Bump version to v1.6.0

Docker-DCO-1.1-Signed-off-by: Jessie Frazelle <princess@docker.com> (github: jfrazelle)

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.6.0 (2015-04-07)
+
+#### Builder
++ Building images from an image ID
++ build containers with resource constraints, ie `docker build --cpu-shares=100 --memory=1024m...`
++ `commit --change` to apply specified Dockerfile instructions while committing the image
++ `import --change` to apply specified Dockerfile instructions while importing the image
+
+#### Client
++ Windows Support
+
+#### Runtime
++ Container and image Labels
++ `--cgroup-parent` for specifying a parent cgroup to place container cgroup within
++ Logging drivers, `json-file`, `syslog`, or `none`
++ Pulling images by ID
++ `--ulimit` to set the ulimit on a container
++ `--default-ulimit` option on the daemon which applies to all created containers (and overwritten by `--ulimit` on run)
+
 ## 1.5.0 (2015-02-10)
 
 #### Builder

VERSION

@@ -1 +1 @@
-1.5.0-dev
+1.6.0-rc6

api/client/utils.go

@@ -281,16 +281,16 @@ func (cli *DockerCli) monitorTtySize(id string, isExec bool) error {
 
 	if runtime.GOOS == "windows" {
 		go func() {
-			prevW, prevH := cli.getTtySize()
+			prevH, prevW := cli.getTtySize()
 			for {
 				time.Sleep(time.Millisecond * 250)
-				w, h := cli.getTtySize()
+				h, w := cli.getTtySize()
 
 				if prevW != w || prevH != h {
 					cli.resizeTty(id, isExec)
 				}
-				prevW = w
 				prevH = h
+				prevW = w
 			}
 		}()
 	} else {

daemon/execdriver/native/driver.go

@@ -190,6 +190,34 @@ func notifyOnOOM(container libcontainer.Container) <-chan struct{} {
 	return oom
 }
 
+func killCgroupProcs(c libcontainer.Container) {
+	var procs []*os.Process
+	if err := c.Pause(); err != nil {
+		log.Warn(err)
+	}
+	pids, err := c.Processes()
+	if err != nil {
+		// don't care about childs if we can't get them, this is mostly because cgroup already deleted
+		log.Warnf("Failed to get processes from container %s: %v", c.ID(), err)
+	}
+	for _, pid := range pids {
+		if p, err := os.FindProcess(pid); err == nil {
+			procs = append(procs, p)
+			if err := p.Kill(); err != nil {
+				log.Warn(err)
+			}
+		}
+	}
+	if err := c.Resume(); err != nil {
+		log.Warn(err)
+	}
+	for _, p := range procs {
+		if _, err := p.Wait(); err != nil {
+			log.Warn(err)
+		}
+	}
+}
+
 func waitInPIDHost(p *libcontainer.Process, c libcontainer.Container) func() (*os.ProcessState, error) {
 	return func() (*os.ProcessState, error) {
 		pid, err := p.Pid()
@@ -197,8 +225,6 @@ func waitInPIDHost(p *libcontainer.Process, c libcontainer.Container) func() (*o
 			return nil, err
 		}
 
-		processes, err := c.Processes()
-
 		process, err := os.FindProcess(pid)
 		s, err := process.Wait()
 		if err != nil {
@@ -208,19 +234,7 @@ func waitInPIDHost(p *libcontainer.Process, c libcontainer.Container) func() (*o
 			}
 			s = execErr.ProcessState
 		}
-		if err != nil {
-			return s, err
-		}
-
-		for _, pid := range processes {
-			process, err := os.FindProcess(pid)
-			if err != nil {
-				log.Errorf("Failed to kill process: %d", pid)
-				continue
-			}
-			process.Kill()
-		}
-
+		killCgroupProcs(c)
 		p.Wait()
 		return s, err
 	}

daemon/logger/syslog/syslog.go

@@ -17,29 +17,20 @@ type Syslog struct {
 }
 
 func New(tag string) (logger.Logger, error) {
-	log, err := syslog.New(syslog.LOG_USER, path.Base(os.Args[0]))
+	log, err := syslog.New(syslog.LOG_USER, fmt.Sprintf("%s: <%s> ", path.Base(os.Args[0]), tag))
 	if err != nil {
 		return nil, err
 	}
 	return &Syslog{
 		writer: log,
-		tag:    tag,
 	}, nil
 }
 
 func (s *Syslog) Log(msg *logger.Message) error {
-	logMessage := fmt.Sprintf("%s: %s", s.tag, string(msg.Line))
 	if msg.Source == "stderr" {
-		if err := s.writer.Err(logMessage); err != nil {
-			return err
-		}
-
-	} else {
-		if err := s.writer.Info(logMessage); err != nil {
-			return err
-		}
+		return s.writer.Err(string(msg.Line))
 	}
-	return nil
+	return s.writer.Info(string(msg.Line))
 }
 
 func (s *Syslog) Close() error {

docs/release.sh

@@ -22,10 +22,17 @@ EOF
 }
 
 create_robots_txt() {
-	cat > ./sources/robots.txt <<'EOF'
-User-agent: *
-Disallow: /
-EOF
+	if [ "$AWS_S3_BUCKET" == "docs.docker.com" ]; then
+		cat > ./sources/robots.txt <<-'EOF'
+		User-agent: *
+		Allow: /
+		EOF
+	else
+		cat > ./sources/robots.txt <<-'EOF'
+		User-agent: *
+		Disallow: /
+		EOF
+	fi
 }
 
 setup_s3() {

hack/install.sh

@@ -20,213 +20,230 @@ command_exists() {
 	command -v "$@" > /dev/null 2>&1
 }
 
-case "$(uname -m)" in
-	*64)
-		;;
-	*)
-		echo >&2 'Error: you are not using a 64bit platform.'
-		echo >&2 'Docker currently only supports 64bit platforms.'
-		exit 1
-		;;
-esac
+echo_docker_as_nonroot() {
+	your_user=your-user
+	[ "$user" != 'root' ] && your_user="$user"
+	# intentionally mixed spaces and tabs here -- tabs are stripped by "<<-EOF", spaces are kept in the output
+	cat <<-EOF
 
