From 28cc28338420aec4814b1093fc85b09c613947b1 Mon Sep 17 00:00:00 2001
From: Brandon Philips <brandon@ifup.co>
Date: Mon, 27 Jan 2014 12:16:45 -0800
Subject: [PATCH 001/403] fix(CONTRIBUTING): Developer Certificate of Origin
 w/o Grant

In 7fb55f77250a9b52b0515a7e655ecc605ae452ca the DCO lost the grant so
change the title back to just DCO.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Upstream-commit: 8458f99a387ae70cfaa1e43759919fe414c55505
Component: engine
---
 components/engine/CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/CONTRIBUTING.md b/components/engine/CONTRIBUTING.md
index f4acb3e716..7bd7ea60d5 100644
--- a/components/engine/CONTRIBUTING.md
+++ b/components/engine/CONTRIBUTING.md
@@ -113,7 +113,7 @@ pass it on as an open-source patch.  The rules are pretty simple: if you
 can certify the below:
 
 ```
-Docker Developer Grant and Certificate of Origin 1.1
+Docker Developer Certificate of Origin 1.1
 
 By making a contribution to the Docker Project ("Project"), I represent and
 warrant that:

From 1ed42315f3d9ef0d7a3e07cce3211a449e028fc8 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Fri, 27 Dec 2013 10:47:42 -0700
Subject: [PATCH 002/403] Move UserLookup functionality into a separate
 pkg/user submodule that implements proper parsing of /etc/passwd and
 /etc/group, and use that to add support for "docker run -u user:group" and
 for getting supplementary groups (if ":group" is not specified)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: ee93f6185be3ae73c16cf41ae397bae3ce2f6c55
Component: engine
---
 components/engine/execdriver/lxc/init.go      |  27 +-
 .../engine/integration/buildfile_test.go      |  80 ++++++
 components/engine/pkg/user/MAINTAINERS        |   1 +
 components/engine/pkg/user/user.go            | 245 ++++++++++++++++++
 components/engine/pkg/user/user_test.go       |  94 +++++++
 components/engine/utils/utils.go              |  31 ---
 6 files changed, 430 insertions(+), 48 deletions(-)
 create mode 100644 components/engine/pkg/user/MAINTAINERS
 create mode 100644 components/engine/pkg/user/user.go
 create mode 100644 components/engine/pkg/user/user_test.go

diff --git a/components/engine/execdriver/lxc/init.go b/components/engine/execdriver/lxc/init.go
index 7c2b039c50..d3af40049f 100644
--- a/components/engine/execdriver/lxc/init.go
+++ b/components/engine/execdriver/lxc/init.go
@@ -4,11 +4,10 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/pkg/netlink"
-	"github.com/dotcloud/docker/utils"
+	"github.com/dotcloud/docker/pkg/user"
 	"github.com/syndtr/gocapability/capability"
 	"net"
 	"os"
-	"strconv"
 	"strings"
 	"syscall"
 )
@@ -79,28 +78,22 @@ func setupWorkingDirectory(args *execdriver.InitArgs) error {
 
 // Takes care of dropping privileges to the desired user
 func changeUser(args *execdriver.InitArgs) error {
-	if args.User == "" {
-		return nil
-	}
-	userent, err := utils.UserLookup(args.User)
+	uid, gid, suppGids, err := user.GetUserGroupSupplementary(
+		args.User,
+		syscall.Getuid(), syscall.Getgid(),
+	)
 	if err != nil {
-		return fmt.Errorf("Unable to find user %v: %v", args.User, err)
+		return err
 	}
 
-	uid, err := strconv.Atoi(userent.Uid)
-	if err != nil {
-		return fmt.Errorf("Invalid uid: %v", userent.Uid)
+	if err := syscall.Setgroups(suppGids); err != nil {
+		return fmt.Errorf("Setgroups failed: %v", err)
 	}
-	gid, err := strconv.Atoi(userent.Gid)
-	if err != nil {
-		return fmt.Errorf("Invalid gid: %v", userent.Gid)
-	}
-
 	if err := syscall.Setgid(gid); err != nil {
-		return fmt.Errorf("setgid failed: %v", err)
+		return fmt.Errorf("Setgid failed: %v", err)
 	}
 	if err := syscall.Setuid(uid); err != nil {
-		return fmt.Errorf("setuid failed: %v", err)
+		return fmt.Errorf("Setuid failed: %v", err)
 	}
 
 	return nil
diff --git a/components/engine/integration/buildfile_test.go b/components/engine/integration/buildfile_test.go
index 16a51e575d..0a8479e50a 100644
--- a/components/engine/integration/buildfile_test.go
+++ b/components/engine/integration/buildfile_test.go
@@ -148,6 +148,86 @@ RUN [ "$(/hello.sh)" = "hello world" ]
 		nil,
 	},
 
+	// Users and groups
+	{
+		`
+FROM {IMAGE}
+
+# Make sure our defaults work
+RUN [ "$(id -u):$(id -g)" = '0:0' ]
+RUN [ "$(id -un):$(id -gn)" = 'root:root' ]
+
+# TODO decide if "args.user = strconv.Itoa(syscall.Getuid())" is acceptable behavior for changeUser in sysvinit instead of "return nil" when "USER" isn't specified (so that we get the proper group list even if that is the empty list, even in the default case of not supplying an explicit USER to run as, which implies USER 0)
+USER root
+RUN [ "$(id -G) -- $(id -Gn)" = '0 -- root' ]
+
+# Setup dockerio user and group
+RUN echo 'dockerio:x:1000:1000::/bin:/bin/false' >> /etc/passwd
+RUN echo 'dockerio:x:1000:' >> /etc/group
+
+# Make sure we can switch to our user and all the information is exactly as we expect it to be
+USER dockerio
+RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+
+# Switch back to root and double check that worked exactly as we might expect it to
+USER root
+RUN [ "$(id -u):$(id -g)" = '0:0' ]
+RUN [ "$(id -un):$(id -gn)" = 'root:root' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '0 -- root' ]
+
+# Add a "supplementary" group for our dockerio user
+RUN echo 'supplementary:x:1001:dockerio' >> /etc/group
+
+# ... and then go verify that we get it like we expect
+USER dockerio
+RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1000 1001 -- dockerio supplementary' ]
+USER 1000
+RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1000 1001 -- dockerio supplementary' ]
+
+# and finally, super test the new "user:group" syntax
+USER dockerio:dockerio
+RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+USER 1000:dockerio
+RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+USER dockerio:1000
+RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+USER 1000:1000
+RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+USER dockerio:supplementary
+RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
+USER dockerio:1001
+RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
+USER 1000:supplementary
+RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
+USER 1000:1001
+RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
+RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
+RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
+`,
+		nil,
+		nil,
+	},
+
 	// Environment variable
 	{
 		`
diff --git a/components/engine/pkg/user/MAINTAINERS b/components/engine/pkg/user/MAINTAINERS
new file mode 100644
index 0000000000..18e05a3070
--- /dev/null
+++ b/components/engine/pkg/user/MAINTAINERS
@@ -0,0 +1 @@
+Tianon Gravi <admwiggin@gmail.com> (@tianon)
diff --git a/components/engine/pkg/user/user.go b/components/engine/pkg/user/user.go
new file mode 100644
index 0000000000..30fc90f0e4
--- /dev/null
+++ b/components/engine/pkg/user/user.go
@@ -0,0 +1,245 @@
+package user
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"os"
+	"reflect"
+	"strconv"
+	"strings"
+)
+
+type User struct {
+	Name  string
+	Pass  string
+	Uid   int
+	Gid   int
+	Gecos string
+	Home  string
+	Shell string
+}
+
+type Group struct {
+	Name string
+	Pass string
+	Gid  int
+	List []string
+}
+
+func parseLine(line string, v ...interface{}) {
+	if line == "" {
+		return
+	}
+
+	parts := strings.Split(line, ":")
+	for i, p := range parts {
+		if len(v) <= i {
+			// if we have more "parts" than we have places to put them, bail for great "tolerance" of naughty configuration files
+			break
+		}
+
+		t := reflect.TypeOf(v[i])
+		if t.Kind() != reflect.Ptr {
+			// panic, because this is a programming/logic error, not a runtime one
+			panic("parseLine expects only pointers!  argument " + strconv.Itoa(i) + " is not a pointer!")
+		}
+
+		switch t.Elem().Kind() {
+		case reflect.String:
+			// "root", "adm", "/bin/bash"
+			*v[i].(*string) = p
+		case reflect.Int:
+			// "0", "4", "1000"
+			*v[i].(*int), _ = strconv.Atoi(p)
+			// ignore string to int conversion errors, for great "tolerance" of naughty configuration files
+		case reflect.Slice, reflect.Array:
+			// "", "root", "root,adm,daemon"
+			list := []string{}
+			if p != "" {
+				list = strings.Split(p, ",")
+			}
+			*v[i].(*[]string) = list
+		}
+	}
+}
+
+func ParsePasswd() ([]*User, error) {
+	return ParsePasswdFilter(nil)
+}
+
+func ParsePasswdFilter(filter func(*User) bool) ([]*User, error) {
+	f, err := os.Open("/etc/passwd")
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	return parsePasswdFile(f, filter)
+}
+
+func parsePasswdFile(r io.Reader, filter func(*User) bool) ([]*User, error) {
+	var (
+		s   = bufio.NewScanner(r)
+		out = []*User{}
+	)
+
+	for s.Scan() {
+		if err := s.Err(); err != nil {
+			return nil, err
+		}
+
+		text := strings.TrimSpace(s.Text())
+		if text == "" {
+			continue
+		}
+
+		// see: man 5 passwd
+		//  name:password:UID:GID:GECOS:directory:shell
+		// Name:Pass:Uid:Gid:Gecos:Home:Shell
+		//  root:x:0:0:root:/root:/bin/bash
+		//  adm:x:3:4:adm:/var/adm:/bin/false
+		p := &User{}
+		parseLine(
+			text,
+			&p.Name, &p.Pass, &p.Uid, &p.Gid, &p.Gecos, &p.Home, &p.Shell,
+		)
+
+		if filter == nil || filter(p) {
+			out = append(out, p)
+		}
+	}
+
+	return out, nil
+}
+
+func ParseGroup() ([]*Group, error) {
+	return ParseGroupFilter(nil)
+}
+
+func ParseGroupFilter(filter func(*Group) bool) ([]*Group, error) {
+	f, err := os.Open("/etc/group")
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	return parseGroupFile(f, filter)
+}
+
+func parseGroupFile(r io.Reader, filter func(*Group) bool) ([]*Group, error) {
+	var (
+		s   = bufio.NewScanner(r)
+		out = []*Group{}
+	)
+
+	for s.Scan() {
+		if err := s.Err(); err != nil {
+			return nil, err
+		}
+
+		text := s.Text()
+		if text == "" {
+			continue
+		}
+
+		// see: man 5 group
+		//  group_name:password:GID:user_list
+		// Name:Pass:Gid:List
+		//  root:x:0:root
+		//  adm:x:4:root,adm,daemon
+		p := &Group{}
+		parseLine(
+			text,
+			&p.Name, &p.Pass, &p.Gid, &p.List,
+		)
+
+		if filter == nil || filter(p) {
+			out = append(out, p)
+		}
+	}
+
+	return out, nil
+}
+
+// Given a string like "user", "1000", "user:group", "1000:1000", returns the uid, gid, and list of supplementary group IDs, if possible.
+func GetUserGroupSupplementary(userSpec string, defaultUid int, defaultGid int) (int, int, []int, error) {
+	var (
+		uid      = defaultUid
+		gid      = defaultGid
+		suppGids = []int{}
+
+		userArg, groupArg string
+	)
+
+	// allow for userArg to have either "user" syntax, or optionally "user:group" syntax
+	parseLine(userSpec, &userArg, &groupArg)
+
+	users, err := ParsePasswdFilter(func(u *User) bool {
+		if userArg == "" {
+			return u.Uid == uid
+		}
+		return u.Name == userArg || strconv.Itoa(u.Uid) == userArg
+	})
+	if err != nil && !os.IsNotExist(err) {
+		if userArg == "" {
+			userArg = strconv.Itoa(uid)
+		}
+		return 0, 0, nil, fmt.Errorf("Unable to find user %v: %v", userArg, err)
+	}
+
+	haveUser := users != nil && len(users) > 0
+	if haveUser {
+		// if we found any user entries that matched our filter, let's take the first one as "correct"
+		uid = users[0].Uid
+		gid = users[0].Gid
+	} else if userArg != "" {
+		// we asked for a user but didn't find them...  let's check to see if we wanted a numeric user
+		uid, err = strconv.Atoi(userArg)
+		if err != nil {
+			// not numeric - we have to bail
+			return 0, 0, nil, fmt.Errorf("Unable to find user %v", userArg)
+		}
+
+		// if userArg couldn't be found in /etc/passwd but is numeric, just roll with it - this is legit
+	}
+
+	if groupArg != "" || (haveUser && users[0].Name != "") {
+		groups, err := ParseGroupFilter(func(g *Group) bool {
+			if groupArg != "" {
+				return g.Name == groupArg || strconv.Itoa(g.Gid) == groupArg
+			}
+			for _, u := range g.List {
+				if u == users[0].Name {
+					return true
+				}
+			}
+			return false
+		})
+		if err != nil && !os.IsNotExist(err) {
+			return 0, 0, nil, fmt.Errorf("Unable to find groups for user %v: %v", users[0].Name, err)
+		}
+
+		haveGroup := groups != nil && len(groups) > 0
+		if groupArg != "" {
+			if haveGroup {
+				// if we found any group entries that matched our filter, let's take the first one as "correct"
+				gid = groups[0].Gid
+			} else {
+				// we asked for a group but didn't find id...  let's check to see if we wanted a numeric group
+				gid, err = strconv.Atoi(groupArg)
+				if err != nil {
+					// not numeric - we have to bail
+					return 0, 0, nil, fmt.Errorf("Unable to find group %v", groupArg)
+				}
+
+				// if groupArg couldn't be found in /etc/group but is numeric, just roll with it - this is legit
+			}
+		} else if haveGroup {
+			suppGids = make([]int, len(groups))
+			for i, group := range groups {
+				suppGids[i] = group.Gid
+			}
+		}
+	}
+
+	return uid, gid, suppGids, nil
+}
diff --git a/components/engine/pkg/user/user_test.go b/components/engine/pkg/user/user_test.go
new file mode 100644
index 0000000000..136632c27e
--- /dev/null
+++ b/components/engine/pkg/user/user_test.go
@@ -0,0 +1,94 @@
+package user
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestUserParseLine(t *testing.T) {
+	var (
+		a, b string
+		c    []string
+		d    int
+	)
+
+	parseLine("", &a, &b)
+	if a != "" || b != "" {
+		t.Fatalf("a and b should be empty ('%v', '%v')", a, b)
+	}
+
+	parseLine("a", &a, &b)
+	if a != "a" || b != "" {
+		t.Fatalf("a should be 'a' and b should be empty ('%v', '%v')", a, b)
+	}
+
+	parseLine("bad boys:corny cows", &a, &b)
+	if a != "bad boys" || b != "corny cows" {
+		t.Fatalf("a should be 'bad boys' and b should be 'corny cows' ('%v', '%v')", a, b)
+	}
+
+	parseLine("", &c)
+	if len(c) != 0 {
+		t.Fatalf("c should be empty (%#v)", c)
+	}
+
+	parseLine("d,e,f:g:h:i,j,k", &c, &a, &b, &c)
+	if a != "g" || b != "h" || len(c) != 3 || c[0] != "i" || c[1] != "j" || c[2] != "k" {
+		t.Fatalf("a should be 'g', b should be 'h', and c should be ['i','j','k'] ('%v', '%v', '%#v')", a, b, c)
+	}
+
+	parseLine("::::::::::", &a, &b, &c)
+	if a != "" || b != "" || len(c) != 0 {
+		t.Fatalf("a, b, and c should all be empty ('%v', '%v', '%#v')", a, b, c)
+	}
+
+	parseLine("not a number", &d)
+	if d != 0 {
+		t.Fatalf("d should be 0 (%v)", d)
+	}
+
+	parseLine("b:12:c", &a, &d, &b)
+	if a != "b" || b != "c" || d != 12 {
+		t.Fatalf("a should be 'b' and b should be 'c', and d should be 12 ('%v', '%v', %v)", a, b, d)
+	}
+}
+
+func TestUserParsePasswd(t *testing.T) {
+	users, err := parsePasswdFile(strings.NewReader(`
+root:x:0:0:root:/root:/bin/bash
+adm:x:3:4:adm:/var/adm:/bin/false
+this is just some garbage data
+`), nil)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if len(users) != 3 {
+		t.Fatalf("Expected 3 users, got %v", len(users))
+	}
+	if users[0].Uid != 0 || users[0].Name != "root" {
+		t.Fatalf("Expected users[0] to be 0 - root, got %v - %v", users[0].Uid, users[0].Name)
+	}
+	if users[1].Uid != 3 || users[1].Name != "adm" {
+		t.Fatalf("Expected users[1] to be 3 - adm, got %v - %v", users[1].Uid, users[1].Name)
+	}
+}
+
+func TestUserParseGroup(t *testing.T) {
+	groups, err := parseGroupFile(strings.NewReader(`
+root:x:0:root
+adm:x:4:root,adm,daemon
+this is just some garbage data
+`), nil)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if len(groups) != 3 {
+		t.Fatalf("Expected 3 groups, got %v", len(groups))
+	}
+	if groups[0].Gid != 0 || groups[0].Name != "root" || len(groups[0].List) != 1 {
+		t.Fatalf("Expected groups[0] to be 0 - root - 1 member, got %v - %v - %v", groups[0].Gid, groups[0].Name, len(groups[0].List))
+	}
+	if groups[1].Gid != 4 || groups[1].Name != "adm" || len(groups[1].List) != 3 {
+		t.Fatalf("Expected groups[1] to be 4 - adm - 3 members, got %v - %v - %v", groups[1].Gid, groups[1].Name, len(groups[1].List))
+	}
+}
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 542ab49702..5caf792549 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -836,37 +836,6 @@ func ParseRepositoryTag(repos string) (string, string) {
 	return repos, ""
 }
 
-type User struct {
-	Uid      string // user id
-	Gid      string // primary group id
-	Username string
-	Name     string
-	HomeDir  string
-}
-
-// UserLookup check if the given username or uid is present in /etc/passwd
-// and returns the user struct.
-// If the username is not found, an error is returned.
-func UserLookup(uid string) (*User, error) {
-	file, err := ioutil.ReadFile("/etc/passwd")
-	if err != nil {
-		return nil, err
-	}
-	for _, line := range strings.Split(string(file), "\n") {
-		data := strings.Split(line, ":")
-		if len(data) > 5 && (data[0] == uid || data[2] == uid) {
-			return &User{
-				Uid:      data[2],
-				Gid:      data[3],
-				Username: data[0],
-				Name:     data[4],
-				HomeDir:  data[5],
-			}, nil
-		}
-	}
-	return nil, fmt.Errorf("User not found in /etc/passwd")
-}
-
 // An StatusError reports an unsuccessful exit by a command.
 type StatusError struct {
 	Status     string

From 57b57cdf8c66e4f55d194bd0a1e9dd1ca891fc5b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 17 Jan 2014 13:41:38 -0800
Subject: [PATCH 003/403] Use type switch instead of reflection

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 4ffc52385cec66cbd930bc6b5ab828ed65f43dbb
Component: engine
---
 components/engine/pkg/user/user.go | 36 +++++++++++++-----------------
 1 file changed, 16 insertions(+), 20 deletions(-)

diff --git a/components/engine/pkg/user/user.go b/components/engine/pkg/user/user.go
index 30fc90f0e4..1672f7e679 100644
--- a/components/engine/pkg/user/user.go
+++ b/components/engine/pkg/user/user.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"reflect"
 	"strconv"
 	"strings"
 )
@@ -39,28 +38,25 @@ func parseLine(line string, v ...interface{}) {
 			break
 		}
 
-		t := reflect.TypeOf(v[i])
-		if t.Kind() != reflect.Ptr {
+		switch e := v[i].(type) {
+		case *string:
+			// "root", "adm", "/bin/bash"
+			*e = p
+		case *int:
+			// "0", "4", "1000"
+			// ignore string to int conversion errors, for great "tolerance" of naughty configuration files
+			*e, _ = strconv.Atoi(p)
+		case *[]string:
+			// "", "root", "root,adm,daemon"
+			if p != "" {
+				*e = strings.Split(p, ",")
+			} else {
+				*e = []string{}
+			}
+		default:
 			// panic, because this is a programming/logic error, not a runtime one
 			panic("parseLine expects only pointers!  argument " + strconv.Itoa(i) + " is not a pointer!")
 		}
-
-		switch t.Elem().Kind() {
-		case reflect.String:
-			// "root", "adm", "/bin/bash"
-			*v[i].(*string) = p
-		case reflect.Int:
-			// "0", "4", "1000"
-			*v[i].(*int), _ = strconv.Atoi(p)
-			// ignore string to int conversion errors, for great "tolerance" of naughty configuration files
-		case reflect.Slice, reflect.Array:
-			// "", "root", "root,adm,daemon"
-			list := []string{}
-			if p != "" {
-				list = strings.Split(p, ",")
-			}
-			*v[i].(*[]string) = list
-		}
 	}
 }
 

From 0e1ea1b20489d82a005aa4ba5d177728f36f1741 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Mon, 27 Jan 2014 23:14:30 -0700
Subject: [PATCH 004/403] Consolidate a bunch of the supplementary-groups tests
 to cut down on the number of RUN lines in a single Dockerfile within
 TestBuild

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: e8963748fca208e6015e3cb7981fc0bf07929e3e
Component: engine
---
 .../engine/integration/buildfile_test.go      | 59 ++++++-------------
 1 file changed, 19 insertions(+), 40 deletions(-)

diff --git a/components/engine/integration/buildfile_test.go b/components/engine/integration/buildfile_test.go
index 0a8479e50a..2165fe3b06 100644
--- a/components/engine/integration/buildfile_test.go
+++ b/components/engine/integration/buildfile_test.go
@@ -154,12 +154,11 @@ RUN [ "$(/hello.sh)" = "hello world" ]
 FROM {IMAGE}
 
 # Make sure our defaults work
-RUN [ "$(id -u):$(id -g)" = '0:0' ]
-RUN [ "$(id -un):$(id -gn)" = 'root:root' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)" = '0:0/root:root' ]
 
 # TODO decide if "args.user = strconv.Itoa(syscall.Getuid())" is acceptable behavior for changeUser in sysvinit instead of "return nil" when "USER" isn't specified (so that we get the proper group list even if that is the empty list, even in the default case of not supplying an explicit USER to run as, which implies USER 0)
 USER root
-RUN [ "$(id -G) -- $(id -Gn)" = '0 -- root' ]
+RUN [ "$(id -G):$(id -Gn)" = '0:root' ]
 
 # Setup dockerio user and group
 RUN echo 'dockerio:x:1000:1000::/bin:/bin/false' >> /etc/passwd
@@ -167,62 +166,42 @@ RUN echo 'dockerio:x:1000:' >> /etc/group
 
 # Make sure we can switch to our user and all the information is exactly as we expect it to be
 USER dockerio
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
 
 # Switch back to root and double check that worked exactly as we might expect it to
 USER root
-RUN [ "$(id -u):$(id -g)" = '0:0' ]
-RUN [ "$(id -un):$(id -gn)" = 'root:root' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '0 -- root' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '0:0/root:root/0:root' ]
 
 # Add a "supplementary" group for our dockerio user
 RUN echo 'supplementary:x:1001:dockerio' >> /etc/group
 
 # ... and then go verify that we get it like we expect
 USER dockerio
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 1001 -- dockerio supplementary' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000 1001:dockerio supplementary' ]
 USER 1000
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 1001 -- dockerio supplementary' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000 1001:dockerio supplementary' ]
 
-# and finally, super test the new "user:group" syntax
+# super test the new "user:group" syntax
 USER dockerio:dockerio
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
 USER 1000:dockerio
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
 USER dockerio:1000
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
 USER 1000:1000
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
 USER dockerio:supplementary
-RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1001/dockerio:supplementary/1001:supplementary' ]
 USER dockerio:1001
-RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1001/dockerio:supplementary/1001:supplementary' ]
 USER 1000:supplementary
-RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1001/dockerio:supplementary/1001:supplementary' ]
 USER 1000:1001
-RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
-RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1001/dockerio:supplementary/1001:supplementary' ]
+
+# make sure unknown uid/gid still works properly
+USER 1042:1043
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1042:1043/1042:1043/1043:1043' ]
 `,
 		nil,
 		nil,

From c7f0c458dfaf043b1e30c021121dab43c058cbfa Mon Sep 17 00:00:00 2001
From: James DeFelice <james.defelice@ishisystems.com>
Date: Fri, 31 Jan 2014 12:44:20 -0500
Subject: [PATCH 005/403] Update lxc_template.go

If networking is disabled, but then pipework is used later to add nics, the network still doesn't function. Using flags=up for empty networking fixes this.
Docker-DCO-1.1-Signed-off-by: James DeFelice <james.defelice@ishisystems.com> (github: jdef)
Upstream-commit: 17c124baf6a0f3725615b22aa52ca96ac5b95326
Component: engine
---
 components/engine/execdriver/lxc/lxc_template.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/execdriver/lxc/lxc_template.go b/components/engine/execdriver/lxc/lxc_template.go
index 705bdf5363..a89365f989 100644
--- a/components/engine/execdriver/lxc/lxc_template.go
+++ b/components/engine/execdriver/lxc/lxc_template.go
@@ -15,6 +15,7 @@ lxc.network.name = eth0
 {{else}}
 # network is disabled (-n=false)
 lxc.network.type = empty
+lxc.network.flags = up
 {{end}}
 
 # root filesystem

From 5a4e6a3400fb5e275c67ed436b2819598baacafe Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Wed, 5 Feb 2014 10:15:22 +1000
Subject: [PATCH 006/403] remove mention of #docker-meeting

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: d43c85961f3378607ace3e05dbab43ab2481699c
Component: engine
---
 components/engine/CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/CONTRIBUTING.md b/components/engine/CONTRIBUTING.md
index 93c1d11b1f..ba8c3d1a67 100644
--- a/components/engine/CONTRIBUTING.md
+++ b/components/engine/CONTRIBUTING.md
@@ -163,7 +163,7 @@ If you have any questions, please refer to the FAQ in the [docs](http://docs.doc
 * Step 1: learn the component inside out
 * Step 2: make yourself useful by contributing code, bugfixes, support etc.
 * Step 3: volunteer on the irc channel (#docker@freenode)
-* Step 4: propose yourself at a scheduled #docker-meeting
+* Step 4: propose yourself at a scheduled docker meeting in #docker-dev
 
 Don't forget: being a maintainer is a time investment. Make sure you will have time to make yourself available.
 You don't have to be a maintainer to make a difference on the project!

From 3ce6127194c14c5ee091aa39410e36fbf5b390b5 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 4 Feb 2014 17:13:00 +0100
Subject: [PATCH 007/403] devmapper: Rename DeviceSet.RemoveDevice to
 DeleteDevice

"Remove" is a bit overloaded, as it is also what deactivating a
device mapper device is called. Using "delete" is more clear here.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 63d4b293e7c91b8e2ed8da56f338f1bd0a4e1464
Component: engine
---
 components/engine/graphdriver/devmapper/deviceset.go | 8 ++++----
 components/engine/graphdriver/devmapper/driver.go    | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index 8432d92a4e..b6f21fa386 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -290,7 +290,7 @@ func (devices *DeviceSet) setupBaseImage() error {
 
 	if oldInfo != nil && !oldInfo.Initialized {
 		utils.Debugf("Removing uninitialized base image")
-		if err := devices.removeDevice(""); err != nil {
+		if err := devices.deleteDevice(""); err != nil {
 			utils.Debugf("\n--->Err: %s\n", err)
 			return err
 		}
@@ -562,7 +562,7 @@ func (devices *DeviceSet) AddDevice(hash, baseHash string) error {
 	return nil
 }
 
-func (devices *DeviceSet) removeDevice(hash string) error {
+func (devices *DeviceSet) deleteDevice(hash string) error {
 	info := devices.Devices[hash]
 	if info == nil {
 		return fmt.Errorf("hash %s doesn't exists", hash)
@@ -610,11 +610,11 @@ func (devices *DeviceSet) removeDevice(hash string) error {
 	return nil
 }
 
-func (devices *DeviceSet) RemoveDevice(hash string) error {
+func (devices *DeviceSet) DeleteDevice(hash string) error {
 	devices.Lock()
 	defer devices.Unlock()
 
-	return devices.removeDevice(hash)
+	return devices.deleteDevice(hash)
 }
 
 func (devices *DeviceSet) deactivateDevice(hash string) error {
diff --git a/components/engine/graphdriver/devmapper/driver.go b/components/engine/graphdriver/devmapper/driver.go
index 664899cfbf..9b6cb109d2 100644
--- a/components/engine/graphdriver/devmapper/driver.go
+++ b/components/engine/graphdriver/devmapper/driver.go
@@ -99,7 +99,7 @@ func (d *Driver) Remove(id string) error {
 	if err := d.unmount(id, mp); err != nil {
 		return err
 	}
-	return d.DeviceSet.RemoveDevice(id)
+	return d.DeviceSet.DeleteDevice(id)
 }
 
 func (d *Driver) Get(id string) (string, error) {

From 9d46aecf3b33f8573681674052f5031a3bfd339a Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 4 Feb 2014 16:06:54 +0100
Subject: [PATCH 008/403] devmapper: add and use removeDeviceAndWait helper

This adds a function that calls the lowlevel removeDevice
and then waits for it to finish.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: dca21dfac77de2bbd69dd5a52b8a2b7816a54367
Component: engine
---
 .../engine/graphdriver/devmapper/deviceset.go | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index b6f21fa386..e4c835a3de 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -632,28 +632,33 @@ func (devices *DeviceSet) deactivateDevice(hash string) error {
 		return err
 	}
 	if devinfo.Exists != 0 {
-		if err := removeDevice(devname); err != nil {
+		if err := devices.removeDeviceAndWait(devname); err != nil {
 			utils.Debugf("\n--->Err: %s\n", err)
 			return err
 		}
-		if err := devices.waitRemove(hash); err != nil {
-			return err
-		}
 	}
 
 	return nil
 }
 
+// Issues the underlying dm remove operation and then waits
+// for it to finish.
