Fix invalid fd race

Sometimes I was getting:

2014/06/13 13:47:24 finalize namespace drop bounding set read /proc/1/status: bad file descriptor

This happens when applying the capabilities, and the code that
reads the current caps opens /proc/1/status and then reads some data from it.
But during this it gets a EBADFD error.

The problem is that FinalizeNamespace() closes all FDs before applying
the caps, and if a GC then happens after /proc/1/status is opened but
before reading from the fd, then an old os.File finalizer may close the
already closed-and-reused fd, wreaking havoc.

We fix this by instead of closing the FDs we mark them close-on-exec
which guarantees that they will be closed when we do the final
exec into the container.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
pkg/cgroups Add GetCgroupMounts() and GetAllSubsystems()

This lists all currently mounted cgroups and all supported cgroup
subsystems on the machine.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Mount cgroups in the container

We make a tmpfs on /sys/fs/cgroups, and here we mount read-only
versions of all the host cgroups. Additionally we make symlinks
for all merged subsystems.

For any "named" cgroup, such as "name=systemd" we also mount the
subset of the cgroup where the container lives as read-write. This
means that the container can create sub-cgroups inside the container
and move tasks into those, but it can never escape from its current
position in the cgroup hierarchy.

In particular, this allows systemd to mostly work in a non-privileged
container. The only problem currently is that PrivateTmp=true fails
because systemd is not allowed to mount a new /tmp.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Merge pull request #15 from alexlarsson/mount-cgroup-in-container

Mount cgroup in container
Use PATH_MAX as buffer size for buffers containing paths.
Docker-DCO-1.1-Signed-off-by: Mrunal Patel <mrunalp@gmail.com> (github: mrunalp)
Merge pull request #21 from mrunalp/use_path_max

Use PATH_MAX as buffer size for buffers containing paths.
Ignore isnotexist errors for restrict paths

Handle the error when remounting certain files and paths as readonly if
they do not exist.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #17 from alexlarsson/fix-close-race

Fix invalid fd race
Use lstat to check device symlinks
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #26 from crosbymichael/device-copy-links

Use lstat to check device symlinks
Merge pull request #24 from crosbymichael/is-not-exist-errors

Ignore isnotexist errors for restrict paths
Revert "Mount cgroups in the container"

This reverts commit b441dfa7293dfff89efb81800ba968ed73f8f0d1.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #30 from crosbymichael/revert-mount-cgroup

Revert "Mount cgroups in the container"
Update sample json file for quick testing
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #31 from crosbymichael/update-sample-json

Update sample json file for quick testing
Update travis to run unit tests

Also fix container_tests.go
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #32 from crosbymichael/update-travis

Update travis to run unit tests
Require two LGTMs for non-maintainer changes.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
Merge pull request #29 from vmarmol/fixes

Require two LGTMs for non-maintainer changes.
Add option parsing to nsenter and enable specifying commands with arguments.
Docker-DCO-1.1-Signed-off-by: Mrunal Patel <mrunalp@gmail.com> (github: mrunalp)