-if command_exists docker || command_exists lxc-docker; then
-	echo >&2 'Warning: "docker" or "lxc-docker" command appears to already exist.'
-	echo >&2 'Please ensure that you do not already have docker installed.'
-	echo >&2 'You may press Ctrl+C now to abort this process and rectify this situation.'
-	( set -x; sleep 20 )
-fi
+	If you would like to use Docker as a non-root user, you should now consider
+	adding your user to the "docker" group with something like:
 
-user="$(id -un 2>/dev/null || true)"
+	  sudo usermod -aG docker $your_user
 
-sh_c='sh -c'
-if [ "$user" != 'root' ]; then
-	if command_exists sudo; then
-		sh_c='sudo -E sh -c'
-	elif command_exists su; then
-		sh_c='su -c'
-	else
-		echo >&2 'Error: this installer needs the ability to run commands as root.'
-		echo >&2 'We are unable to find either "sudo" or "su" available to make this happen.'
-		exit 1
+	Remember that you will have to log out and back in for this to take effect!
+
+	EOF
+}
+
+do_install() {
+	case "$(uname -m)" in
+		*64)
+			;;
+		*)
+			cat >&2 <<-'EOF'
+			Error: you are not using a 64bit platform.
+			Docker currently only supports 64bit platforms.
+			EOF
+			exit 1
+			;;
+	esac
+
+	if command_exists docker || command_exists lxc-docker; then
+		cat >&2 <<-'EOF'
+		Warning: "docker" or "lxc-docker" command appears to already exist.
+		Please ensure that you do not already have docker installed.
+		You may press Ctrl+C now to abort this process and rectify this situation.
+		EOF
+		( set -x; sleep 20 )
 	fi
-fi
 
-curl=''
-if command_exists curl; then
-	curl='curl -sSL'
-elif command_exists wget; then
-	curl='wget -qO-'
-elif command_exists busybox && busybox --list-modules | grep -q wget; then
-	curl='busybox wget -qO-'
-fi
+	user="$(id -un 2>/dev/null || true)"
 
-# perform some very rudimentary platform detection
-lsb_dist=''
-if command_exists lsb_release; then
-	lsb_dist="$(lsb_release -si)"
-fi
-if [ -z "$lsb_dist" ] && [ -r /etc/lsb-release ]; then
-	lsb_dist="$(. /etc/lsb-release && echo "$DISTRIB_ID")"
-fi
-if [ -z "$lsb_dist" ] && [ -r /etc/debian_version ]; then
-	lsb_dist='debian'
-fi
-if [ -z "$lsb_dist" ] && [ -r /etc/fedora-release ]; then
-	lsb_dist='fedora'
-fi
-if [ -z "$lsb_dist" ] && [ -r /etc/os-release ]; then
-	lsb_dist="$(. /etc/os-release && echo "$ID")"
-fi
-
-lsb_dist="$(echo "$lsb_dist" | tr '[:upper:]' '[:lower:]')"
-case "$lsb_dist" in
-	amzn|fedora)
-		if [ "$lsb_dist" = 'amzn' ]; then
-			(
-				set -x
-				$sh_c 'sleep 3; yum -y -q install docker'
-			)
+	sh_c='sh -c'
+	if [ "$user" != 'root' ]; then
+		if command_exists sudo; then
+			sh_c='sudo -E sh -c'
+		elif command_exists su; then
+			sh_c='su -c'
 		else
-			(
-				set -x
-				$sh_c 'sleep 3; yum -y -q install docker-io'
-			)
-		fi
-		if command_exists docker && [ -e /var/run/docker.sock ]; then
-			(
-				set -x
-				$sh_c 'docker version'
-			) || true
-		fi
-		your_user=your-user
-		[ "$user" != 'root' ] && your_user="$user"
-		echo
-		echo 'If you would like to use Docker as a non-root user, you should now consider'
-		echo 'adding your user to the "docker" group with something like:'
-		echo
-		echo '  sudo usermod -aG docker' $your_user
-		echo
-		echo 'Remember that you will have to log out and back in for this to take effect!'
-		echo
-		exit 0
-		;;
-
-	ubuntu|debian|linuxmint)
-		export DEBIAN_FRONTEND=noninteractive
-
-		did_apt_get_update=
-		apt_get_update() {
-			if [ -z "$did_apt_get_update" ]; then
-				( set -x; $sh_c 'sleep 3; apt-get update' )
-				did_apt_get_update=1
-			fi
-		}
-
-		# aufs is preferred over devicemapper; try to ensure the driver is available.
-		if ! grep -q aufs /proc/filesystems && ! $sh_c 'modprobe aufs'; then
-			if uname -r | grep -q -- '-generic' && dpkg -l 'linux-image-*-generic' | grep -q '^ii' 2>/dev/null; then
-				kern_extras="linux-image-extra-$(uname -r) linux-image-extra-virtual"
-
-				apt_get_update
-				( set -x; $sh_c 'sleep 3; apt-get install -y -q '"$kern_extras" ) || true
-
-				if ! grep -q aufs /proc/filesystems && ! $sh_c 'modprobe aufs'; then
-					echo >&2 'Warning: tried to install '"$kern_extras"' (for AUFS)'
-					echo >&2 ' but we still have no AUFS.  Docker may not work. Proceeding anyways!'
-					( set -x; sleep 10 )
-				fi
-			else
-				echo >&2 'Warning: current kernel is not supported by the linux-image-extra-virtual'
-				echo >&2 ' package.  We have no AUFS support.  Consider installing the packages'
-				echo >&2 ' linux-image-virtual kernel and linux-image-extra-virtual for AUFS support.'
-				( set -x; sleep 10 )
-			fi
-		fi
-
-		# install apparmor utils if they're missing and apparmor is enabled in the kernel
-		# otherwise Docker will fail to start
-		if [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = 'Y' ]; then
-			if command -v apparmor_parser &> /dev/null; then
-				echo 'apparmor is enabled in the kernel and apparmor utils were already installed'
-			else
-				echo 'apparmor is enabled in the kernel, but apparmor_parser missing'
-				apt_get_update
-				( set -x; $sh_c 'sleep 3; apt-get install -y -q apparmor' )
-			fi
-		fi
-
-		if [ ! -e /usr/lib/apt/methods/https ]; then
-			apt_get_update
-			( set -x; $sh_c 'sleep 3; apt-get install -y -q apt-transport-https ca-certificates' )
-		fi
-		if [ -z "$curl" ]; then
-			apt_get_update
-			( set -x; $sh_c 'sleep 3; apt-get install -y -q curl ca-certificates' )
-			curl='curl -sSL'
-		fi
-		(
-			set -x
-			if [ "https://get.docker.com/" = "$url" ]; then
-				$sh_c "apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9"
-			elif [ "https://test.docker.com/" = "$url" ]; then
-				$sh_c "apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 740B314AE3941731B942C66ADF4FD13717AAD7D6"
-			else
-				$sh_c "$curl ${url}gpg | apt-key add -"
-			fi
-			$sh_c "echo deb ${url}ubuntu docker main > /etc/apt/sources.list.d/docker.list"
-			$sh_c 'sleep 3; apt-get update; apt-get install -y -q lxc-docker'
-		)
-		if command_exists docker && [ -e /var/run/docker.sock ]; then
-			(
-				set -x
-				$sh_c 'docker version'
-			) || true
-		fi
-		your_user=your-user
-		[ "$user" != 'root' ] && your_user="$user"
-		echo
-		echo 'If you would like to use Docker as a non-root user, you should now consider'
-		echo 'adding your user to the "docker" group with something like:'
-		echo
-		echo '  sudo usermod -aG docker' $your_user
-		echo
-		echo 'Remember that you will have to log out and back in for this to take effect!'
-		echo
-		exit 0
-		;;
-
-	gentoo)
-		if [ "$url" = "https://test.docker.com/" ]; then
-			echo >&2
-			echo >&2 '  You appear to be trying to install the latest nightly build in Gentoo.'
-			echo >&2 '  The portage tree should contain the latest stable release of Docker, but'
-			echo >&2 '  if you want something more recent, you can always use the live ebuild'
-			echo >&2 '  provided in the "docker" overlay available via layman.  For more'
-			echo >&2 '  instructions, please see the following URL:'
-			echo >&2 '    https://github.com/tianon/docker-overlay#using-this-overlay'
-			echo >&2 '  After adding the "docker" overlay, you should be able to:'
-			echo >&2 '    emerge -av =app-emulation/docker-9999'
-			echo >&2
+			cat >&2 <<-'EOF'
+			Error: this installer needs the ability to run commands as root.
+			We are unable to find either "sudo" or "su" available to make this happen.
+			EOF
 			exit 1
 		fi
+	fi
 
