to maintain their
components.. I nominate @jpetazzo ot maintain dind (he's the original
author).

@jpetazzo I don't expect this to be too much load, but it's a good and
symbolic start :)

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Mount /proc and /sys read-only, except in privileged containers.

It has been pointed out that some files in /proc and /sys can be used
to break out of containers. However, if those filesystems are mounted
read-only, most of the known exploits are mitigated, since they rely
on writing some file in those filesystems.

This does not replace security modules (like SELinux or AppArmor), it
is just another layer of security. Likewise, it doesn't mean that the
other mitigations (shadowing parts of /proc or /sys with bind mounts)
are useless. Those measures are still useful. As such, the shadowing
of /proc/kcore is still enabled with both LXC and native drivers.

Special care has to be taken with /proc/1/attr, which still needs to
be mounted read-write in order to enable the AppArmor profile. It is
bind-mounted from a private read-write mount of procfs.

All that enforcement is done in dockerinit. The code doing the real
work is in libcontainer. The init function for the LXC driver calls
the function from libcontainer to avoid code duplication.

Docker-DCO-1.1-Signed-off-by: Jérôme Petazzoni <jerome@docker.com> (github: jpetazzo)
Update to enable cross compile
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Update restrictions for better handling of mounts

This also cleans up some of the left over restriction paths code from
before.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Mount attr and task as rw for selinux support
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Fix /proc/kcore mount of /dev/null
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Adding Rohit Jnagal and Victor Marmol to pkg/cgroups maintainers.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
Adding Rohit Jnagal and Victor Marmol to pkg/libcontainer maintainers.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
remove when httputil.NewClientConn when not in hijack

Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)