Fix invalid fd race

Sometimes I was getting:

2014/06/13 13:47:24 finalize namespace drop bounding set read /proc/1/status: bad file descriptor

This happens when applying the capabilities, and the code that
reads the current caps opens /proc/1/status and then reads some data from it.
But during this it gets a EBADFD error.

The problem is that FinalizeNamespace() closes all FDs before applying
the caps, and if a GC then happens after /proc/1/status is opened but
before reading from the fd, then an old os.File finalizer may close the
already closed-and-reused fd, wreaking havoc.

We fix this by instead of closing the FDs we mark them close-on-exec
which guarantees that they will be closed when we do the final
exec into the container.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Ignore isnotexist errors for restrict paths

Handle the error when remounting certain files and paths as readonly if
they do not exist.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #17 from alexlarsson/fix-close-race

Fix invalid fd race
Use lstat to check device symlinks
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #26 from crosbymichael/device-copy-links

Use lstat to check device symlinks
Merge pull request #24 from crosbymichael/is-not-exist-errors

Ignore isnotexist errors for restrict paths
Revert "Mount cgroups in the container"

This reverts commit b441dfa7293dfff89efb81800ba968ed73f8f0d1.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #30 from crosbymichael/revert-mount-cgroup

Revert "Mount cgroups in the container"
Update sample json file for quick testing
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #31 from crosbymichael/update-sample-json

Update sample json file for quick testing
Update travis to run unit tests

Also fix container_tests.go
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #32 from crosbymichael/update-travis

Update travis to run unit tests
Require two LGTMs for non-maintainer changes.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
Merge pull request #29 from vmarmol/fixes

Require two LGTMs for non-maintainer changes.
Add option parsing to nsenter and enable specifying commands with arguments.
Docker-DCO-1.1-Signed-off-by: Mrunal Patel <mrunalp@gmail.com> (github: mrunalp)
Merge pull request #27 from mrunalp/dev/nsenter_flags

Add option parsing to nsenter and enable specifying commands with arguments
CpuStats.CpuUsage includes TotalUsage

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
Replacing docker-dev with libcontainer mailing list.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
Merge pull request #34 from bernerdschaefer/cgroup-stats-total-cpu-usage

CpuStats.CpuUsage includes TotalUsage
Merge pull request #35 from vmarmol/fixes

Replacing docker-dev with libcontainer mailing list.