-		(
-			set -x
-			$sh_c 'sleep 3; emerge app-emulation/docker'
-		)
-		exit 0
-		;;
-esac
+	curl=''
+	if command_exists curl; then
+		curl='curl -sSL'
+	elif command_exists wget; then
+		curl='wget -qO-'
+	elif command_exists busybox && busybox --list-modules | grep -q wget; then
+		curl='busybox wget -qO-'
+	fi
 
-cat >&2 <<'EOF'
+	# perform some very rudimentary platform detection
+	lsb_dist=''
+	if command_exists lsb_release; then
+		lsb_dist="$(lsb_release -si)"
+	fi
+	if [ -z "$lsb_dist" ] && [ -r /etc/lsb-release ]; then
+		lsb_dist="$(. /etc/lsb-release && echo "$DISTRIB_ID")"
+	fi
+	if [ -z "$lsb_dist" ] && [ -r /etc/debian_version ]; then
+		lsb_dist='debian'
+	fi
+	if [ -z "$lsb_dist" ] && [ -r /etc/fedora-release ]; then
+		lsb_dist='fedora'
+	fi
+	if [ -z "$lsb_dist" ] && [ -r /etc/os-release ]; then
+		lsb_dist="$(. /etc/os-release && echo "$ID")"
+	fi
 
-  Either your platform is not easily detectable, is not supported by this
-  installer script (yet - PRs welcome! [hack/install.sh]), or does not yet have
-  a package for Docker.  Please visit the following URL for more detailed
-  installation instructions:
+	lsb_dist="$(echo "$lsb_dist" | tr '[:upper:]' '[:lower:]')"
+	case "$lsb_dist" in
+		amzn|fedora|centos)
+			if [ "$lsb_dist" = 'amzn' ]; then
+				(
+					set -x
+					$sh_c 'sleep 3; yum -y -q install docker'
+				)
+			else
+				(
+					set -x
+					$sh_c 'sleep 3; yum -y -q install docker-io'
+				)
+			fi
+			if command_exists docker && [ -e /var/run/docker.sock ]; then
+				(
+					set -x
+					$sh_c 'docker version'
+				) || true
+			fi
+			echo_docker_as_nonroot
+			exit 0
+			;;
 
-    https://docs.docker.com/en/latest/installation/
+		ubuntu|debian|linuxmint)
+			export DEBIAN_FRONTEND=noninteractive
 
