rkt run: acquire lock on container directory

stage0 acquires an exclusive advisory lock on the container directory,
leaving the fd open when executing stage1/init with the fd value stored in
the environment variable RKT_LOCK_FD.

stage1's fakesdboot.so shim prevents closure of RKT_LOCK_FD in nspawn by
replacing the close with a O_CLOEXEC fcntl, retaining the lock handle until
nspawn exits.

This facilitates simple and reliable container discovery by external
processes via flock() attempts on container directories.  Consult the
flock(2) and flock(1) man pages for information on advisory file locks.

With this change some basic lifecycle features are trivial using bash:

 Identifying which containers are active:
  shopt -s nullglob
  for c in /var/lib/rkt/containers/*; do
   flock --exclusive --nonblock "$c" echo "$c inactive" || echo "$c active"
  done

 GC of inactive containers:
  shopt -s nullglob
  mkdir -p /var/lib/rkt/gc
  for c in /var/lib/rkt/containers/*; do
   [ -e "$c/stage1" ] || continue
   flock --exclusive --nonblock "$c" mv "$c" /var/lib/rkt/gc
  done

 Assuming a periodic task clears out aged contents from /var/lib/rkt/gc
stage1: record pid of container's init process in $cuuid/pid

Intercept syscall() used by systemd-nspawn for clone, writing the
newly-namespaced child's pid into /var/lib/rkt/containers/$cuuid from the
parent before returning to systemd-nspawn.

This change combined with locking enables simple status queries of running
containers, for example in bash:

 shopt -s nullglob
 for c in /var/lib/rkt/containers/*; do
  [ -e "$c/pid" ] || continue
  flock --exclusive --nonblock "$c" /bin/true || {
   echo $c
   cpid=$(cat "$c/pid")
   nsenter --mount --uts --ipc --pid --root --wd --target "${cpid}" systemctl status
  }
 done
Documentation: Fix image manifest in getting started guide

The "app manifest" is now called "image manifest" and its structure has
changed. Fix that up.

Signed-off-by: Pekka Enberg <penberg@cloudius-systems.com>
Merge pull request #262 from penberg/docs/getting-started

Documentation: Fix image manifest in getting started guide
Merge pull request #244 from vcaputo/lock_dir-record_pid

rkt run: acquire lock on container directory and record pid
gc stuff

Conflicts:
	stage0/run.go
pkg/lock: cleanups, blocking vs. nonblocking calls, FD extraction
rkt gc: implement gc

Container directories deemed inactive by exclusive lock acquisition are
atomically renamed to /var/lib/rkt/garbage, the directory's ctime gets
updated as part of the rename.

The /var/lib/rkt/garbage directory is then scanned for directories having a
ctime older than --grace-period (defaults to 30m).  Qualifying directories
are deleted under another exclusive lock.

All lock acquisitions are non-blocking with failures being ignored.

Functions like gc status will have the grace period window for retrieving
statuses from inactive containers in either the containers or garbage
dirs, and should access the status files under the protection of a shared
lock.