+func (devices *DeviceSet) removeDeviceAndWait(devname string) error {
+	if err := removeDevice(devname); err != nil {
+		return err
+	}
+	if err := devices.waitRemove(devname); err != nil {
+		return err
+	}
+	return nil
+}
+
 // waitRemove blocks until either:
 // a) the device registered at <device_set_prefix>-<hash> is removed,
 // or b) the 1 second timeout expires.
-func (devices *DeviceSet) waitRemove(hash string) error {
-	utils.Debugf("[deviceset %s] waitRemove(%s)", devices.devicePrefix, hash)
-	defer utils.Debugf("[deviceset %s] waitRemove(%) END", devices.devicePrefix, hash)
-	devname, err := devices.byHash(hash)
-	if err != nil {
-		return err
-	}
+func (devices *DeviceSet) waitRemove(devname string) error {
+	utils.Debugf("[deviceset %s] waitRemove(%s)", devices.devicePrefix, devname)
+	defer utils.Debugf("[deviceset %s] waitRemove(%s) END", devices.devicePrefix, devname)
 	i := 0
 	for ; i < 1000; i += 1 {
 		devinfo, err := getInfo(devname)

From d2595404a2f6c4c9e43025a708be188ff50eb364 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 4 Feb 2014 18:19:09 +0100
Subject: [PATCH 009/403] devmapper: Move refcounting to DeviceSet

We already have some kind of refcounting in DeviceSet, this fleshes
it out to allow it to completely subsume the refcounting in
devmapper.Driver.

This allows us to drop the double refcounting, and the locking inside
devmapper.Driver. This, in particular the locking simplification will
make it easier in the future to parallelize the device mapper.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: b95c560fdda4813319a2377e240592a3261e30ef
Component: engine
---
 .../engine/graphdriver/devmapper/deviceset.go | 108 +++++++++++++-----
 .../engine/graphdriver/devmapper/driver.go    |  70 +++---------
 .../graphdriver/devmapper/driver_test.go      |   3 -
 3 files changed, 93 insertions(+), 88 deletions(-)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index e4c835a3de..4d708c840a 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -29,6 +29,15 @@ type DevInfo struct {
 	TransactionId uint64     `json:"transaction_id"`
 	Initialized   bool       `json:"initialized"`
 	devices       *DeviceSet `json:"-"`
+
+	mountCount int    `json:"-"`
+	mountPath  string `json:"-"`
+	// A floating mount means one reference is not owned and
+	// will be stolen by the next mount. This allows us to
+	// avoid unmounting directly after creation before the
+	// first get (since we need to mount to set up the device
+	// a bit first).
+	floating bool `json:"-"`
 }
 
 type MetaData struct {
@@ -43,7 +52,6 @@ type DeviceSet struct {
 	TransactionId    uint64
 	NewTransactionId uint64
 	nextFreeDevice   int
-	activeMounts     map[string]int
 }
 
 type DiskUsage struct {
@@ -69,6 +77,14 @@ type DevStatus struct {
 	HighestMappedSector uint64
 }
 
+type UnmountMode int
+
+const (
+	UnmountRegular UnmountMode = iota
+	UnmountFloat
+	UnmountSink
+)
+
 func getDevName(name string) string {
 	return "/dev/mapper/" + name
 }
@@ -733,13 +749,12 @@ func (devices *DeviceSet) Shutdown() error {
 	utils.Debugf("[devmapper] Shutting down DeviceSet: %s", devices.root)
 	defer utils.Debugf("[deviceset %s] shutdown END", devices.devicePrefix)
 
-	for path, count := range devices.activeMounts {
-		for i := count; i > 0; i-- {
-			if err := sysUnmount(path, 0); err != nil {
-				utils.Debugf("Shutdown unmounting %s, error: %s\n", path, err)
+	for _, info := range devices.Devices {
+		if info.mountCount > 0 {
+			if err := sysUnmount(info.mountPath, 0); err != nil {
+				utils.Debugf("Shutdown unmounting %s, error: %s\n", info.mountPath, err)
 			}
 		}
-		delete(devices.activeMounts, path)
 	}
 
 	for _, d := range devices.Devices {
@@ -761,22 +776,32 @@ func (devices *DeviceSet) Shutdown() error {
 	return nil
 }
 
-func (devices *DeviceSet) MountDevice(hash, path string, readOnly bool) error {
+func (devices *DeviceSet) MountDevice(hash, path string) error {
 	devices.Lock()
 	defer devices.Unlock()
 
+	info := devices.Devices[hash]
+
+	if info.mountCount > 0 {
+		if path != info.mountPath {
+			return fmt.Errorf("Trying to mount devmapper device in multple places (%s, %s)", info.mountPath, path)
+		}
+
+		if info.floating {
+			// Steal floating ref
+			info.floating = false
+		} else {
+			info.mountCount++
+		}
+		return nil
+	}
+
 	if err := devices.activateDeviceIfNeeded(hash); err != nil {
 		return fmt.Errorf("Error activating devmapper device for '%s': %s", hash, err)
 	}
 
-	info := devices.Devices[hash]
-
 	var flags uintptr = sysMsMgcVal
 
-	if readOnly {
-		flags = flags | sysMsRdOnly
-	}
-
 	err := sysMount(info.DevName(), path, "ext4", flags, "discard")
 	if err != nil && err == sysEInval {
 		err = sysMount(info.DevName(), path, "ext4", flags, "")
@@ -785,20 +810,50 @@ func (devices *DeviceSet) MountDevice(hash, path string, readOnly bool) error {
 		return fmt.Errorf("Error mounting '%s' on '%s': %s", info.DevName(), path, err)
 	}
 
-	count := devices.activeMounts[path]
-	devices.activeMounts[path] = count + 1
+	info.mountCount = 1
+	info.mountPath = path
+	info.floating = false
 
 	return devices.setInitialized(hash)
 }
 
-func (devices *DeviceSet) UnmountDevice(hash, path string, deactivate bool) error {
-	utils.Debugf("[devmapper] UnmountDevice(hash=%s path=%s)", hash, path)
+func (devices *DeviceSet) UnmountDevice(hash string, mode UnmountMode) error {
+	utils.Debugf("[devmapper] UnmountDevice(hash=%s, mode=%d)", hash, mode)
 	defer utils.Debugf("[devmapper] UnmountDevice END")
 	devices.Lock()
 	defer devices.Unlock()
 
-	utils.Debugf("[devmapper] Unmount(%s)", path)
-	if err := sysUnmount(path, 0); err != nil {
+	info := devices.Devices[hash]
+
+	if mode == UnmountFloat {
+		if info.floating {
+			return fmt.Errorf("UnmountDevice: can't float floating reference %s\n", hash)
+		}
+
+		// Leave this reference floating
+		info.floating = true
+		return nil
+	}
+
+	if mode == UnmountSink {
+		if !info.floating {
+			// Someone already sunk this
+			return nil
+		}
+		// Otherwise, treat this as a regular unmount
+	}
+
+	if info.mountCount == 0 {
+		return fmt.Errorf("UnmountDevice: device not-mounted id %s\n", hash)
+	}
+
+	info.mountCount--
+	if info.mountCount > 0 {
+		return nil
+	}
+
+	utils.Debugf("[devmapper] Unmount(%s)", info.mountPath)
+	if err := sysUnmount(info.mountPath, 0); err != nil {
 		utils.Debugf("\n--->Err: %s\n", err)
 		return err
 	}
@@ -809,15 +864,9 @@ func (devices *DeviceSet) UnmountDevice(hash, path string, deactivate bool) erro
 		return err
 	}
 
-	if count := devices.activeMounts[path]; count > 1 {
-		devices.activeMounts[path] = count - 1
-	} else {
-		delete(devices.activeMounts, path)
-	}
+	devices.deactivateDevice(hash)
 
-	if deactivate {
-		devices.deactivateDevice(hash)
-	}
+	info.mountPath = ""
 
 	return nil
 }
@@ -960,9 +1009,8 @@ func NewDeviceSet(root string, doInit bool) (*DeviceSet, error) {
 	SetDevDir("/dev")
 
 	devices := &DeviceSet{
-		root:         root,
-		MetaData:     MetaData{Devices: make(map[string]*DevInfo)},
-		activeMounts: make(map[string]int),
+		root:     root,
+		MetaData: MetaData{Devices: make(map[string]*DevInfo)},
 	}
 
 	if err := devices.initDevmapper(doInit); err != nil {
diff --git a/components/engine/graphdriver/devmapper/driver.go b/components/engine/graphdriver/devmapper/driver.go
index 9b6cb109d2..25b998e59f 100644
--- a/components/engine/graphdriver/devmapper/driver.go
+++ b/components/engine/graphdriver/devmapper/driver.go
@@ -8,7 +8,6 @@ import (
 	"github.com/dotcloud/docker/utils"
 	"io/ioutil"
 	"path"
-	"sync"
 )
 
 func init() {
@@ -22,9 +21,7 @@ func init() {
 
 type Driver struct {
 	*DeviceSet
-	home       string
-	sync.Mutex // Protects concurrent modification to active
-	active     map[string]int
+	home string
 }
 
 var Init = func(home string) (graphdriver.Driver, error) {
@@ -35,7 +32,6 @@ var Init = func(home string) (graphdriver.Driver, error) {
 	d := &Driver{
 		DeviceSet: deviceSet,
 		home:      home,
-		active:    make(map[string]int),
 	}
 	return d, nil
 }
@@ -83,55 +79,36 @@ func (d *Driver) Create(id, parent string) error {
 		return err
 	}
 
+	// We float this reference so that the next Get call can
+	// steal it, so we don't have to unmount
+	if err := d.DeviceSet.UnmountDevice(id, UnmountFloat); err != nil {
+		return err
+	}
+
 	return nil
 }
 
 func (d *Driver) Remove(id string) error {
-	// Protect the d.active from concurrent access
-	d.Lock()
-	defer d.Unlock()
-
-	if d.active[id] != 0 {
-		utils.Errorf("Warning: removing active id %s\n", id)
-	}
-
-	mp := path.Join(d.home, "mnt", id)
-	if err := d.unmount(id, mp); err != nil {
+	// Sink the float from create in case no Get() call was made
+	if err := d.DeviceSet.UnmountDevice(id, UnmountSink); err != nil {
 		return err
 	}
+	// This assumes the device has been properly Get/Put:ed and thus is unmounted
 	return d.DeviceSet.DeleteDevice(id)
 }
 
 func (d *Driver) Get(id string) (string, error) {
-	// Protect the d.active from concurrent access
-	d.Lock()
-	defer d.Unlock()
-
-	count := d.active[id]
-
 	mp := path.Join(d.home, "mnt", id)
-	if count == 0 {
-		if err := d.mount(id, mp); err != nil {
-			return "", err
-		}
+	if err := d.mount(id, mp); err != nil {
+		return "", err
 	}
 
-	d.active[id] = count + 1
-
 	return path.Join(mp, "rootfs"), nil
 }
 
 func (d *Driver) Put(id string) {
-	// Protect the d.active from concurrent access
-	d.Lock()
-	defer d.Unlock()
-
-	if count := d.active[id]; count > 1 {
-		d.active[id] = count - 1
-	} else {
-		mp := path.Join(d.home, "mnt", id)
-		d.unmount(id, mp)
-		delete(d.active, id)
+	if err := d.DeviceSet.UnmountDevice(id, UnmountRegular); err != nil {
+		utils.Errorf("Warning: error unmounting device %s: %s\n", id, err)
 	}
 }
 
@@ -140,25 +117,8 @@ func (d *Driver) mount(id, mountPoint string) error {
 	if err := osMkdirAll(mountPoint, 0755); err != nil && !osIsExist(err) {
 		return err
 	}
-	// If mountpoint is already mounted, do nothing
-	if mounted, err := Mounted(mountPoint); err != nil {
-		return fmt.Errorf("Error checking mountpoint: %s", err)
-	} else if mounted {
-		return nil
-	}
 	// Mount the device
-	return d.DeviceSet.MountDevice(id, mountPoint, false)
-}
-
-func (d *Driver) unmount(id, mountPoint string) error {
-	// If mountpoint is not mounted, do nothing
-	if mounted, err := Mounted(mountPoint); err != nil {
-		return fmt.Errorf("Error checking mountpoint: %s", err)
-	} else if !mounted {
-		return nil
-	}
-	// Unmount the device
-	return d.DeviceSet.UnmountDevice(id, mountPoint, true)
+	return d.DeviceSet.MountDevice(id, mountPoint)
 }
 
 func (d *Driver) Exists(id string) bool {
diff --git a/components/engine/graphdriver/devmapper/driver_test.go b/components/engine/graphdriver/devmapper/driver_test.go
index 785845ce6e..ff4ec45e5d 100644
--- a/components/engine/graphdriver/devmapper/driver_test.go
+++ b/components/engine/graphdriver/devmapper/driver_test.go
@@ -495,7 +495,6 @@ func TestDriverCreate(t *testing.T) {
 			"DmTaskCreate",
 			"DmTaskGetInfo",
 			"sysMount",
-			"Mounted",
 			"DmTaskRun",
 			"DmTaskSetTarget",
 			"DmTaskSetSector",
@@ -614,7 +613,6 @@ func TestDriverRemove(t *testing.T) {
 			"DmTaskCreate",
 			"DmTaskGetInfo",
 			"sysMount",
-			"Mounted",
 			"DmTaskRun",
 			"DmTaskSetTarget",
 			"DmTaskSetSector",
@@ -645,7 +643,6 @@ func TestDriverRemove(t *testing.T) {
 			"DmTaskSetTarget",
 			"DmTaskSetAddNode",
 			"DmUdevWait",
-			"Mounted",
 			"sysUnmount",
 		)
 	}()

From 931e825d565d33a2da6801d8e50bc625ca5a50e9 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 4 Feb 2014 16:08:45 +0100
Subject: [PATCH 010/403] devmapper: Use removeDeviceAndWait in
 DeviceSet.removeDevice()

This makes sure the device is removed just like in deactivateDevice.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 7e25cd5891f84c2fab656c364002290e4b87f934
Component: engine
---
 components/engine/graphdriver/devmapper/deviceset.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index 4d708c840a..4955fb5cf0 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -595,7 +595,7 @@ func (devices *DeviceSet) deleteDevice(hash string) error {
 
 	devinfo, _ := getInfo(info.Name())
 	if devinfo != nil && devinfo.Exists != 0 {
-		if err := removeDevice(info.Name()); err != nil {
+		if err := devices.removeDeviceAndWait(info.Name()); err != nil {
 			utils.Debugf("Error removing device: %s\n", err)
 			return err
 		}

From 8a70fd74d7ddfdda9f4d33c32694aa76af173dd7 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Wed, 5 Feb 2014 21:37:53 +0100
Subject: [PATCH 011/403] devmapper: Handle EBUSY while removing

For some reason we seem to get transient EBUSY when removing
thinp devices, which prohibit removing containers. When
this happens we retry a few times which seems to fix the
issue for me.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 2c82fd93d8a01cc1f53fe861378e6d2dca0486c6
Component: engine
---
 .../engine/graphdriver/devmapper/deviceset.go | 25 ++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index 4955fb5cf0..3dedfd75b5 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -12,6 +12,7 @@ import (
 	"path"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 )
@@ -52,6 +53,7 @@ type DeviceSet struct {
 	TransactionId    uint64
 	NewTransactionId uint64
 	nextFreeDevice   int
+	sawBusy          bool
 }
 
 type DiskUsage struct {
@@ -371,6 +373,10 @@ func (devices *DeviceSet) log(level int, file string, line int, dmError int, mes
 		return // Ignore _LOG_DEBUG
 	}
 
+	if strings.Contains(message, "busy") {
+		devices.sawBusy = true
+	}
+
 	utils.Debugf("libdevmapper(%d): %s:%d (%d) %s", level, file, line, dmError, message)
 }
 
@@ -660,9 +666,26 @@ func (devices *DeviceSet) deactivateDevice(hash string) error {
 // Issues the underlying dm remove operation and then waits
 // for it to finish.
 func (devices *DeviceSet) removeDeviceAndWait(devname string) error {
-	if err := removeDevice(devname); err != nil {
+	var err error
+
+	for i := 0; i < 10; i++ {
+		devices.sawBusy = false
+		err = removeDevice(devname)
+		if err == nil {
+			break
+		}
+		if !devices.sawBusy {
+			return err
+		}
+
+		// If we see EBUSY it may be a transient error,
+		// sleep a bit a retry a few times.
+		time.Sleep(5 * time.Millisecond)
+	}
+	if err != nil {
 		return err
 	}
+
 	if err := devices.waitRemove(devname); err != nil {
 		return err
 	}

From bd67bce0231112871be2740a088f5f096f5efd3c Mon Sep 17 00:00:00 2001
From: Brandon Philips <brandon@ifup.co>
Date: Thu, 6 Feb 2014 11:34:25 -0800
Subject: [PATCH 012/403] pkg: systemd: add initial MAINTAINERS

I volunteered for pkg/systemd MAINTAINER and there were no objections
during the #docker-dev meeting. For context I wrote most of the stuff in
here and wrote the dependent calls in api.go. Plus, I actively test the
code via CoreOS.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Upstream-commit: 15711ed670e8ab59611030ea1191189ad495ea63
Component: engine
---
 components/engine/pkg/systemd/MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 components/engine/pkg/systemd/MAINTAINERS

diff --git a/components/engine/pkg/systemd/MAINTAINERS b/components/engine/pkg/systemd/MAINTAINERS
new file mode 100644
index 0000000000..51228b368a
--- /dev/null
+++ b/components/engine/pkg/systemd/MAINTAINERS
@@ -0,0 +1 @@
+Brandon Philips <brandon.philips@coreos.com> (@philips)

From 4c4ba56ea42af6aa191a8a20f17f425052d79767 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Thu, 6 Feb 2014 22:26:09 +0100
Subject: [PATCH 013/403] devmapper: Fix UnmountDevice for non-existing device

Properly error out if passed an id that doesn't exist.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 304e33a2fe2d006cc1063c8060c6e22c9ade3d59
Component: engine
---
 components/engine/graphdriver/devmapper/deviceset.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index 3dedfd75b5..c1f2f558a0 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -847,6 +847,9 @@ func (devices *DeviceSet) UnmountDevice(hash string, mode UnmountMode) error {
 	defer devices.Unlock()
 
 	info := devices.Devices[hash]
+	if info == nil {
+		return fmt.Errorf("UnmountDevice: no such device %s\n", hash)
+	}
 
 	if mode == UnmountFloat {
 		if info.floating {

From 3959ecf0a97738a02c5c3f8263c02a37f2687e42 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Thu, 6 Feb 2014 23:08:17 +0100
Subject: [PATCH 014/403] devmapper: Fix MountDevice for non-existing Device

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 693d3f8c6ab4c9fed5fe4c5ac5fcb44568fe1638
Component: engine
---
 components/engine/graphdriver/devmapper/deviceset.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index c1f2f558a0..637192dbcb 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -804,6 +804,9 @@ func (devices *DeviceSet) MountDevice(hash, path string) error {
 	defer devices.Unlock()
 
 	info := devices.Devices[hash]
+	if info == nil {
+		return fmt.Errorf("Unknown device %s", hash)
+	}
 
 	if info.mountCount > 0 {
 		if path != info.mountPath {

From f006ee4708ab7b5fb9b5e4c9cc9b1f21f055f88f Mon Sep 17 00:00:00 2001
From: James Turnbull <james@lovedthanlost.net>
Date: Fri, 7 Feb 2014 01:42:11 +0100
Subject: [PATCH 015/403] Added Security FAQ security

Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Upstream-commit: 55b74bfe469115f25a52c6ad48b13eb9c7e6197c
Component: engine
---
 components/engine/docs/sources/faq.rst | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/components/engine/docs/sources/faq.rst b/components/engine/docs/sources/faq.rst
index cf072f34a7..5c8e69703f 100644
--- a/components/engine/docs/sources/faq.rst
+++ b/components/engine/docs/sources/faq.rst
@@ -183,6 +183,12 @@ Cloud:
 - Google Compute Engine
 - Rackspace
 
+How do I report a security issue with Docker?
+.............................................
+
+You can learn about the project's security policy `here <http://www.docker.io/security/>`_
+and report security issues to this `mailbox <mailto:security@docker.com>`_.
+
 Can I help by adding some questions and answers?
 ................................................
 

From 9378ca24df3afaeee9bc0300d1c6cae22118a107 Mon Sep 17 00:00:00 2001
From: Dafydd Crosby <dtcrsby@gmail.com>
Date: Fri, 7 Feb 2014 00:10:47 -0700
Subject: [PATCH 016/403] Fix RST formatting Upstream-commit:
 b2945f27767f35a273feb6e255945f3e1f6108d2 Component: engine

---
 components/engine/docs/sources/reference/run.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/docs/sources/reference/run.rst b/components/engine/docs/sources/reference/run.rst
index 307edace00..d8de280671 100644
--- a/components/engine/docs/sources/reference/run.rst
+++ b/components/engine/docs/sources/reference/run.rst
@@ -143,6 +143,7 @@ Network Settings
 ----------------
 
 ::
+
    -n=true   : Enable networking for this container
    -dns=[]   : Set custom dns servers for the container
 

From 4f66485afb9dcdad76c7833228614613f1858107 Mon Sep 17 00:00:00 2001
From: German DZ <germ@ndz.com.ar>
Date: Fri, 7 Feb 2014 09:22:10 +0100
Subject: [PATCH 017/403] New folder structure to support TextMate2 bundles
 format

Docker-DCO-1.1-Signed-off-by: German Del Zotto <germ@ndz.com.ar> (github: GermanDZ)
Upstream-commit: f289b3a19e03b99a6618009320abaec2c0cf1ec1
Component: engine
---
 .../Preferences}/Dockerfile.tmPreferences        |  0
 .../Syntaxes}/Dockerfile.tmLanguage              |  0
 .../syntax/textmate/Docker.tmbundle/info.plist   | 16 ++++++++++++++++
 3 files changed, 16 insertions(+)
 rename components/engine/contrib/syntax/textmate/{ => Docker.tmbundle/Preferences}/Dockerfile.tmPreferences (100%)
 rename components/engine/contrib/syntax/textmate/{ => Docker.tmbundle/Syntaxes}/Dockerfile.tmLanguage (100%)
 create mode 100644 components/engine/contrib/syntax/textmate/Docker.tmbundle/info.plist

diff --git a/components/engine/contrib/syntax/textmate/Dockerfile.tmPreferences b/components/engine/contrib/syntax/textmate/Docker.tmbundle/Preferences/Dockerfile.tmPreferences
similarity index 100%
rename from components/engine/contrib/syntax/textmate/Dockerfile.tmPreferences
rename to components/engine/contrib/syntax/textmate/Docker.tmbundle/Preferences/Dockerfile.tmPreferences
diff --git a/components/engine/contrib/syntax/textmate/Dockerfile.tmLanguage b/components/engine/contrib/syntax/textmate/Docker.tmbundle/Syntaxes/Dockerfile.tmLanguage
similarity index 100%
rename from components/engine/contrib/syntax/textmate/Dockerfile.tmLanguage
rename to components/engine/contrib/syntax/textmate/Docker.tmbundle/Syntaxes/Dockerfile.tmLanguage
diff --git a/components/engine/contrib/syntax/textmate/Docker.tmbundle/info.plist b/components/engine/contrib/syntax/textmate/Docker.tmbundle/info.plist
new file mode 100644
index 0000000000..239f4b0a9b
--- /dev/null
+++ b/components/engine/contrib/syntax/textmate/Docker.tmbundle/info.plist
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>contactEmailRot13</key>
+	<string>germ@andz.com.ar</string>
+	<key>contactName</key>
+	<string>GermanDZ</string>
+	<key>description</key>
+	<string>Helpers for Docker.</string>
+	<key>name</key>
+	<string>Docker</string>
+	<key>uuid</key>
+	<string>8B9DDBAF-E65C-4E12-FFA7-467D4AA535B1</string>
+</dict>
+</plist>

From 1097b506cc8c026455b85620abfeba97d2713142 Mon Sep 17 00:00:00 2001
From: German DZ <germ@ndz.com.ar>
Date: Fri, 7 Feb 2014 09:30:11 +0100
Subject: [PATCH 018/403] Instructions for Textmate's bundle installation

Docker-DCO-1.1-Signed-off-by: German Del Zotto <germ@ndz.com.ar> (github: GermanDZ)
Upstream-commit: ac06646b1fb7172937c52d5f1217dcac5a86f0f9
Component: engine
---
 components/engine/contrib/syntax/textmate/README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/components/engine/contrib/syntax/textmate/README.md b/components/engine/contrib/syntax/textmate/README.md
index 8f3ec693b7..e78b76af45 100644
--- a/components/engine/contrib/syntax/textmate/README.md
+++ b/components/engine/contrib/syntax/textmate/README.md
@@ -1,4 +1,4 @@
-# Dockerfile.tmLanguage
+# Docker.tmbundle
 
 Dockerfile syntaxt highlighting for TextMate and Sublime Text.
 
@@ -6,11 +6,11 @@ Dockerfile syntaxt highlighting for TextMate and Sublime Text.
 
 ### Sublime Text
 
-Available for Sublime Text under [package control](https://sublime.wbond.net/packages/Dockerfile%20Syntax%20Highlighting).  
+Available for Sublime Text under [package control](https://sublime.wbond.net/packages/Dockerfile%20Syntax%20Highlighting).
 Search for *Dockerfile Syntax Highlighting*
 
-### TextMate
+### TextMate 2
 
-*...unknown. Probably put it somewhere smart.*
+Copy the directory `Docker.tmbundle` (showed as a Package in OSX) to `~/Library/Application Support/TextMate/Managed/Bundles`
 
 enjoy.

From 9e9837fce8088c70e7a56020363b57c2a590d294 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Fri, 7 Feb 2014 15:21:33 +1000
Subject: [PATCH 019/403] please, for the love of Docker, do. not. use.
 symlinks

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: f787bec4a6853b46b1ba755d4f8a2ee07d9cbd3e
Component: engine
---
 .../engine/docs/sources/reference/commandline/cli.rst      | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index ae77080309..5f4f821e12 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -102,12 +102,17 @@ the ``-H`` flag for the client.
         docker ps
         # both are equal
 
-
 To run the daemon with `systemd socket activation <http://0pointer.de/blog/projects/socket-activation.html>`_, use ``docker -d -H fd://``.
 Using ``fd://`` will work perfectly for most setups but you can also specify individual sockets too ``docker -d -H fd://3``.
 If the specified socket activated files aren't found then docker will exit.
 You can find examples of using systemd socket activation with docker and systemd in the `docker source tree <https://github.com/dotcloud/docker/blob/master/contrib/init/systemd/socket-activation/>`_.
 
+.. warning::
+  Docker and LXC do not support the use of softlinks for either the Docker data directory (``/var/lib/docker``) or for ``/tmp``.