-EOF
-exit 1
+			did_apt_get_update=
+			apt_get_update() {
+				if [ -z "$did_apt_get_update" ]; then
+					( set -x; $sh_c 'sleep 3; apt-get update' )
+					did_apt_get_update=1
+				fi
+			}
+
+			# aufs is preferred over devicemapper; try to ensure the driver is available.
+			if ! grep -q aufs /proc/filesystems && ! $sh_c 'modprobe aufs'; then
+				if uname -r | grep -q -- '-generic' && dpkg -l 'linux-image-*-generic' | grep -q '^ii' 2>/dev/null; then
+					kern_extras="linux-image-extra-$(uname -r) linux-image-extra-virtual"
+
+					apt_get_update
+					( set -x; $sh_c 'sleep 3; apt-get install -y -q '"$kern_extras" ) || true
+
+					if ! grep -q aufs /proc/filesystems && ! $sh_c 'modprobe aufs'; then
+						echo >&2 'Warning: tried to install '"$kern_extras"' (for AUFS)'
+						echo >&2 ' but we still have no AUFS.  Docker may not work. Proceeding anyways!'
+						( set -x; sleep 10 )
+					fi
+				else
+					echo >&2 'Warning: current kernel is not supported by the linux-image-extra-virtual'
+					echo >&2 ' package.  We have no AUFS support.  Consider installing the packages'
+					echo >&2 ' linux-image-virtual kernel and linux-image-extra-virtual for AUFS support.'
+					( set -x; sleep 10 )
+				fi
+			fi
+
+			# install apparmor utils if they're missing and apparmor is enabled in the kernel
+			# otherwise Docker will fail to start
+			if [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = 'Y' ]; then
+				if command -v apparmor_parser &> /dev/null; then
+					echo 'apparmor is enabled in the kernel and apparmor utils were already installed'
+				else
+					echo 'apparmor is enabled in the kernel, but apparmor_parser missing'
+					apt_get_update
+					( set -x; $sh_c 'sleep 3; apt-get install -y -q apparmor' )
+				fi
+			fi
+
+			if [ ! -e /usr/lib/apt/methods/https ]; then
+				apt_get_update
+				( set -x; $sh_c 'sleep 3; apt-get install -y -q apt-transport-https ca-certificates' )
+			fi
+			if [ -z "$curl" ]; then
+				apt_get_update
+				( set -x; $sh_c 'sleep 3; apt-get install -y -q curl ca-certificates' )
+				curl='curl -sSL'
+			fi
+			(
+				set -x
+				if [ "https://get.docker.com/" = "$url" ]; then
+					$sh_c "apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9"
+				elif [ "https://test.docker.com/" = "$url" ]; then
+					$sh_c "apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 740B314AE3941731B942C66ADF4FD13717AAD7D6"
+				else
+					$sh_c "$curl ${url}gpg | apt-key add -"
+				fi
+				$sh_c "echo deb ${url}ubuntu docker main > /etc/apt/sources.list.d/docker.list"
+				$sh_c 'sleep 3; apt-get update; apt-get install -y -q lxc-docker'
+			)
+			if command_exists docker && [ -e /var/run/docker.sock ]; then
+				(
+					set -x
+					$sh_c 'docker version'
+				) || true
+			fi
+			echo_docker_as_nonroot
+			exit 0
+			;;
+
+		gentoo)
+			if [ "$url" = "https://test.docker.com/" ]; then
+				# intentionally mixed spaces and tabs here -- tabs are stripped by "<<-'EOF'", spaces are kept in the output
+				cat >&2 <<-'EOF'
+
+				  You appear to be trying to install the latest nightly build in Gentoo.'
+				  The portage tree should contain the latest stable release of Docker, but'
+				  if you want something more recent, you can always use the live ebuild'
+				  provided in the "docker" overlay available via layman.  For more'
+				  instructions, please see the following URL:'
+
+				    https://github.com/tianon/docker-overlay#using-this-overlay'
+
+				  After adding the "docker" overlay, you should be able to:'
+
+				    emerge -av =app-emulation/docker-9999'
+
+				EOF
+				exit 1
+			fi
+
+			(
+				set -x
+				$sh_c 'sleep 3; emerge app-emulation/docker'
+			)
+			exit 0
+			;;
+	esac
+
+	# intentionally mixed spaces and tabs here -- tabs are stripped by "<<-'EOF'", spaces are kept in the output
+	cat >&2 <<-'EOF'
+
+	  Either your platform is not easily detectable, is not supported by this
+	  installer script (yet - PRs welcome! [hack/install.sh]), or does not yet have
+	  a package for Docker.  Please visit the following URL for more detailed
+	  installation instructions:
+
+	    https://docs.docker.com/en/latest/installation/
+
+	EOF
+	exit 1
+}
+
+# wrapped up in a function so that we have some protection against only getting
+# half the file during "curl | sh"
+do_install

hack/vendor.sh

@@ -75,7 +75,7 @@ rm -rf src/github.com/docker/distribution
 mkdir -p src/github.com/docker/distribution
 mv tmp-digest src/github.com/docker/distribution/digest
 
-clone git github.com/docker/libcontainer d00b8369852285d6a830a8d3b966608b2ed89705
+clone git github.com/docker/libcontainer bd8ec36106086f72b66e1be85a81202b93503e44
 # see src/github.com/docker/libcontainer/update-vendor.sh which is the "source of truth" for libcontainer deps (just like this file)
 rm -rf src/github.com/docker/libcontainer/vendor
 eval "$(grep '^clone ' src/github.com/docker/libcontainer/update-vendor.sh | grep -v 'github.com/codegangsta/cli' | grep -v 'github.com/Sirupsen/logrus')"

integration-cli/docker_cli_run_test.go

@@ -3237,6 +3237,35 @@ func TestRunNetHost(t *testing.T) {
 	logDone("run - net host mode")
 }
 
+func TestRunNetContainerWhichHost(t *testing.T) {
+	testRequires(t, SameHostDaemon)
+	defer deleteAllContainers()
+
+	hostNet, err := os.Readlink("/proc/1/ns/net")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command(dockerBinary, "run", "-d", "--net=host", "--name=test", "busybox", "top")
+	out, _, err := runCommandWithOutput(cmd)
+	if err != nil {
+		t.Fatal(err, out)
+	}
+
+	cmd = exec.Command(dockerBinary, "run", "--net=container:test", "busybox", "readlink", "/proc/self/ns/net")
+	out, _, err = runCommandWithOutput(cmd)
+	if err != nil {
+		t.Fatal(err, out)
+	}
+
+	out = strings.Trim(out, "\n")
+	if hostNet != out {
+		t.Fatalf("Container should have host network namespace")
+	}
+
+	logDone("run - net container mode, where container in host mode")
+}
+
 func TestRunAllowPortRangeThroughPublish(t *testing.T) {
 	defer deleteAllContainers()
 
