This makes sure fsdiff doesn't try to unmount things that shouldn't be.

**Note**: This is intended as a temporary solution to have as minor a
change as possible for 1.11.1. A bigger change will be required in order
to support container re-attach.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 7342060)

Signed-off-by: Ken Cochrane <kencochrane@gmail.com>
(cherry picked from commit 09ca4dd)

This gives discovery a chance to initialize, particularly if the K/V
store being used is in a container.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit 2dce79e)

Signed-off-by: Alessandro Boch <aboch@docker.com>
(cherry picked from commit f198dfd)

Rework memoryStore so that filters and apply run
on a cloned list of containers after the lock has
been released. This avoids possible deadlocks when
these filter/apply callbacks take locks for a
container.

Fixes moby#22732

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit bd2b3d3)

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 81d24e7)

In order to do this, allow the socketcall syscall in the default
seccomp profile. This is a multiplexing syscall for the socket
operations, which is becoming obsolete gradually, but it is used
in some architectures. libseccomp has special handling for it for
x86 where it is common, so we did not need it in the profile,
but does not have any handling for ppc64le. It turns out that the
Debian images we use for tests do use the socketcall, while the
newer images such as Ubuntu 16.04 do not. Enabling this does no
harm as we allow all the socket operations anyway, and we allow
the similar ipc call for similar reasons already.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit a83cedd)

1) docker create / run / start: this would create a snapshot device and mounts it onto the filesystem.
So the first time GET operation is called. it will create the rootfs directory and return the path to rootfs
2) Now when I do docker commit. It will call the GET operation second time. This time the refcount will check
that the count > 1 (count=2). so the rootfs already exists, it will just return the path to rootfs.

Earlier it was just returning the mp: /var/lib/docker/devicemapper/mnt/{ID} and hence the inconsistent paths error.

Signed-off-by: Shishir Mahajan <shishir.mahajan@redhat.com>
(cherry picked from commit 09d0720)
Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>