+  If your system is likely to be set up in that way, you can use ``readlink -f`` to canonicalise the links:
+
+  ``TMPDIR=$(readlink -f /tmp) /usr/local/bin/docker -d -D -g $(readlink -f /var/lib/docker) -H unix:// $EXPOSE_ALL > /var/lib/boot2docker/docker.log 2>&1``
+
 .. _cli_attach:
 
 ``attach``

From 29b4f1c1236b902888c489bcc1e80eb5851d3ad8 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Fri, 7 Feb 2014 19:09:52 -0800
Subject: [PATCH 020/403] Remove panic in lxc driver.

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 7c06d5e34e2ebf5006ce3a34438f18c071153e97
Component: engine
---
 components/engine/execdriver/lxc/driver.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index 4c3979e718..ee4d02a6b6 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -279,7 +279,8 @@ func (i *info) IsRunning() bool {
 
 	output, err := i.driver.getInfo(i.ID)
 	if err != nil {
-		panic(err)
+		utils.Errorf("Error getting info for lxc container %s: %s (%s)", i.ID, err, output)
+		return false
 	}
 	if strings.Contains(string(output), "RUNNING") {
 		running = true

From 7920ed3ee7b4c95f169bc46c69b623dce50ad6ab Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 8 Feb 2014 09:53:04 -0800
Subject: [PATCH 021/403] Add set master for interface
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 a6c791e8a92f29a2ae2c6bc81e4ab873d3ceb41f Component: engine

---
 .../engine/pkg/netlink/netlink_linux.go       | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 0ea5b4dbac..01b3ff08fc 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -386,6 +386,39 @@ func NetworkSetMTU(iface *net.Interface, mtu int) error {
 	return s.HandleAck(wb.Seq)
 }
 
+// same as ip link set $name master $master
+func NetworkSetMaster(iface, master *net.Interface) error {
+	s, err := getNetlinkSocket()
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	wb := newNetlinkRequest(syscall.RTM_SETLINK, syscall.NLM_F_ACK)
+
+	msg := newIfInfomsg(syscall.AF_UNSPEC)
+	msg.Type = syscall.RTM_SETLINK
+	msg.Flags = syscall.NLM_F_REQUEST
+	msg.Index = int32(iface.Index)
+	msg.Change = 0xFFFFFFFF
+	wb.AddData(msg)
+
+	var (
+		b      = make([]byte, 4)
+		native = nativeEndian()
+	)
+	native.PutUint32(b, uint32(master.Index))
+
+	data := newRtAttr(syscall.IFLA_MASTER, b)
+	wb.AddData(data)
+
+	if err := s.Send(wb); err != nil {
+		return err
+	}
+
+	return s.HandleAck(wb.Seq)
+}
+
 // Add an Ip address to an interface. This is identical to:
 // ip addr add $ip/$ipNet dev $iface
 func NetworkLinkAddIp(iface *net.Interface, ip net.IP, ipNet *net.IPNet) error {

From e66ed158d681c87038e9435019c2126cbdeffcf8 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 8 Feb 2014 10:03:16 -0800
Subject: [PATCH 022/403] Add network set interface in namespace by pid
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 e3762e8d6937741a5654b1443f95beb784f018f1 Component: engine

---
 .../engine/pkg/netlink/netlink_linux.go       | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 01b3ff08fc..e69635e2f6 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -419,6 +419,38 @@ func NetworkSetMaster(iface, master *net.Interface) error {
 	return s.HandleAck(wb.Seq)
 }
 
+func NetworkSetNsPid(iface *net.Interface, nspid int) error {
+	s, err := getNetlinkSocket()
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	wb := newNetlinkRequest(syscall.RTM_SETLINK, syscall.NLM_F_ACK)
+
+	msg := newIfInfomsg(syscall.AF_UNSPEC)
+	msg.Type = syscall.RTM_SETLINK
+	msg.Flags = syscall.NLM_F_REQUEST
+	msg.Index = int32(iface.Index)
+	msg.Change = 0xFFFFFFFF
+	wb.AddData(msg)
+
+	var (
+		b      = make([]byte, 4)
+		native = nativeEndian()
+	)
+	native.PutUint32(b, uint32(nspid))
+
+	data := newRtAttr(syscall.IFLA_NET_NS_PID, b)
+	wb.AddData(data)
+
+	if err := s.Send(wb); err != nil {
+		return err
+	}
+
+	return s.HandleAck(wb.Seq)
+}
+
 // Add an Ip address to an interface. This is identical to:
 // ip addr add $ip/$ipNet dev $iface
 func NetworkLinkAddIp(iface *net.Interface, ip net.IP, ipNet *net.IPNet) error {

From 31b1c10e097f3cdb6dc389a566290e977ef42c10 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Sat, 8 Feb 2014 11:34:11 -0700
Subject: [PATCH 023/403] Swap Firefox to Iceweasel so that the Desktop
 Integration example is simplified and easier to understand

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 72c72f91c621d9dd2431eee01a28a4ca490588bc
Component: engine
---
 .../{README.txt => README.md}                 |  2 +-
 .../desktop-integration/data/Dockerfile       | 20 ++++----
 .../desktop-integration/firefox/Dockerfile    | 49 -------------------
 .../desktop-integration/iceweasel/Dockerfile  | 41 ++++++++++++++++
 4 files changed, 52 insertions(+), 60 deletions(-)
 rename components/engine/contrib/desktop-integration/{README.txt => README.md} (71%)
 delete mode 100644 components/engine/contrib/desktop-integration/firefox/Dockerfile
 create mode 100644 components/engine/contrib/desktop-integration/iceweasel/Dockerfile

diff --git a/components/engine/contrib/desktop-integration/README.txt b/components/engine/contrib/desktop-integration/README.md
similarity index 71%
rename from components/engine/contrib/desktop-integration/README.txt
rename to components/engine/contrib/desktop-integration/README.md
index 2f55c979e3..02181a5f75 100644
--- a/components/engine/contrib/desktop-integration/README.txt
+++ b/components/engine/contrib/desktop-integration/README.md
@@ -8,4 +8,4 @@ Examples
 ========
 
 * Data container: ./data/Dockerfile creates a data image sharing /data volume
-* Firefox: ./firefox/Dockerfile shows a way to dockerize a common multimedia application
+* Iceweasel: ./iceweasel/Dockerfile shows a way to dockerize a common multimedia application
diff --git a/components/engine/contrib/desktop-integration/data/Dockerfile b/components/engine/contrib/desktop-integration/data/Dockerfile
index 453afdd3d6..a9843a52ad 100644
--- a/components/engine/contrib/desktop-integration/data/Dockerfile
+++ b/components/engine/contrib/desktop-integration/data/Dockerfile
@@ -11,28 +11,28 @@
 #   # Build data image
 #   docker build -t data -rm .
 #
-#   # Create a data container. (eg: firefox-data)
-#   docker run -name firefox-data data true
+#   # Create a data container. (eg: iceweasel-data)
+#   docker run -name iceweasel-data data true
 #
 #   # List data from it
-#   docker run -volumes-from firefox-data busybox ls -al /data
+#   docker run -volumes-from iceweasel-data busybox ls -al /data
 
 docker-version 0.6.5
 
 # Smallest base image, just to launch a container
-from busybox
-maintainer	Daniel Mizyrycki <daniel@docker.com>
+FROM busybox
+MAINTAINER Daniel Mizyrycki <daniel@docker.com>
 
 # Create a regular user
-run echo 'sysadmin:x:1000:1000::/data:/bin/sh' >> /etc/passwd
-run echo 'sysadmin:x:1000:' >> /etc/group
+RUN echo 'sysadmin:x:1000:1000::/data:/bin/sh' >> /etc/passwd
+RUN echo 'sysadmin:x:1000:' >> /etc/group
 
 # Create directory for that user
-run mkdir /data
-run chown sysadmin.sysadmin /data
+RUN mkdir /data
+RUN chown sysadmin.sysadmin /data
 
 # Add content to /data. This will keep sysadmin ownership
-run touch /data/init_volume
+RUN touch /data/init_volume
 
 # Create /data volume
 VOLUME /data
diff --git a/components/engine/contrib/desktop-integration/firefox/Dockerfile b/components/engine/contrib/desktop-integration/firefox/Dockerfile
deleted file mode 100644
index f8924f4b4a..0000000000
--- a/components/engine/contrib/desktop-integration/firefox/Dockerfile
+++ /dev/null
@@ -1,49 +0,0 @@
-# VERSION:        0.7
-# DESCRIPTION:    Create firefox container with its dependencies
-# AUTHOR:         Daniel Mizyrycki <daniel@dotcloud.com>
-# COMMENTS:
-#   This file describes how to build a Firefox container with all
-#   dependencies installed. It uses native X11 unix socket and alsa
-#   sound devices. Tested on Debian 7.2
-# USAGE:
-#   # Download Firefox Dockerfile
-#   wget http://raw.github.com/dotcloud/docker/master/contrib/desktop-integration/firefox/Dockerfile
-#
-#   # Build firefox image
-#   docker build -t firefox -rm .
-#
-#   # Run stateful data-on-host firefox. For ephemeral, remove -v /data/firefox:/data
-#   docker run -v /data/firefox:/data -v /tmp/.X11-unix:/tmp/.X11-unix \
-#     -v /dev/snd:/dev/snd -lxc-conf='lxc.cgroup.devices.allow = c 116:* rwm' \
-#     -e DISPLAY=unix$DISPLAY firefox
-#
-#   # To run stateful dockerized data containers
-#   docker run -volumes-from firefox-data -v /tmp/.X11-unix:/tmp/.X11-unix \
-#     -v /dev/snd:/dev/snd -lxc-conf='lxc.cgroup.devices.allow = c 116:* rwm' \
-#     -e DISPLAY=unix$DISPLAY firefox
-
-docker-version 0.6.5
-
-# Base docker image
-from tianon/debian:wheezy
-maintainer	Daniel Mizyrycki <daniel@docker.com>
-
-# Install firefox dependencies
-run echo "deb http://ftp.debian.org/debian/ wheezy main contrib" > /etc/apt/sources.list
-run apt-get update
-run DEBIAN_FRONTEND=noninteractive apt-get install -y libXrender1 libasound2 \
-    libdbus-glib-1-2 libgtk2.0-0 libpango1.0-0 libxt6 wget bzip2 sudo
-
-# Install Firefox
-run mkdir /application
-run cd /application; wget -O - \
-    http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/25.0/linux-x86_64/en-US/firefox-25.0.tar.bz2 | tar jx
-
-# create sysadmin account
-run useradd -m -d /data -p saIVpsc0EVTwA sysadmin
-run sed -Ei 's/sudo:x:27:/sudo:x:27:sysadmin/' /etc/group
-run sed -Ei 's/(\%sudo\s+ALL=\(ALL\:ALL\) )ALL/\1 NOPASSWD:ALL/' /etc/sudoers
-
-# Autorun firefox. -no-remote is necessary to create a new container, as firefox
-# appears to communicate with itself through X11.
-cmd ["/bin/sh", "-c", "/usr/bin/sudo -u sysadmin -H -E /application/firefox/firefox -no-remote"]
diff --git a/components/engine/contrib/desktop-integration/iceweasel/Dockerfile b/components/engine/contrib/desktop-integration/iceweasel/Dockerfile
new file mode 100644
index 0000000000..721cc6d2cf
--- /dev/null
+++ b/components/engine/contrib/desktop-integration/iceweasel/Dockerfile
@@ -0,0 +1,41 @@
+# VERSION:        0.7
+# DESCRIPTION:    Create iceweasel container with its dependencies
+# AUTHOR:         Daniel Mizyrycki <daniel@dotcloud.com>
+# COMMENTS:
+#   This file describes how to build a Iceweasel container with all
+#   dependencies installed. It uses native X11 unix socket and alsa
+#   sound devices. Tested on Debian 7.2
+# USAGE:
+#   # Download Iceweasel Dockerfile
+#   wget http://raw.github.com/dotcloud/docker/master/contrib/desktop-integration/iceweasel/Dockerfile
+#
+#   # Build iceweasel image
+#   docker build -t iceweasel -rm .
+#
+#   # Run stateful data-on-host iceweasel. For ephemeral, remove -v /data/iceweasel:/data
+#   docker run -v /data/iceweasel:/data -v /tmp/.X11-unix:/tmp/.X11-unix \
+#     -v /dev/snd:/dev/snd -lxc-conf='lxc.cgroup.devices.allow = c 116:* rwm' \
+#     -e DISPLAY=unix$DISPLAY iceweasel
+#
+#   # To run stateful dockerized data containers
+#   docker run -volumes-from iceweasel-data -v /tmp/.X11-unix:/tmp/.X11-unix \
+#     -v /dev/snd:/dev/snd -lxc-conf='lxc.cgroup.devices.allow = c 116:* rwm' \
+#     -e DISPLAY=unix$DISPLAY iceweasel
+
+docker-version 0.6.5
+
+# Base docker image
+FROM debian:wheezy
+MAINTAINER Daniel Mizyrycki <daniel@docker.com>
+
+# Install Iceweasel and "sudo"
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -yq iceweasel sudo
+
+# create sysadmin account
+RUN useradd -m -d /data -p saIVpsc0EVTwA sysadmin
+RUN sed -Ei 's/sudo:x:27:/sudo:x:27:sysadmin/' /etc/group
+RUN sed -Ei 's/(\%sudo\s+ALL=\(ALL\:ALL\) )ALL/\1 NOPASSWD:ALL/' /etc/sudoers
+
+# Autorun iceweasel. -no-remote is necessary to create a new container, as
+# iceweasel appears to communicate with itself through X11.
+CMD ["/usr/bin/sudo", "-u", "sysadmin", "-H", "-E", "/usr/bin/iceweasel", "-no-remote"]

From 347c7fca0d09592fa110dd4ea8cf3ab28b5e3e54 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 8 Feb 2014 20:44:04 -0800
Subject: [PATCH 024/403] Use c to change interface name
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 ee39033073ece35e91c6c5a8cb66d23246511fb0 Component: engine

---
 .../engine/pkg/netlink/netlink_linux.go       | 66 +++++++++++++++++++
 1 file changed, 66 insertions(+)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index e69635e2f6..77ebfcd46a 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -2,6 +2,60 @@
 
 package netlink
 
+/*
+#include <string.h>
+#include <errno.h>
+#include <sys/ioctl.h>
+#include <net/if.h>
+
+static int get_socket(void) {
+	int s_errno;
+	int fd;
+
+	fd = socket(PF_INET, SOCK_DGRAM, 0);
+	if (fd >= 0) {
+		return fd;
+    }
+	s_errno = errno;
+
+	fd = socket(PF_PACKET, SOCK_DGRAM, 0);
+	if (fd >= 0) {
+		return fd;
+    }
+
+	fd = socket(PF_INET6, SOCK_DGRAM, 0);
+	if (fd >= 0) {
+		return fd;
+    }
+	errno = s_errno;
+	return -1;
+}
+
+
+static int change_name(const char *old_name, const char *new_name) {
+    struct ifreq ifr;
+	int err;
+	int fd;
+
+	fd = get_socket();
+	if (fd < 0) {
+		return -1;
+    }
+
+	strncpy(ifr.ifr_name, old_name, IFNAMSIZ);
+	strncpy(ifr.ifr_newname, new_name, IFNAMSIZ);
+
+    err = ioctl(fd, SIOCSIFNAME, &ifr);
+	if (err) {
+        close(fd);
+		return -1;
+	}
+    close(fd);
+	return err;
+}
+*/
+import "C"
+
 import (
 	"encoding/binary"
 	"fmt"
@@ -641,3 +695,15 @@ done:
 
 	return res, nil
 }
+
+func NetworkChangeName(oldName, newName string) error {
+	var (
+		cold = C.CString(oldName)
+		cnew = C.CString(newName)
+	)
+
+	if errno := int(C.change_name(cold, cnew)); errno != 0 {
+		return fmt.Errorf("unable to change name %d", errno)
+	}
+	return nil
+}

From 81f4bd236b25d06becafb4b46b5cf6efaa95d4fa Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Sun, 9 Feb 2014 07:25:34 +0100
Subject: [PATCH 025/403] devmapper: Enable skip_block_zeroing

This makes the device mapper not zero out blocks allocated on the
thinp device. This is safe in our use case, as we access the device
via a filesystem that doesn't leak any uninitialized data to userspace.

This partially helps with https://github.com/dotcloud/docker/issues/3280
and should generally improve preformance on the devicemapper backend.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 695719b29a6311a56faae0c6ed3c985b7a75add0
Component: engine
---
 components/engine/graphdriver/devmapper/devmapper.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/graphdriver/devmapper/devmapper.go b/components/engine/graphdriver/devmapper/devmapper.go
index 7f83a09df9..7317118dcf 100644
--- a/components/engine/graphdriver/devmapper/devmapper.go
+++ b/components/engine/graphdriver/devmapper/devmapper.go
@@ -324,7 +324,7 @@ func createPool(poolName string, dataFile, metadataFile *osFile) error {
 		return fmt.Errorf("Can't get data size")
 	}
 
-	params := metadataFile.Name() + " " + dataFile.Name() + " 128 32768"
+	params := metadataFile.Name() + " " + dataFile.Name() + " 128 32768 1 skip_block_zeroing"
 	if err := task.AddTarget(0, size/512, "thin-pool", params); err != nil {
 		return fmt.Errorf("Can't add target")
 	}

From 64b4ce5805a246950a0be1bd761cafc13229f2db Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sun, 9 Feb 2014 01:43:46 -0800
Subject: [PATCH 026/403] Add bidirectional iptables rule back to links

Fixes #4014
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 0cba91e26447e14260f111bef6d3745d2dd55444
Component: engine
---
 components/engine/networkdriver/lxc/driver.go | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/components/engine/networkdriver/lxc/driver.go b/components/engine/networkdriver/lxc/driver.go
index 3f9c0af011..0bc24b91b6 100644
--- a/components/engine/networkdriver/lxc/driver.go
+++ b/components/engine/networkdriver/lxc/driver.go
@@ -172,7 +172,6 @@ func setupIPTables(addr net.Addr, icc bool) error {
 		iptables.Raw(append([]string{"-D"}, acceptArgs...)...)
 
 		if !iptables.Exists(dropArgs...) {
-
 			utils.Debugf("Disable inter-container communication")
 			if output, err := iptables.Raw(append([]string{"-I"}, dropArgs...)...); err != nil {
 				return fmt.Errorf("Unable to prevent intercontainer communication: %s", err)
@@ -470,6 +469,20 @@ func LinkContainers(job *engine.Job) engine.Status {
 			job.Errorf("Error toggle iptables forward: %s", output)
 			return engine.StatusErr
 		}
+
+		if output, err := iptables.Raw(action, "FORWARD",
+			"-i", bridgeIface, "-o", bridgeIface,
+			"-p", proto,
+			"-s", childIP,
+			"--sport", port,
+			"-d", parentIP,
+			"-j", "ACCEPT"); !ignoreErrors && err != nil {
+			job.Error(err)
+			return engine.StatusErr
+		} else if len(output) != 0 {
+			job.Errorf("Error toggle iptables forward: %s", output)
+			return engine.StatusErr
+		}
 	}
 	return engine.StatusOK
 }

From de9b1efd2f62cdd335380752743a9e8f91ee7f3e Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 6 Feb 2014 14:13:03 -0800
Subject: [PATCH 027/403] Remove linux specific calls

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 3dfc910d7774d57c533b067fbe59d6b24dd803cd
Component: engine
---
 components/engine/archive/archive.go          | 25 +++++++++++--------
 components/engine/archive/stat_linux.go       |  7 ++++++
 .../{stat_darwin.go => stat_unsupported.go}   |  8 ++++--
 3 files changed, 28 insertions(+), 12 deletions(-)
 rename components/engine/archive/{stat_darwin.go => stat_unsupported.go} (67%)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index b1400c2210..3a1c111ea2 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"compress/bzip2"
 	"compress/gzip"
+	"errors"
 	"fmt"
 	"github.com/dotcloud/docker/utils"
 	"io"
@@ -17,14 +18,18 @@ import (
 	"syscall"
 )
 
-type Archive io.Reader
+type (
+	Archive     io.Reader
+	Compression int
+	TarOptions  struct {
+		Includes    []string
+		Compression Compression
+	}
+)
 
-type Compression int
-
-type TarOptions struct {
-	Includes    []string
-	Compression Compression
-}
+var (
+	ErrNotImplemented = errors.New("Function not implemented")
+)
 
 const (
 	Uncompressed Compression = iota
@@ -236,14 +241,14 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader *tar.Reader)
 		return fmt.Errorf("Unhandled tar header type %d\n", hdr.Typeflag)
 	}
 
-	if err := syscall.Lchown(path, hdr.Uid, hdr.Gid); err != nil {
+	if err := os.Lchown(path, hdr.Uid, hdr.Gid); err != nil {
 		return err
 	}
 
 	// There is no LChmod, so ignore mode for symlink. Also, this
 	// must happen after chown, as that can modify the file mode
 	if hdr.Typeflag != tar.TypeSymlink {
-		if err := syscall.Chmod(path, uint32(hdr.Mode&07777)); err != nil {
+		if err := os.Chmod(path, os.FileMode(hdr.Mode&07777)); err != nil {
 			return err
 		}
 	}
@@ -251,7 +256,7 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader *tar.Reader)
 	ts := []syscall.Timespec{timeToTimespec(hdr.AccessTime), timeToTimespec(hdr.ModTime)}
 	// syscall.UtimesNano doesn't support a NOFOLLOW flag atm, and
 	if hdr.Typeflag != tar.TypeSymlink {
-		if err := syscall.UtimesNano(path, ts); err != nil {
+		if err := UtimesNano(path, ts); err != nil {
 			return err
 		}
 	} else {
diff --git a/components/engine/archive/stat_linux.go b/components/engine/archive/stat_linux.go
index 2f7a520ccd..f87a99c55a 100644
--- a/components/engine/archive/stat_linux.go
+++ b/components/engine/archive/stat_linux.go
@@ -30,3 +30,10 @@ func LUtimesNano(path string, ts []syscall.Timespec) error {
 
 	return nil
 }
+
+func UtimesNano(path string, ts []syscall.Timespec) error {
+	if err := syscall.UtimesNano(path, ts); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/components/engine/archive/stat_darwin.go b/components/engine/archive/stat_unsupported.go
similarity index 67%
rename from components/engine/archive/stat_darwin.go
rename to components/engine/archive/stat_unsupported.go
index 32203299dd..50ca461867 100644
--- a/components/engine/archive/stat_darwin.go
+++ b/components/engine/archive/stat_unsupported.go
@@ -1,4 +1,4 @@
-// +build !linux !amd64
+// +build !linux
 
 package archive
 
@@ -13,5 +13,9 @@ func getLastModification(stat *syscall.Stat_t) syscall.Timespec {
 }
 
 func LUtimesNano(path string, ts []syscall.Timespec) error {
-	return nil
+	return ErrNotImplemented
+}
+
+func UtimesNano(path string, ts []syscall.Timespec) error {
+	return ErrNotImplemented
 }

From c36542fc7c5dee450e3a8a386253f628690a210a Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sun, 9 Feb 2014 05:54:13 -0800
Subject: [PATCH 028/403] Replace my C code with tianons Go code
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 524416560a4624d30023db32101c9fe5ebffc895 Component: engine

---
 .../engine/pkg/netlink/netlink_linux.go       | 97 +++++++------------
 1 file changed, 35 insertions(+), 62 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 77ebfcd46a..46bd3d8373 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -2,60 +2,6 @@
 
 package netlink
 
-/*
-#include <string.h>
-#include <errno.h>
-#include <sys/ioctl.h>
-#include <net/if.h>
-
-static int get_socket(void) {
-	int s_errno;
-	int fd;
-
-	fd = socket(PF_INET, SOCK_DGRAM, 0);
-	if (fd >= 0) {
-		return fd;
-    }
-	s_errno = errno;
-
-	fd = socket(PF_PACKET, SOCK_DGRAM, 0);
-	if (fd >= 0) {
-		return fd;
-    }
-
-	fd = socket(PF_INET6, SOCK_DGRAM, 0);
-	if (fd >= 0) {
-		return fd;
-    }
-	errno = s_errno;
-	return -1;
-}
-
-
-static int change_name(const char *old_name, const char *new_name) {
-    struct ifreq ifr;
-	int err;
-	int fd;
-
-	fd = get_socket();
-	if (fd < 0) {
-		return -1;
-    }
-
-	strncpy(ifr.ifr_name, old_name, IFNAMSIZ);
-	strncpy(ifr.ifr_newname, new_name, IFNAMSIZ);
-
-    err = ioctl(fd, SIOCSIFNAME, &ifr);
-	if (err) {
-        close(fd);
-		return -1;
-	}
-    close(fd);
-	return err;
-}
-*/
-import "C"
-
 import (
 	"encoding/binary"
 	"fmt"
@@ -696,14 +642,41 @@ done:
 	return res, nil
 }
 
-func NetworkChangeName(oldName, newName string) error {
-	var (
-		cold = C.CString(oldName)
-		cnew = C.CString(newName)
-	)
-
-	if errno := int(C.change_name(cold, cnew)); errno != 0 {
-		return fmt.Errorf("unable to change name %d", errno)
+func getIfSocket() (int, error) {
+	fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, 0)
+	if err == nil {
+		return fd, err
 	}
+	sErr := err
+
+	fd, err = syscall.Socket(syscall.AF_PACKET, syscall.SOCK_DGRAM, 0)
+	if err == nil {
+		return fd, err
+	}
+
+	fd, err = syscall.Socket(syscall.AF_INET6, syscall.SOCK_DGRAM, 0)
+	if err == nil {
+		return fd, err
+	}
+
+	return -1, sErr
+}
+
+func NetworkChangeName(oldName, newName string) error {
+	fd, err := getIfSocket()
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(fd)
+	IFNAMSIZ := 16
+
+	data := [32]byte{}
+	copy(data[:IFNAMSIZ-1], oldName)
+	copy(data[IFNAMSIZ:IFNAMSIZ*2-1], newName)
+
+	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&data[0]))); errno != 0 {
+		return errno
+	}
+
 	return nil
 }

From a53586948286f9ff6b960c384d5f81c0ab252dc1 Mon Sep 17 00:00:00 2001
From: Andrew Williams <williams.andrew@gmail.com>
Date: Sun, 9 Feb 2014 15:36:04 -0600
Subject: [PATCH 029/403] Adjust test to match its comment

Docker-DCO-1.1-Signed-off-by: Andrew Williams <williams.andrew@gmail.com> (github: TheDude05)
Upstream-commit: 95bcb8924ac2cbe0fb625a604d2c6d5a8e2fa06a
Component: engine
---
 components/engine/networkdriver/network_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/networkdriver/network_test.go b/components/engine/networkdriver/network_test.go
index c15f8b1cf5..6224c2dffb 100644
--- a/components/engine/networkdriver/network_test.go
+++ b/components/engine/networkdriver/network_test.go
@@ -105,7 +105,7 @@ func TestNetworkOverlaps(t *testing.T) {
 	//netY starts before and ends at same IP of netX
 	AssertOverlap("172.16.1.1/24", "172.16.0.1/23", t)
 	//netY starts before and ends outside of netX
-	AssertOverlap("172.16.1.1/24", "172.16.0.1/23", t)
+	AssertOverlap("172.16.1.1/24", "172.16.0.1/22", t)
 	//netY starts and ends before netX
 	AssertNoOverlap("172.16.1.1/25", "172.16.0.1/24", t)
 	//netX starts and ends before netY

From aaca90f4b6ea71d0d77e2679206d2f094fe94824 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Sun, 9 Feb 2014 18:12:43 -0700
Subject: [PATCH 030/403] Update NetworkChangeName to be more similar to my
 original (moving IFNAMSIZ constant outside the function like it should've
 been)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 3a7c144e9992591f32daf2d4f1b35b7b6520a07e
Component: engine
---
 components/engine/pkg/netlink/netlink_linux.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 46bd3d8373..b94cbf6822 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -662,15 +662,17 @@ func getIfSocket() (int, error) {
 	return -1, sErr
 }
 
+// from <net/if.h>
+const IFNAMSIZ = 16
+
 func NetworkChangeName(oldName, newName string) error {
 	fd, err := getIfSocket()
 	if err != nil {
 		return err
 	}
 	defer syscall.Close(fd)
-	IFNAMSIZ := 16
 
-	data := [32]byte{}
+	data := [IFNAMSIZ * 2]byte{}
 	copy(data[:IFNAMSIZ-1], oldName)
 	copy(data[IFNAMSIZ:IFNAMSIZ*2-1], newName)
 

From aa80369d9ad65869acb93f6a9ed1c8463ee16b54 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Sun, 9 Feb 2014 18:21:01 -0700
Subject: [PATCH 031/403] Add slightly better GOPATH detection/handling

This also adds a new "AUTO_GOPATH" environment variable that will create an appropriate GOPATH as part of the build process.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: d3d85d38fb5bdd0327fdc9fe8b637cb0f4e1dcf2
Component: engine
---
 components/engine/hack/make.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index ef13c1a283..d73b33a4fa 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -68,6 +68,19 @@ else
 	exit 1
 fi
 
+if [ "$AUTO_GOPATH" ]; then
+	rm -rf .gopath
+	mkdir -p .gopath/src/github.com/dotcloud
+	ln -sf ../../../.. .gopath/src/github.com/dotcloud/docker
+	export GOPATH="$(pwd)/.gopath:$(pwd)/vendor"
+fi
+
+if [ ! "$GOPATH" ]; then
+	echo >&2 'error: missing GOPATH; please see http://golang.org/doc/code.html#GOPATH'
+	echo >&2 '  alternatively, set AUTO_GOPATH=1'
+	exit 1
+fi
+
 # Use these flags when compiling the tests and final binary
 LDFLAGS='-X main.GITCOMMIT "'$GITCOMMIT'" -X main.VERSION "'$VERSION'" -w'
 LDFLAGS_STATIC='-X github.com/dotcloud/docker/utils.IAMSTATIC true -linkmode external -extldflags "-lpthread -static -Wl,--unresolved-symbols=ignore-in-object-files"'

From 4ce6d81f0dd510dabacc05da1c85b5c933454055 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 10 Feb 2014 11:04:24 -0800
Subject: [PATCH 032/403] Improve no command handling
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 44821158409d59024173336188e087c605e1da1a Component: engine

---
 components/engine/runtime.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 7e4ae79b40..a16238e200 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -378,9 +378,7 @@ func (runtime *Runtime) Create(config *Config, name string) (*Container, []strin
 		}
 	}
 
-	if len(config.Entrypoint) != 0 && config.Cmd == nil {
-		config.Cmd = []string{}
-	} else if config.Cmd == nil || len(config.Cmd) == 0 {
+	if len(config.Entrypoint) == 0 && len(config.Cmd) == 0 {
 		return nil, nil, fmt.Errorf("No command specified")
 	}
 

From 5fb9dcf8436d627b209cd9705d741e17affe9f4d Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 10 Feb 2014 11:36:23 -0800
Subject: [PATCH 033/403] Improve get if socket loop
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 27df18ff11dbfc22ca539462710abf07d507c0d9 Component: engine

---
 .../engine/pkg/netlink/netlink_linux.go       | 43 +++++++++----------
 1 file changed, 20 insertions(+), 23 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index b94cbf6822..4e091ef103 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -10,6 +10,12 @@ import (
 	"unsafe"
 )
 
+const (
+	IFNAMSIZ       = 16
+	DEFAULT_CHANGE = 0xFFFFFFFF
+	IFLA_INFO_KIND = 1
+)
+
 var nextSeqNr int
 
 func nativeEndian() binary.ByteOrder {
@@ -368,7 +374,7 @@ func NetworkSetMTU(iface *net.Interface, mtu int) error {
 	msg.Type = syscall.RTM_SETLINK
 	msg.Flags = syscall.NLM_F_REQUEST
 	msg.Index = int32(iface.Index)
-	msg.Change = 0xFFFFFFFF
+	msg.Change = DEFAULT_CHANGE
 	wb.AddData(msg)
 
 	var (
@@ -400,7 +406,7 @@ func NetworkSetMaster(iface, master *net.Interface) error {
 	msg.Type = syscall.RTM_SETLINK
 	msg.Flags = syscall.NLM_F_REQUEST
 	msg.Index = int32(iface.Index)
-	msg.Change = 0xFFFFFFFF
+	msg.Change = DEFAULT_CHANGE
 	wb.AddData(msg)
 
 	var (
@@ -432,7 +438,7 @@ func NetworkSetNsPid(iface *net.Interface, nspid int) error {
 	msg.Type = syscall.RTM_SETLINK
 	msg.Flags = syscall.NLM_F_REQUEST
 	msg.Index = int32(iface.Index)
-	msg.Change = 0xFFFFFFFF
+	msg.Change = DEFAULT_CHANGE
 	wb.AddData(msg)
 
 	var (
@@ -524,8 +530,6 @@ func NetworkLinkAdd(name string, linkType string) error {
 	nameData := newRtAttr(syscall.IFLA_IFNAME, zeroTerminated(name))
 	wb.AddData(nameData)
 
-	IFLA_INFO_KIND := 1
-
 	kindData := newRtAttr(IFLA_INFO_KIND, nonZeroTerminated(linkType))
 
 	infoData := newRtAttr(syscall.IFLA_LINKINFO, kindData.ToWireFormat())
@@ -642,29 +646,22 @@ done:
 	return res, nil
 }
 
-func getIfSocket() (int, error) {
-	fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, 0)
-	if err == nil {
-		return fd, err
+func getIfSocket() (fd int, err error) {
+	for _, socket := range []int{
+		syscall.AF_INET,
+		syscall.AF_PACKET,
+		syscall.AF_INET6,
+	} {
+		if fd, err = syscall.Socket(socket, syscall.SOCK_DGRAM, 0); err == nil {
+			break
+		}
 	}
-	sErr := err
-
-	fd, err = syscall.Socket(syscall.AF_PACKET, syscall.SOCK_DGRAM, 0)
 	if err == nil {
-		return fd, err
+		return fd, nil
 	}
-
-	fd, err = syscall.Socket(syscall.AF_INET6, syscall.SOCK_DGRAM, 0)
-	if err == nil {
-		return fd, err
-	}
-
-	return -1, sErr
+	return -1, err
 }
 
-// from <net/if.h>
-const IFNAMSIZ = 16
-
 func NetworkChangeName(oldName, newName string) error {
 	fd, err := getIfSocket()
 	if err != nil {

From f694361fe52fead4488c67c8121af06ba8f2c6dc Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Mon, 10 Feb 2014 13:44:34 -0700
Subject: [PATCH 034/403] Add better ".git" detection and use

This way, packagers can set GIT_DIR appropriately if they'd prefer to not have ".git" inside their working directory.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 0a0406450fb83f4ff7d08235cd3e94ea8fba752f
Component: engine
---
 components/engine/hack/make.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index d73b33a4fa..cebb9064e6 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -53,9 +53,9 @@ DEFAULT_BUNDLES=(
 )
 
 VERSION=$(cat ./VERSION)
-if [ -d .git ] && command -v git &> /dev/null; then
+if command -v git &> /dev/null && git rev-parse &> /dev/null; then
 	GITCOMMIT=$(git rev-parse --short HEAD)
-	if [ -n "$(git status --porcelain)" ]; then
+	if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
 		GITCOMMIT="$GITCOMMIT-dirty"
 	fi
 elif [ "$DOCKER_GITCOMMIT" ]; then

From 2095048f8cccbd9e784b16b9ed989c0f9bb07737 Mon Sep 17 00:00:00 2001
From: "O.S.Tezer" <ostezer@gmail.com>
Date: Sun, 9 Feb 2014 14:40:31 +0200
Subject: [PATCH 035/403] docs: Installation Instruction Title & Description
 Fixes Docker-DCO-1.1-Signed-off-by: O.S. Tezer <ostezer@gmail.com> (github:
 ostezer)

1. All titles are listed by simple platform names apart from Windows' "Installing Docker On Windows". Changed this to "Windows" to match the rest.