@@ -3382,3 +3411,28 @@ func TestRunVolumesFromRestartAfterRemoved(t *testing.T) {
 
 	logDone("run - can restart a volumes-from container after producer is removed")
 }
+
+func TestRunPidHostWithChildIsKillable(t *testing.T) {
+	defer deleteAllContainers()
+	name := "ibuildthecloud"
+	if out, err := exec.Command(dockerBinary, "run", "-d", "--pid=host", "--name", name, "busybox", "sh", "-c", "sleep 30; echo hi").CombinedOutput(); err != nil {
+		t.Fatal(err, out)
+	}
+	time.Sleep(1 * time.Second)
+	errchan := make(chan error)
+	go func() {
+		if out, err := exec.Command(dockerBinary, "kill", name).CombinedOutput(); err != nil {
+			errchan <- fmt.Errorf("%v:\n%s", err, out)
+		}
+		close(errchan)
+	}()
+	select {
+	case err := <-errchan:
+		if err != nil {
+			t.Fatal(err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("Kill container timed out")
+	}
+	logDone("run - can kill container with pid-host and some childs of pid 1")
+}

pkg/term/term_windows.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 
+	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/pkg/term/winconsole"
 )
 
@@ -48,8 +49,8 @@ func GetWinsize(fd uintptr) (*Winsize, error) {
 
 	// TODO(azlinux): Set the pixel width / height of the console (currently unused by any caller)
 	return &Winsize{
-		Width:  uint16(info.Window.Bottom - info.Window.Top + 1),
-		Height: uint16(info.Window.Right - info.Window.Left + 1),
+		Width:  uint16(info.Window.Right - info.Window.Left + 1),
+		Height: uint16(info.Window.Bottom - info.Window.Top + 1),
 		x:      0,
 		y:      0}, nil
 }
@@ -57,6 +58,7 @@ func GetWinsize(fd uintptr) (*Winsize, error) {
 // SetWinsize sets the size of the given terminal connected to the passed file descriptor.
 func SetWinsize(fd uintptr, ws *Winsize) error {
 	// TODO(azlinux): Implement SetWinsize
+	logrus.Debugf("[windows] SetWinsize: WARNING -- Unsupported method invoked")
 	return nil
 }
 
@@ -120,11 +122,10 @@ func MakeRaw(fd uintptr) (*State, error) {
 	mode &^= winconsole.ENABLE_ECHO_INPUT
 	mode &^= winconsole.ENABLE_LINE_INPUT
 	mode &^= winconsole.ENABLE_MOUSE_INPUT
-	// TODO(azlinux): Enable window input to handle window resizing
-	mode |= winconsole.ENABLE_WINDOW_INPUT
+	mode &^= winconsole.ENABLE_WINDOW_INPUT
+	mode &^= winconsole.ENABLE_PROCESSED_INPUT
 
 	// Enable these modes
-	mode |= winconsole.ENABLE_PROCESSED_INPUT
 	mode |= winconsole.ENABLE_EXTENDED_FLAGS
 	mode |= winconsole.ENABLE_INSERT_MODE
 	mode |= winconsole.ENABLE_QUICK_EDIT_MODE

pkg/term/winconsole/console_windows.go

@@ -12,6 +12,8 @@ import (
 	"sync"
 	"syscall"
 	"unsafe"
+
+	"github.com/Sirupsen/logrus"
 )
 
 const (
@@ -410,25 +412,25 @@ func getNumberOfChars(fromCoord COORD, toCoord COORD, screenSize COORD) uint32 {
 
 var buffer []CHAR_INFO
 
-func clearDisplayRect(handle uintptr, fillChar rune, attributes WORD, fromCoord COORD, toCoord COORD, windowSize COORD) (uint32, error) {
+func clearDisplayRect(handle uintptr, attributes WORD, fromCoord COORD, toCoord COORD) (uint32, error) {
 	var writeRegion SMALL_RECT
-	writeRegion.Top = fromCoord.Y
 	writeRegion.Left = fromCoord.X
+	writeRegion.Top = fromCoord.Y
 	writeRegion.Right = toCoord.X
 	writeRegion.Bottom = toCoord.Y
 
 	// allocate and initialize buffer
 	width := toCoord.X - fromCoord.X + 1
 	height := toCoord.Y - fromCoord.Y + 1
-	size := width * height
+	size := uint32(width) * uint32(height)
 	if size > 0 {
-		for i := 0; i < int(size); i++ {
-			buffer[i].UnicodeChar = WCHAR(fillChar)
-			buffer[i].Attributes = attributes
+		buffer := make([]CHAR_INFO, size)
+		for i := range buffer {
+			buffer[i] = CHAR_INFO{WCHAR(' '), attributes}
 		}
 
 		// Write to buffer
-		r, err := writeConsoleOutput(handle, buffer[:size], windowSize, COORD{X: 0, Y: 0}, &writeRegion)
+		r, err := writeConsoleOutput(handle, buffer, COORD{X: width, Y: height}, COORD{X: 0, Y: 0}, &writeRegion)
 		if !r {
 			if err != nil {
 				return 0, err
@@ -439,18 +441,18 @@ func clearDisplayRect(handle uintptr, fillChar rune, attributes WORD, fromCoord
 	return uint32(size), nil
 }
 
-func clearDisplayRange(handle uintptr, fillChar rune, attributes WORD, fromCoord COORD, toCoord COORD, windowSize COORD) (uint32, error) {
+func clearDisplayRange(handle uintptr, attributes WORD, fromCoord COORD, toCoord COORD) (uint32, error) {
 	nw := uint32(0)
 	// start and end on same line
 	if fromCoord.Y == toCoord.Y {
-		return clearDisplayRect(handle, fillChar, attributes, fromCoord, toCoord, windowSize)
+		return clearDisplayRect(handle, attributes, fromCoord, toCoord)
 	}
 	// TODO(azlinux): if full screen, optimize
 
