deps
always permit mknod

you have to be root do this anyway, i.e. the process being run privileged.
mknod is the least of our security concerns in that case.

also remove all remaining references to allow_nested_warden
support for creating containers from docker images

on container creation, specify image:<repo name>. the image will be pulled
down from the docker registry if not present, and mounted using Docker's own
graph drivers.

this does not include e.g. baked-in 'run' commands from a Dockerfile: just the
resulting base image.
deps
introduce rootfs provider interface

This extracts all rootfs logic from the container pool. A Docker RootFS
provider is introduced, which delegates to the Overlay RootFS provider if its
image doesn't match the docker scheme.

One downside: container mount points are now in the host's mount namespace,
which is noisier but shouldn't be any less secure.

Removed clear.sh and fixed up DestroyContainers to go through the API;
clear.sh did not appropriately deal with the container's mount points, and
would just destroy the container and leave them around.
rootfs provider is identified by url-format string

tricky bit here is remembering the provider to use when destroying/pruning the
container. snapshots cannot be relied upon because they are written,
optionally, on shut down. instead, a file is written after the container is
created, and creation fails if creating that file fails.
fix hang in measurements suite

switch to before/after-suite, and only call .TearDown (not .Stop)
Merge pull request #3 from cloudfoundry-incubator/docker-images

Support for docker rootfs provider