2. Some articles' description (and title) information does not match the majority. Modified them to match the rest (i.e. Please note this project is currently under heavy development. It should not be used in production.)

3. Removed "Linux" from Gentoo & Ubuntu descriptions.
Upstream-commit: 10d57b648fe77fe34642d0af6c5c010ff1180c85
Component: engine
---
 components/engine/docs/sources/installation/amazon.rst    | 2 +-
 components/engine/docs/sources/installation/archlinux.rst | 2 +-
 components/engine/docs/sources/installation/fedora.rst    | 2 +-
 .../engine/docs/sources/installation/frugalware.rst       | 2 +-
 .../engine/docs/sources/installation/gentoolinux.rst      | 4 ++--
 components/engine/docs/sources/installation/mac.rst       | 2 +-
 components/engine/docs/sources/installation/openSUSE.rst  | 2 +-
 components/engine/docs/sources/installation/rackspace.rst | 4 ++--
 components/engine/docs/sources/installation/rhel.rst      | 2 +-
 .../engine/docs/sources/installation/ubuntulinux.rst      | 2 +-
 components/engine/docs/sources/installation/windows.rst   | 8 ++++----
 11 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/components/engine/docs/sources/installation/amazon.rst b/components/engine/docs/sources/installation/amazon.rst
index e8fdc2c1ca..31090a070c 100644
--- a/components/engine/docs/sources/installation/amazon.rst
+++ b/components/engine/docs/sources/installation/amazon.rst
@@ -1,5 +1,5 @@
 :title: Installation on Amazon EC2
-:description: Docker installation on Amazon EC2 
+:description: Please note this project is currently under heavy development. It should not be used in production. 
 :keywords: amazon ec2, virtualization, cloud, docker, documentation, installation
 
 Amazon EC2
diff --git a/components/engine/docs/sources/installation/archlinux.rst b/components/engine/docs/sources/installation/archlinux.rst
index 2d823bfd46..c9b4c1d2c5 100644
--- a/components/engine/docs/sources/installation/archlinux.rst
+++ b/components/engine/docs/sources/installation/archlinux.rst
@@ -1,5 +1,5 @@
 :title: Installation on Arch Linux
-:description: Docker installation on Arch Linux.
+:description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: arch linux, virtualization, docker, documentation, installation
 
 .. _arch_linux:
diff --git a/components/engine/docs/sources/installation/fedora.rst b/components/engine/docs/sources/installation/fedora.rst
index 6dd2bf91d9..7e0aee78fd 100644
--- a/components/engine/docs/sources/installation/fedora.rst
+++ b/components/engine/docs/sources/installation/fedora.rst
@@ -1,4 +1,4 @@
-:title: Requirements and Installation on Fedora
+:title: Installation on Fedora
 :description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: Docker, Docker documentation, Fedora, requirements, virtualbox, vagrant, git, ssh, putty, cygwin, linux
 
diff --git a/components/engine/docs/sources/installation/frugalware.rst b/components/engine/docs/sources/installation/frugalware.rst
index de2b92ae10..ed9bb2bfaa 100644
--- a/components/engine/docs/sources/installation/frugalware.rst
+++ b/components/engine/docs/sources/installation/frugalware.rst
@@ -1,5 +1,5 @@
 :title: Installation on FrugalWare
-:description: Docker installation on FrugalWare.
+:description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: frugalware linux, virtualization, docker, documentation, installation
 
 .. _frugalware:
diff --git a/components/engine/docs/sources/installation/gentoolinux.rst b/components/engine/docs/sources/installation/gentoolinux.rst
index 421af0a1e7..5abfddeb91 100644
--- a/components/engine/docs/sources/installation/gentoolinux.rst
+++ b/components/engine/docs/sources/installation/gentoolinux.rst
@@ -1,5 +1,5 @@
-:title: Installation on Gentoo Linux
-:description: Docker installation instructions and nuances for Gentoo Linux.
+:title: Installation on Gentoo
+:description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: gentoo linux, virtualization, docker, documentation, installation
 
 .. _gentoo_linux:
diff --git a/components/engine/docs/sources/installation/mac.rst b/components/engine/docs/sources/installation/mac.rst
index c247c4aba2..3cf1c93a15 100644
--- a/components/engine/docs/sources/installation/mac.rst
+++ b/components/engine/docs/sources/installation/mac.rst
@@ -1,4 +1,4 @@
-:title: Requirements and Installation on Mac OS X 10.6 Snow Leopard
+:title: Installation on Mac OS X 10.6 Snow Leopard
 :description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: Docker, Docker documentation, requirements, virtualbox, ssh, linux, os x, osx, mac
 
diff --git a/components/engine/docs/sources/installation/openSUSE.rst b/components/engine/docs/sources/installation/openSUSE.rst
index ded5de44a4..c791beacbf 100644
--- a/components/engine/docs/sources/installation/openSUSE.rst
+++ b/components/engine/docs/sources/installation/openSUSE.rst
@@ -1,5 +1,5 @@
 :title: Installation on openSUSE
-:description: Docker installation on openSUSE.
+:description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: openSUSE, virtualbox, docker, documentation, installation
 
 .. _openSUSE:
diff --git a/components/engine/docs/sources/installation/rackspace.rst b/components/engine/docs/sources/installation/rackspace.rst
index d0005a14bc..687131a413 100644
--- a/components/engine/docs/sources/installation/rackspace.rst
+++ b/components/engine/docs/sources/installation/rackspace.rst
@@ -1,5 +1,5 @@
-:title: Rackspace Cloud Installation
-:description: Installing Docker on Ubuntu proviced by Rackspace
+:title: Installation on Rackspace Cloud
+:description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: Rackspace Cloud, installation, docker, linux, ubuntu
 
 Rackspace Cloud
diff --git a/components/engine/docs/sources/installation/rhel.rst b/components/engine/docs/sources/installation/rhel.rst
index 9036fb79ea..7930da6309 100644
--- a/components/engine/docs/sources/installation/rhel.rst
+++ b/components/engine/docs/sources/installation/rhel.rst
@@ -1,4 +1,4 @@
-:title: Requirements and Installation on Red Hat Enterprise Linux
+:title: Installation on Red Hat Enterprise Linux
 :description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: Docker, Docker documentation, requirements, linux, rhel, centos
 
diff --git a/components/engine/docs/sources/installation/ubuntulinux.rst b/components/engine/docs/sources/installation/ubuntulinux.rst
index 3d6ee6415d..f37be90d7d 100644
--- a/components/engine/docs/sources/installation/ubuntulinux.rst
+++ b/components/engine/docs/sources/installation/ubuntulinux.rst
@@ -1,4 +1,4 @@
-:title: Requirements and Installation on Ubuntu Linux
+:title: Installation on Ubuntu
 :description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: Docker, Docker documentation, requirements, virtualbox, vagrant, git, ssh, putty, cygwin, linux
 
diff --git a/components/engine/docs/sources/installation/windows.rst b/components/engine/docs/sources/installation/windows.rst
index c980a32df9..9d965ea3fe 100644
--- a/components/engine/docs/sources/installation/windows.rst
+++ b/components/engine/docs/sources/installation/windows.rst
@@ -1,11 +1,11 @@
-:title: Requirements and Installation on Windows
-:description: Docker's tutorial to run docker on Windows
+:title: Installation on Windows
+:description: Please note this project is currently under heavy development. It should not be used in production.
 :keywords: Docker, Docker documentation, Windows, requirements, virtualbox, vagrant, git, ssh, putty, cygwin
 
 .. _windows:
 
-Installing Docker on Windows
-============================
+Windows
+=======
 
 Docker can run on Windows using a VM like VirtualBox. You then run
 Linux within the VM.

From 6da22355911c2ddf5e8eb0389b6435c6e7698bac Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 10 Feb 2014 13:37:16 -0800
Subject: [PATCH 036/403] Create veth pair via netlink
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 38eabfa65c5be78a08a8287b600e230dbe0bfac5 Component: engine

---
 .../engine/pkg/netlink/netlink_linux.go       | 43 ++++++++++++++++++-
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 4e091ef103..52c77a26a4 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -14,6 +14,8 @@ const (
 	IFNAMSIZ       = 16
 	DEFAULT_CHANGE = 0xFFFFFFFF
 	IFLA_INFO_KIND = 1
+	IFLA_INFO_DATA = 2
+	VETH_PEER      = 1
 )
 
 var nextSeqNr int
@@ -197,7 +199,9 @@ func (rr *NetlinkRequest) ToWireFormat() []byte {
 }
 
 func (rr *NetlinkRequest) AddData(data NetlinkRequestData) {
-	rr.Data = append(rr.Data, data)
+	if data != nil {
+		rr.Data = append(rr.Data, data)
+	}
 }
 
 func newNetlinkRequest(proto, flags int) *NetlinkRequest {
@@ -676,6 +680,41 @@ func NetworkChangeName(oldName, newName string) error {
 	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&data[0]))); errno != 0 {
 		return errno
 	}
-
 	return nil
 }
+
+func NetworkCreateVethPair(name1, name2 string) error {
+	s, err := getNetlinkSocket()
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	wb := newNetlinkRequest(syscall.RTM_NEWLINK, syscall.NLM_F_CREATE|syscall.NLM_F_EXCL|syscall.NLM_F_ACK)
+
+	msg := newIfInfomsg(syscall.AF_UNSPEC)
+	wb.AddData(msg)
+
+	kindData := newRtAttr(IFLA_INFO_KIND, nonZeroTerminated("veth"))
+	info := newRtAttr(syscall.IFLA_LINKINFO, kindData.ToWireFormat())
+	//	wb.AddData(info)
+
+	peerName := newRtAttr(syscall.IFLA_IFNAME, nonZeroTerminated(name2))
+	peer := newRtAttr(VETH_PEER, peerName.ToWireFormat())
+	//	wb.AddData(peer)
+
+	b := []byte{}
+	b = append(b, peer.ToWireFormat()...)
+	b = append(b, info.ToWireFormat()...)
+
+	infoData := newRtAttr(IFLA_INFO_DATA, b)
+	wb.AddData(infoData)
+
+	nameData := newRtAttr(syscall.IFLA_IFNAME, zeroTerminated(name1))
+	wb.AddData(nameData)
+
+	if err := s.Send(wb); err != nil {
+		return err
+	}
+	return s.HandleAck(wb.Seq)
+}

From 7dcdfb0d44d2c1a991494f75c27a27548361bde9 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Mon, 10 Feb 2014 23:52:15 +0000
Subject: [PATCH 037/403] fix --run in docker commit

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 5d29749e9dba4d918fc5ed5d6049f397e98967cf
Component: engine
---
 components/engine/api/api.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index 7c229eead0..3bc8a8b504 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -367,7 +367,7 @@ func postCommit(eng *engine.Engine, version float64, w http.ResponseWriter, r *h
 		env    engine.Env
 		job    = eng.Job("commit", r.Form.Get("container"))
 	)
-	if err := config.Import(r.Body); err != nil {
+	if err := config.Decode(r.Body); err != nil {
 		utils.Errorf("%s", err)
 	}
 

From 06def9a48b934fae9b5e92088baf96be21e9e4c3 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Tue, 11 Feb 2014 10:10:50 +1000
Subject: [PATCH 038/403] bring back the explaination of our LGTM process

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: 5051b8610d7802db2d479cfba14009552a95789f
Component: engine
---
 components/engine/CONTRIBUTING.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/components/engine/CONTRIBUTING.md b/components/engine/CONTRIBUTING.md
index ee40b1d3b2..3c5a57e131 100644
--- a/components/engine/CONTRIBUTING.md
+++ b/components/engine/CONTRIBUTING.md
@@ -109,6 +109,18 @@ name and email address match your git configuration. The AUTHORS file is
 regenerated occasionally from the git commit history, so a mismatch may result
 in your changes being overwritten.
 
+### Merge approval
+
+Docker maintainers use LGTM (looks good to me) in comments on the code review
+to indicate acceptance.
+
+A change requires LGTMs from an absolute majority of the maintainers of each
+component affected. For example, if a change affects docs/ and registry/, it
+needs an absolute majority from the maintainers of docs/ AND, separately, an
+absolute majority of the maintainers of registry
+
+For more details see [MAINTAINERS.md](hack/MAINTAINERS.md)
+
 ### Sign your work
 
 The sign-off is a simple line at the end of the explanation for the

From 1093e871da328f465db19fc02cf45a566da456a4 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 10 Feb 2014 16:41:16 -0800
Subject: [PATCH 039/403] Allow add of empty name Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 4dec36d1ee8cfd8b396210daa5367d146bbb34bc Component: engine

---
 components/engine/pkg/netlink/netlink_linux.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 52c77a26a4..23dba0c884 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -531,8 +531,10 @@ func NetworkLinkAdd(name string, linkType string) error {
 	msg := newIfInfomsg(syscall.AF_UNSPEC)
 	wb.AddData(msg)
 
-	nameData := newRtAttr(syscall.IFLA_IFNAME, zeroTerminated(name))
-	wb.AddData(nameData)
+	if name != "" {
+		nameData := newRtAttr(syscall.IFLA_IFNAME, zeroTerminated(name))
+		wb.AddData(nameData)
+	}
 
 	kindData := newRtAttr(IFLA_INFO_KIND, nonZeroTerminated(linkType))
 

From 11beb9de931c94290a2f55328a6ecb87aa9da51f Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Mon, 10 Feb 2014 16:10:15 +1000
Subject: [PATCH 040/403] point out that ENV DEBIAN_FRONTEND will persist, so
 its not recommended

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: c4b9e1c9add2ab3c97cc89c8f6b12b83750cea1d
Component: engine
---
 components/engine/docs/sources/reference/builder.rst | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/components/engine/docs/sources/reference/builder.rst b/components/engine/docs/sources/reference/builder.rst
index 571824c36c..4b6a151006 100644
--- a/components/engine/docs/sources/reference/builder.rst
+++ b/components/engine/docs/sources/reference/builder.rst
@@ -251,9 +251,14 @@ value ``<value>``. This value will be passed to all future ``RUN``
 instructions. This is functionally equivalent to prefixing the command
 with ``<key>=<value>``
 
+The environment variables set using ``ENV`` will persist when a container is run
+from the resulting image. You can view the values using ``docker inspect``, and change them using ``docker run --env <key>=<value>``.
+
 .. note::
-    The environment variables will persist when a container is run
-    from the resulting image.
+    One example where this can cause unexpected consequenses, is setting 
+    ``ENV DEBIAN_FRONTEND noninteractive``.
+    Which will persist when the container is run interactively; for example: 
+    ``docker run -t -i image bash``
 
 .. _dockerfile_add:
 

From 71b22701b5877e7bbf00e08f44e4176387c64753 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Tue, 11 Feb 2014 14:58:42 +1000
Subject: [PATCH 041/403] add a little info on upgrading

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: 82863aecab824118e223b53fed905ed5fd9182bb
Component: engine
---
 components/engine/docs/sources/installation/mac.rst | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/components/engine/docs/sources/installation/mac.rst b/components/engine/docs/sources/installation/mac.rst
index 4f0550ad3d..5381842432 100644
--- a/components/engine/docs/sources/installation/mac.rst
+++ b/components/engine/docs/sources/installation/mac.rst
@@ -147,6 +147,18 @@ If SSH complains about keys:
 
     ssh-keygen -R '[localhost]:2022'
 
+Upgrading to a newer release of boot2docker
+-------------------------------------------
+
+To upgrade an initialised VM, you can use the following 3 commands. Your persistence
+disk will not be changed, so you won't lose your images and containers:
+
+.. code-block:: bash
+
+    ./boot2docker stop
+    ./boot2docker download
+    ./boot2docker start
+
 About the way Docker works on Mac OS X:
 ---------------------------------------
 

From c0caaa92a354d45f99a70088a91fd1e3b97da4ca Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 10 Feb 2014 22:32:07 -0800
Subject: [PATCH 042/403] Add more netlink functions for set ns by fd and bring
 iface down Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 f9cd1be6ffbda85f20cc7926274fab7484a19823 Component: engine

---
 .../engine/pkg/netlink/netlink_linux.go       | 61 ++++++++++++++++++-
 1 file changed, 58 insertions(+), 3 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 23dba0c884..3b21a38d06 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -15,7 +15,8 @@ const (
 	DEFAULT_CHANGE = 0xFFFFFFFF
 	IFLA_INFO_KIND = 1
 	IFLA_INFO_DATA = 2
-	VETH_PEER      = 1
+	VETH_INFO_PEER = 1
+	IFLA_NET_NS_FD = 28
 )
 
 var nextSeqNr int
@@ -365,6 +366,28 @@ func NetworkLinkUp(iface *net.Interface) error {
 	return s.HandleAck(wb.Seq)
 }
 
+func NetworkLinkDown(iface *net.Interface) error {
+	s, err := getNetlinkSocket()
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	wb := newNetlinkRequest(syscall.RTM_NEWLINK, syscall.NLM_F_ACK)
+
+	msg := newIfInfomsg(syscall.AF_UNSPEC)
+	msg.Change = syscall.IFF_UP
+	msg.Flags = 0 & ^syscall.IFF_UP
+	msg.Index = int32(iface.Index)
+	wb.AddData(msg)
+
+	if err := s.Send(wb); err != nil {
+		return err
+	}
+
+	return s.HandleAck(wb.Seq)
+}
+
 func NetworkSetMTU(iface *net.Interface, mtu int) error {
 	s, err := getNetlinkSocket()
 	if err != nil {
@@ -461,6 +484,38 @@ func NetworkSetNsPid(iface *net.Interface, nspid int) error {
 	return s.HandleAck(wb.Seq)
 }
 
+func NetworkSetNsFd(iface *net.Interface, fd int) error {
+	s, err := getNetlinkSocket()
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	wb := newNetlinkRequest(syscall.RTM_SETLINK, syscall.NLM_F_ACK)
+
+	msg := newIfInfomsg(syscall.AF_UNSPEC)
+	msg.Type = syscall.RTM_SETLINK
+	msg.Flags = syscall.NLM_F_REQUEST
+	msg.Index = int32(iface.Index)
+	msg.Change = DEFAULT_CHANGE
+	wb.AddData(msg)
+
+	var (
+		b      = make([]byte, 4)
+		native = nativeEndian()
+	)
+	native.PutUint32(b, uint32(fd))
+
+	data := newRtAttr(IFLA_NET_NS_FD, b)
+	wb.AddData(data)
+
+	if err := s.Send(wb); err != nil {
+		return err
+	}
+
+	return s.HandleAck(wb.Seq)
+}
+
 // Add an Ip address to an interface. This is identical to:
 // ip addr add $ip/$ipNet dev $iface
 func NetworkLinkAddIp(iface *net.Interface, ip net.IP, ipNet *net.IPNet) error {
@@ -668,7 +723,7 @@ func getIfSocket() (fd int, err error) {
 	return -1, err
 }
 
-func NetworkChangeName(oldName, newName string) error {
+func NetworkChangeName(iface *net.Interface, newName string) error {
 	fd, err := getIfSocket()
 	if err != nil {
 		return err
@@ -676,7 +731,7 @@ func NetworkChangeName(oldName, newName string) error {
 	defer syscall.Close(fd)
 
 	data := [IFNAMSIZ * 2]byte{}
-	copy(data[:IFNAMSIZ-1], oldName)
+	copy(data[:IFNAMSIZ-1], iface.Name)
 	copy(data[IFNAMSIZ:IFNAMSIZ*2-1], newName)
 
 	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&data[0]))); errno != 0 {

From abb4de85469c76a53fd8a2106d41560a00ed2b78 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 11 Feb 2014 09:40:13 +0100
Subject: [PATCH 043/403] devmapper: Remove directory when removing
 devicemapper device

We're currently leaving around lots of empty directories in
/var/lib/docker/devicemapper/mnt/ for removed images and containers.
