Add overlayfs graph backend

This backend uses the overlayfs union filesystem for containers
plus hard link file sharing for images.

Each container/image can have a "root" subdirectory which is a plain
filesystem hierarchy, or they can use overlayfs.

If they use overlayfs there is a "upper" directory and a "lower-id"
file, as well as "merged" and "work" directories. The "upper"
directory has the upper layer of the overlay, and "lower-id" contains
the id of the parent whose "root" directory shall be used as the lower
layer in the overlay. The overlay itself is mounted in the "merged"
directory, and the "work" dir is needed for overlayfs to work.

When a overlay layer is created there are two cases, either the
parent has a "root" dir, then we start out with a empty "upper"
directory overlaid on the parents root. This is typically the
case with the init layer of a container which is based on an image.
If there is no "root" in the parent, we inherit the lower-id from
the parent and start by making a copy if the parents "upper" dir.
This is typically the case for a container layer which copies
its parent -init upper layer.

Additionally we also have a custom implementation of ApplyLayer
which makes a recursive copy of the parent "root" layer using
hardlinks to share file data, and then applies the layer on top
of that. This means all chile images share file (but not directory)
data with the parent.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
pkg/mount: add more sharesubtree options

Signed-off-by: Vincent Batts <vbatts@redhat.com>
pkg/mount: testing for linux sharedsubtree mounts

* shared
* shared/slave
* unbindable
* private

Signed-off-by: Vincent Batts <vbatts@redhat.com>
pkg/mount: adding fields supported by freebsd

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Finalize TarSum Version 1 w/ refactor

The current Dev version of TarSum includes hashing of extended
file attributes and omits inclusion of modified time headers.

I refactored the logic around the version differences to make it
more clear that the difference between versions is in how tar
headers are selected and ordered.

TarSum Version 1 is now declared with the new Dev version continuing
to track it.

Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
Compute TarSum on storage of image layer content

Now, newly created/imported layers will have the checksum of
the layer diff computed and stored in the image json file.

For now, it is not an error if the computed checksum does not
match an existing checksum, only a warning message is logged. The
eventual goal is to use the checksums in the image JSON to verify
the integrity of the layer contents when doing `docker load` or
`docker pull`, and error out if it does not match.

Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
Make test-unit runnable without parallel

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
btrfs: information for the information gods

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Export envvars necessary for unit-test

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
Improve "security reports" section in contribution docs.

Signed-off-by: Solomon Hykes <solomon@docker.com>
In contribution docs, emphasize that bug reports are appreciated!

Signed-off-by: Solomon Hykes <solomon@docker.com>
Move GOVERNANCE.md to hack/

Signed-off-by: Solomon Hykes <solomon@docker.com>
Move 'hack' to the less confusing 'project'

We might want to break it up into smaller pieces (eg. tools in one
place, documents in another) but let's worry about that later.

Signed-off-by: Solomon Hykes <solomon@docker.com>
Don't loose precision when parsing image size on 32 bit machines. Presumably fixes #8979.

Signed-off-by: Recursive Madman <recursive.madman@gmx.de>
LINKED CONTAINER ID PASSED TO LXC

This passed the --net=container:CONTINER_ID to lxc-start as --share-net
Docker-DCO-1.1-Signed-off-by: Abin Shahab <ashahab@altiscale.com> (github: ashahab-altiscale)
handle GET redirects

Signed-off-by: Victor Vieux <vieux@docker.com>
fix unix socket

Signed-off-by: Victor Vieux <vieux@docker.com>
Allow IPC namespace to be shared between containers or with the host

Some workloads rely on IPC for communications with other processes.  We
would like to split workloads between two container but still allow them
to communicate though shared IPC.

This patch mimics the --net code to allow --ipc=host to not split off
the IPC Namespace.  ipc=container:CONTAINERID to share ipc between containers

If you share IPC between containers, then you need to make sure SELinux labels
match.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Update CONTRIBUTING to reflect new PR-docs process.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
registry: refactor registry.IsSecure calls into registry.NewEndpoint

Signed-off-by: Tibor Vass <teabee89@gmail.com>