When linking, position of `-l` flags is important since
they muse come _after_ any object files which uses symbols
from a specified library, that is due to --as-needed binutils
ld flag enabled by default

Signed-off-by: Maxim Ivanov <ivanov.maxim@gmail.com>
(cherry picked from commit 24152a4)

…by#20638

Signed-off-by: Lei Jitang <leijitang@huawei.com>
(cherry picked from commit fb0ac1a)

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 93ad9c3)

Because devices will be bind-mounted instead of using `mknod`, we need
to make sure the source exists and filter the list by only those whose
source is a valid path/current device entry.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)

(cherry picked from commit 9a554e8)

In cases where the a plugin responds with both a null or empty volume
and a null or empty Err, the daemon would panic.
This is because we assumed the idiom if `err` is nil, then `v` must not
be but in reality the plugin may return whatever it wants and we want to
make sure it doesn't harm the daemon.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 96c79a1)

The execdriver pipes setup uses OS pipes with fds so that they can be
chown'ed to the remapped root user for proper access. Recent flakiness
in certain short-lived tests (usually via the "exec" path) reveals that
the copy routines are not completing before exit/tear-down.

This fix adds synchronization and proper closure such that these
routines exit successfully.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)

(cherry picked from commit 9953867)

Since Docker is already skipping newlines in /etc/sub{uid,gid},
this patch skips commented out lines - otherwise Docker fails to start.
Add unit test also.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
(cherry picked from commit bf04d68)

The Releases file(s) and other bits for EOL-ed distros such as Ubuntu
Vivid should remain untouched when we are releasing debs.

However, few files in https://apt.dockerproject.org/repo/dists/ubuntu-vivid/
were being updated for the docker 1.10 release including the Release files.
This is due to apt-ftparchive generating index files for vivid as well,
due to the stale apt-ftparchive.conf

This change always creates config using suites in contrib/reprepro/suites.sh.

Signed-off-by: Anusha Ragunathan <anusha@docker.com>
(cherry picked from commit 204c780)

Stop using global variables as prefixes to inject the writer header.
That can cause issues when two writers set the length of the buffer in
the same header concurrently.

Stop Writing to the internal buffer twice for each write. This could
mess up with the ordering information is written.

Signed-off-by: David Calavera <david.calavera@gmail.com>
(cherry picked from commit 443a5c2)

This improves on an earlier change by adding another keyserver and using a for loop instead of duplicating the command

Signed-off-by: Mike Dougherty <mike.dougherty@docker.com>
(cherry picked from commit adac575)

Concurrent uploads which share layers worked correctly as of moby#18353,
but unfortunately moby#18785 caused a regression. This PR removed the logic
that shares digests between different push sessions. This overlooked the
case where one session was waiting for another session to upload a
layer.

This commit adds back the ability to propagate this digest information,
using the distribution.Descriptor type because this is what is received
from stats and uploads, and also what is ultimately needed for building
the manifest.

Surprisingly, there was no test covering this case. This commit adds
one. It fails without the fix.

See recent comments on moby#9132.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
(cherry picked from commit 5c99eeb)

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
(cherry picked from commit 843a119)

On 32 bit x86 this is a multiplexing syscall for the system V
ipc syscalls such as shmget, and so needs to be allowed for
shared memory access for 32 bit binaries.

Fixes moby#20733

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit 31410a6)

We generally want to filter the personality(2) syscall, as it
allows disabling ASLR, and turning on some poorly supported
emulations that have been the target of CVEs. However the use
cases for reading the current value, setting the default
PER_LINUX personality, and setting PER_LINUX32 for 32 bit
emulation are fine.

See issue moby#20634

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit 39b799a)

This fixes an issue that caused the client to hang forever if the
process died before the code arrived to exit the `Kill` function.

Signed-off-by: David Calavera <david.calavera@gmail.com>
(cherry picked from commit 1a729c3)

This will allow us to have a windows-to-linux CI, where the linux host
can be anywhere, connecting with TLS.

Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit f4a1e3d)

Signed-off-by: Tibor Vass <tibor@docker.com>