Support hairpin NAT without going through docker server

Hairpin NAT is currently done by passing through the docker server.  If
two containers on the same box try to access each other through exposed
ports and using the host IP the current iptables rules will not match the
DNAT and thus the traffic goes to 'docker -d'

This change drops the restriction that DNAT traffic must not originate
from docker0.  It should be safe to drop this restriction because the
DOCKER chain is already gated by jumps that check for the destination
address to be a local address.

Docker-DCO-1.1-Signed-off-by: Darren Shepherd <darren.s.shepherd@gmail.com> (github: ibuildthecloud)
Resync the DCO text with upstream at http://developercertificate.org/

```
Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.
```

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Add authenticated TLS support for API

Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
Add proper support for relative WORKDIR instructions

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Disable automatic killing of containers when docker stop fails

Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
add softlayer installation instructions

Docker-DCO-1.1-Signed-off-by: Andrea Turli <andrea.turli@gmail.com> (github: andreaturli)
address comments from @jamtur01

Docker-DCO-1.1-Signed-off-by: Andrea Turli <andrea.turli@gmail.com> (github: andreaturli)
add time since exit in docker ps

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Improve WORKDIR test to cover more edge cases

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Add some documentation about relative WORKDIR values

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Only unshare the mount namespace for execin

Fixes #4728
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
graphdriver: build tags

Enable build tags for all the graphdrivers to be excludable.

As an example:
```
$ go build
$ ls -l docker
-rwxr-xr-x 1 vbatts vbatts 18400158 Mar 14 14:22 docker*
$ go build -tags "exclude_graphdriver_aufs exclude_graphdriver_vfs exclude_graphdriver_devicemapper"
$ ls -l docker
-rwxr-xr-x 1 vbatts vbatts 17467068 Mar 14 14:22 docker*
```

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
runtime: no build tags for vfs driver

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Merge pull request #4731 from crosbymichael/fix-execin

Only unshare the mount namespace for execin
add env hint

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
devmapper: Increase timeout in waitClose to 10sec

As reported in https://github.com/dotcloud/docker/issues/4389 we're
currently seeing timeouts in waitClose on some systems. We already
bumped the timeout in waitRemove() in
https://github.com/dotcloud/docker/issues/4504.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Update ubuntulinux.rst

Adding the Docker repository key fails if port 11371 not open. This would probably work for more people.
Merge pull request #4738 from SvenDowideit/mention-env-scrubbing

add env hint
Merge pull request #4739 from alexlarsson/dm-timeout

devmapper: Increase timeout in waitClose to 10sec
Merge pull request #4674 from vbatts/vbatts-graphdriver_build_tags

graphdriver: build tags