mount of /.dockerinit is not needed for native driver, so move it into lxc driver

Docker-DCO-1.1-Signed-off-by: Albert Zhang <zhgwenming@gmail.com> (github: zhgwenming)
Add support for client certificates for registries

This lets you specify custom client TLS certificates and CA root for a
specific registry hostname. Docker will then verify the registry
against the CA and present the client cert when talking to that
registry.  This allows the registry to verify that the client has a
proper key, indicating that the client is allowed to access the
images.

A custom cert is configured by creating a directory in
/etc/docker/certs.d with the same name as the registry hostname. Inside
this directory all *.crt files are added as CA Roots (if none exists,
the system default is used) and pair of files <filename>.key and
<filename>.cert indicate a custom certificate to present to the registry.

If there are multiple certificates each one will be tried in
alphabetical order, proceeding to the next if we get a 403 of 5xx
response.

So, an example setup would be:
/etc/docker/certs.d/
└── localhost
    ├── client.cert
    ├── client.key
    └── localhost.crt

A simple way to test this setup is to use an apache server to host a
registry. Just copy a registry tree into the apache root, here is an
example one containing the busybox image:
  http://people.gnome.org/~alexl/v1.tar.gz

Then add this conf file as /etc/httpd/conf.d/registry.conf:

 # This must be in the root context, otherwise it causes a re-negotiation
 # which is not supported by the tls implementation in go
 SSLVerifyClient optional_no_ca

 <Location /v1>
 Action cert-protected /cgi-bin/cert.cgi
 SetHandler cert-protected

 Header set x-docker-registry-version "0.6.2"
 SetEnvIf Host (.*) custom_host=$1
 Header set X-Docker-Endpoints "%{custom_host}e"
 </Location>

And this as /var/www/cgi-bin/cert.cgi

 #!/bin/bash
 if [ "$HTTPS" != "on" ]; then
     echo "Status: 403 Not using SSL"
     echo "x-docker-registry-version: 0.6.2"
     echo
     exit 0
 fi
 if [ "$SSL_CLIENT_VERIFY" == "NONE" ]; then
     echo "Status: 403 Client certificate invalid"
     echo "x-docker-registry-version: 0.6.2"
     echo
     exit 0
 fi
 echo "Content-length: $(stat --printf='%s' $PATH_TRANSLATED)"
 echo "x-docker-registry-version: 0.6.2"
 echo "X-Docker-Endpoints: $SERVER_NAME"
 echo "X-Docker-Size: 0"
 echo

 cat $PATH_TRANSLATED

This will return 403 for all accessed to /v1 unless *any* client cert
is presented. Obviously a real implementation would verify more details
about the certificate.

Example client certs can be generated with:

openssl genrsa -out client.key 1024
openssl req -new -x509 -text -key client.key -out client.cert

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Revert "removed expect from mkimage-arch since it was not working"

This reverts commit 962e1186f9a0a43344e19dcf70bac159f0eafb4e.

Conflicts:
	contrib/mkimage-arch.sh

Docker-DCO-1.1-Signed-off-by: Zoltan Tombol <zoltan.tombol@gmail.com> (github: ztombol)
Fix expect script in mkimage-arch

Docker-DCO-1.1-Signed-off-by: Zoltan Tombol <zoltan.tombol@gmail.com> (github: ztombol)
Set state running before dumping to disk

Fixes #4766
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
add systemd MAINTAINERS file

	new file:   contrib/init/systemd/MAINTAINERS

Docker-DCO-1.1-Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org> (github: lsm5)
use systemd socket-activation by default

	modified:   contrib/init/systemd/docker.service
	renamed:    contrib/init/systemd/socket-activation/docker.socket -> contrib/init/systemd/docker.socket
	deleted:    contrib/init/systemd/socket-activation/docker.service

Docker-DCO-1.1-Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org> (github: lsm5)
systemd unitfile requires docker.socket

	modified:   contrib/init/systemd/docker.service

Docker-DCO-1.1-Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org> (github: lsm5)
since moved the ./dockerinit mount into lxc driver, fix the lxc testcase accordingly

Docker-DCO-1.1-Signed-off-by: Albert Zhang <zhgwenming@gmail.com> (github: zhgwenming)
Closes 6937. Allows setting of docker config dir.

Can now dynamically set the docker config directory through an
environment variable.

export DOCKER_CONFIG=/path/to/docker_config/

Default behavior remains the same, e.g. ~/.docker

Documentation for change added to the https.md docs.

Docker-DCO-1.1-Signed-off-by: James A. Kyle <james@jameskyle.org> (github: jameskyle)
missing doc for 6896

Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Change HTTP code: 404 to a more user friendly Image Not found msg

Docker-DCO-1.1-Signed-off-by: William Henry <whenry@redhat.com> (github: ipbabble)
re-write to put the emphasis on the  format

Docker-DCO-1.1-Signed-off-by: SvenDowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
removed default --rm option from example build command

this line gave the false impression that containers are not removed
unless you specify the --rm argument.
Merge pull request #6954 from LK4D4/fix_container_run_after_restart_#4766

Set state running before dumping to disk
Merge pull request #7045 from SvenDowideit/pr_out_re_write_to_put_the_emphasis_on_the_format

re-write to put the emphasis on the  format
Allow case insensitive caps for add and drop
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #7060 from crosbymichael/case-insensitive-caps

Allow case insensitive caps for add and drop
Add "Acquire::GzipIndexes" to contrib/mkimage/debootstrap

This results in a dramatic improvement in the size of individual "apt-get update" layers (on a clean wheezy base, from "29.88 MB" down to "8.273 MB").

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
don't allow links to be used with --net=host

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)