Support hairpin NAT

This re-applies commit b39d02b with additional iptables rules to solve the issue with containers routing back into themselves.

The previous issue with this attempt was that the DNAT rule would send traffic back into the container it came from. When this happens you have 2 issues.
1) reverse path filtering. The container is going to see the traffic coming in from the outside and it's going to have a source address of itself. So reverse path filtering will kick in and drop the packet.
2) direct return mismatch. Assuming you turned reverse path filtering off, when the packet comes back in, it's goign to have a source address of itself, thus when the reply traffic is sent, it's going to have a source address of itself. But the original packet was sent to the host IP address, so the traffic will be dropped because it's coming from an address which the original traffic was not sent to (and likely with an incorrect port as well).

The solution to this is to masquerade the traffic when it gets routed back into the origin container. However for this to work you need to enable hairpin mode on the bridge port, otherwise the kernel will just drop the traffic.
The hairpin mode set is part of libcontainer, while the MASQ change is part of docker.

This reverts commit 63c303eecdbaf4dc7967fd51b82cd447c778cecc.

Docker-DCO-1.1-Signed-off-by: Patrick Hemmer <patrick.hemmer@gmail.com> (github: phemmer)
made getDefaultNetworkMtu private

Signed-off-by: Blake Geno <blakegeno@gmail.com>
unify `–`(en dash) to `-` when specifying options

Signed-off-by: Xie Shi <georgexsh@gmail.com>
bump fpm to 1.3.2

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Removed fixme from utils_test.go

Signed-off-by: Blake Geno <blakegeno@gmail.com>
Bring API docs inline with 1.3

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Fix vet errors

Signed-off-by: Alexandr Morozov <lk4d4@docker.com>
Create GOVERNANCE.md
Information on Governance Advisory Board and associated proposals

Signed-off-by: Ben Golub <ben.golub@docker.com>
Close stdin after execution with `docker exec -i`

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
Merge pull request #8987 from erikh/exec_stdin_close

Close stdin after execution with `docker exec -i`
Merge pull request #8683 from cpuguy83/fix_api_docs

Bring API docs inline with 1.3
Update libcontainer to fd6df76562137aa3b18e44b790c

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Update docker with syncpipe changes

We removed the syncpipe package and replaced it with specific calls to
create a new *os.File from a specified fd passed to the process.  This
reduced code and an extra object to manage the container's init
lifecycle.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
See #8379 - if the container doesn't start I added code to make sure that if no other processing sets the container.exitCode to a non-zero value when we make sure its done before we return. I also made sure that while trying to start the CMD/ENTRYPOINT, if it fails, then we set the container.exitCode to the exitStatus from the exec().

Closes #8379

Signed-off-by: Doug Davis <dug@us.ibm.com>
Merge pull request #8953 from golubbe/master

Create governance doc and show links to DGAB materials in google doc
Merge pull request #8974 from unclejack/bump_fpm

bump fpm to 1.3.2
Fix the unit test not to remove /tmp

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
Merge pull request #8998 from yoheiueda/dont-remove-tmpdir

Fix the unit test not to remove /tmp
Merge pull request #8990 from duglin/Issue8379a

Make sure that if a container can't start we set the exitcode to non-zero value
Merge pull request #8988 from crosbymichael/update-libcontainer-nov1

Update libcontainer to fd6df76562137aa3b18e44b790c