Preserve extended attributes and acls on archlinux build

Failure to do this means that file capabilites are not preserved in the image.
Ping fails to work as a non-root user if cap_net_raw is capability is not set

Signed-off-by: Dan Griffin <dgriffin@peer1.com>
Fix apparent copy paste mistake

The note under the RUN header refers to the CMD instruction. It should refer to the RUN instruction instead.

Signed-off-by: Huu Nguyen <whoshuu@gmail.com>
Remove out-of-context code block

Signed-off-by: Huu Nguyen <whoshuu@gmail.com>
Grammatical mistake in docs

Change `The team can now use this image by run their own containers.` to `The team can now use this image by running their own containers.`
Remove extra line feed typo

The removed extra line feed broke the paragraph at https://docs.docker.com/userguide/dockerizing/
Edits and refinements to 1.3.1 release notes.

Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Added missing item from Changelog

Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Support hairpin NAT

This re-applies commit b39d02b with additional iptables rules to solve the issue with containers routing back into themselves.

The previous issue with this attempt was that the DNAT rule would send traffic back into the container it came from. When this happens you have 2 issues.
1) reverse path filtering. The container is going to see the traffic coming in from the outside and it's going to have a source address of itself. So reverse path filtering will kick in and drop the packet.
2) direct return mismatch. Assuming you turned reverse path filtering off, when the packet comes back in, it's goign to have a source address of itself, thus when the reply traffic is sent, it's going to have a source address of itself. But the original packet was sent to the host IP address, so the traffic will be dropped because it's coming from an address which the original traffic was not sent to (and likely with an incorrect port as well).

The solution to this is to masquerade the traffic when it gets routed back into the origin container. However for this to work you need to enable hairpin mode on the bridge port, otherwise the kernel will just drop the traffic.
The hairpin mode set is part of libcontainer, while the MASQ change is part of docker.

This reverts commit 63c303eecdbaf4dc7967fd51b82cd447c778cecc.

Docker-DCO-1.1-Signed-off-by: Patrick Hemmer <patrick.hemmer@gmail.com> (github: phemmer)
registry: don't iterate through certs

the golang tls.Conn does a fine job of that.
http://golang.org/src/pkg/crypto/tls/handshake_client.go?#L334

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Merge pull request #8404 from danjpgriffin/master

Preserve extended attributes and acls on archlinux build
Updated footer to match rest of site

Signed-off-by: Nathan Hsieh <hsieh.nathan@gmail.com>
made getDefaultNetworkMtu private

Signed-off-by: Blake Geno <blakegeno@gmail.com>
Merge pull request #8892 from fredlf/relnotes-edit

Edits and refinements to 1.3.1 release notes.
Add a better error message when we get an unknown http issue

Closes #5184

Signed-off-by: Doug Davis <dug@us.ibm.com>
Merge pull request #8345 from duglin/Issue5184

Add a better error message when we get an unknown http issue
Merge pull request #8900 from nhsiehgit/updatefooter

Updatefooter
unify `–`(en dash) to `-` when specifying options

Signed-off-by: Xie Shi <georgexsh@gmail.com>
Merge pull request #8908 from medimatrix/patch-1

Grammatical mistake in docs
Merge pull request #8915 from gDD/patch-1

Remove extra line feed typo
Merge pull request #8577 from vbatts/vbatts-registry_certs

registry: don't iterate through certs