mount of /.dockerinit is not needed for native driver, so move it into lxc driver

Docker-DCO-1.1-Signed-off-by: Albert Zhang <zhgwenming@gmail.com> (github: zhgwenming)
Add support for client certificates for registries

This lets you specify custom client TLS certificates and CA root for a
specific registry hostname. Docker will then verify the registry
against the CA and present the client cert when talking to that
registry.  This allows the registry to verify that the client has a
proper key, indicating that the client is allowed to access the
images.

A custom cert is configured by creating a directory in
/etc/docker/certs.d with the same name as the registry hostname. Inside
this directory all *.crt files are added as CA Roots (if none exists,
the system default is used) and pair of files <filename>.key and
<filename>.cert indicate a custom certificate to present to the registry.

If there are multiple certificates each one will be tried in
alphabetical order, proceeding to the next if we get a 403 of 5xx
response.

So, an example setup would be:
/etc/docker/certs.d/
└── localhost
    ├── client.cert
    ├── client.key
    └── localhost.crt

A simple way to test this setup is to use an apache server to host a
registry. Just copy a registry tree into the apache root, here is an
example one containing the busybox image:
  http://people.gnome.org/~alexl/v1.tar.gz

Then add this conf file as /etc/httpd/conf.d/registry.conf:

 # This must be in the root context, otherwise it causes a re-negotiation
 # which is not supported by the tls implementation in go
 SSLVerifyClient optional_no_ca

 <Location /v1>
 Action cert-protected /cgi-bin/cert.cgi
 SetHandler cert-protected

 Header set x-docker-registry-version "0.6.2"
 SetEnvIf Host (.*) custom_host=$1
 Header set X-Docker-Endpoints "%{custom_host}e"
 </Location>

And this as /var/www/cgi-bin/cert.cgi

 #!/bin/bash
 if [ "$HTTPS" != "on" ]; then
     echo "Status: 403 Not using SSL"
     echo "x-docker-registry-version: 0.6.2"
     echo
     exit 0
 fi
 if [ "$SSL_CLIENT_VERIFY" == "NONE" ]; then
     echo "Status: 403 Client certificate invalid"
     echo "x-docker-registry-version: 0.6.2"
     echo
     exit 0
 fi
 echo "Content-length: $(stat --printf='%s' $PATH_TRANSLATED)"
 echo "x-docker-registry-version: 0.6.2"
 echo "X-Docker-Endpoints: $SERVER_NAME"
 echo "X-Docker-Size: 0"
 echo

 cat $PATH_TRANSLATED

This will return 403 for all accessed to /v1 unless *any* client cert
is presented. Obviously a real implementation would verify more details
about the certificate.

Example client certs can be generated with:

openssl genrsa -out client.key 1024
openssl req -new -x509 -text -key client.key -out client.cert

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Update bash completion for "docker run --link" and "docker run -v" to complete on running containers and the local filesystem respectively

Also, add completion for "docker run -a" ("stdin", "stdout", and "stderr"), "docker run --env-file" (local filesystem), and some other minor code style tweaks.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Standardize "curl" arguments across the repo to be or include "-sSL"

- https://botbot.me/freenode/docker-dev/msg/17315692/
- https://botbot.me/freenode/docker-dev/msg/17315994/

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Add repo/tag parsing on the daemon for pull and import

Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
removing an extraneous space

Docker-DCO-1.1-Signed-off-by: Zac Dover <zdover@redhat.com> (github: zdover23)
devmapper: revert the default dm-thin-pool blocksize back to 64K

Commit 09ee269d ("devmapper: Add option for specifying the thin pool
blocksize") also switched the default dm-thin-pool blocksize from 64K to
512K.  That change unfortunately breaks the activation of dm-thin-pool
devices that were previously created using a 64K blocksize.  Here is an
example of the dm-thin-pool activation failure users may experience:

 device-mapper: thin: 253:4: pool target (204800 blocks) too small: expected 1638400
 device-mapper: table: 253:4: thin-pool: preresume failed, error = -22

The reason for this is docker is passing 512K as the blocksize for a
dm-thin-pool that was previously created using a 64K blocksize.  Docker
doesn't record the blocksize the is used when it creates a dm-thin-pool.
Until now it never had a need to do so because the blocksize was always
hardcoded.  The dm-thin-pool blocksize must be the same every time a
dm-thin-pool is activated.

As a stop-gap fix, revert to using 64K for the default blocksize.

But we do need a proper fix for this now that 'dm.blocksize' is exposed
as a proper storage option.  One possible fix would be to record the
blocksize for each dm-thin-pool that docker creates and to pass that
recorded blocksize down in the dmsetup table load each time the
dm-thin-pool is activated (this would be comparable to what lvm2 does).

Docker-DCO-1.1-Signed-off-by: Mike Snitzer <snitzer@redhat.com> (github: snitm)
Add support for IPv6 addresses in --dns parameters.

Docker-DCO-1.1-Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com> (github: adelton)
add check on docker run

Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
update for consistency

Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Revert "removed expect from mkimage-arch since it was not working"

This reverts commit 962e1186f9a0a43344e19dcf70bac159f0eafb4e.

Conflicts:
	contrib/mkimage-arch.sh

Docker-DCO-1.1-Signed-off-by: Zoltan Tombol <zoltan.tombol@gmail.com> (github: ztombol)
Fix expect script in mkimage-arch

Docker-DCO-1.1-Signed-off-by: Zoltan Tombol <zoltan.tombol@gmail.com> (github: ztombol)
bump api to 1.14 & update docs

Docker-DCO-1.1-Signed-off-by: Adrien Folie <folie.adrien@gmail.com> (github: folieadrien)
Merge pull request #6920 from vieux/pr_6408

Add support for IPv6 addresses in --dns parameters.
Merge pull request #6939 from snitm/thinp-blocksize-fix

devmapper: revert the default dm-thin-pool blocksize back to 64K
Add --device flag to allow additional host devices in container

We add a --device flag which can be used like:

 docker run --device /dev/sda:/dev/xvda:rwm ubuntu /bin/bash

To allow the container to have read write permissions to access the host's /dev/sda via a node named /dev/xvda in the container.

Note: Much of this code was written by Dinesh Subhraveti dineshs@altiscale.com (github: dineshs-altiscale) and so he deserves a ton of credit.

Docker-DCO-1.1-Signed-off-by: Timothy <timothyhobbs@seznam.cz> (github: timthelion)
Added bitbucket hook info and warning re: validating accounts.

Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
add FSETID back to the caps whitelist

Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Merge pull request #6961 from crosbymichael/devices-flag

Add --device flag to allow additional host devices in container
Merge pull request #6209 from zdover23/03_Jun_2014

BZ#1104401 - correcting flags in docker-commit