Fix invalid fd race

Sometimes I was getting:

2014/06/13 13:47:24 finalize namespace drop bounding set read /proc/1/status: bad file descriptor

This happens when applying the capabilities, and the code that
reads the current caps opens /proc/1/status and then reads some data from it.
But during this it gets a EBADFD error.

The problem is that FinalizeNamespace() closes all FDs before applying
the caps, and if a GC then happens after /proc/1/status is opened but
before reading from the fd, then an old os.File finalizer may close the
already closed-and-reused fd, wreaking havoc.

We fix this by instead of closing the FDs we mark them close-on-exec
which guarantees that they will be closed when we do the final
exec into the container.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Use PATH_MAX as buffer size for buffers containing paths.
Docker-DCO-1.1-Signed-off-by: Mrunal Patel <mrunalp@gmail.com> (github: mrunalp)
Merge pull request #21 from mrunalp/use_path_max

Use PATH_MAX as buffer size for buffers containing paths.
Ignore isnotexist errors for restrict paths

Handle the error when remounting certain files and paths as readonly if
they do not exist.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #17 from alexlarsson/fix-close-race

Fix invalid fd race
Use lstat to check device symlinks
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #26 from crosbymichael/device-copy-links

Use lstat to check device symlinks
Merge pull request #24 from crosbymichael/is-not-exist-errors

Ignore isnotexist errors for restrict paths
Revert "Mount cgroups in the container"

This reverts commit b441dfa7293dfff89efb81800ba968ed73f8f0d1.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #30 from crosbymichael/revert-mount-cgroup

Revert "Mount cgroups in the container"
Update sample json file for quick testing
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #31 from crosbymichael/update-sample-json

Update sample json file for quick testing
Update travis to run unit tests

Also fix container_tests.go
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #32 from crosbymichael/update-travis

Update travis to run unit tests
Require two LGTMs for non-maintainer changes.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
Merge pull request #29 from vmarmol/fixes

Require two LGTMs for non-maintainer changes.
Add option parsing to nsenter and enable specifying commands with arguments.
Docker-DCO-1.1-Signed-off-by: Mrunal Patel <mrunalp@gmail.com> (github: mrunalp)
Merge pull request #27 from mrunalp/dev/nsenter_flags

Add option parsing to nsenter and enable specifying commands with arguments
CpuStats.CpuUsage includes TotalUsage

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
Replacing docker-dev with libcontainer mailing list.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)