Fix this by removing the directory when the device is removed.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 2343fe44533f19ebae5e6127f4a2a19d1d8773fa
Component: engine
---
 components/engine/graphdriver/devmapper/driver.go | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/components/engine/graphdriver/devmapper/driver.go b/components/engine/graphdriver/devmapper/driver.go
index 25b998e59f..4d414f9a75 100644
--- a/components/engine/graphdriver/devmapper/driver.go
+++ b/components/engine/graphdriver/devmapper/driver.go
@@ -7,6 +7,7 @@ import (
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/utils"
 	"io/ioutil"
+	"os"
 	"path"
 )
 
@@ -94,7 +95,16 @@ func (d *Driver) Remove(id string) error {
 		return err
 	}
 	// This assumes the device has been properly Get/Put:ed and thus is unmounted
-	return d.DeviceSet.DeleteDevice(id)
+	if err := d.DeviceSet.DeleteDevice(id); err != nil {
+		return err
+	}
+
+	mp := path.Join(d.home, "mnt", id)
+	if err := os.RemoveAll(mp); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	return nil
 }
 
 func (d *Driver) Get(id string) (string, error) {

From 9ca9fdc33f1da57898214159ca003b89ae10b370 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 11 Feb 2014 09:42:34 +0100
Subject: [PATCH 044/403] devicemapper: Fix tests on fedora

If /dev/loop-control exists on the system running the test then
ioctlLoopCtlGetFree() will be called, but if not it won't.  It does
not exist in the standard docker build environment, so the tests
currently require this to not be called. This makes it instead
optional, allowing the tests to run on e.g. Fedora.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: eb4578daee98561b16d11d2978b5f5e297d903e8
Component: engine
---
 components/engine/graphdriver/devmapper/driver_test.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/components/engine/graphdriver/devmapper/driver_test.go b/components/engine/graphdriver/devmapper/driver_test.go
index ff4ec45e5d..7939241987 100644
--- a/components/engine/graphdriver/devmapper/driver_test.go
+++ b/components/engine/graphdriver/devmapper/driver_test.go
@@ -136,7 +136,12 @@ type Set map[string]bool
 
 func (r Set) Assert(t *testing.T, names ...string) {
 	for _, key := range names {
-		if _, exists := r[key]; !exists {
+		required := true
+		if strings.HasPrefix(key, "?") {
+			key = key[1:]
+			required = false
+		}
+		if _, exists := r[key]; !exists && required {
 			t.Fatalf("Key not set: %s", key)
 		}
 		delete(r, key)
@@ -486,6 +491,7 @@ func TestDriverCreate(t *testing.T) {
 			"ioctl.blkgetsize",
 			"ioctl.loopsetfd",
 			"ioctl.loopsetstatus",
+			"?ioctl.loopctlgetfree",
 		)
 
 		if err := d.Create("1", ""); err != nil {
@@ -603,6 +609,7 @@ func TestDriverRemove(t *testing.T) {
 			"ioctl.blkgetsize",
 			"ioctl.loopsetfd",
 			"ioctl.loopsetstatus",
+			"?ioctl.loopctlgetfree",
 		)
 
 		if err := d.Create("1", ""); err != nil {

From 96a42d5055d3d6f9b5081414fcf7da48f32313ba Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 11 Feb 2014 11:10:55 +0100
Subject: [PATCH 045/403] lxc: Drop NET_ADMIN capability in non-privileged
 containers

With this capability set the container can e.g. change the ip address
of his devices to that of another container on the docker0 bridge. In
a quick test I was able to listen to a port on a different ip than the
one docker assigned me, but was not able to hijack an open port
redirection that another container had open. Maybe its possible with
some more knowledge of networking though.

Anyway, network setup is meant to be handled by docker, not the apps,
so I believe denying this is generally in the spirit of docker, and
it closes down potential security issues.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 02fddffd51da782f912e2709ea814c330269515b
Component: engine
---
 components/engine/execdriver/lxc/init.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/execdriver/lxc/init.go b/components/engine/execdriver/lxc/init.go
index 7c2b039c50..0a7746dd15 100644
--- a/components/engine/execdriver/lxc/init.go
+++ b/components/engine/execdriver/lxc/init.go
@@ -127,6 +127,7 @@ func setupCapabilities(args *execdriver.InitArgs) error {
 		capability.CAP_AUDIT_CONTROL,
 		capability.CAP_MAC_OVERRIDE,
 		capability.CAP_MAC_ADMIN,
+		capability.CAP_NET_ADMIN,
 	}
 
 	c, err := capability.NewPid(os.Getpid())

From d33fce79f6a0ab67e56a246c90cef8c23ea7185f Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Tue, 11 Feb 2014 19:53:45 +1000
Subject: [PATCH 046/403] add a little more information about the docker run -P
 option

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: b2146cb0e7a23553d1520ed87837a1b5455c9130
Component: engine
---
 .../engine/docs/sources/reference/commandline/cli.rst    | 4 ++++
 components/engine/docs/sources/use/port_redirection.rst  | 9 +++++++++
 2 files changed, 13 insertions(+)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 5f4f821e12..18cef685aa 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -1088,6 +1088,10 @@ is, ``docker run`` is equivalent to the API ``/containers/create`` then
 The ``docker run`` command can be used in combination with ``docker commit`` to
 :ref:`change the command that a container runs <cli_commit_examples>`.
 
+See :ref:`port_redirection` for more detailed information about the ``--expose``, 
+``-p``, ``-P`` and ``--link`` parameters, and :ref:`working_with_links_names` for 
+specific examples using ``--link``.
+
 Known Issues (run -volumes-from)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/components/engine/docs/sources/use/port_redirection.rst b/components/engine/docs/sources/use/port_redirection.rst
index 5cddb238e4..2f4fd37c76 100644
--- a/components/engine/docs/sources/use/port_redirection.rst
+++ b/components/engine/docs/sources/use/port_redirection.rst
@@ -31,6 +31,15 @@ container, Docker provide ways to bind the container port to an
 interface of the host system. To simplify communication between
 containers, Docker provides the linking mechanism.
 
+Auto map all exposed ports on the host
+-------------------------------------
+
+To bind all the exposed container ports to the host automatically, use 
+``docker run -P <imageid>``.  The mapped host ports will be auto-selected 
+from a pool of unused ports (49000..49900), and you will need to use 
+``docker ps``, ``docker inspect <container_id>``  or 
+``docker port <container_id> <port>`` to determine what they are.
+
 Binding a port to a host interface
 -----------------------------------
 

From 6d92748c6f7c8960aeb386905ac59cee8b656f85 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 11 Feb 2014 03:32:35 -0800
Subject: [PATCH 047/403] Exec out to ip right now for creating the veth pair
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 27ed9a9f98750ab666d6221553b6f4ea59d396b8 Component: engine

---
 .../engine/pkg/netlink/netlink_linux.go       | 36 +++----------------
 1 file changed, 4 insertions(+), 32 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 3b21a38d06..b9e04a339a 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -6,6 +6,7 @@ import (
 	"encoding/binary"
 	"fmt"
 	"net"
+	"os/exec"
 	"syscall"
 	"unsafe"
 )
@@ -741,37 +742,8 @@ func NetworkChangeName(iface *net.Interface, newName string) error {
 }
 
 func NetworkCreateVethPair(name1, name2 string) error {
-	s, err := getNetlinkSocket()
-	if err != nil {
-		return err
+	if data, err := exec.Command("ip", "link", "add", name1, "type", "veth", "peer", "name", name2).Output(); err != nil {
+		return fmt.Errorf("%s %s", data, err)
 	}
-	defer s.Close()
-
-	wb := newNetlinkRequest(syscall.RTM_NEWLINK, syscall.NLM_F_CREATE|syscall.NLM_F_EXCL|syscall.NLM_F_ACK)
-
-	msg := newIfInfomsg(syscall.AF_UNSPEC)
-	wb.AddData(msg)
-
-	kindData := newRtAttr(IFLA_INFO_KIND, nonZeroTerminated("veth"))
-	info := newRtAttr(syscall.IFLA_LINKINFO, kindData.ToWireFormat())
-	//	wb.AddData(info)
-
-	peerName := newRtAttr(syscall.IFLA_IFNAME, nonZeroTerminated(name2))
-	peer := newRtAttr(VETH_PEER, peerName.ToWireFormat())
-	//	wb.AddData(peer)
-
-	b := []byte{}
-	b = append(b, peer.ToWireFormat()...)
-	b = append(b, info.ToWireFormat()...)
-
-	infoData := newRtAttr(IFLA_INFO_DATA, b)
-	wb.AddData(infoData)
-
-	nameData := newRtAttr(syscall.IFLA_IFNAME, zeroTerminated(name1))
-	wb.AddData(nameData)
-
-	if err := s.Send(wb); err != nil {
-		return err
-	}
-	return s.HandleAck(wb.Seq)
+	return nil
 }

From 3f55cc6f4171cf1abf21b46736513e7d4ba51109 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Mon, 10 Feb 2014 15:11:17 -0700
Subject: [PATCH 048/403] Add comment clarifying null termination

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: c626349f651a660302f64101055d65dc6e990307
Component: engine
---
 components/engine/pkg/netlink/netlink_linux.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 3b21a38d06..85dac51ea4 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -731,6 +731,8 @@ func NetworkChangeName(iface *net.Interface, newName string) error {
 	defer syscall.Close(fd)
 
 	data := [IFNAMSIZ * 2]byte{}
+	// the "-1"s here are very important for ensuring we get proper null
+	// termination of our new C strings
 	copy(data[:IFNAMSIZ-1], iface.Name)
 	copy(data[IFNAMSIZ:IFNAMSIZ*2-1], newName)
 

From d3d8c35b4150df6c5565f6cc3432ea9d1289b3e5 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 11 Feb 2014 12:47:59 +0100
Subject: [PATCH 049/403] devmapper: Fix shutdown warnings

Shutdown contains debug warnings like:

[debug] deviceset.go:699 [deviceset docker-0:33-17945897] waitRemove(/dev/mapper/docker-0:33-17945897-pool)
[debug] deviceset.go:380 libdevmapper(3): libdm-common.c:552 (-1) Device /dev/mapper/docker-0:33-17945897-pool not found

This is because shutdown is using removeDeviceAndWait() to remove the pool device and the
wait part fails because the pool is gone.

We fix this by adding a pool specific removal function which avoids all the trickiness of the
normal remove.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: eab270395e5b47b16a41c54ec6e1427f8144bffc
Component: engine
---
 .../engine/graphdriver/devmapper/deviceset.go | 23 +++++++++++++++----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index 637192dbcb..9b5ae62b67 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -639,6 +639,22 @@ func (devices *DeviceSet) DeleteDevice(hash string) error {
 	return devices.deleteDevice(hash)
 }
 
+func (devices *DeviceSet) deactivatePool() error {
+	utils.Debugf("[devmapper] deactivatePool()")
+	defer utils.Debugf("[devmapper] deactivatePool END")
+	devname := devices.getPoolDevName()
+	devinfo, err := getInfo(devname)
+	if err != nil {
+		utils.Debugf("\n--->Err: %s\n", err)
+		return err
+	}
+	if devinfo.Exists != 0 {
+		return removeDevice(devname)
+	}
+
+	return nil
+}
+
 func (devices *DeviceSet) deactivateDevice(hash string) error {
 	utils.Debugf("[devmapper] deactivateDevice(%s)", hash)
 	defer utils.Debugf("[devmapper] deactivateDevice END")
@@ -789,11 +805,8 @@ func (devices *DeviceSet) Shutdown() error {
 		}
 	}
 
-	pool := devices.getPoolDevName()
-	if devinfo, err := getInfo(pool); err == nil && devinfo.Exists != 0 {
-		if err := devices.deactivateDevice("pool"); err != nil {
-			utils.Debugf("Shutdown deactivate %s , error: %s\n", pool, err)
-		}
+	if err := devices.deactivatePool(); err != nil {
+		utils.Debugf("Shutdown deactivate pool , error: %s\n", err)
 	}
 
 	return nil

From 78f5f41e8eade8831716809d05cf7bb7cfe322d6 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 11 Feb 2014 12:55:40 +0100
Subject: [PATCH 050/403] devmapper: Remove byHash hack

We no longer pass "pool" anywhere that uses byHash() per the last
commit, so we can now remove this hack.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 6128dcea4a9bbe808baba4e18c9c4fee3a265532
Component: engine
---
 .../engine/graphdriver/devmapper/deviceset.go | 40 ++++++-------------
 1 file changed, 12 insertions(+), 28 deletions(-)

diff --git a/components/engine/graphdriver/devmapper/deviceset.go b/components/engine/graphdriver/devmapper/deviceset.go
index 9b5ae62b67..303e363e92 100644
--- a/components/engine/graphdriver/devmapper/deviceset.go
+++ b/components/engine/graphdriver/devmapper/deviceset.go
@@ -658,19 +658,18 @@ func (devices *DeviceSet) deactivatePool() error {
 func (devices *DeviceSet) deactivateDevice(hash string) error {
 	utils.Debugf("[devmapper] deactivateDevice(%s)", hash)
 	defer utils.Debugf("[devmapper] deactivateDevice END")
-	var devname string
-	// FIXME: shouldn't we just register the pool into devices?
-	devname, err := devices.byHash(hash)
-	if err != nil {
-		return err
+
+	info := devices.Devices[hash]
+	if info == nil {
+		return fmt.Errorf("Unknown device %s", hash)
 	}
-	devinfo, err := getInfo(devname)
+	devinfo, err := getInfo(info.Name())
 	if err != nil {
 		utils.Debugf("\n--->Err: %s\n", err)
 		return err
 	}
 	if devinfo.Exists != 0 {
-		if err := devices.removeDeviceAndWait(devname); err != nil {
+		if err := devices.removeDeviceAndWait(info.Name()); err != nil {
 			utils.Debugf("\n--->Err: %s\n", err)
 			return err
 		}
@@ -741,18 +740,18 @@ func (devices *DeviceSet) waitRemove(devname string) error {
 // a) the device registered at <device_set_prefix>-<hash> is closed,
 // or b) the 1 second timeout expires.
 func (devices *DeviceSet) waitClose(hash string) error {
-	devname, err := devices.byHash(hash)
-	if err != nil {
-		return err
+	info := devices.Devices[hash]
+	if info == nil {
+		return fmt.Errorf("Unknown device %s", hash)
 	}
 	i := 0
 	for ; i < 1000; i += 1 {
-		devinfo, err := getInfo(devname)
+		devinfo, err := getInfo(info.Name())
 		if err != nil {
 			return err
 		}
 		if i%100 == 0 {
-			utils.Debugf("Waiting for unmount of %s: opencount=%d", devname, devinfo.OpenCount)
+			utils.Debugf("Waiting for unmount of %s: opencount=%d", hash, devinfo.OpenCount)
 		}
 		if devinfo.OpenCount == 0 {
 			break
@@ -760,26 +759,11 @@ func (devices *DeviceSet) waitClose(hash string) error {
 		time.Sleep(1 * time.Millisecond)
 	}
 	if i == 1000 {
-		return fmt.Errorf("Timeout while waiting for device %s to close", devname)
+		return fmt.Errorf("Timeout while waiting for device %s to close", hash)
 	}
 	return nil
 }
 
-// byHash is a hack to allow looking up the deviceset's pool by the hash "pool".
-// FIXME: it seems probably cleaner to register the pool in devices.Devices,
-// but I am afraid of arcane implications deep in the devicemapper code,
-// so this will do.
-func (devices *DeviceSet) byHash(hash string) (devname string, err error) {
-	if hash == "pool" {
-		return devices.getPoolDevName(), nil
-	}
-	info := devices.Devices[hash]
-	if info == nil {
-		return "", fmt.Errorf("hash %s doesn't exists", hash)
-	}
-	return info.Name(), nil
-}
-
 func (devices *DeviceSet) Shutdown() error {
 	devices.Lock()
 	defer devices.Unlock()

From a0e7d3fc71b49f9b0bf6e37bf9e9b129b764742e Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 11 Feb 2014 06:21:33 -0800
Subject: [PATCH 051/403] Ensure docker cp stream is closes properly
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 35821ad78f4ad2b20cf839ecc5a73b44c568c5eb Component: engine

---
 components/engine/container.go | 4 ++--
 components/engine/server.go    | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index 81e8749d2a..0bfa8befe6 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -1562,7 +1562,7 @@ func (container *Container) GetSize() (int64, int64) {
 	return sizeRw, sizeRootfs
 }
 
-func (container *Container) Copy(resource string) (archive.Archive, error) {
+func (container *Container) Copy(resource string) (io.ReadCloser, error) {
 	if err := container.Mount(); err != nil {
 		return nil, err
 	}
@@ -1589,7 +1589,7 @@ func (container *Container) Copy(resource string) (archive.Archive, error) {
 	if err != nil {
 		return nil, err
 	}
-	return EofReader(archive, func() { container.Unmount() }), nil
+	return utils.NewReadCloserWrapper(archive, container.Unmount), nil
 }
 
 // Returns true if the container exposes a certain port
diff --git a/components/engine/server.go b/components/engine/server.go
index f108f61740..20b45f65aa 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -2339,6 +2339,7 @@ func (srv *Server) ContainerCopy(job *engine.Job) engine.Status {
 		if err != nil {
 			return job.Error(err)
 		}
+		defer data.Close()
 
 		if _, err := io.Copy(job.Stdout, data); err != nil {
 			return job.Error(err)

From c19931ad4a73697d8f63aac72e7ea08342816b87 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 11 Feb 2014 18:02:30 +0100
Subject: [PATCH 052/403] Avoid extra mount/unmount during container
 registration

Runtime.Register() called driver.Get()/Put() in order to read back the
basefs of the container. However, this is not needed, as the basefs
is read during container.Mount() anyway, and basefs is only valid
while mounted (and all current calls satisfy this).

This seems minor, but this is actually problematic, as the Get/Put
pair will create a spurious mount/unmount cycle that is not needed and
slows things down. Additionally it will create a supurious
devicemapper activate/deactivate cycle that causes races with udev as
seen in https://github.com/dotcloud/docker/issues/4036.

With this change devicemapper is now race-free, and container startup
is slightly faster.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 0c71015dcf788c5342bb9422a447b7f9ad12d43d
Component: engine
---
 components/engine/runtime.go | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index a16238e200..176f51b0b1 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -133,14 +133,6 @@ func (runtime *Runtime) Register(container *Container) error {
 		return err
 	}
 
-	// Get the root filesystem from the driver
-	basefs, err := runtime.driver.Get(container.ID)
-	if err != nil {
-		return fmt.Errorf("Error getting container filesystem %s from driver %s: %s", container.ID, runtime.driver, err)
-	}
-	defer runtime.driver.Put(container.ID)
-	container.basefs = basefs
-
 	container.runtime = runtime
 
 	// Attach to stdout and stderr

From 33338e981dfdd73baec9d6ad791e22d9c70e3071 Mon Sep 17 00:00:00 2001
From: Vladimir Bulyga <xx@ccxx.cc>
Date: Wed, 12 Feb 2014 00:26:19 +0200
Subject: [PATCH 053/403] Update remote_api_client_libraries.rst

hello, add please my interface

Docker-DCO-1.1-Signed-off-by: Vladimir <xx@ccxx.cc> (github: 13w)
Upstream-commit: d35b03ef8db9d773937133277cc16364a551ab74
Component: engine
---
 .../docs/sources/reference/api/remote_api_client_libraries.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst b/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
index 45ce8ff9d1..c7ced0055e 100644
--- a/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
+++ b/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
@@ -26,6 +26,9 @@ and we will add the libraries here.
 +----------------------+----------------+--------------------------------------------+----------+
 | Javascript           | docker-js      | https://github.com/dgoujard/docker-js      | Active   |
 +----------------------+----------------+--------------------------------------------+----------+
+| Javascript (Angular) | docker-cp      | https://github.com/13W/docker-cp           | Active   |
+| **WebUI**            |                |                                            |          |
++----------------------+----------------+--------------------------------------------+----------+
 | Javascript (Angular) | dockerui       | https://github.com/crosbymichael/dockerui  | Active   |
 | **WebUI**            |                |                                            |          |
 +----------------------+----------------+--------------------------------------------+----------+

From 231362cb9e6bd53dddbabcc9aa1fd636e1cb77fd Mon Sep 17 00:00:00 2001
From: Cameron Boehmer <cameron.boehmer@gmail.com>
Date: Sun, 9 Feb 2014 05:05:19 -0800
Subject: [PATCH 054/403] add port forwarding notes for mac/boot2docker docs

Docker-DCO-1.1-Signed-off-by: Cameron Boehmer <cameron.boehmer@gmail.com> (github: cameronboehmer)
Upstream-commit: 49b928c0b05852b58881ce8ebdb164db92befd3a
Component: engine
---
 .../engine/docs/sources/installation/mac.rst  | 25 +++++++++++++++----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/components/engine/docs/sources/installation/mac.rst b/components/engine/docs/sources/installation/mac.rst
index 4f0550ad3d..5d57c258de 100644
--- a/components/engine/docs/sources/installation/mac.rst
+++ b/components/engine/docs/sources/installation/mac.rst
@@ -49,10 +49,10 @@ Run the following commands to get boot2docker:
 
     # Enter the installation directory
     cd ~/bin
-    
+
     # Get the file
     curl https://raw.github.com/steeve/boot2docker/master/boot2docker > boot2docker
-    
+
     # Mark it executable
     chmod +x boot2docker
 
@@ -67,13 +67,13 @@ Run the following commands to get it downloaded and set up:
 
     # Get the file
     curl -o docker https://get.docker.io/builds/Darwin/x86_64/docker-latest
-    
+
     # Mark it executable
     chmod +x docker
 
     # Set the environment variable for the docker daemon
     export DOCKER_HOST=tcp://
-    
+
     # Copy the executable file
     sudo cp docker /usr/local/bin/
 
@@ -94,7 +94,7 @@ Inside the ``~/bin`` directory, run the following commands:
 
     # Run the VM (the docker daemon)
     ./boot2docker up
-    
+
     # To see all available commands:
     ./boot2docker
 
@@ -116,6 +116,21 @@ client just like any other application.
     # Git commit (server): c348c04
     # Go version (server): go1.2
 
+Forwarding VM Port Range to Host
+-------------------------------
+
+If we take the port range that docker uses by default with the -P option
+(49000-49900), and forward same range from host to vm, we'll be able to interact
+with our containers as if they were running locally:
+
+.. code-block:: bash
+
+   # vm must be powered off
+   for i in {4900..49900}; do
+    VBoxManage modifyvm "boot2docker-vm" --natpf1 "tcp-port$i,tcp,,$i,,$i";
+    VBoxManage modifyvm "boot2docker-vm" --natpf1 "udp-port$i,udp,,$i,,$i";
+   done
+
 SSH-ing The VM
 --------------
 

From ef486c66301274afc749d61f6b7f08da68230a04 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 16:05:45 -0800
Subject: [PATCH 055/403] Move docker version introspection to a sub-package.

This facilitates the refactoring of commands.go.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: ae3c7dec3b075a263da8d1e1cc510275b281e799
Component: engine
---
 components/engine/commands.go                    |  5 -----
 components/engine/docker/docker.go               | 12 +++---------
 components/engine/dockerversion/dockerversion.go | 11 +++++++++++
 components/engine/hack/make.sh                   |  2 +-
 components/engine/version.go                     |  9 +++++++++
 5 files changed, 24 insertions(+), 15 deletions(-)
 create mode 100644 components/engine/dockerversion/dockerversion.go

diff --git a/components/engine/commands.go b/components/engine/commands.go
index cc019f8c10..55cb3e21c7 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -38,11 +38,6 @@ import (
 	"time"
 )
 
-var (
-	GITCOMMIT string
-	VERSION   string
-)
-
 var (
 	ErrConnectionRefused = errors.New("Can't connect to docker daemon. Is 'docker -d' running on this host?")
 )
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index d92f4d98ea..df99a20450 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -8,17 +8,13 @@ import (
 
 	"github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/api"
+	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	flag "github.com/dotcloud/docker/pkg/mflag"
 	"github.com/dotcloud/docker/sysinit"
 	"github.com/dotcloud/docker/utils"
 )
 
-var (
-	GITCOMMIT string
-	VERSION   string
-)
-
 func main() {
 	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || selfPath == "/.dockerinit" {
 		// Running in init mode
@@ -71,8 +67,6 @@ func main() {
 	if *flDebug {
 		os.Setenv("DEBUG", "1")
 	}
-	docker.GITCOMMIT = GITCOMMIT
-	docker.VERSION = VERSION
 	if *flDaemon {
 		if flag.NArg() != 0 {
 			flag.Usage()
@@ -104,7 +98,7 @@ func main() {
 		job = eng.Job("serveapi", flHosts.GetAll()...)
 		job.SetenvBool("Logging", true)
 		job.SetenvBool("EnableCors", *flEnableCors)
-		job.Setenv("Version", VERSION)
+		job.Setenv("Version", dockerversion.VERSION)
 		if err := job.Run(); err != nil {
 			log.Fatal(err)
 		}
@@ -126,5 +120,5 @@ func main() {
 }
 
 func showVersion() {
-	fmt.Printf("Docker version %s, build %s\n", VERSION, GITCOMMIT)
+	fmt.Printf("Docker version %s, build %s\n", dockerversion.VERSION, dockerversion.GITCOMMIT)
 }
diff --git a/components/engine/dockerversion/dockerversion.go b/components/engine/dockerversion/dockerversion.go
new file mode 100644
index 0000000000..1872691ed2
--- /dev/null
+++ b/components/engine/dockerversion/dockerversion.go
@@ -0,0 +1,11 @@
+package dockerversion
+
+// FIXME: this should be embedded in the docker/docker.go,
+// but we can't because distro policy requires us to
+// package a separate dockerinit binary, and that binary needs
+// to know its version too.
+
+var (
+	GITCOMMIT string
+	VERSION   string
+)
diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index d73b33a4fa..011b796201 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -82,7 +82,7 @@ if [ ! "$GOPATH" ]; then
 fi
 
 # Use these flags when compiling the tests and final binary
-LDFLAGS='-X main.GITCOMMIT "'$GITCOMMIT'" -X main.VERSION "'$VERSION'" -w'
+LDFLAGS='-X github.com/dotcloud/docker/dockerversion.GITCOMMIT "'$GITCOMMIT'" -X github.com/dotcloud/docker/dockerversion.VERSION "'$VERSION'" -w'
 LDFLAGS_STATIC='-X github.com/dotcloud/docker/utils.IAMSTATIC true -linkmode external -extldflags "-lpthread -static -Wl,--unresolved-symbols=ignore-in-object-files"'
 BUILDFLAGS='-tags netgo -a'
 
diff --git a/components/engine/version.go b/components/engine/version.go
index a4288245f7..2eee68c2f2 100644
--- a/components/engine/version.go
+++ b/components/engine/version.go
@@ -1,11 +1,20 @@
 package docker
 
 import (
+	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/utils"
 	"runtime"
 )
 
+var (
+	// FIXME: this is a convenience indirection to preserve legacy
+	// code. It can be removed by using dockerversion.VERSION and
+	// dockerversion.GITCOMMIT directly
+	GITCOMMIT string = dockerversion.GITCOMMIT
+	VERSION   string = dockerversion.VERSION
+)
+
 func init() {
 	engine.Register("version", jobVersion)
 }

From deaadc8b5665cccdef88bccfd66a04286ed2c844 Mon Sep 17 00:00:00 2001
From: Andy Rothfusz <github@developersupport.net>
Date: Tue, 11 Feb 2014 16:19:42 -0800
Subject: [PATCH 056/403] fix underline/heading Upstream-commit:
 c76a4e34896fd0785cf982372a3713c4ef70754b Component: engine

---
 components/engine/docs/sources/installation/mac.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/installation/mac.rst b/components/engine/docs/sources/installation/mac.rst
index 86a01f6bb6..7d2a0b19e8 100644
--- a/components/engine/docs/sources/installation/mac.rst
+++ b/components/engine/docs/sources/installation/mac.rst
@@ -117,7 +117,7 @@ client just like any other application.