 	// spans more than one line
 	if fromCoord.Y < toCoord.Y {
 		// from start position till end of line for first line
-		n, err := clearDisplayRect(handle, fillChar, attributes, fromCoord, COORD{X: windowSize.X - 1, Y: fromCoord.Y}, windowSize)
+		n, err := clearDisplayRect(handle, attributes, fromCoord, COORD{X: toCoord.X, Y: fromCoord.Y})
 		if err != nil {
 			return nw, err
 		}
@@ -458,14 +460,14 @@ func clearDisplayRange(handle uintptr, fillChar rune, attributes WORD, fromCoord
 		// lines between
 		linesBetween := toCoord.Y - fromCoord.Y - 1
 		if linesBetween > 0 {
-			n, err = clearDisplayRect(handle, fillChar, attributes, COORD{X: 0, Y: fromCoord.Y + 1}, COORD{X: windowSize.X - 1, Y: toCoord.Y - 1}, windowSize)
+			n, err = clearDisplayRect(handle, attributes, COORD{X: 0, Y: fromCoord.Y + 1}, COORD{X: toCoord.X, Y: toCoord.Y - 1})
 			if err != nil {
 				return nw, err
 			}
 			nw += n
 		}
 		// lines at end
-		n, err = clearDisplayRect(handle, fillChar, attributes, COORD{X: 0, Y: toCoord.Y}, toCoord, windowSize)
+		n, err = clearDisplayRect(handle, attributes, COORD{X: 0, Y: toCoord.Y}, toCoord)
 		if err != nil {
 			return nw, err
 		}
@@ -593,6 +595,7 @@ func (term *WindowsTerminal) HandleOutputCommand(handle uintptr, command []byte)
 	n = len(command)
 
 	parsedCommand := parseAnsiCommand(command)
+	logrus.Debugf("[windows] HandleOutputCommand: %v", parsedCommand)
 
 	// console settings changes need to happen in atomic way
 	term.outMutex.Lock()
@@ -648,6 +651,7 @@ func (term *WindowsTerminal) HandleOutputCommand(handle uintptr, command []byte)
 			column = int16(screenBufferInfo.Window.Right) + 1
 		}
 		// The numbers are not 0 based, but 1 based
+		logrus.Debugf("[windows] HandleOutputCommmand: Moving cursor to (%v,%v)", column-1, line-1)
 		if err := setConsoleCursorPosition(handle, false, column-1, line-1); err != nil {
 			return n, err
 		}
@@ -715,9 +719,9 @@ func (term *WindowsTerminal) HandleOutputCommand(handle uintptr, command []byte)
 		switch value {
 		case 0:
 			start = screenBufferInfo.CursorPosition
-			// end of the screen
-			end.X = screenBufferInfo.MaximumWindowSize.X - 1
-			end.Y = screenBufferInfo.MaximumWindowSize.Y - 1
+			// end of the buffer
+			end.X = screenBufferInfo.Size.X - 1
+			end.Y = screenBufferInfo.Size.Y - 1
 			// cursor
 			cursor = screenBufferInfo.CursorPosition
 		case 1:
@@ -733,20 +737,21 @@ func (term *WindowsTerminal) HandleOutputCommand(handle uintptr, command []byte)
 			// start of the screen
 			start.X = 0
 			start.Y = 0
-			// end of the screen
-			end.X = screenBufferInfo.MaximumWindowSize.X - 1
-			end.Y = screenBufferInfo.MaximumWindowSize.Y - 1
+			// end of the buffer
+			end.X = screenBufferInfo.Size.X - 1
+			end.Y = screenBufferInfo.Size.Y - 1
 			// cursor
 			cursor.X = 0
 			cursor.Y = 0
 		}
-		if _, err := clearDisplayRange(uintptr(handle), ' ', term.screenBufferInfo.Attributes, start, end, screenBufferInfo.MaximumWindowSize); err != nil {
+		if _, err := clearDisplayRange(uintptr(handle), term.screenBufferInfo.Attributes, start, end); err != nil {
 			return n, err
 		}
 		// remember the the cursor position is 1 based
 		if err := setConsoleCursorPosition(handle, false, int16(cursor.X), int16(cursor.Y)); err != nil {
 			return n, err
 		}
+
 	case "K":
 		// [K
 		// Clears all characters from the cursor position to the end of the line (including the character at the cursor position).
@@ -766,7 +771,7 @@ func (term *WindowsTerminal) HandleOutputCommand(handle uintptr, command []byte)
 			// start is where cursor is
 			start = screenBufferInfo.CursorPosition
 			// end of line
-			end.X = screenBufferInfo.MaximumWindowSize.X - 1
+			end.X = screenBufferInfo.Size.X - 1
 			end.Y = screenBufferInfo.CursorPosition.Y
 			// cursor remains the same
 			cursor = screenBufferInfo.CursorPosition
@@ -782,15 +787,15 @@ func (term *WindowsTerminal) HandleOutputCommand(handle uintptr, command []byte)
 		case 2:
 			// start of the line
 			start.X = 0
-			start.Y = screenBufferInfo.MaximumWindowSize.Y - 1
+			start.Y = screenBufferInfo.CursorPosition.Y - 1
 			// end of the line
-			end.X = screenBufferInfo.MaximumWindowSize.X - 1
-			end.Y = screenBufferInfo.MaximumWindowSize.Y - 1
+			end.X = screenBufferInfo.Size.X - 1
+			end.Y = screenBufferInfo.CursorPosition.Y - 1
 			// cursor
 			cursor.X = 0
-			cursor.Y = screenBufferInfo.MaximumWindowSize.Y - 1
+			cursor.Y = screenBufferInfo.CursorPosition.Y - 1
 		}
-		if _, err := clearDisplayRange(uintptr(handle), ' ', term.screenBufferInfo.Attributes, start, end, screenBufferInfo.MaximumWindowSize); err != nil {
+		if _, err := clearDisplayRange(uintptr(handle), term.screenBufferInfo.Attributes, start, end); err != nil {
 			return n, err
 		}
 		// remember the the cursor position is 1 based
@@ -1037,8 +1042,7 @@ func (term *WindowsTerminal) HandleInputSequence(fd uintptr, command []byte) (n
 }
 
 func marshal(c COORD) uintptr {
-	// works only on intel-endian machines
-	return uintptr(uint32(uint32(uint16(c.Y))<<16 | uint32(uint16(c.X))))
+	return uintptr(*((*DWORD)(unsafe.Pointer(&c))))
 }
 
