Remove linux specific calls

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Add Freebsd client support

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Add ability to force removal of running container via docker rm -f

Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
merge existing config when committing

Fixes #1141

Docker-DCO-1.1-Signed-off-by: Wes Morgan <cap10morgan@gmail.com> (github: cap10morgan)
Support hairpin NAT without going through docker server

Hairpin NAT is currently done by passing through the docker server.  If
two containers on the same box try to access each other through exposed
ports and using the host IP the current iptables rules will not match the
DNAT and thus the traffic goes to 'docker -d'

This change drops the restriction that DNAT traffic must not originate
from docker0.  It should be safe to drop this restriction because the
DOCKER chain is already gated by jumps that check for the destination
address to be a local address.

Docker-DCO-1.1-Signed-off-by: Darren Shepherd <darren.s.shepherd@gmail.com> (github: ibuildthecloud)
Create directories for tar files with relaxed permissions

Docker-DCO-1.1-Signed-off-by: Alexey Kotlyarov <alexey@infoxchange.net.au> (github: koterpillar)
Show some ENV / local updated baseimage tricks that use an apt-cacher-ng proxy to make debian based installations instant

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
implement pharvey's suggestions

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Change mustn't to must not

mustn't is ambiguous.  It may mean "you don't need to" even when it's not a tag question.  See prose:

http://books.google.cz/books?id=otFPvwLG524C&pg=PA241&lpg=PA241&dq=mustn%27t+trouble+yourself&source=bl&ots=vjgh7n-yyW&sig=LBQAwlZu3GxI5YzvRAXFow4hE1U&hl=en&sa=X&ei=a14XU9vxB4SBywOPz4HwDw&ved=0CDQQ6AEwAg#v=onepage&q=mustn%27t%20trouble%20yourself&f=false

http://www.nytimes.com/books/first/m/maynard-home.html (search for mustn't)

We mustn't argue over grammar.

See: https://github.com/dotcloud/docker/pull/4473

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: timthelion)
Return correct process pid for lxc

Fixes #2875
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
libcontainer: Don't use UsetCloseOnExec, it is racy

We can't keep file descriptors without close-on-exec except with
syscall.ForkLock held, as otherwise they could leak by accident into
other children from forks in other threads.

Instead we just use Cmd.ExtraFiles which handles all this for us.

This fixes https://github.com/dotcloud/docker/issues/4493

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
DeviceMapper: Succeed immediately when removing non-existant devices

We've seen situations where removal of "ID-init" failed during
container deletion (EBUSY), after removal of "ID" has succeeded. This
caused the container delete operation to fail, and on the next delete
attempt the removal of "ID" failed immediately with "does not exist".

Ideally we should not fail the ID-init removal, but its also non-ideal
to allow a state where the container is half-removed and we cannot
make progress deleting the container. So, we silently ignore not-exist
errors on device removal.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Merge pull request #4474 from timthelion/master

Change mustn't to must not
Merge pull request #4498 from alexlarsson/fix-cloexec-race

libcontainer: Don't use UsetCloseOnExec, it is racy
devmapper: Add per-device lock

We currently use a global lock to protect global data (like the
Devices map) as well as device data itself and access to
(non-threadsafe) libdevmapper.

This commit also adds a per-device lock, which will allow per-device
operations to temporarily release the global lock while e.g. waiting.
The per-device lock will make sure that nothing else accesses that
device while we're operating on it.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
devmapper: Increase sleep times and unlock while sleeping

We've seen some cases in the wild where waiting for unmount/deactivate
of devmapper devices taking a long time (several seconds). So, we increase
the sleeps to 10 seconds before we timeout. For instance:

https://github.com/dotcloud/docker/issues/4389

But, in order to not keep other processes blocked we unlock the global
dm lock while waiting to allow other devices to continue working.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
remove dbus from apparmor profile

This removes the dbus entry from the apparmor profile Docker creates.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Use CGO for apparmor profile switch

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Create a -G option that specifies the group which unix sockets belong to.

Docker-DCO-1.1-Signed-off-by: Evan Krall <krall@yelp.com> (github: EvanKrall)
Merge pull request #4503 from unclejack/attempt_to_fix_apparmor_profile

remove dbus from apparmor profile for Ubuntu 12.04