     # Go version (server): go1.2
 
 Forwarding VM Port Range to Host
--------------------------------
+--------------------------------
 
 If we take the port range that docker uses by default with the -P option
 (49000-49900), and forward same range from host to vm, we'll be able to interact

From 9ed97b673b0a73d0703c8b999d0a780c117b0be7 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 11 Feb 2014 17:26:54 -0700
Subject: [PATCH 057/403] Move even more stuff into dockerversion

Also, use it in all the places. :)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: da04f49b383c02ee28c32f948048b9e9a402bb4f
Component: engine
---
 components/engine/commands.go                   | 17 +++++++++--------
 components/engine/dockerinit/dockerinit.go      |  5 -----
 .../engine/dockerversion/dockerversion.go       |  4 ++++
 components/engine/graph.go                      |  3 ++-
 components/engine/hack/make/dynbinary           |  2 +-
 components/engine/runtime.go                    |  3 ++-
 components/engine/server.go                     |  3 ++-
 components/engine/utils/utils.go                | 13 ++++---------
 components/engine/version.go                    | 12 ++----------
 9 files changed, 26 insertions(+), 36 deletions(-)

diff --git a/components/engine/commands.go b/components/engine/commands.go
index 55cb3e21c7..651173555e 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -11,6 +11,7 @@ import (
 	"github.com/dotcloud/docker/api"
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/auth"
+	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	flag "github.com/dotcloud/docker/pkg/mflag"
 	"github.com/dotcloud/docker/pkg/sysinfo"
@@ -383,12 +384,12 @@ func (cli *DockerCli) CmdVersion(args ...string) error {
 		cmd.Usage()
 		return nil
 	}
-	if VERSION != "" {
-		fmt.Fprintf(cli.out, "Client version: %s\n", VERSION)
+	if dockerversion.VERSION != "" {
+		fmt.Fprintf(cli.out, "Client version: %s\n", dockerversion.VERSION)
 	}
 	fmt.Fprintf(cli.out, "Go version (client): %s\n", runtime.Version())
-	if GITCOMMIT != "" {
-		fmt.Fprintf(cli.out, "Git commit (client): %s\n", GITCOMMIT)
+	if dockerversion.GITCOMMIT != "" {
+		fmt.Fprintf(cli.out, "Git commit (client): %s\n", dockerversion.GITCOMMIT)
 	}
 
 	body, _, err := readBody(cli.call("GET", "/version", nil, false))
@@ -413,7 +414,7 @@ func (cli *DockerCli) CmdVersion(args ...string) error {
 	release := utils.GetReleaseVersion()
 	if release != "" {
 		fmt.Fprintf(cli.out, "Last stable version: %s", release)
-		if (VERSION != "" || remoteVersion.Exists("Version")) && (strings.Trim(VERSION, "-dev") != release || strings.Trim(remoteVersion.Get("Version"), "-dev") != release) {
+		if (dockerversion.VERSION != "" || remoteVersion.Exists("Version")) && (strings.Trim(dockerversion.VERSION, "-dev") != release || strings.Trim(remoteVersion.Get("Version"), "-dev") != release) {
 			fmt.Fprintf(cli.out, ", please update docker")
 		}
 		fmt.Fprintf(cli.out, "\n")
@@ -2298,7 +2299,7 @@ func (cli *DockerCli) call(method, path string, data interface{}, passAuthInfo b
 			}
 		}
 	}
-	req.Header.Set("User-Agent", "Docker-Client/"+VERSION)
+	req.Header.Set("User-Agent", "Docker-Client/"+dockerversion.VERSION)
 	req.Host = cli.addr
 	if data != nil {
 		req.Header.Set("Content-Type", "application/json")
@@ -2355,7 +2356,7 @@ func (cli *DockerCli) stream(method, path string, in io.Reader, out io.Writer, h
 	if err != nil {
 		return err
 	}
-	req.Header.Set("User-Agent", "Docker-Client/"+VERSION)
+	req.Header.Set("User-Agent", "Docker-Client/"+dockerversion.VERSION)
 	req.Host = cli.addr
 	if method == "POST" {
 		req.Header.Set("Content-Type", "plain/text")
@@ -2419,7 +2420,7 @@ func (cli *DockerCli) hijack(method, path string, setRawTerminal bool, in io.Rea
 	if err != nil {
 		return err
 	}
-	req.Header.Set("User-Agent", "Docker-Client/"+VERSION)
+	req.Header.Set("User-Agent", "Docker-Client/"+dockerversion.VERSION)
 	req.Header.Set("Content-Type", "plain/text")
 	req.Host = cli.addr
 
diff --git a/components/engine/dockerinit/dockerinit.go b/components/engine/dockerinit/dockerinit.go
index 0c363f4ac3..1d0689387a 100644
--- a/components/engine/dockerinit/dockerinit.go
+++ b/components/engine/dockerinit/dockerinit.go
@@ -4,11 +4,6 @@ import (
 	"github.com/dotcloud/docker/sysinit"
 )
 
-var (
-	GITCOMMIT string
-	VERSION   string
-)
-
 func main() {
 	// Running in init mode
 	sysinit.SysInit()
diff --git a/components/engine/dockerversion/dockerversion.go b/components/engine/dockerversion/dockerversion.go
index 1872691ed2..c130ac2810 100644
--- a/components/engine/dockerversion/dockerversion.go
+++ b/components/engine/dockerversion/dockerversion.go
@@ -8,4 +8,8 @@ package dockerversion
 var (
 	GITCOMMIT string
 	VERSION   string
+
+	IAMSTATIC bool   // whether or not Docker itself was compiled statically via ./hack/make.sh binary
+	INITSHA1  string // sha1sum of separate static dockerinit, if Docker itself was compiled dynamically via ./hack/make.sh dynbinary
+	INITPATH  string // custom location to search for a valid dockerinit binary (available for packagers as a last resort escape hatch)
 )
diff --git a/components/engine/graph.go b/components/engine/graph.go
index 42da42c8af..138c7b8613 100644
--- a/components/engine/graph.go
+++ b/components/engine/graph.go
@@ -3,6 +3,7 @@ package docker
 import (
 	"fmt"
 	"github.com/dotcloud/docker/archive"
+	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/utils"
 	"io"
@@ -130,7 +131,7 @@ func (graph *Graph) Create(layerData archive.Archive, container *Container, comm
 		ID:            GenerateID(),
 		Comment:       comment,
 		Created:       time.Now().UTC(),
-		DockerVersion: VERSION,
+		DockerVersion: dockerversion.VERSION,
 		Author:        author,
 		Config:        config,
 		Architecture:  runtime.GOARCH,
diff --git a/components/engine/hack/make/dynbinary b/components/engine/hack/make/dynbinary
index c02094c0c5..7de3a6cb59 100644
--- a/components/engine/hack/make/dynbinary
+++ b/components/engine/hack/make/dynbinary
@@ -12,6 +12,6 @@ export DOCKER_INITSHA1="$(sha1sum $DEST/dockerinit-$VERSION | cut -d' ' -f1)"
 # exported so that "dyntest" can easily access it later without recalculating it
 
 (
-	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/utils.INITSHA1 \"$DOCKER_INITSHA1\" -X github.com/dotcloud/docker/utils.INITPATH \"$DOCKER_INITPATH\""
+	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\" -X github.com/dotcloud/docker/dockerversion.INITPATH \"$DOCKER_INITPATH\""
 	source "$(dirname "$BASH_SOURCE")/binary"
 )
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 176f51b0b1..cec5444090 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -4,6 +4,7 @@ import (
 	"container/list"
 	"fmt"
 	"github.com/dotcloud/docker/archive"
+	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/execdriver/chroot"
@@ -678,7 +679,7 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 		return nil, err
 	}
 
-	localCopy := path.Join(config.Root, "init", fmt.Sprintf("dockerinit-%s", VERSION))
+	localCopy := path.Join(config.Root, "init", fmt.Sprintf("dockerinit-%s", dockerversion.VERSION))
 	sysInitPath := utils.DockerInitPath(localCopy)
 	if sysInitPath == "" {
 		return nil, fmt.Errorf("Could not locate dockerinit: This usually means docker was built incorrectly. See http://docs.docker.io/en/latest/contributing/devenvironment for official build instructions.")
diff --git a/components/engine/server.go b/components/engine/server.go
index f108f61740..cb677266e5 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/auth"
+	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/pkg/graphdb"
 	"github.com/dotcloud/docker/registry"
@@ -827,7 +828,7 @@ func (srv *Server) DockerInfo(job *engine.Job) engine.Status {
 	v.SetInt("NEventsListener", len(srv.events))
 	v.Set("KernelVersion", kernelVersion)
 	v.Set("IndexServerAddress", auth.IndexServerAddress())
-	v.Set("InitSha1", utils.INITSHA1)
+	v.Set("InitSha1", dockerversion.INITSHA1)
 	v.Set("InitPath", initPath)
 	if _, err := v.WriteTo(job.Stdout); err != nil {
 		return job.Error(err)
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 5caf792549..60952606d5 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/dotcloud/docker/dockerversion"
 	"index/suffixarray"
 	"io"
 	"io/ioutil"
@@ -23,12 +24,6 @@ import (
 	"time"
 )
 
-var (
-	IAMSTATIC bool   // whether or not Docker itself was compiled statically via ./hack/make.sh binary
-	INITSHA1  string // sha1sum of separate static dockerinit, if Docker itself was compiled dynamically via ./hack/make.sh dynbinary
-	INITPATH  string // custom location to search for a valid dockerinit binary (available for packagers as a last resort escape hatch)
-)
-
 // A common interface to access the Fatal method of
 // both testing.B and testing.T.
 type Fataler interface {
@@ -201,7 +196,7 @@ func isValidDockerInitPath(target string, selfPath string) bool { // target and
 	if target == "" {
 		return false
 	}
-	if IAMSTATIC {
+	if dockerversion.IAMSTATIC {
 		if selfPath == "" {
 			return false
 		}
@@ -218,7 +213,7 @@ func isValidDockerInitPath(target string, selfPath string) bool { // target and
 		}
 		return os.SameFile(targetFileInfo, selfPathFileInfo)
 	}
-	return INITSHA1 != "" && dockerInitSha1(target) == INITSHA1
+	return dockerversion.INITSHA1 != "" && dockerInitSha1(target) == dockerversion.INITSHA1
 }
 
 // Figure out the path of our dockerinit (which may be SelfPath())
@@ -230,7 +225,7 @@ func DockerInitPath(localCopy string) string {
 	}
 	var possibleInits = []string{
 		localCopy,
-		INITPATH,
+		dockerversion.INITPATH,
 		filepath.Join(filepath.Dir(selfPath), "dockerinit"),
 
 		// FHS 3.0 Draft: "/usr/libexec includes internal binaries that are not intended to be executed directly by users or shell scripts. Applications may use a single subdirectory under /usr/libexec."
diff --git a/components/engine/version.go b/components/engine/version.go
index 2eee68c2f2..88298a16cb 100644
--- a/components/engine/version.go
+++ b/components/engine/version.go
@@ -7,14 +7,6 @@ import (
 	"runtime"
 )
 
-var (
-	// FIXME: this is a convenience indirection to preserve legacy
-	// code. It can be removed by using dockerversion.VERSION and
-	// dockerversion.GITCOMMIT directly
-	GITCOMMIT string = dockerversion.GITCOMMIT
-	VERSION   string = dockerversion.VERSION
-)
-
 func init() {
 	engine.Register("version", jobVersion)
 }
@@ -31,8 +23,8 @@ func jobVersion(job *engine.Job) engine.Status {
 // environment.
 func dockerVersion() *engine.Env {
 	v := &engine.Env{}
-	v.Set("Version", VERSION)
-	v.Set("GitCommit", GITCOMMIT)
+	v.Set("Version", dockerversion.VERSION)
+	v.Set("GitCommit", dockerversion.GITCOMMIT)
 	v.Set("GoVersion", runtime.Version())
 	v.Set("Os", runtime.GOOS)
 	v.Set("Arch", runtime.GOARCH)

From afe2170b4f040ea721f5eeb51bc0e7141782225f Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Fri, 7 Feb 2014 09:37:10 +1000
Subject: [PATCH 058/403] rewrite the PostgreSQL example using a Dockerfile,
 and add details to it

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 2ed2ba4e8caa2d70d57d124a2f3509f400d8187e
Component: engine
---
 .../examples/postgresql_service.Dockerfile    |  53 ++++++
 .../sources/examples/postgresql_service.rst   | 179 +++++++-----------
 2 files changed, 121 insertions(+), 111 deletions(-)
 create mode 100644 components/engine/docs/sources/examples/postgresql_service.Dockerfile

diff --git a/components/engine/docs/sources/examples/postgresql_service.Dockerfile b/components/engine/docs/sources/examples/postgresql_service.Dockerfile
new file mode 100644
index 0000000000..af1423f258
--- /dev/null
+++ b/components/engine/docs/sources/examples/postgresql_service.Dockerfile
@@ -0,0 +1,53 @@
+#
+# example Dockerfile for http://docs.docker.io/en/latest/examples/postgresql_service/
+#
+
+FROM ubuntu
+MAINTAINER SvenDowideit@docker.com
+
+# Add the PostgreSQL PGP key to verify their Debian packages.
+# It should be the same key as https://www.postgresql.org/media/keys/ACCC4CF8.asc 
+RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8
+
+# Add PostgreSQL's repository. It contains the most recent stable release
+#     of PostgreSQL, ``9.3``.
+RUN echo "deb http://apt.postgresql.org/pub/repos/apt/ precise-pgdg main" > /etc/apt/sources.list.d/pgdg.list
+
+# Update the Ubuntu and PostgreSQL repository indexes
+RUN apt-get update
+
+# Install ``python-software-properties``, ``software-properties-common`` and PostgreSQL 9.3
+#  There are some warnings (in red) that show up during the build. You can hide
+#  them by prefixing each apt-get statement with DEBIAN_FRONTEND=noninteractive
+RUN apt-get -y -q install python-software-properties software-properties-common
+RUN apt-get -y -q install postgresql-9.3 postgresql-client-9.3 postgresql-contrib-9.3
+
+# Note: The official Debian and Ubuntu images automatically ``apt-get clean``
+# after each ``apt-get`` 
+
+# Run the rest of the commands as the ``postgres`` user created by the ``postgres-9.3`` package when it was ``apt-get installed``
+USER postgres
+
+# Create a PostgreSQL role named ``docker`` with ``docker`` as the password and
+# then create a database `docker` owned by the ``docker`` role.
+# Note: here we use ``&&\`` to run commands one after the other - the ``\``
+#       allows the RUN command to span multiple lines.
+RUN    /etc/init.d/postgresql start &&\
+    psql --command "CREATE USER docker WITH SUPERUSER PASSWORD 'docker';" &&\
+    createdb -O docker docker
+
+# Adjust PostgreSQL configuration so that remote connections to the
+# database are possible. 
+RUN echo "host all  all    0.0.0.0/0  md5" >> /etc/postgresql/9.3/main/pg_hba.conf
+
+# And add ``listen_addresses`` to ``/etc/postgresql/9.3/main/postgresql.conf``
+RUN echo "listen_addresses='*'" >> /etc/postgresql/9.3/main/postgresql.conf
+
+# Expose the PostgreSQL port
+EXPOSE 5432
+
+# Add VOLUMEs to allow backup of config, logs and databases
+VOLUME	["/etc/postgresql", "/var/log/postgresql", "/var/lib/postgresql"]
+
+# Set the default command to run when starting the container
+CMD ["/usr/lib/postgresql/9.3/bin/postgres", "-D", "/var/lib/postgresql/9.3/main", "-c", "config_file=/etc/postgresql/9.3/main/postgresql.conf"]
diff --git a/components/engine/docs/sources/examples/postgresql_service.rst b/components/engine/docs/sources/examples/postgresql_service.rst
index 1c427563e7..5a2323471b 100644
--- a/components/engine/docs/sources/examples/postgresql_service.rst
+++ b/components/engine/docs/sources/examples/postgresql_service.rst
@@ -9,152 +9,109 @@ PostgreSQL Service
 
 .. include:: example_header.inc
 
-.. note::
-
-    A shorter version of `this blog post`_.
-
-.. _this blog post: http://zaiste.net/2013/08/docker_postgresql_how_to/
-
 Installing PostgreSQL on Docker
 -------------------------------
 
-Run an interactive shell in a Docker container.
+Assuming there is no Docker image that suits your needs in `the index`_, you 
+can create one yourself.
 
-.. code-block:: bash
+.. _the index: http://index.docker.io
 
-    sudo docker run -i -t ubuntu /bin/bash
-
-Update its dependencies.
-
-.. code-block:: bash
-
-    apt-get update
-
-Install ``python-software-properties``, ``software-properties-common``, ``wget`` and ``vim``.
-
-.. code-block:: bash
-
-    apt-get -y install python-software-properties software-properties-common wget vim
-
-Add PostgreSQL's repository. It contains the most recent stable release
-of PostgreSQL, ``9.3``.
-
-.. code-block:: bash
-
-    wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
-    echo "deb http://apt.postgresql.org/pub/repos/apt/ precise-pgdg main" > /etc/apt/sources.list.d/pgdg.list
-    apt-get update
-
-Finally, install PostgreSQL 9.3
-
-.. code-block:: bash
-
-    apt-get -y install postgresql-9.3 postgresql-client-9.3 postgresql-contrib-9.3
-
-Now, create a PostgreSQL superuser role that can create databases and
-other roles.  Following Vagrant's convention the role will be named
-``docker`` with ``docker`` password assigned to it.
-
-.. code-block:: bash
-
-    su postgres -c "createuser -P -d -r -s docker"
-
-Create a test database also named ``docker`` owned by previously created ``docker``
-role.
-
-.. code-block:: bash
-
-    su postgres -c "createdb -O docker docker"
-
-Adjust PostgreSQL configuration so that remote connections to the
-database are possible. Make sure that inside
-``/etc/postgresql/9.3/main/pg_hba.conf`` you have following line:
-
-.. code-block:: bash
-
-    host    all             all             0.0.0.0/0               md5
-
-Additionaly, inside ``/etc/postgresql/9.3/main/postgresql.conf``
-uncomment ``listen_addresses`` like so:
-
-.. code-block:: bash
-
-    listen_addresses='*'
+Start by creating a new Dockerfile:
 
 .. note::
 
     This PostgreSQL setup is for development only purposes. Refer
-    to PostgreSQL documentation how to fine-tune these settings so that it
-    is secure enough.
+    to the PostgreSQL documentation to fine-tune these settings so that it
+    is suitably secure.
 
-Exit.
+.. literalinclude:: postgresql_service.Dockerfile
+
+Build an image from the Dockerfile assign it a name.
 
 .. code-block:: bash
 
-    exit
+    $ sudo docker build -t eg_postgresql .
 
-Create an image from our container and assign it a name. The ``<container_id>``
-is in the Bash prompt; you can also locate it using ``docker ps -a``.
+And run the PostgreSQL server container (in the foreground):
 
 .. code-block:: bash
 
-    sudo docker commit <container_id> <your username>/postgresql
+    $ sudo docker run -rm -P -name pg_test eg_postgresql
 
-Finally, run the PostgreSQL server via ``docker``.
+There are  2 ways to connect to the PostgreSQL server. We can use 
+:ref:`working_with_links_names`, or we can access it from our host (or the network).
+
+.. note:: The ``-rm`` removes the container and its image when the container 
+          exists successfully.
+
+Using container linking
+^^^^^^^^^^^^^^^^^^^^^^^
+
+Containers can be linked to another container's ports directly using 
+``-link remote_name:local_alias`` in the client's ``docker run``. This will
+set a number of environment variables that can then be used to connect:
 
 .. code-block:: bash
 
-    CONTAINER=$(sudo docker run -d -p 5432 \
-      -t <your username>/postgresql \
-      /bin/su postgres -c '/usr/lib/postgresql/9.3/bin/postgres \
-        -D /var/lib/postgresql/9.3/main \
-        -c config_file=/etc/postgresql/9.3/main/postgresql.conf')
+    $ sudo docker run -rm -t -i -link pg_test:pg eg_postgresql bash
 
-Connect the PostgreSQL server using ``psql`` (You will need the
-postgresql client installed on the machine.  For ubuntu, use something
-like ``sudo apt-get install postgresql-client``).
+    postgres@7ef98b1b7243:/$ psql -h $PG_PORT_5432_TCP_ADDR -p $PG_PORT_5432_TCP_PORT -d docker -U docker --password
+
+Connecting from your host system
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Assuming you have the postgresql-client installed, you can use the host-mapped port
+to test as well. You need to use ``docker ps`` to find out what local host port the 
+container is mapped to first:
 
 .. code-block:: bash
 
-    CONTAINER_IP=$(sudo docker inspect -format='{{.NetworkSettings.IPAddress}}' $CONTAINER)
-    psql -h $CONTAINER_IP -p 5432 -d docker -U docker -W
+    $ docker ps
+    CONTAINER ID        IMAGE                  COMMAND                CREATED             STATUS              PORTS                                      NAMES
+    5e24362f27f6        eg_postgresql:latest   /usr/lib/postgresql/   About an hour ago   Up About an hour    0.0.0.0:49153->5432/tcp                    pg_test
+    $ psql -h localhost -p 49153 -d docker -U docker --password
 
-As before, create roles or databases if needed.
+Testing the database
+^^^^^^^^^^^^^^^^^^^^
+
+Once you have authenticated and have a ``docker =#`` prompt, you can
+create a table and populate it.
 
 .. code-block:: bash
 
     psql (9.3.1)
     Type "help" for help.
 
-    docker=# CREATE DATABASE foo OWNER=docker;
-    CREATE DATABASE
+    docker=# CREATE TABLE cities (
+    docker(#     name            varchar(80),
+    docker(#     location        point
+    docker(# );
+    CREATE TABLE
+    docker=# INSERT INTO cities VALUES ('San Francisco', '(-194.0, 53.0)');
+    INSERT 0 1
+    docker=# select * from cities;
+         name      | location  
+    ---------------+-----------
+     San Francisco | (-194,53)
+    (1 row)
 
-Additionally, publish your newly created image on the Docker Index.
+Using the container volumes
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+You can use the defined volumes to inspect the PostgreSQL log files and to backup your
+configuration and data:
 
 .. code-block:: bash
 
-    sudo docker login
-    Username: <your username>
-    [...]
+    docker run -rm --volumes-from pg_test -t -i busybox sh
 
-.. code-block:: bash
+    / # ls
+    bin      etc      lib      linuxrc  mnt      proc     run      sys      usr
+    dev      home     lib64    media    opt      root     sbin     tmp      var
+    / # ls /etc/postgresql/9.3/main/
+    environment      pg_hba.conf      postgresql.conf
+    pg_ctl.conf      pg_ident.conf    start.conf
+    /tmp # ls /var/log
+    ldconfig    postgresql
 
-    sudo docker push <your username>/postgresql
-
-PostgreSQL service auto-launch
-------------------------------
-
-Running our image seems complicated. We have to specify the whole command with
-``docker run``. Let's simplify it so the service starts automatically when the
-container starts.
-
-.. code-block:: bash
-
-    sudo docker commit -run='{"Cmd": \
-      ["/bin/su", "postgres", "-c", "/usr/lib/postgresql/9.3/bin/postgres -D \
-      /var/lib/postgresql/9.3/main -c \
-      config_file=/etc/postgresql/9.3/main/postgresql.conf"], "PortSpecs": ["5432"]}' \
-      <container_id> <your username>/postgresql
-
-From now on, just type ``docker run <your username>/postgresql`` and
-PostgreSQL should automatically start.

From 944b4ea1c7e6621b95eea01367ce65976bba0daf Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 16:48:44 -0800
Subject: [PATCH 059/403] New package `nat`: utilities for manipulating the
 text description of network ports.

This facilitates the refactoring of commands.go

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 3ecd8ff0c80c593e1874cbfa0cc2abf946eeaf66
Component: engine
---
 components/engine/commands.go                 |   9 +-
 components/engine/config_test.go              |   3 +-
 components/engine/container.go                |  52 ++-----
 components/engine/container_unit_test.go      |   7 +-
 components/engine/integration/runtime_test.go |  11 +-
 components/engine/links.go                    |  11 +-
 components/engine/links_test.go               |  11 +-
 components/engine/nat/nat.go                  | 133 ++++++++++++++++++
 components/engine/nat/sort.go                 |  28 ++++
 .../{sorter_unit_test.go => nat/sort_test.go} |   6 +-
 components/engine/sorter.go                   |  25 ----
 components/engine/utils.go                    | 103 ++------------
 12 files changed, 212 insertions(+), 187 deletions(-)
 create mode 100644 components/engine/nat/nat.go
 create mode 100644 components/engine/nat/sort.go
 rename components/engine/{sorter_unit_test.go => nat/sort_test.go} (86%)

diff --git a/components/engine/commands.go b/components/engine/commands.go
index cc019f8c10..db8cc1d2f5 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -12,6 +12,7 @@ import (
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/auth"
 	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/nat"
 	flag "github.com/dotcloud/docker/pkg/mflag"
 	"github.com/dotcloud/docker/pkg/sysinfo"
 	"github.com/dotcloud/docker/pkg/term"
@@ -799,7 +800,7 @@ func (cli *DockerCli) CmdPort(args ...string) error {
 		return err
 	}
 
-	if frontends, exists := out.NetworkSettings.Ports[Port(port+"/"+proto)]; exists && frontends != nil {
+	if frontends, exists := out.NetworkSettings.Ports[nat.Port(port+"/"+proto)]; exists && frontends != nil {
 		for _, frontend := range frontends {
 			fmt.Fprintf(cli.out, "%s:%s\n", frontend.HostIp, frontend.HostPort)
 		}
@@ -1792,7 +1793,7 @@ func parseRun(cmd *flag.FlagSet, args []string, sysInfo *sysinfo.SysInfo) (*Conf
 	cmd.Var(&flLinks, []string{"#link", "-link"}, "Add link to another container (name:alias)")
 	cmd.Var(&flEnv, []string{"e", "-env"}, "Set environment variables")
 
-	cmd.Var(&flPublish, []string{"p", "-publish"}, fmt.Sprintf("Publish a container's port to the host (format: %s) (use 'docker port' to see the actual mapping)", PortSpecTemplateFormat))
+	cmd.Var(&flPublish, []string{"p", "-publish"}, fmt.Sprintf("Publish a container's port to the host (format: %s) (use 'docker port' to see the actual mapping)", nat.PortSpecTemplateFormat))
 	cmd.Var(&flExpose, []string{"#expose", "-expose"}, "Expose a port from the container without publishing it to your host")
 	cmd.Var(&flDns, []string{"#dns", "-dns"}, "Set custom dns servers")
 	cmd.Var(&flVolumesFrom, []string{"#volumes-from", "-volumes-from"}, "Mount volumes from the specified container(s)")
@@ -1885,7 +1886,7 @@ func parseRun(cmd *flag.FlagSet, args []string, sysInfo *sysinfo.SysInfo) (*Conf
 		domainname = parts[1]
 	}
 
-	ports, portBindings, err := parsePortSpecs(flPublish.GetAll())
+	ports, portBindings, err := nat.ParsePortSpecs(flPublish.GetAll())
 	if err != nil {
 		return nil, nil, cmd, err
 	}
@@ -1895,7 +1896,7 @@ func parseRun(cmd *flag.FlagSet, args []string, sysInfo *sysinfo.SysInfo) (*Conf
 		if strings.Contains(e, ":") {
 			return nil, nil, cmd, fmt.Errorf("Invalid port format for --expose: %s", e)
 		}
-		p := NewPort(splitProtoPort(e))
+		p := nat.NewPort(nat.SplitProtoPort(e))
 		if _, exists := ports[p]; !exists {
 			ports[p] = struct{}{}
 		}
diff --git a/components/engine/config_test.go b/components/engine/config_test.go
index 31c961135a..1c808163e2 100644
--- a/components/engine/config_test.go
+++ b/components/engine/config_test.go
@@ -1,6 +1,7 @@
 package docker
 
 import (
+	"github.com/dotcloud/docker/nat"
 	"testing"
 )
 
@@ -125,7 +126,7 @@ func TestMergeConfig(t *testing.T) {
 		t.Fatalf("Expected VolumesFrom to be 1111, found %s", configUser.VolumesFrom)
 	}
 
-	ports, _, err := parsePortSpecs([]string{"0000"})
+	ports, _, err := nat.ParsePortSpecs([]string{"0000"})
 	if err != nil {
 		t.Error(err)
 	}
diff --git a/components/engine/container.go b/components/engine/container.go
index 81e8749d2a..991c2aeee7 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -8,6 +8,7 @@ import (
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/graphdriver"
+	"github.com/dotcloud/docker/nat"
 	"github.com/dotcloud/docker/pkg/mount"
 	"github.com/dotcloud/docker/pkg/term"
 	"github.com/dotcloud/docker/utils"
@@ -86,7 +87,7 @@ type Config struct {
 	AttachStdout    bool
 	AttachStderr    bool
 	PortSpecs       []string // Deprecated - Can be in the format of 8080/tcp
-	ExposedPorts    map[Port]struct{}
+	ExposedPorts    map[nat.Port]struct{}
 	Tty             bool // Attach standard streams to a tty, including stdin if it is not closed.
 	OpenStdin       bool // Open stdin
 	StdinOnce       bool // If true, close stdin after the 1 attached client disconnects.