 // IsConsole returns true if the given file descriptor is a terminal.

pkg/term/winconsole/term_emulator.go

@@ -1,6 +1,7 @@
 package winconsole
 
 import (
+	"fmt"
 	"io"
 	"strconv"
 	"strings"
@@ -206,6 +207,21 @@ func (c *ansiCommand) getParam(index int) string {
 	return ""
 }
 
+func (ac *ansiCommand) String() string {
+	return fmt.Sprintf("0x%v \"%v\" (\"%v\")",
+		bytesToHex(ac.CommandBytes),
+		ac.Command,
+		strings.Join(ac.Parameters, "\",\""))
+}
+
+func bytesToHex(b []byte) string {
+	hex := make([]string, len(b))
+	for i, ch := range b {
+		hex[i] = fmt.Sprintf("%X", ch)
+	}
+	return strings.Join(hex, "")
+}
+
 func parseInt16OrDefault(s string, defaultValue int16) (n int16, err error) {
 	if s == "" {
 		return defaultValue, nil

vendor/src/github.com/docker/libcontainer/.gitignore

@@ -1 +1,2 @@
+bundles
 nsinit/nsinit

vendor/src/github.com/docker/libcontainer/Makefile

@@ -29,3 +29,5 @@ local:
 validate:
 	hack/validate.sh
 
+binary: all
+	docker run --rm --privileged -v $(CURDIR)/bundles:/go/bin dockercore/libcontainer make direct-install

vendor/src/github.com/docker/libcontainer/README.md

@@ -141,6 +141,9 @@ container.Resume()
 It is able to spawn new containers or join existing containers.  A root
 filesystem must be provided for use along with a container configuration file.
 
+To build `nsinit`, run `make binary`. It will save the binary into
+`bundles/nsinit`.
+
 To use `nsinit`, cd into a Linux rootfs and copy a `container.json` file into 
 the directory with your specified configuration. Environment, networking, 
 and different capabilities for the container are specified in this file. 

vendor/src/github.com/docker/libcontainer/cgroups/systemd/apply_systemd.go

@@ -3,7 +3,6 @@
 package systemd
 
 import (
-	"bytes"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -247,6 +246,21 @@ func writeFile(dir, file, data string) error {
 	return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
 }
 
+func join(c *configs.Cgroup, subsystem string, pid int) (string, error) {
+	path, err := getSubsystemPath(c, subsystem)
+	if err != nil {
+		return "", err
+	}
+	if err := os.MkdirAll(path, 0755); err != nil && !os.IsExist(err) {
+		return "", err
+	}
+	if err := writeFile(path, "cgroup.procs", strconv.Itoa(pid)); err != nil {
+		return "", err
+	}
+
+	return path, nil
+}
+
 func joinCpu(c *configs.Cgroup, pid int) error {
 	path, err := getSubsystemPath(c, "cpu")
 	if err != nil {
@@ -266,16 +280,11 @@ func joinCpu(c *configs.Cgroup, pid int) error {
 }
 
 func joinFreezer(c *configs.Cgroup, pid int) error {
-	path, err := getSubsystemPath(c, "freezer")
-	if err != nil {
+	if _, err := join(c, "freezer", pid); err != nil {
 		return err
 	}
 
-	if err := os.MkdirAll(path, 0755); err != nil && !os.IsExist(err) {
-		return err
-	}
-
-	return ioutil.WriteFile(filepath.Join(path, "cgroup.procs"), []byte(strconv.Itoa(pid)), 0700)
+	return nil
 }
 
 func getSubsystemPath(c *configs.Cgroup, subsystem string) (string, error) {
@@ -303,21 +312,15 @@ func (m *Manager) Freeze(state configs.FreezerState) error {
 		return err
 	}
 
-	if err := ioutil.WriteFile(filepath.Join(path, "freezer.state"), []byte(state), 0); err != nil {
+	prevState := m.Cgroups.Freezer
+	m.Cgroups.Freezer = state
+
+	freezer := subsystems["freezer"]
+	err = freezer.Set(path, m.Cgroups)
+	if err != nil {
+		m.Cgroups.Freezer = prevState
 		return err
 	}
-	for {
-		state_, err := ioutil.ReadFile(filepath.Join(path, "freezer.state"))
-		if err != nil {
-			return err
-		}
-		if string(state) == string(bytes.TrimSpace(state_)) {
-			break
-		}
-		time.Sleep(1 * time.Millisecond)
-	}
-
-	m.Cgroups.Freezer = state
 
 	return nil
 }
@@ -366,29 +369,16 @@ func getUnitName(c *configs.Cgroup) string {
 // because systemd will re-write the device settings if it needs to re-apply the cgroup context.
 // This happens at least for v208 when any sibling unit is started.
 func joinDevices(c *configs.Cgroup, pid int) error {
-	path, err := getSubsystemPath(c, "devices")
+	path, err := join(c, "devices", pid)
 	if err != nil {
 		return err
 	}
 
-	if err := os.MkdirAll(path, 0755); err != nil && !os.IsExist(err) {
+	devices := subsystems["devices"]
+	if err := devices.Set(path, c); err != nil {
 		return err
 	}
 
