dotcloud/docker — pull request #3845 by alexlarsson (2014-01-30 18:11:15+00:00)
Title: Implement capabilitiy bit storage in layers

This adds support for storing the capability bits of files in docker layers.
The capability bits are stored in the security.capabilites extended attributes, so i added support for xattrs to tar/archive, which is needed for this. The upstream patch is here:
https://codereview.appspot.com/54570043/
And the pull request for github.com/dotcloud/tar which is used for now is here:
https://github.com/dotcloud/tar/pull/2

This is important for fedora, that use capability bits in many rpms to avoid setuid binaries.
A simple way to verify this is to do:
```
# docker run -t -i fedora sh
# yum install -y attr httpd
# attr -l /usr/sbin/suexec
Attribute "selinux" has a 32 byte value for /usr/sbin/suexec
Attribute "capability" has a 20 byte value for /usr/sbin/suexec
# exit
# docker commit $id httpd-caps
# docker run -t -i httpd-caps sh
# attr -l /usr/sbin/suexec
Attribute "selinux" has a 32 byte value for /usr/sbin/suexec
Attribute "capability" has a 20 byte value for /usr/sbin/suexec
# exit
```
This verifies that the installation of httpd created a /usr/sbin/suexec with a capability bit set, and commiting the container to an image and then launching that kept the capabilities.