@@ -147,7 +148,7 @@ type HostConfig struct {
 	ContainerIDFile string
 	LxcConf         []KeyValuePair
 	Privileged      bool
-	PortBindings    map[Port][]PortBinding
+	PortBindings    nat.PortMap
 	Links           []string
 	PublishAllPorts bool
 }
@@ -189,38 +190,7 @@ type KeyValuePair struct {
 	Value string
 }
 
-type PortBinding struct {
-	HostIp   string
-	HostPort string
-}
-
-// 80/tcp
-type Port string
-
-func (p Port) Proto() string {
-	parts := strings.Split(string(p), "/")
-	if len(parts) == 1 {
-		return "tcp"
-	}
-	return parts[1]
-}
-
-func (p Port) Port() string {
-	return strings.Split(string(p), "/")[0]
-}
-
-func (p Port) Int() int {
-	i, err := parsePort(p.Port())
-	if err != nil {
-		panic(err)
-	}
-	return i
-}
-
-func NewPort(proto, port string) Port {
-	return Port(fmt.Sprintf("%s/%s", port, proto))
-}
-
+// FIXME: move deprecated port stuff to nat to clean up the core.
 type PortMapping map[string]string // Deprecated
 
 type NetworkSettings struct {
@@ -229,13 +199,13 @@ type NetworkSettings struct {
 	Gateway     string
 	Bridge      string
 	PortMapping map[string]PortMapping // Deprecated
-	Ports       map[Port][]PortBinding
+	Ports       nat.PortMap
 }
 
 func (settings *NetworkSettings) PortMappingAPI() *engine.Table {
 	var outs = engine.NewTable("", 0)
 	for port, bindings := range settings.Ports {
-		p, _ := parsePort(port.Port())
+		p, _ := nat.ParsePort(port.Port())
 		if len(bindings) == 0 {
 			out := &engine.Env{}
 			out.SetInt("PublicPort", p)
@@ -245,7 +215,7 @@ func (settings *NetworkSettings) PortMappingAPI() *engine.Table {
 		}
 		for _, binding := range bindings {
 			out := &engine.Env{}
-			h, _ := parsePort(binding.HostPort)
+			h, _ := nat.ParsePort(binding.HostPort)
 			out.SetInt("PrivatePort", p)
 			out.SetInt("PublicPort", h)
 			out.Set("Type", port.Proto())
@@ -1152,8 +1122,8 @@ func (container *Container) allocateNetwork() error {
 	}
 
 	var (
-		portSpecs = make(map[Port]struct{})
-		bindings  = make(map[Port][]PortBinding)
+		portSpecs = make(nat.PortSet)
+		bindings  = make(nat.PortMap)
 	)
 
 	if !container.State.IsGhost() {
@@ -1177,7 +1147,7 @@ func (container *Container) allocateNetwork() error {
 	for port := range portSpecs {
 		binding := bindings[port]
 		if container.hostConfig.PublishAllPorts && len(binding) == 0 {
-			binding = append(binding, PortBinding{})
+			binding = append(binding, nat.PortBinding{})
 		}
 
 		for i := 0; i < len(binding); i++ {
@@ -1593,7 +1563,7 @@ func (container *Container) Copy(resource string) (archive.Archive, error) {
 }
 
 // Returns true if the container exposes a certain port
-func (container *Container) Exposes(p Port) bool {
+func (container *Container) Exposes(p nat.Port) bool {
 	_, exists := container.Config.ExposedPorts[p]
 	return exists
 }
diff --git a/components/engine/container_unit_test.go b/components/engine/container_unit_test.go
index 679ff57e73..dd915ad2e4 100644
--- a/components/engine/container_unit_test.go
+++ b/components/engine/container_unit_test.go
@@ -1,6 +1,7 @@
 package docker
 
 import (
+	"github.com/dotcloud/docker/nat"
 	"testing"
 )
 
@@ -22,7 +23,7 @@ func TestParseLxcConfOpt(t *testing.T) {
 }
 
 func TestParseNetworkOptsPrivateOnly(t *testing.T) {
-	ports, bindings, err := parsePortSpecs([]string{"192.168.1.100::80"})
+	ports, bindings, err := nat.ParsePortSpecs([]string{"192.168.1.100::80"})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -64,7 +65,7 @@ func TestParseNetworkOptsPrivateOnly(t *testing.T) {
 }
 
 func TestParseNetworkOptsPublic(t *testing.T) {
-	ports, bindings, err := parsePortSpecs([]string{"192.168.1.100:8080:80"})
+	ports, bindings, err := nat.ParsePortSpecs([]string{"192.168.1.100:8080:80"})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -106,7 +107,7 @@ func TestParseNetworkOptsPublic(t *testing.T) {
 }
 
 func TestParseNetworkOptsUdp(t *testing.T) {
-	ports, bindings, err := parsePortSpecs([]string{"192.168.1.100::6000/udp"})
+	ports, bindings, err := nat.ParsePortSpecs([]string{"192.168.1.100::6000/udp"})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/components/engine/integration/runtime_test.go b/components/engine/integration/runtime_test.go
index da95967a30..70dde8f497 100644
--- a/components/engine/integration/runtime_test.go
+++ b/components/engine/integration/runtime_test.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/nat"
 	"github.com/dotcloud/docker/sysinit"
 	"github.com/dotcloud/docker/utils"
 	"io"
@@ -368,7 +369,7 @@ func startEchoServerContainer(t *testing.T, proto string) (*docker.Runtime, *doc
 		eng     = NewTestEngine(t)
 		runtime = mkRuntimeFromEngine(eng, t)
 		port    = 5554
-		p       docker.Port
+		p       nat.Port
 	)
 	defer func() {
 		if err != nil {
@@ -387,8 +388,8 @@ func startEchoServerContainer(t *testing.T, proto string) (*docker.Runtime, *doc
 		} else {
 			t.Fatal(fmt.Errorf("Unknown protocol %v", proto))
 		}
-		ep := make(map[docker.Port]struct{}, 1)
-		p = docker.Port(fmt.Sprintf("%s/%s", strPort, proto))
+		ep := make(map[nat.Port]struct{}, 1)
+		p = nat.Port(fmt.Sprintf("%s/%s", strPort, proto))
 		ep[p] = struct{}{}
 
 		jobCreate := eng.Job("create")
@@ -411,8 +412,8 @@ func startEchoServerContainer(t *testing.T, proto string) (*docker.Runtime, *doc
 	}
 
 	jobStart := eng.Job("start", id)
-	portBindings := make(map[docker.Port][]docker.PortBinding)
-	portBindings[p] = []docker.PortBinding{
+	portBindings := make(map[nat.Port][]nat.PortBinding)
+	portBindings[p] = []nat.PortBinding{
 		{},
 	}
 	if err := jobStart.SetenvJson("PortsBindings", portBindings); err != nil {
diff --git a/components/engine/links.go b/components/engine/links.go
index aa1c08374b..ff39947a0d 100644
--- a/components/engine/links.go
+++ b/components/engine/links.go
@@ -3,6 +3,7 @@ package docker
 import (
 	"fmt"
 	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/nat"
 	"path"
 	"strings"
 )
@@ -12,7 +13,7 @@ type Link struct {
 	ChildIP          string
 	Name             string
 	ChildEnvironment []string
-	Ports            []Port
+	Ports            []nat.Port
 	IsEnabled        bool
 	eng              *engine.Engine
 }
@@ -25,7 +26,7 @@ func NewLink(parent, child *Container, name string, eng *engine.Engine) (*Link,
 		return nil, fmt.Errorf("Cannot link to a non running container: %s AS %s", child.Name, name)
 	}
 
-	ports := make([]Port, len(child.Config.ExposedPorts))
+	ports := make([]nat.Port, len(child.Config.ExposedPorts))
 	var i int
 	for p := range child.Config.ExposedPorts {
 		ports[i] = p
@@ -85,14 +86,14 @@ func (l *Link) ToEnv() []string {
 }
 
 // Default port rules
-func (l *Link) getDefaultPort() *Port {
-	var p Port
+func (l *Link) getDefaultPort() *nat.Port {
+	var p nat.Port
 	i := len(l.Ports)
 
 	if i == 0 {
 		return nil
 	} else if i > 1 {
-		sortPorts(l.Ports, func(ip, jp Port) bool {
+		nat.Sort(l.Ports, func(ip, jp nat.Port) bool {
 			// If the two ports have the same number, tcp takes priority
 			// Sort in desc order
 			return ip.Int() < jp.Int() || (ip.Int() == jp.Int() && strings.ToLower(ip.Proto()) == "tcp")
diff --git a/components/engine/links_test.go b/components/engine/links_test.go
index 8a266a9a3d..0286d2395b 100644
--- a/components/engine/links_test.go
+++ b/components/engine/links_test.go
@@ -1,6 +1,7 @@
 package docker
 
 import (
+	"github.com/dotcloud/docker/nat"
 	"strings"
 	"testing"
 )
@@ -22,9 +23,9 @@ func TestLinkNew(t *testing.T) {
 	from := newMockLinkContainer(fromID, "172.0.17.2")
 	from.Config.Env = []string{}
 	from.State = State{Running: true}
-	ports := make(map[Port]struct{})
+	ports := make(nat.PortSet)
 
-	ports[Port("6379/tcp")] = struct{}{}
+	ports[nat.Port("6379/tcp")] = struct{}{}
 
 	from.Config.ExposedPorts = ports
 
@@ -51,7 +52,7 @@ func TestLinkNew(t *testing.T) {
 		t.Fail()
 	}
 	for _, p := range link.Ports {
-		if p != Port("6379/tcp") {
+		if p != nat.Port("6379/tcp") {
 			t.Fail()
 		}
 	}
@@ -64,9 +65,9 @@ func TestLinkEnv(t *testing.T) {
 	from := newMockLinkContainer(fromID, "172.0.17.2")
 	from.Config.Env = []string{"PASSWORD=gordon"}
 	from.State = State{Running: true}
-	ports := make(map[Port]struct{})
+	ports := make(nat.PortSet)
 
-	ports[Port("6379/tcp")] = struct{}{}
+	ports[nat.Port("6379/tcp")] = struct{}{}
 
 	from.Config.ExposedPorts = ports
 
diff --git a/components/engine/nat/nat.go b/components/engine/nat/nat.go
new file mode 100644
index 0000000000..f3af362f8b
--- /dev/null
+++ b/components/engine/nat/nat.go
@@ -0,0 +1,133 @@
+package nat
+
+// nat is a convenience package for docker's manipulation of strings describing
+// network ports.
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/utils"
+	"strconv"
+	"strings"
+)
+
+const (
+	PortSpecTemplate       = "ip:hostPort:containerPort"
+	PortSpecTemplateFormat = "ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort"
+)
+
+type PortBinding struct {
+	HostIp   string
+	HostPort string
+}
+
+type PortMap map[Port][]PortBinding
+
+type PortSet map[Port]struct{}
+
+// 80/tcp
+type Port string
+
+func NewPort(proto, port string) Port {
+	return Port(fmt.Sprintf("%s/%s", port, proto))
+}
+
+func ParsePort(rawPort string) (int, error) {
+	port, err := strconv.ParseUint(rawPort, 10, 16)
+	if err != nil {
+		return 0, err
+	}
+	return int(port), nil
+}
+
+func (p Port) Proto() string {
+	parts := strings.Split(string(p), "/")
+	if len(parts) == 1 {
+		return "tcp"
+	}
+	return parts[1]
+}
+
+func (p Port) Port() string {
+	return strings.Split(string(p), "/")[0]
+}
+
+func (p Port) Int() int {
+	i, err := ParsePort(p.Port())
+	if err != nil {
+		panic(err)
+	}
+	return i
+}
+
+// Splits a port in the format of port/proto
+func SplitProtoPort(rawPort string) (string, string) {
+	parts := strings.Split(rawPort, "/")
+	l := len(parts)
+	if l == 0 {
+		return "", ""
+	}
+	if l == 1 {
+		return "tcp", rawPort
+	}
+	return parts[0], parts[1]
+}
+
+// We will receive port specs in the format of ip:public:private/proto and these need to be
+// parsed in the internal types
+func ParsePortSpecs(ports []string) (map[Port]struct{}, map[Port][]PortBinding, error) {
+	var (
+		exposedPorts = make(map[Port]struct{}, len(ports))
+		bindings     = make(map[Port][]PortBinding)
+	)
+
+	for _, rawPort := range ports {
+		proto := "tcp"
+
+		if i := strings.LastIndex(rawPort, "/"); i != -1 {
+			proto = rawPort[i+1:]
+			rawPort = rawPort[:i]
+		}
+		if !strings.Contains(rawPort, ":") {
+			rawPort = fmt.Sprintf("::%s", rawPort)
+		} else if len(strings.Split(rawPort, ":")) == 2 {
+			rawPort = fmt.Sprintf(":%s", rawPort)
+		}
+
+		parts, err := utils.PartParser(PortSpecTemplate, rawPort)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		var (
+			containerPort = parts["containerPort"]
+			rawIp         = parts["ip"]
+			hostPort      = parts["hostPort"]
+		)
+
+		if containerPort == "" {
+			return nil, nil, fmt.Errorf("No port specified: %s<empty>", rawPort)
+		}
+		if _, err := strconv.ParseUint(containerPort, 10, 16); err != nil {
+			return nil, nil, fmt.Errorf("Invalid containerPort: %s", containerPort)
+		}
+		if _, err := strconv.ParseUint(hostPort, 10, 16); hostPort != "" && err != nil {
+			return nil, nil, fmt.Errorf("Invalid hostPort: %s", hostPort)
+		}
+
+		port := NewPort(proto, containerPort)
+		if _, exists := exposedPorts[port]; !exists {
+			exposedPorts[port] = struct{}{}
+		}
+
+		binding := PortBinding{
+			HostIp:   rawIp,
+			HostPort: hostPort,
+		}
+		bslice, exists := bindings[port]
+		if !exists {
+			bslice = []PortBinding{}
+		}
+		bindings[port] = append(bslice, binding)
+	}
+	return exposedPorts, bindings, nil
+}
diff --git a/components/engine/nat/sort.go b/components/engine/nat/sort.go
new file mode 100644
index 0000000000..f36c12f7bb
--- /dev/null
+++ b/components/engine/nat/sort.go
@@ -0,0 +1,28 @@
+package nat
+
+import "sort"
+
+type portSorter struct {
+	ports []Port
+	by    func(i, j Port) bool
+}
+
+func (s *portSorter) Len() int {
+	return len(s.ports)
+}
+
+func (s *portSorter) Swap(i, j int) {
+	s.ports[i], s.ports[j] = s.ports[j], s.ports[i]
+}
+
+func (s *portSorter) Less(i, j int) bool {
+	ip := s.ports[i]
+	jp := s.ports[j]
+
+	return s.by(ip, jp)
+}
+
+func Sort(ports []Port, predicate func(i, j Port) bool) {
+	s := &portSorter{ports, predicate}
+	sort.Sort(s)
+}
diff --git a/components/engine/sorter_unit_test.go b/components/engine/nat/sort_test.go
similarity index 86%
rename from components/engine/sorter_unit_test.go
rename to components/engine/nat/sort_test.go
index 0669feedb3..5d490e321b 100644
--- a/components/engine/sorter_unit_test.go
+++ b/components/engine/nat/sort_test.go
@@ -1,4 +1,4 @@
-package docker
+package nat
 
 import (
 	"fmt"
@@ -11,7 +11,7 @@ func TestSortUniquePorts(t *testing.T) {
 		Port("22/tcp"),
 	}
 
-	sortPorts(ports, func(ip, jp Port) bool {
+	Sort(ports, func(ip, jp Port) bool {
 		return ip.Int() < jp.Int() || (ip.Int() == jp.Int() && ip.Proto() == "tcp")
 	})
 
@@ -30,7 +30,7 @@ func TestSortSamePortWithDifferentProto(t *testing.T) {
 		Port("6379/udp"),
 	}
 
-	sortPorts(ports, func(ip, jp Port) bool {
+	Sort(ports, func(ip, jp Port) bool {
 		return ip.Int() < jp.Int() || (ip.Int() == jp.Int() && ip.Proto() == "tcp")
 	})
 
diff --git a/components/engine/sorter.go b/components/engine/sorter.go
index 9b3e1a9486..b49ac58c24 100644
--- a/components/engine/sorter.go
+++ b/components/engine/sorter.go
@@ -2,31 +2,6 @@ package docker
 
 import "sort"
 
-type portSorter struct {
-	ports []Port
-	by    func(i, j Port) bool
-}
-
-func (s *portSorter) Len() int {
-	return len(s.ports)
-}
-
-func (s *portSorter) Swap(i, j int) {
-	s.ports[i], s.ports[j] = s.ports[j], s.ports[i]
-}
-
-func (s *portSorter) Less(i, j int) bool {
-	ip := s.ports[i]
-	jp := s.ports[j]
-
-	return s.by(ip, jp)
-}
-
-func sortPorts(ports []Port, predicate func(i, j Port) bool) {
-	s := &portSorter{ports, predicate}
-	sort.Sort(s)
-}
-
 type containerSorter struct {
 	containers []*Container
 	by         func(i, j *Container) bool
diff --git a/components/engine/utils.go b/components/engine/utils.go
index e3ba08d51c..d4718954da 100644
--- a/components/engine/utils.go
+++ b/components/engine/utils.go
@@ -3,10 +3,10 @@ package docker
 import (
 	"fmt"
 	"github.com/dotcloud/docker/archive"
+	"github.com/dotcloud/docker/nat"
 	"github.com/dotcloud/docker/pkg/namesgenerator"
 	"github.com/dotcloud/docker/utils"
 	"io"
-	"strconv"
 	"strings"
 	"sync/atomic"
 )
@@ -98,7 +98,7 @@ func MergeConfig(userConf, imageConf *Config) error {
 		userConf.ExposedPorts = imageConf.ExposedPorts
 	} else if imageConf.ExposedPorts != nil {
 		if userConf.ExposedPorts == nil {
-			userConf.ExposedPorts = make(map[Port]struct{})
+			userConf.ExposedPorts = make(nat.PortSet)
 		}
 		for port := range imageConf.ExposedPorts {
 			if _, exists := userConf.ExposedPorts[port]; !exists {
@@ -109,9 +109,9 @@ func MergeConfig(userConf, imageConf *Config) error {
 
 	if userConf.PortSpecs != nil && len(userConf.PortSpecs) > 0 {
 		if userConf.ExposedPorts == nil {
-			userConf.ExposedPorts = make(map[Port]struct{})
+			userConf.ExposedPorts = make(nat.PortSet)
 		}
-		ports, _, err := parsePortSpecs(userConf.PortSpecs)
+		ports, _, err := nat.ParsePortSpecs(userConf.PortSpecs)
 		if err != nil {
 			return err
 		}
@@ -125,10 +125,10 @@ func MergeConfig(userConf, imageConf *Config) error {
 	if imageConf.PortSpecs != nil && len(imageConf.PortSpecs) > 0 {
 		utils.Debugf("Migrating image port specs to containter: %s", strings.Join(imageConf.PortSpecs, ", "))
 		if userConf.ExposedPorts == nil {
-			userConf.ExposedPorts = make(map[Port]struct{})
+			userConf.ExposedPorts = make(nat.PortSet)
 		}
 
-		ports, _, err := parsePortSpecs(imageConf.PortSpecs)
+		ports, _, err := nat.ParsePortSpecs(imageConf.PortSpecs)
 		if err != nil {
 			return err
 		}
@@ -212,96 +212,9 @@ func parseLxcOpt(opt string) (string, string, error) {
 	return strings.TrimSpace(parts[0]), strings.TrimSpace(parts[1]), nil
 }
 
-// FIXME: network related stuff (including parsing) should be grouped in network file
-const (
-	PortSpecTemplate       = "ip:hostPort:containerPort"
-	PortSpecTemplateFormat = "ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort"
-)
-
-// We will receive port specs in the format of ip:public:private/proto and these need to be
-// parsed in the internal types
-func parsePortSpecs(ports []string) (map[Port]struct{}, map[Port][]PortBinding, error) {
-	var (
-		exposedPorts = make(map[Port]struct{}, len(ports))
-		bindings     = make(map[Port][]PortBinding)
-	)
-
-	for _, rawPort := range ports {
-		proto := "tcp"
-
-		if i := strings.LastIndex(rawPort, "/"); i != -1 {
-			proto = rawPort[i+1:]
-			rawPort = rawPort[:i]
-		}
-		if !strings.Contains(rawPort, ":") {
-			rawPort = fmt.Sprintf("::%s", rawPort)
-		} else if len(strings.Split(rawPort, ":")) == 2 {
-			rawPort = fmt.Sprintf(":%s", rawPort)
-		}
-
-		parts, err := utils.PartParser(PortSpecTemplate, rawPort)
-		if err != nil {
-			return nil, nil, err
-		}
-
-		var (
-			containerPort = parts["containerPort"]
-			rawIp         = parts["ip"]
-			hostPort      = parts["hostPort"]
-		)
-
-		if containerPort == "" {
-			return nil, nil, fmt.Errorf("No port specified: %s<empty>", rawPort)
-		}
-		if _, err := strconv.ParseUint(containerPort, 10, 16); err != nil {
-			return nil, nil, fmt.Errorf("Invalid containerPort: %s", containerPort)
-		}
-		if _, err := strconv.ParseUint(hostPort, 10, 16); hostPort != "" && err != nil {
-			return nil, nil, fmt.Errorf("Invalid hostPort: %s", hostPort)
-		}
-
-		port := NewPort(proto, containerPort)
-		if _, exists := exposedPorts[port]; !exists {
-			exposedPorts[port] = struct{}{}
-		}
-
-		binding := PortBinding{
-			HostIp:   rawIp,
-			HostPort: hostPort,
-		}
-		bslice, exists := bindings[port]
-		if !exists {
-			bslice = []PortBinding{}
-		}
-		bindings[port] = append(bslice, binding)
-	}
-	return exposedPorts, bindings, nil
-}
-
-// Splits a port in the format of port/proto
-func splitProtoPort(rawPort string) (string, string) {
-	parts := strings.Split(rawPort, "/")
-	l := len(parts)
-	if l == 0 {
-		return "", ""
-	}
-	if l == 1 {
-		return "tcp", rawPort
-	}
-	return parts[0], parts[1]
-}
-
-func parsePort(rawPort string) (int, error) {
-	port, err := strconv.ParseUint(rawPort, 10, 16)
-	if err != nil {
-		return 0, err
-	}
-	return int(port), nil
-}
-
 func migratePortMappings(config *Config, hostConfig *HostConfig) error {
 	if config.PortSpecs != nil {
-		ports, bindings, err := parsePortSpecs(config.PortSpecs)
+		ports, bindings, err := nat.ParsePortSpecs(config.PortSpecs)
 		if err != nil {
 			return err
 		}
@@ -314,7 +227,7 @@ func migratePortMappings(config *Config, hostConfig *HostConfig) error {
 		}
 
 		if config.ExposedPorts == nil {
-			config.ExposedPorts = make(map[Port]struct{}, len(ports))
+			config.ExposedPorts = make(nat.PortSet, len(ports))
 		}
 		for k, v := range ports {
 			config.ExposedPorts[k] = v

From 1cb1e79554b88ca7de83f616ad4e88050b54cbd8 Mon Sep 17 00:00:00 2001
From: Andy Rothfusz <github@developersupport.net>
Date: Tue, 11 Feb 2014 16:53:08 -0800
Subject: [PATCH 060/403] fix underline/heading

Docker-DCO-1.1-Signed-off-by: Andy Rothfusz <github@developersupport.net> (github: metalivedev)
Upstream-commit: 6fd8e5d976e872447447d8c25d20d525305f281d
Component: engine
---
 components/engine/docs/sources/use/port_redirection.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/use/port_redirection.rst b/components/engine/docs/sources/use/port_redirection.rst
index 2f4fd37c76..2612d63aec 100644
--- a/components/engine/docs/sources/use/port_redirection.rst
+++ b/components/engine/docs/sources/use/port_redirection.rst
@@ -32,7 +32,7 @@ interface of the host system. To simplify communication between
 containers, Docker provides the linking mechanism.
 
 Auto map all exposed ports on the host
--------------------------------------
+--------------------------------------
 
 To bind all the exposed container ports to the host automatically, use 
 ``docker run -P <imageid>``.  The mapped host ports will be auto-selected 

From 2b6a0d82a2ad45cccee2e2c0c642aaf0159d85bb Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 11 Feb 2014 18:23:17 -0700
Subject: [PATCH 061/403] Fix the one spot I missed dockerversion

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 7ea725fdc530e989516fae60f5dafecb139d75b8
Component: engine
---
 components/engine/hack/make.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index 011b796201..55409c55fc 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -83,7 +83,7 @@ fi
 
 # Use these flags when compiling the tests and final binary
 LDFLAGS='-X github.com/dotcloud/docker/dockerversion.GITCOMMIT "'$GITCOMMIT'" -X github.com/dotcloud/docker/dockerversion.VERSION "'$VERSION'" -w'
-LDFLAGS_STATIC='-X github.com/dotcloud/docker/utils.IAMSTATIC true -linkmode external -extldflags "-lpthread -static -Wl,--unresolved-symbols=ignore-in-object-files"'
+LDFLAGS_STATIC='-X github.com/dotcloud/docker/dockerversion.IAMSTATIC true -linkmode external -extldflags "-lpthread -static -Wl,--unresolved-symbols=ignore-in-object-files"'
 BUILDFLAGS='-tags netgo -a'
 
 HAVE_GO_TEST_COVER=

From e8ca8bfeb882447056f7c568e3813cec2be5e068 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 11 Feb 2014 19:10:23 -0700
Subject: [PATCH 062/403] Fix the tests, too

Seriously.  There's not much codebase left we haven't touched.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 0d871840b202fc31418990bbcbe0df1c4ad689fb
Component: engine
---
 components/engine/integration/api_test.go   | 3 ++-
 components/engine/integration/graph_test.go | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/components/engine/integration/api_test.go b/components/engine/integration/api_test.go
index 82de56a8ba..d3efb75969 100644
--- a/components/engine/integration/api_test.go
+++ b/components/engine/integration/api_test.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/api"
+	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/utils"
 	"io"
@@ -45,7 +46,7 @@ func TestGetVersion(t *testing.T) {
 		t.Fatal(err)
 	}
 	out.Close()
-	expected := docker.VERSION
+	expected := dockerversion.VERSION
 	if result := v.Get("Version"); result != expected {
 		t.Errorf("Expected version %s, %s found", expected, result)
 	}
diff --git a/components/engine/integration/graph_test.go b/components/engine/integration/graph_test.go
index eec4c5c7dc..ff1c0d9361 100644
--- a/components/engine/integration/graph_test.go
+++ b/components/engine/integration/graph_test.go
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/archive"
+	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/utils"
 	"io"
@@ -105,8 +106,8 @@ func TestGraphCreate(t *testing.T) {
 	if image.Comment != "Testing" {
 		t.Fatalf("Wrong comment: should be '%s', not '%s'", "Testing", image.Comment)
 	}
-	if image.DockerVersion != docker.VERSION {
-		t.Fatalf("Wrong docker_version: should be '%s', not '%s'", docker.VERSION, image.DockerVersion)
+	if image.DockerVersion != dockerversion.VERSION {
+		t.Fatalf("Wrong docker_version: should be '%s', not '%s'", dockerversion.VERSION, image.DockerVersion)
 	}
 	images, err := graph.Map()
 	if err != nil {

From cbe391a3ed8f867bfaa8f594248fd35cee2a88d7 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 17:48:50 -0800
Subject: [PATCH 063/403] Move api-specific code to the api package

This facilitates the refactoring of commands.go.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: e08a1c53aa5a19a17d40d41accbab040611c4411
Component: engine
---
 components/engine/api/api.go       |  9 +++++++++
 components/engine/docker/docker.go |  2 +-
 components/engine/opts.go          | 10 ----------
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index 3bc8a8b504..e0077a94e3 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -27,6 +27,7 @@ import (
 	"syscall"
 )
 
+// FIXME: move code common to client and server to common.go
 const (
 	APIVERSION        = 1.9
 	DEFAULTHTTPHOST   = "127.0.0.1"
@@ -34,6 +35,14 @@ const (
 	DEFAULTUNIXSOCKET = "/var/run/docker.sock"
 )
 
+func ValidateHost(val string) (string, error) {
+	host, err := utils.ParseHost(DEFAULTHTTPHOST, DEFAULTHTTPPORT, DEFAULTUNIXSOCKET, val)
+	if err != nil {
+		return val, err
+	}
+	return host, nil
+}
+
 type HttpApiFunc func(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error
 
 func init() {
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index d92f4d98ea..d2fe7c2596 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -42,7 +42,7 @@ func main() {
 		flDefaultIp          = flag.String([]string{"#ip", "-ip"}, "0.0.0.0", "Default IP address to use when binding container ports")
 		flInterContainerComm = flag.Bool([]string{"#icc", "-icc"}, true, "Enable inter-container communication")
 		flGraphDriver        = flag.String([]string{"s", "-storage-driver"}, "", "Force the docker runtime to use a specific storage driver")
-		flHosts              = docker.NewListOpts(docker.ValidateHost)
+		flHosts              = docker.NewListOpts(api.ValidateHost)
 		flMtu                = flag.Int([]string{"#mtu", "-mtu"}, 0, "Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if not default route is available")
 	)
 	flag.Var(&flDns, []string{"#dns", "-dns"}, "Force docker to use specific DNS servers")
diff --git a/components/engine/opts.go b/components/engine/opts.go
index b1d71c491d..dffbcb404e 100644
--- a/components/engine/opts.go
+++ b/components/engine/opts.go
@@ -2,8 +2,6 @@ package docker
 
 import (
 	"fmt"
-	"github.com/dotcloud/docker/api"
-	"github.com/dotcloud/docker/utils"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -129,14 +127,6 @@ func ValidateEnv(val string) (string, error) {
 	return fmt.Sprintf("%s=%s", val, os.Getenv(val)), nil
 }
 
-func ValidateHost(val string) (string, error) {
-	host, err := utils.ParseHost(api.DEFAULTHTTPHOST, api.DEFAULTHTTPPORT, api.DEFAULTUNIXSOCKET, val)
-	if err != nil {
-		return val, err
-	}
-	return host, nil
-}
-
 func ValidateIp4Address(val string) (string, error) {
 	re := regexp.MustCompile(`^(([0-9]+\.){3}([0-9]+))\s*$`)
 	var ns = re.FindSubmatch([]byte(val))

From faccead7fb03dd012b9528525fcc89e2866de5ed Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 18:46:55 -0800
Subject: [PATCH 064/403] pkg/opts: a collection of custom value parsers
 implementing flag.Value

This facilitates the refactoring of commands.go.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: e6e320acc757f22e113da755293583402c6c1e7c
Component: engine
---
 components/engine/commands.go                 | 19 ++++++++++---------
 components/engine/docker/docker.go            |  5 +++--
 components/engine/{ => pkg/opts}/opts.go      | 13 ++++++++++++-
 .../opts/opts_test.go}                        |  2 +-
 components/engine/utils.go                    |  3 ++-
 5 files changed, 28 insertions(+), 14 deletions(-)
 rename components/engine/{ => pkg/opts}/opts.go (88%)
 rename components/engine/{opts_unit_test.go => pkg/opts/opts_test.go} (97%)

diff --git a/components/engine/commands.go b/components/engine/commands.go
index db8cc1d2f5..973a41d86a 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -14,6 +14,7 @@ import (
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/nat"
 	flag "github.com/dotcloud/docker/pkg/mflag"
+	"github.com/dotcloud/docker/pkg/opts"
 	"github.com/dotcloud/docker/pkg/sysinfo"
 	"github.com/dotcloud/docker/pkg/term"
 	"github.com/dotcloud/docker/registry"
@@ -1757,16 +1758,16 @@ func ParseRun(args []string, sysInfo *sysinfo.SysInfo) (*Config, *HostConfig, *f
 func parseRun(cmd *flag.FlagSet, args []string, sysInfo *sysinfo.SysInfo) (*Config, *HostConfig, *flag.FlagSet, error) {
 	var (
 		// FIXME: use utils.ListOpts for attach and volumes?
