Add warden: manager for ephemeral Linux containers

Change-Id: I3913e5be6392ffec183e9eb58d933988c15deafb
warden: More prep work to support both LXC and insecure

Change-Id: I886d7de9244bfd60ba8c2dea72f5857d3c1d4e73
warden: Implement insecure handler

The insecure handler does not try to jail the container in any way.
Scripts run in insecure containers have access to the full file system,
network interfaces, process table, etc. They are run as the user that
runs warden.

Change-Id: Ia5eeed8fb0df1f67750eebe1cd69cf86e7c552f7
warden: Support spawn/link semantics

This enables client connections to go away without killing the scripts
that it started. Clients can reconnect and re-attach to the scripts they
started to wait until completion, or to reap the status when the script
has already exited.

Change-Id: Id9b89f241d9bba89b5ea211b5737d957ca48c62a
warden: Use em-posix-spawn

Change-Id: I07bb2bed927049ca9cfecaaf007ef43d84314c61
warden: Make aufs check whiteouts on ro branches

This makes deleted files on non-root branches cascade through to the
lowest one. See the aufs man page, section on "Branch Syntax" for more
information on this matter.

Change-Id: Ie65407873c24587434fefbe902fed90b6860dc47
warden: Add script to stop and remove all containers

Change-Id: I28fc17d2e627116fc4b4413d3dd622c44f36c857
Add script to close inherited fds before lxc-start is called

lxc-start will abort if it inherits any file descriptors. We avoid
this by first closing fds and then exec'ing lxc-start.

Test plan:
- Container creation works

Change-Id: If436db238cfceb787c3167db8310df54f9d79bde
Add uid pool to LXC container

This is in preparation for adding quota support to the LXC container.
If a uid pool is supplied the LXC container will now attempt to acquire a
uid for each container that is created. A WardenError will be raised in the
event that a uid cannot be acquired. Note that the uid is the same both inside
and outside the container in order to facilitate enforcement of disk quotas.

Test plan:
- All existing tests pass.
- New tests pass.

Change-Id: Ic509c0cd9e40275f92207d35bb9bfb943d700026
warden: Make container configuration as minimal as possible

Change-Id: I1e4c8104bdd05bccfe9242ec9946787b31b1fbf8
warden: Run scripts inside container through shell

Previously, EM executed scripts in the context of a container by
connecting to a Unix socket itself. Because warden shells out for every
other task it does, executing scripts inside a container is now also
done by shelling out. Making this work right using existing tools
proved to be cumbersome, so I included a small C program that either
listens or connects to a Unix socket.

Change-Id: I7f6df9786b9631aff2bd57cc1d20c8d337415bf0
warden: Rework bootstrap process for containers

Change-Id: Ied4afef02732d79931252ba72f1542d00d627afd
warden: Call setuid before running scripts inside container

Change-Id: I3beeaab7fd19114ca3e75ee3122493e85dd2eb6d
warden: Support outbound network traffic filtering

This adds support for black/whitelisting of networks. These
configuration parameters are applied as follows:

* If destination IP is whitelisted => allow
* If destination IP is blacklisted => deny
* Default => allow

To use a deny-by-default policy, the 0.0.0.0/0 network may be added as a
blacklisted and all traffic that is not explicitly allowed is denied.

Change-Id: I3b610e15d02dc95acce04d27902b172afa27c4d3
Split container teardown into two stages

This is prep work for adding a "stasis" state to containers. We
split stop.sh into two stages: one that kills all processes, and
another that finishes container destruction (unmounting unions,
file removal, etc).

Test plan:
- All existing unit tests pass

Change-Id: I2829f6dc2a6be3370656bc7e43139b1d6f630418
warden: Remove lxc-tools dependency

The work that needs to be done to create a namespaced process is so
little that we can do it ourselves. Apart from removing a dependency,
this also gives more freedom in configuring cgroups and better startup
performance.

Change-Id: Ifba18027f5f7d4163b6a180db2ef37678316cd00
warden: Misc cleanup for container setup

Change-Id: I79844ab2b7fb7a075975eb438aa1d73b2e2b56d8
warden: Rework container management scripts

Change-Id: I3588b0a3cee13817903d8c2e103734b8ff55cf6d
warden: Make setup use same Ubuntu mirror as host

Change-Id: I5d4ca246208b0c57d8ed1cb1598f35e409f259cf
[warden] Allow base chroot specification during setup

This adds the ability to specify a specific directory to install the chroot in,
as well as flags to disable debootstrap and apt setup.

Test plan:
- rake setup && rake spec

Change-Id: I8064aa2b757911f3241da26337a40ff1fb1d254b