Services v2 (ip-per-service)

DO NOT COMMIT.  Needs test updates and a new e2e test.  Some FIXMEs still.  95% complete.

Add support for IP-per-service behavior.  This creates virtual IP addresses for each service, and uses iptables to route traffic "magically".

The first few commits are relatively independent, and could be extracted to different PRs, if you feel like making me suffer.

See #1107 for background.
See, that's what I thought, but I tried it.

thockin@thockin-glaptop:~$ sudo docker run -d --name db -p 8001:8002 -p 8003:8004 ubuntu sleep 600
f67a0d4d99e24c02756c4259f07a617231b67e4af2d74a5d269355581a05d6af

thockin@thockin-glaptop:~$ sudo docker run -ti --link db:db ubuntu bash
root@9de6633e68fa:/# set | grep DB
DB_NAME=/angry_bohr/db
DB_PORT=tcp://172.17.0.14:8002
DB_PORT_8002_TCP=tcp://172.17.0.14:8002
DB_PORT_8002_TCP_ADDR=172.17.0.14
DB_PORT_8002_TCP_PORT=8002
DB_PORT_8002_TCP_PROTO=tcp
DB_PORT_8004_TCP=tcp://172.17.0.14:8004
DB_PORT_8004_TCP_ADDR=172.17.0.14
DB_PORT_8004_TCP_PORT=8004
DB_PORT_8004_TCP_PROTO=tcp


Note that the only ports exposed are container ports, which makes total sense - why bounce through a host port for container-to-container comms?

Anyway, this is way OT for this PR :)