Use --privileged in Makefile

We need --privileged for apparmor based systems until we have an
apparmor specific flag to set the profile to unconfined.

Signed-off-by: Michael Crosby <michael@docker.com>
Merge pull request #162 from rhatdan/unreserve

Allow docker to free container labels when containers are removed.
Merge pull request #164 from crosbymichael/use-privilged

Use --privileged in Makefile
Move mount logic into Mount type

Signed-off-by: Michael Crosby <michael@docker.com>
Add tmpfs support to Mount

Signed-off-by: Michael Crosby <michael@docker.com>
Use blkio.throttle.* stats when CFQ is not in use

This makes blkio's GetStats try to read blkio.io_serviced_recursive
first and fall back to read the stats from blkio.throttle in case it
can't. blkio.io_serviced_recursive seems to be available across all
kernels with CFQ enabled.

This closes #165

Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org>
Merge pull request #168 from crosbymichael/tmpfs

Add support for user defined mounts in tmpfs
Merge pull request #167 from discordianfish/use-blkio-throttle-stats-as-backup

Use blkio.throttle.* stats when CFQ is not in use
Update container to have ID provided by the user

Signed-off-by: Michael Crosby <michael@docker.com>
Merge pull request #166 from crosbymichael/api-update

Update container to have an ID provided by the user
Remove sampling from libcontainer CPU stats.

Sampling should be done by higher layer in configurable intervals. This
change removes the percentage stat as sampling is required for this.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
syncpipe: read from parent before reporting error

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
Get UID and GID for device nodes

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Merge pull request #170 from soundcloud/syncpipe-read-before-close-child

syncpipe: consume from parent before closing child
Merge pull request #173 from crosbymichael/device-ownership

Get UID and GID for device nodes
Merge pull request #174 from vmarmol/no-sleep

Remove sampling from libcontainer CPU stats.
Remove erroneous reference to `path` in description and error list;
add format description for `id` string;
add "invalid format" error for `id` string;
remove initial capitals on references to parameter names;
remove reference to `initialConfig`;
add description of id checking.

Signed-off-by: Steve Powell <spowell@pivotal.io>
Allow mounts to be supplied with the MS_SLAVE option.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
Merge pull request #172 from cf-guardian/create-api

Correct Create() api call description in Factory interface.
Add rich errors to the API

Add a rich Error type to the libcontainer package and use it in the API so
that callers can:

  * Check for a specific error without depending on an error string,
  * Obtain the stack trace of the function or method which detected the error.

The Error type provides a typed error code and a stack trace. The error code
identifies the error and enables the caller to test for it without being
sensitive to changes in the error text. The stack trace identifies the point
at which the error was detected. The combination of error code and stack trace
will enable errors to be diagnosed much more easily and with less guesswork
than when raw string-based errors are used.

The Error type conforms to the error interface and its Error method prints a
short error message. The Detail method provides a verbose error message
including the stack trace.

Notes:

1. There is an unfortunate precedent in the Go standard library which uses
variables to define errors. Checking for a specific error involves a string
comparison and assumes the corresponding variable has not been updated. It is
more robust and efficient to identify errors with integer-based types and
associated constants, although errors should still include a string
description for ease of use by humans.

2. It is not feasible to assign distinct types to Factory and Container
error codes because common errors such as SystemError cannot be declared in
two places and the names of the error codes then need to be decorated. This is
less readable.

Signed-off-by: Steve Powell <spowell@pivotal.io>