Wait for pidfile to exist when starting with Redhat init script

Fixes #5359

Docker-DCO-1.1-Signed-off-by: Chris St. Pierre <chris.a.st.pierre@gmail.com> (github: stpierre)
added timeout when waiting for docker pidfile

Docker-DCO-1.1-Signed-off-by: Chris St. Pierre <chris.a.st.pierre@gmail.com> (github: stpierre)
native driver: Add required capabilities

We need SETFCAP to be able to mark files as having caps, which is
heavily used by fedora.
See https://github.com/dotcloud/docker/issues/5928

We also need SETPCAP, for instance systemd needs this to set caps
on its childen.

Both of these are safe in the sense that they can never ever
result in a process with a capability not in the bounding set of the
container.

We also add NET_BIND_SERVICE caps, to be able to bind to ports lower
than 1024.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Merge pull request #5844 from stpierre/init-script-wait-for-pidfile

Wait for pidfile to exist when starting with RedHat init script
Merge pull request #5929 from alexlarsson/systemd-cgroup-allow-mknod

cgroups: Allow mknod for any device in systemd cgroup backend
Merge pull request #5930 from alexlarsson/add-cap-setfcap

native driver: Don't drop SETFCAP
pkg/cgroups Add GetMounts() and GetSubsystems()

This lists all currently mounted cgroups and all supported cgroup
subsystems on the machine.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
libcontainer: Mount cgroups in the container

We make a tmpfs on /sys/fs/cgroups, and here we mount read-only
versions of all the host cgroups. Additionally we make symlinks
for all merged subsystems.

For any "named" cgroup, such as "name=systemd" we also mount the
subset of the cgroup where the container lives as read-write. This
means that the container can create sub-cgroups inside the container
and move tasks into those, but it can never escape from its current
position in the cgroup hierarchy.

In particular, this allows systemd to mostly work in a non-privileged
container. The only problem currently is that PrivateTmp=true fails
because systemd is not allowed to mount a new /tmp.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)