Remove hairpin nat on veth create

Writing to this file within /sys is casuing some issues for
older kernels, specifically with 2.6.xx, where the write is failing
because /sys is becoming ro.  We will continue to work on the 2.6 issues
but for the time being we cannot ship this with it enabled as it's
breaking all container runs.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #274 from crosbymichael/revert-hairpin-nat

Remove hairpin nat on veth create
Add call to label to allow it to tell kernel how to label created files

SELinux supports a call that tells the kernel, from this point onward
create content with this label.  If you pass "", the kernel will
go back to the default.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
netlink: add NetworkSetTxQueueLen to set qlen

Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
Merge pull request #275 from rhatdan/selinux

Add call to label to allow it to tell kernel how to label created files
Merge pull request #276 from unclejack/add_txq

netlink: add NetworkSetTxQueueLen to set qlen
Add support for ppc64, ppc64le, s390x

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
Merge pull request #277 from yoheiueda/support-for-ppc64-ppc64le-s390x

Add support for ppc64, ppc64le, s390x
Add support for setting rlimit for contianer

Adds a new item to the config struct []*Rlimit
Rlimit takes a type (ie, syscall.RLIMIT_NOFILE) and the hard/soft limit
(As max/cur)

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Merge pull request #280 from cpuguy83/add_rlimit_support

Add support for setting rlimit for contianer
Add container spec

This document specifies the current container specification with all the
underlying setup and configuration that goes into making a container.
This is the v1 spec that is today but allows for flexability when we
introduce more features such as seccomp default profiles and more.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #282 from crosbymichael/spec

Add container spec
Introduce support for syscall filtering in containers #237

This PR introduces the ability to filter system calls on a per-container basis on Linux, using libseccomp to support multiple architectures.

This adds another layer of security between containers and the kernel. System calls which are unnecessary in a container or problematic from a security perspective can be restricted to prevent their use. Most of the truly problematic syscalls are already restricted by dropping capabilities; this adds an additional, finer-grained layer of protection.

There's a similar feature present in LXC already, with the significant difference that LXC uses a whitelist of system calls, whereas these patches use a blacklist. The blacklist approach ensures no difference in functionality to clients not explicitly aware of seccomp support (the restricted syscalls list in the container config is left empty, and the seccomp init function exits without taking action).

This PR adds a vendored library dependency (Go bindings for libseccomp) and a build dependency on libseccomp >= v2.1. The actual changes to libcontainer are fairly minimal, most of the delta is in the libseccomp bindings.

Presently missing: integration tests, documentation

Docker-DCO-1.1-Signed-off-by: Matt Heon <mheon@redhat.com> (github: mheon)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)

Conflicts:
	config.go