Add overlayfs graph backend

This backend uses the overlayfs union filesystem for containers
plus hard link file sharing for images.

Each container/image can have a "root" subdirectory which is a plain
filesystem hierarchy, or they can use overlayfs.

If they use overlayfs there is a "upper" directory and a "lower-id"
file, as well as "merged" and "work" directories. The "upper"
directory has the upper layer of the overlay, and "lower-id" contains
the id of the parent whose "root" directory shall be used as the lower
layer in the overlay. The overlay itself is mounted in the "merged"
directory, and the "work" dir is needed for overlayfs to work.

When a overlay layer is created there are two cases, either the
parent has a "root" dir, then we start out with a empty "upper"
directory overlaid on the parents root. This is typically the
case with the init layer of a container which is based on an image.
If there is no "root" in the parent, we inherit the lower-id from
the parent and start by making a copy if the parents "upper" dir.
This is typically the case for a container layer which copies
its parent -init upper layer.

Additionally we also have a custom implementation of ApplyLayer
which makes a recursive copy of the parent "root" layer using
hardlinks to share file data, and then applies the layer on top
of that. This means all chile images share file (but not directory)
data with the parent.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Compute TarSum on storage of image layer content

Now, newly created/imported layers will have the checksum of
the layer diff computed and stored in the image json file.

For now, it is not an error if the computed checksum does not
match an existing checksum, only a warning message is logged. The
eventual goal is to use the checksums in the image JSON to verify
the integrity of the layer contents when doing `docker load` or
`docker pull`, and error out if it does not match.

Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
Make test-unit runnable without parallel

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
btrfs: information for the information gods

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Export envvars necessary for unit-test

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
Improve "security reports" section in contribution docs.

Signed-off-by: Solomon Hykes <solomon@docker.com>
In contribution docs, emphasize that bug reports are appreciated!

Signed-off-by: Solomon Hykes <solomon@docker.com>
Move GOVERNANCE.md to hack/

Signed-off-by: Solomon Hykes <solomon@docker.com>
Move 'hack' to the less confusing 'project'

We might want to break it up into smaller pieces (eg. tools in one
place, documents in another) but let's worry about that later.

Signed-off-by: Solomon Hykes <solomon@docker.com>
LINKED CONTAINER ID PASSED TO LXC

This passed the --net=container:CONTINER_ID to lxc-start as --share-net
Docker-DCO-1.1-Signed-off-by: Abin Shahab <ashahab@altiscale.com> (github: ashahab-altiscale)
handle GET redirects

Signed-off-by: Victor Vieux <vieux@docker.com>
fix unix socket

Signed-off-by: Victor Vieux <vieux@docker.com>
Allow IPC namespace to be shared between containers or with the host

Some workloads rely on IPC for communications with other processes.  We
would like to split workloads between two container but still allow them
to communicate though shared IPC.

This patch mimics the --net code to allow --ipc=host to not split off
the IPC Namespace.  ipc=container:CONTAINERID to share ipc between containers

If you share IPC between containers, then you need to make sure SELinux labels
match.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Update CONTRIBUTING to reflect new PR-docs process.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
update timeout

Signed-off-by: Victor Vieux <vieux@docker.com>
Fix AUFS silent mount errors on many layers

Fixes #1171
Fixes #6465

Data passed to mount(2) is clipped to PAGE_SIZE if its bigger. Previous 
implementation checked if error was returned and then started to append layers 
one by one. But if the PAGE_SIZE clipping appeared in between the paths, in the 
permission sections or in xino definition the call would not error and 
remaining layers would just be skipped(or some other unknown situation).

This also optimizes system calls as it tries to mount as much as possible with 
the first mount.


Signed-off-by: Tõnis Tiigi <tonistiigi@gmail.com> (github: tonistiigi)
btrfs: build tag to enable showing version info

be default it is on, with build tags to disable the version info

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Dockerfile: buildtags for old btrfs

Since the build uses ubuntu 14.04, which has an old btrfs, include the
buildtags needed for this old version to not break the build.

Signed-off-by: Vincent Batts <vbatts@redhat.com>
Fix typo "infortmation" in docs for `docker run`
Merge pull request #8964 from jlhawn/image_checksum

Compute TarSum on storage of image layer content