-	if err := ioutil.WriteFile(filepath.Join(path, "cgroup.procs"), []byte(strconv.Itoa(pid)), 0700); err != nil {
-		return err
-	}
-
-	if !c.AllowAllDevices {
-		if err := writeFile(path, "devices.deny", "a"); err != nil {
-			return err
-		}
-	}
-	for _, dev := range c.AllowedDevices {
-		if err := writeFile(path, "devices.allow", dev.CgroupString()); err != nil {
-			return err
-		}
-	}
 	return nil
 }
 

vendor/src/github.com/docker/libcontainer/configs/namespaces.go

@@ -16,6 +16,17 @@ const (
 	NEWUSER NamespaceType = "NEWUSER"
 )
 
+func NamespaceTypes() []NamespaceType {
+	return []NamespaceType{
+		NEWNET,
+		NEWPID,
+		NEWNS,
+		NEWUTS,
+		NEWIPC,
+		NEWUSER,
+	}
+}
+
 // Namespace defines configuration for each namespace.  It specifies an
 // alternate path that is able to be joined via setns.
 type Namespace struct {

vendor/src/github.com/docker/libcontainer/container_linux.go

@@ -306,5 +306,11 @@ func (c *linuxContainer) currentState() (*State, error) {
 	for _, ns := range c.config.Namespaces {
 		state.NamespacePaths[ns.Type] = ns.GetPath(c.initProcess.pid())
 	}
+	for _, nsType := range configs.NamespaceTypes() {
+		if _, ok := state.NamespacePaths[nsType]; !ok {
+			ns := configs.Namespace{Type: nsType}
+			state.NamespacePaths[ns.Type] = ns.GetPath(c.initProcess.pid())
+		}
+	}
 	return state, nil
 }

vendor/src/github.com/docker/libcontainer/container_linux_test.go

@@ -130,7 +130,8 @@ func TestGetContainerState(t *testing.T) {
 				{Type: configs.NEWNS},
 				{Type: configs.NEWNET, Path: expectedNetworkPath},
 				{Type: configs.NEWUTS},
-				{Type: configs.NEWIPC},
+				// emulate host for IPC
+				//{Type: configs.NEWIPC},
 			},
 		},
 		initProcess: &mockProcess{

vendor/src/github.com/docker/libcontainer/integration/exec_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/docker/libcontainer"
+	"github.com/docker/libcontainer/cgroups/systemd"
 	"github.com/docker/libcontainer/configs"
 )
 
@@ -481,6 +482,17 @@ func TestProcessCaps(t *testing.T) {
 }
 
 func TestFreeze(t *testing.T) {
+	testFreeze(t, false)
+}
+
+func TestSystemdFreeze(t *testing.T) {
+	if !systemd.UseSystemd() {
+		t.Skip("Systemd is unsupported")
+	}
+	testFreeze(t, true)
+}
+
+func testFreeze(t *testing.T, systemd bool) {
 	if testing.Short() {
 		return
 	}
@@ -497,6 +509,9 @@ func TestFreeze(t *testing.T) {
 	defer remove(rootfs)
 
 	config := newTemplateConfig(rootfs)
+	if systemd {
+		config.Cgroups.Slice = "system.slice"
+	}
 
 	factory, err := libcontainer.New(root, libcontainer.Cgroupfs)
 	if err != nil {
@@ -559,3 +574,77 @@ func TestFreeze(t *testing.T) {
 		t.Fatal(s.String())
 	}
 }
+
+func TestContainerState(t *testing.T) {
+	if testing.Short() {
+		return
+	}
+	root, err := newTestRoot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(root)
+
+	rootfs, err := newRootfs()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer remove(rootfs)
+
+	l, err := os.Readlink("/proc/1/ns/ipc")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	config := newTemplateConfig(rootfs)
+	config.Namespaces = configs.Namespaces([]configs.Namespace{
+		{Type: configs.NEWNS},
+		{Type: configs.NEWUTS},
+		// host for IPC
+		//{Type: configs.NEWIPC},
+		{Type: configs.NEWPID},
+		{Type: configs.NEWNET},
+	})
+
+	factory, err := libcontainer.New(root, libcontainer.Cgroupfs)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	container, err := factory.Create("test", config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer container.Destroy()
+
+	stdinR, stdinW, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	p := &libcontainer.Process{
+		Args:  []string{"cat"},
+		Env:   standardEnvironment,
+		Stdin: stdinR,
+	}
+	err = container.Start(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	stdinR.Close()
+	defer p.Signal(os.Kill)
+
+	st, err := container.State()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	l1, err := os.Readlink(st.NamespacePaths[configs.NEWIPC])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if l1 != l {
+		t.Fatal("Container using non-host ipc namespace")
+	}
+	stdinW.Close()
+	p.Wait()
+}

vendor/src/github.com/docker/libcontainer/integration/utils_test.go

@@ -68,9 +68,14 @@ func copyBusybox(dest string) error {
 }
 
 func newContainer(config *configs.Config) (libcontainer.Container, error) {
+	cgm := libcontainer.Cgroupfs
+	if config.Cgroups != nil && config.Cgroups.Slice == "system.slice" {
+		cgm = libcontainer.SystemdCgroups
+	}
+
 	factory, err := libcontainer.New(".",
 		libcontainer.InitArgs(os.Args[0], "init", "--"),
-		libcontainer.Cgroupfs,
+		cgm,
 	)
 	if err != nil {
 		return nil, err

vendor/src/github.com/docker/libcontainer/nsinit/main.go

@@ -13,7 +13,7 @@ func main() {
 	app.Version = "2"
 	app.Author = "libcontainer maintainers"
 	app.Flags = []cli.Flag{
-		cli.StringFlag{Name: "root", Value: ".", Usage: "root directory for containers"},
+		cli.StringFlag{Name: "root", Value: "/var/run/nsinit", Usage: "root directory for containers"},
 		cli.StringFlag{Name: "log-file", Value: "", Usage: "set the log file to output logs to"},
 		cli.BoolFlag{Name: "debug", Usage: "enable debug output in the logs"},
 	}