Add system.SetKeepCaps and system.ClearKeepCaps

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
SETUID/SETGID not required for changing user

It is no longer necessary to pass "SETUID" or "SETGID" capabilities to
the container when a "user" is specified in the config.

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
Merge pull request #6083 from bernerdschaefer/nsinit-drop-capabilities-after-changing-user

SETUID/SETGID not required for changing user
Handle EBUSY on remount

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
updated documentation for mentioning images vs containers

Docker-DCO-1.1-Signed-off-by: Robin Speekenbrink <robin@kingsquare.nl> (github: fruitl00p)

rebased by

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Merge pull request #6099 from SvenDowideit/pr_out_updated_documentation_for_mentioning_images_vs_containers

updated documentation for mentioning images vs containers
docs/installation/google: update to use container-vm images

Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)

rebased by

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Merge pull request #6100 from SvenDowideit/pr_out_docs_installation_google_update_to_use_container_vm_images

docs/installation/google: update to use container-vm images
* do not consider iptables' output an error in case of xtables lock
Docker-DCO-1.1-Signed-off-by: Giuseppe Mazzotta <gdm85@users.noreply.github.com> (github: gdm85)
Add ErrPrerequisites to improve misleading errors

There are two cases where we can't use a graphdriver:

1) the graphdriver itself isn't supported by the system
2) the graphdriver is supported by some configuration/prerequisites are
missing

This introduces a new error for the 2) case and uses it when trying to
run docker with btrfs backend on a non-btrfs filesystem.

Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
Merge pull request #6098 from crosbymichael/retry-mount

Handle EBUSY on remount
Merge pull request #6106 from discordianfish/improve-error-btrfs-on-non-btrfs

Add ErrPrerequisites to improve misleading errors
Merge pull request #6105 from gdm85/master

Do not consider iptables' output an error in case of xtables lock