-		flAttach  = NewListOpts(ValidateAttach)
-		flVolumes = NewListOpts(ValidatePath)
-		flLinks   = NewListOpts(ValidateLink)
-		flEnv     = NewListOpts(ValidateEnv)
+		flAttach  = opts.NewListOpts(opts.ValidateAttach)
+		flVolumes = opts.NewListOpts(opts.ValidatePath)
+		flLinks   = opts.NewListOpts(opts.ValidateLink)
+		flEnv     = opts.NewListOpts(opts.ValidateEnv)
 
-		flPublish     ListOpts
-		flExpose      ListOpts
-		flDns         ListOpts
-		flVolumesFrom ListOpts
-		flLxcOpts     ListOpts
+		flPublish     opts.ListOpts
+		flExpose      opts.ListOpts
+		flDns         opts.ListOpts
+		flVolumesFrom opts.ListOpts
+		flLxcOpts     opts.ListOpts
 
 		flAutoRemove      = cmd.Bool([]string{"#rm", "-rm"}, false, "Automatically remove the container when it exits (incompatible with -d)")
 		flDetach          = cmd.Bool([]string{"d", "-detach"}, false, "Detached mode: Run container in the background, print new container id")
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index d2fe7c2596..775dfd3533 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -10,6 +10,7 @@ import (
 	"github.com/dotcloud/docker/api"
 	"github.com/dotcloud/docker/engine"
 	flag "github.com/dotcloud/docker/pkg/mflag"
+	"github.com/dotcloud/docker/pkg/opts"
 	"github.com/dotcloud/docker/sysinit"
 	"github.com/dotcloud/docker/utils"
 )
@@ -36,13 +37,13 @@ func main() {
 		pidfile              = flag.String([]string{"p", "-pidfile"}, "/var/run/docker.pid", "Path to use for daemon PID file")
 		flRoot               = flag.String([]string{"g", "-graph"}, "/var/lib/docker", "Path to use as the root of the docker runtime")
 		flEnableCors         = flag.Bool([]string{"#api-enable-cors", "-api-enable-cors"}, false, "Enable CORS headers in the remote API")
-		flDns                = docker.NewListOpts(docker.ValidateIp4Address)
+		flDns                = opts.NewListOpts(opts.ValidateIp4Address)
 		flEnableIptables     = flag.Bool([]string{"#iptables", "-iptables"}, true, "Disable docker's addition of iptables rules")
 		flEnableIpForward    = flag.Bool([]string{"#ip-forward", "-ip-forward"}, true, "Disable enabling of net.ipv4.ip_forward")
 		flDefaultIp          = flag.String([]string{"#ip", "-ip"}, "0.0.0.0", "Default IP address to use when binding container ports")
 		flInterContainerComm = flag.Bool([]string{"#icc", "-icc"}, true, "Enable inter-container communication")
 		flGraphDriver        = flag.String([]string{"s", "-storage-driver"}, "", "Force the docker runtime to use a specific storage driver")
-		flHosts              = docker.NewListOpts(api.ValidateHost)
+		flHosts              = opts.NewListOpts(api.ValidateHost)
 		flMtu                = flag.Int([]string{"#mtu", "-mtu"}, 0, "Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if not default route is available")
 	)
 	flag.Var(&flDns, []string{"#dns", "-dns"}, "Force docker to use specific DNS servers")
diff --git a/components/engine/opts.go b/components/engine/pkg/opts/opts.go
similarity index 88%
rename from components/engine/opts.go
rename to components/engine/pkg/opts/opts.go
index dffbcb404e..a1b8752bad 100644
--- a/components/engine/opts.go
+++ b/components/engine/pkg/opts/opts.go
@@ -1,7 +1,8 @@
-package docker
+package opts
 
 import (
 	"fmt"
+	"github.com/dotcloud/docker/utils"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -97,6 +98,16 @@ func ValidateLink(val string) (string, error) {
 	return val, nil
 }
 
+// FIXME: this is a duplicate of docker.utils.parseLink.
+// 	it can't be moved to a separate links/ package because
+//	links depends on Container which is defined in the core.
+//
+// Links come in the format of
+// name:alias
+func parseLink(rawLink string) (map[string]string, error) {
+	return utils.PartParser("name:alias", rawLink)
+}
+
 func ValidatePath(val string) (string, error) {
 	var containerPath string
 
diff --git a/components/engine/opts_unit_test.go b/components/engine/pkg/opts/opts_test.go
similarity index 97%
rename from components/engine/opts_unit_test.go
rename to components/engine/pkg/opts/opts_test.go
index 67b061771b..a5c1fac9ca 100644
--- a/components/engine/opts_unit_test.go
+++ b/components/engine/pkg/opts/opts_test.go
@@ -1,4 +1,4 @@
-package docker
+package opts
 
 import (
 	"testing"
diff --git a/components/engine/utils.go b/components/engine/utils.go
index d4718954da..e3a58cc67e 100644
--- a/components/engine/utils.go
+++ b/components/engine/utils.go
@@ -5,6 +5,7 @@ import (
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/nat"
 	"github.com/dotcloud/docker/pkg/namesgenerator"
+	"github.com/dotcloud/docker/pkg/opts"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"strings"
@@ -192,7 +193,7 @@ func MergeConfig(userConf, imageConf *Config) error {
 	return nil
 }
 
-func parseLxcConfOpts(opts ListOpts) ([]KeyValuePair, error) {
+func parseLxcConfOpts(opts opts.ListOpts) ([]KeyValuePair, error) {
 	out := make([]KeyValuePair, opts.Len())
 	for i, o := range opts.GetAll() {
 		k, v, err := parseLxcOpt(o)

From 15bba51638ecc595f321b15685df2a418644d991 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 20:16:58 -0800
Subject: [PATCH 065/403] Remove useless code in client implementation of
 'run'.

This facilitates refactoring commands.go.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: e3140e1e69b24f32ffcc2dd94b7d82ad9305a7bc
Component: engine
---
 components/engine/commands.go | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/components/engine/commands.go b/components/engine/commands.go
index 973a41d86a..331e519c8d 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -1993,12 +1993,7 @@ func (cli *DockerCli) CmdRun(args ...string) error {
 	stream, statusCode, err := cli.call("POST", "/containers/create?"+containerValues.Encode(), config, false)
 	//if image not found try to pull it
 	if statusCode == 404 {
-		_, tag := utils.ParseRepositoryTag(config.Image)
-		if tag == "" {
-			tag = DEFAULTTAG
-		}
-
-		fmt.Fprintf(cli.err, "Unable to find image '%s' (tag: %s) locally\n", config.Image, tag)
+		fmt.Fprintf(cli.err, "Unable to find image '%s' locally\n", config.Image)
 
 		v := url.Values{}
 		repos, tag := utils.ParseRepositoryTag(config.Image)

From e3789229811fa99d41508ffcc5afb95db2876a97 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 20:04:39 -0800
Subject: [PATCH 066/403] Move the canonical run configuration objects to a
 sub-package

    * Config is now runconfig.Config
    * HostConfig is now runconfig.HostConfig
    * MergeConfig is now runconfig.Merge
    * CompareConfig is now runconfig.Compare
    * ParseRun is now runconfig.Parse
    * ContainerConfigFromJob is now runconfig.ContainerConfigFromJob
    * ContainerHostConfigFromJob is now runconfig.ContainerHostConfigFromJob

This facilitates refactoring commands.go and shrinks the core.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 6393c38339e11b4a099a460ecf46bb5cafc4283b
Component: engine
---
 components/engine/buildfile.go                |  11 +-
 components/engine/commands.go                 | 212 +--------------
 components/engine/commands_unit_test.go       |   7 +-
 components/engine/container.go                | 117 +--------
 components/engine/container_unit_test.go      |  17 --
 components/engine/graph.go                    |   3 +-
 components/engine/image.go                    |  23 +-
 components/engine/integration/api_test.go     |  39 +--
 .../engine/integration/container_test.go      |  78 +++---
 components/engine/integration/runtime_test.go |  33 +--
 components/engine/integration/server_test.go  |  21 +-
 components/engine/integration/utils_test.go   |   9 +-
 components/engine/links_test.go               |   3 +-
 components/engine/runconfig/compare.go        |  67 +++++
 components/engine/runconfig/config.go         |  76 ++++++
 .../engine/{ => runconfig}/config_test.go     |  30 +--
 components/engine/runconfig/hostconfig.go     |  39 +++
 components/engine/runconfig/merge.go          | 119 +++++++++
 components/engine/runconfig/parse.go          | 246 ++++++++++++++++++
 components/engine/runconfig/parse_test.go     |  22 ++
 components/engine/runtime.go                  |  11 +-
 components/engine/server.go                   |  17 +-
 components/engine/utils.go                    | 205 +--------------
 23 files changed, 731 insertions(+), 674 deletions(-)
 create mode 100644 components/engine/runconfig/compare.go
 create mode 100644 components/engine/runconfig/config.go
 rename components/engine/{ => runconfig}/config_test.go (83%)
 create mode 100644 components/engine/runconfig/hostconfig.go
 create mode 100644 components/engine/runconfig/merge.go
 create mode 100644 components/engine/runconfig/parse.go
 create mode 100644 components/engine/runconfig/parse_test.go

diff --git a/components/engine/buildfile.go b/components/engine/buildfile.go
index 2a4b163bec..a121276c21 100644
--- a/components/engine/buildfile.go
+++ b/components/engine/buildfile.go
@@ -9,6 +9,7 @@ import (
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/auth"
 	"github.com/dotcloud/docker/registry"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"io/ioutil"
@@ -38,7 +39,7 @@ type buildFile struct {
 
 	image      string
 	maintainer string
-	config     *Config
+	config     *runconfig.Config
 
 	contextPath string
 	context     *utils.TarSum
@@ -101,7 +102,7 @@ func (b *buildFile) CmdFrom(name string) error {
 		}
 	}
 	b.image = image.ID
-	b.config = &Config{}
+	b.config = &runconfig.Config{}
 	if image.Config != nil {
 		b.config = image.Config
 	}
@@ -158,14 +159,14 @@ func (b *buildFile) CmdRun(args string) error {
 	if b.image == "" {
 		return fmt.Errorf("Please provide a source image with `from` prior to run")
 	}
-	config, _, _, err := ParseRun(append([]string{b.image}, b.buildCmdFromJson(args)...), nil)
+	config, _, _, err := runconfig.Parse(append([]string{b.image}, b.buildCmdFromJson(args)...), nil)
 	if err != nil {
 		return err
 	}
 
 	cmd := b.config.Cmd
 	b.config.Cmd = nil
-	MergeConfig(b.config, config)
+	runconfig.Merge(b.config, config)
 
 	defer func(cmd []string) { b.config.Cmd = cmd }(cmd)
 
@@ -742,7 +743,7 @@ func NewBuildFile(srv *Server, outStream, errStream io.Writer, verbose, utilizeC
 	return &buildFile{
 		runtime:       srv.runtime,
 		srv:           srv,
-		config:        &Config{},
+		config:        &runconfig.Config{},
 		outStream:     outStream,
 		errStream:     errStream,
 		tmpContainers: make(map[string]struct{}),
diff --git a/components/engine/commands.go b/components/engine/commands.go
index ac93a32638..285b7a57b4 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -15,10 +15,9 @@ import (
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/nat"
 	flag "github.com/dotcloud/docker/pkg/mflag"
-	"github.com/dotcloud/docker/pkg/opts"
-	"github.com/dotcloud/docker/pkg/sysinfo"
 	"github.com/dotcloud/docker/pkg/term"
 	"github.com/dotcloud/docker/registry"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"io/ioutil"
@@ -1449,11 +1448,11 @@ func (cli *DockerCli) CmdCommit(args ...string) error {
 	v.Set("comment", *flComment)
 	v.Set("author", *flAuthor)
 	var (
-		config *Config
+		config *runconfig.Config
 		env    engine.Env
 	)
 	if *flConfig != "" {
-		config = &Config{}
+		config = &runconfig.Config{}
 		if err := json.Unmarshal([]byte(*flConfig), config); err != nil {
 			return err
 		}
@@ -1743,210 +1742,9 @@ func (cli *DockerCli) CmdTag(args ...string) error {
 	return nil
 }
 
-//FIXME Only used in tests
-func ParseRun(args []string, sysInfo *sysinfo.SysInfo) (*Config, *HostConfig, *flag.FlagSet, error) {
-	cmd := flag.NewFlagSet("run", flag.ContinueOnError)
-	cmd.SetOutput(ioutil.Discard)
-	cmd.Usage = nil
-	return parseRun(cmd, args, sysInfo)
-}
-
-func parseRun(cmd *flag.FlagSet, args []string, sysInfo *sysinfo.SysInfo) (*Config, *HostConfig, *flag.FlagSet, error) {
-	var (
-		// FIXME: use utils.ListOpts for attach and volumes?
-		flAttach  = opts.NewListOpts(opts.ValidateAttach)
-		flVolumes = opts.NewListOpts(opts.ValidatePath)
-		flLinks   = opts.NewListOpts(opts.ValidateLink)
-		flEnv     = opts.NewListOpts(opts.ValidateEnv)
-
-		flPublish     opts.ListOpts
-		flExpose      opts.ListOpts
-		flDns         opts.ListOpts
-		flVolumesFrom opts.ListOpts
-		flLxcOpts     opts.ListOpts
-
-		flAutoRemove      = cmd.Bool([]string{"#rm", "-rm"}, false, "Automatically remove the container when it exits (incompatible with -d)")
-		flDetach          = cmd.Bool([]string{"d", "-detach"}, false, "Detached mode: Run container in the background, print new container id")
-		flNetwork         = cmd.Bool([]string{"n", "-networking"}, true, "Enable networking for this container")
-		flPrivileged      = cmd.Bool([]string{"#privileged", "-privileged"}, false, "Give extended privileges to this container")
-		flPublishAll      = cmd.Bool([]string{"P", "-publish-all"}, false, "Publish all exposed ports to the host interfaces")
-		flStdin           = cmd.Bool([]string{"i", "-interactive"}, false, "Keep stdin open even if not attached")
-		flTty             = cmd.Bool([]string{"t", "-tty"}, false, "Allocate a pseudo-tty")
-		flContainerIDFile = cmd.String([]string{"#cidfile", "-cidfile"}, "", "Write the container ID to the file")
-		flEntrypoint      = cmd.String([]string{"#entrypoint", "-entrypoint"}, "", "Overwrite the default entrypoint of the image")
-		flHostname        = cmd.String([]string{"h", "-hostname"}, "", "Container host name")
-		flMemoryString    = cmd.String([]string{"m", "-memory"}, "", "Memory limit (format: <number><optional unit>, where unit = b, k, m or g)")
-		flUser            = cmd.String([]string{"u", "-user"}, "", "Username or UID")
-		flWorkingDir      = cmd.String([]string{"w", "-workdir"}, "", "Working directory inside the container")
-		flCpuShares       = cmd.Int64([]string{"c", "-cpu-shares"}, 0, "CPU shares (relative weight)")
-
-		// For documentation purpose
-		_ = cmd.Bool([]string{"#sig-proxy", "-sig-proxy"}, true, "Proxify all received signal to the process (even in non-tty mode)")
-		_ = cmd.String([]string{"#name", "-name"}, "", "Assign a name to the container")
-	)
-
-	cmd.Var(&flAttach, []string{"a", "-attach"}, "Attach to stdin, stdout or stderr.")
-	cmd.Var(&flVolumes, []string{"v", "-volume"}, "Bind mount a volume (e.g. from the host: -v /host:/container, from docker: -v /container)")
-	cmd.Var(&flLinks, []string{"#link", "-link"}, "Add link to another container (name:alias)")
-	cmd.Var(&flEnv, []string{"e", "-env"}, "Set environment variables")
-
-	cmd.Var(&flPublish, []string{"p", "-publish"}, fmt.Sprintf("Publish a container's port to the host (format: %s) (use 'docker port' to see the actual mapping)", nat.PortSpecTemplateFormat))
-	cmd.Var(&flExpose, []string{"#expose", "-expose"}, "Expose a port from the container without publishing it to your host")
-	cmd.Var(&flDns, []string{"#dns", "-dns"}, "Set custom dns servers")
-	cmd.Var(&flVolumesFrom, []string{"#volumes-from", "-volumes-from"}, "Mount volumes from the specified container(s)")
-	cmd.Var(&flLxcOpts, []string{"#lxc-conf", "-lxc-conf"}, "Add custom lxc options -lxc-conf=\"lxc.cgroup.cpuset.cpus = 0,1\"")
-
-	if err := cmd.Parse(args); err != nil {
-		return nil, nil, cmd, err
-	}
-
-	// Check if the kernel supports memory limit cgroup.
-	if sysInfo != nil && *flMemoryString != "" && !sysInfo.MemoryLimit {
-		*flMemoryString = ""
-	}
-
-	// Validate input params
-	if *flDetach && flAttach.Len() > 0 {
-		return nil, nil, cmd, ErrConflictAttachDetach
-	}
-	if *flWorkingDir != "" && !path.IsAbs(*flWorkingDir) {
-		return nil, nil, cmd, ErrInvalidWorikingDirectory
-	}
-	if *flDetach && *flAutoRemove {
-		return nil, nil, cmd, ErrConflictDetachAutoRemove
-	}
-
-	// If neither -d or -a are set, attach to everything by default
-	if flAttach.Len() == 0 && !*flDetach {
-		if !*flDetach {
-			flAttach.Set("stdout")
-			flAttach.Set("stderr")
-			if *flStdin {
-				flAttach.Set("stdin")
-			}
-		}
-	}
-
-	var flMemory int64
-	if *flMemoryString != "" {
-		parsedMemory, err := utils.RAMInBytes(*flMemoryString)
-		if err != nil {
-			return nil, nil, cmd, err
-		}
-		flMemory = parsedMemory
-	}
-
-	var binds []string
-	// add any bind targets to the list of container volumes
-	for bind := range flVolumes.GetMap() {
-		if arr := strings.Split(bind, ":"); len(arr) > 1 {
-			if arr[0] == "/" {
-				return nil, nil, cmd, fmt.Errorf("Invalid bind mount: source can't be '/'")
-			}
-			dstDir := arr[1]
-			flVolumes.Set(dstDir)
-			binds = append(binds, bind)
-			flVolumes.Delete(bind)
-		} else if bind == "/" {
-			return nil, nil, cmd, fmt.Errorf("Invalid volume: path can't be '/'")
-		}
-	}
-
-	var (
-		parsedArgs = cmd.Args()
-		runCmd     []string
-		entrypoint []string
-		image      string
-	)
-	if len(parsedArgs) >= 1 {
-		image = cmd.Arg(0)
-	}
-	if len(parsedArgs) > 1 {
-		runCmd = parsedArgs[1:]
-	}
-	if *flEntrypoint != "" {
-		entrypoint = []string{*flEntrypoint}
-	}
-
-	lxcConf, err := parseLxcConfOpts(flLxcOpts)
-	if err != nil {
-		return nil, nil, cmd, err
-	}
-
-	var (
-		domainname string
-		hostname   = *flHostname
-		parts      = strings.SplitN(hostname, ".", 2)
-	)
-	if len(parts) > 1 {
-		hostname = parts[0]
-		domainname = parts[1]
-	}
-
-	ports, portBindings, err := nat.ParsePortSpecs(flPublish.GetAll())
-	if err != nil {
-		return nil, nil, cmd, err
-	}
-
-	// Merge in exposed ports to the map of published ports
-	for _, e := range flExpose.GetAll() {
-		if strings.Contains(e, ":") {
-			return nil, nil, cmd, fmt.Errorf("Invalid port format for --expose: %s", e)
-		}
-		p := nat.NewPort(nat.SplitProtoPort(e))
-		if _, exists := ports[p]; !exists {
-			ports[p] = struct{}{}
-		}
-	}
-
-	config := &Config{
-		Hostname:        hostname,
-		Domainname:      domainname,
-		PortSpecs:       nil, // Deprecated
-		ExposedPorts:    ports,
-		User:            *flUser,
-		Tty:             *flTty,
-		NetworkDisabled: !*flNetwork,
-		OpenStdin:       *flStdin,
-		Memory:          flMemory,
-		CpuShares:       *flCpuShares,
-		AttachStdin:     flAttach.Get("stdin"),
-		AttachStdout:    flAttach.Get("stdout"),
-		AttachStderr:    flAttach.Get("stderr"),
-		Env:             flEnv.GetAll(),
-		Cmd:             runCmd,
-		Dns:             flDns.GetAll(),
-		Image:           image,
-		Volumes:         flVolumes.GetMap(),
-		VolumesFrom:     strings.Join(flVolumesFrom.GetAll(), ","),
-		Entrypoint:      entrypoint,
-		WorkingDir:      *flWorkingDir,
-	}
-
-	hostConfig := &HostConfig{
-		Binds:           binds,
-		ContainerIDFile: *flContainerIDFile,
-		LxcConf:         lxcConf,
-		Privileged:      *flPrivileged,
-		PortBindings:    portBindings,
-		Links:           flLinks.GetAll(),
-		PublishAllPorts: *flPublishAll,
-	}
-
-	if sysInfo != nil && flMemory > 0 && !sysInfo.SwapLimit {
-		//fmt.Fprintf(stdout, "WARNING: Your kernel does not support swap limit capabilities. Limitation discarded.\n")
-		config.MemorySwap = -1
-	}
-
-	// When allocating stdin in attached mode, close stdin at client disconnect
-	if config.OpenStdin && config.AttachStdin {
-		config.StdinOnce = true
-	}
-	return config, hostConfig, cmd, nil
-}
-
 func (cli *DockerCli) CmdRun(args ...string) error {
-	config, hostConfig, cmd, err := parseRun(cli.Subcmd("run", "[OPTIONS] IMAGE [COMMAND] [ARG...]", "Run a command in a new container"), args, nil)
+	// FIXME: just use runconfig.Parse already
+	config, hostConfig, cmd, err := runconfig.ParseSubcommand(cli.Subcmd("run", "[OPTIONS] IMAGE [COMMAND] [ARG...]", "Run a command in a new container"), args, nil)
 	if err != nil {
 		return err
 	}
diff --git a/components/engine/commands_unit_test.go b/components/engine/commands_unit_test.go
index e44d9a1854..60d8d60398 100644
--- a/components/engine/commands_unit_test.go
+++ b/components/engine/commands_unit_test.go
@@ -1,16 +1,17 @@
 package docker
 
 import (
+	"github.com/dotcloud/docker/runconfig"
 	"strings"
 	"testing"
 )
 
-func parse(t *testing.T, args string) (*Config, *HostConfig, error) {
-	config, hostConfig, _, err := ParseRun(strings.Split(args+" ubuntu bash", " "), nil)
+func parse(t *testing.T, args string) (*runconfig.Config, *runconfig.HostConfig, error) {
+	config, hostConfig, _, err := runconfig.Parse(strings.Split(args+" ubuntu bash", " "), nil)
 	return config, hostConfig, err
 }
 
-func mustParse(t *testing.T, args string) (*Config, *HostConfig) {
+func mustParse(t *testing.T, args string) (*runconfig.Config, *runconfig.HostConfig) {
 	config, hostConfig, err := parse(t, args)
 	if err != nil {
 		t.Fatal(err)
diff --git a/components/engine/container.go b/components/engine/container.go
index 991c2aeee7..f068d00375 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -11,6 +11,7 @@ import (
 	"github.com/dotcloud/docker/nat"
 	"github.com/dotcloud/docker/pkg/mount"
 	"github.com/dotcloud/docker/pkg/term"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"github.com/kr/pty"
 	"io"
@@ -42,7 +43,7 @@ type Container struct {
 	Path string
 	Args []string
 
-	Config *Config
+	Config *runconfig.Config
 	State  State
 	Image  string
 
@@ -68,109 +69,11 @@ type Container struct {
 	// Store rw/ro in a separate structure to preserve reverse-compatibility on-disk.
 	// Easier than migrating older container configs :)
 	VolumesRW  map[string]bool
-	hostConfig *HostConfig
+	hostConfig *runconfig.HostConfig
 
 	activeLinks map[string]*Link
 }
 
-// Note: the Config structure should hold only portable information about the container.
-// Here, "portable" means "independent from the host we are running on".
-// Non-portable information *should* appear in HostConfig.
-type Config struct {
-	Hostname        string
-	Domainname      string
-	User            string
-	Memory          int64 // Memory limit (in bytes)
-	MemorySwap      int64 // Total memory usage (memory + swap); set `-1' to disable swap
-	CpuShares       int64 // CPU shares (relative weight vs. other containers)
-	AttachStdin     bool
-	AttachStdout    bool
-	AttachStderr    bool
-	PortSpecs       []string // Deprecated - Can be in the format of 8080/tcp
-	ExposedPorts    map[nat.Port]struct{}
-	Tty             bool // Attach standard streams to a tty, including stdin if it is not closed.
-	OpenStdin       bool // Open stdin
-	StdinOnce       bool // If true, close stdin after the 1 attached client disconnects.
-	Env             []string
-	Cmd             []string
-	Dns             []string
-	Image           string // Name of the image as it was passed by the operator (eg. could be symbolic)
-	Volumes         map[string]struct{}
-	VolumesFrom     string
-	WorkingDir      string
-	Entrypoint      []string
-	NetworkDisabled bool
-	OnBuild         []string
-}
-
-func ContainerConfigFromJob(job *engine.Job) *Config {
-	config := &Config{
-		Hostname:        job.Getenv("Hostname"),
-		Domainname:      job.Getenv("Domainname"),
-		User:            job.Getenv("User"),
-		Memory:          job.GetenvInt64("Memory"),
-		MemorySwap:      job.GetenvInt64("MemorySwap"),
-		CpuShares:       job.GetenvInt64("CpuShares"),
-		AttachStdin:     job.GetenvBool("AttachStdin"),
-		AttachStdout:    job.GetenvBool("AttachStdout"),
-		AttachStderr:    job.GetenvBool("AttachStderr"),
-		Tty:             job.GetenvBool("Tty"),
-		OpenStdin:       job.GetenvBool("OpenStdin"),
-		StdinOnce:       job.GetenvBool("StdinOnce"),
-		Image:           job.Getenv("Image"),
-		VolumesFrom:     job.Getenv("VolumesFrom"),
-		WorkingDir:      job.Getenv("WorkingDir"),
-		NetworkDisabled: job.GetenvBool("NetworkDisabled"),
-	}
-	job.GetenvJson("ExposedPorts", &config.ExposedPorts)
-	job.GetenvJson("Volumes", &config.Volumes)
-	if PortSpecs := job.GetenvList("PortSpecs"); PortSpecs != nil {
-		config.PortSpecs = PortSpecs
-	}
-	if Env := job.GetenvList("Env"); Env != nil {
-		config.Env = Env
-	}
-	if Cmd := job.GetenvList("Cmd"); Cmd != nil {
-		config.Cmd = Cmd
-	}
-	if Dns := job.GetenvList("Dns"); Dns != nil {
-		config.Dns = Dns
-	}
-	if Entrypoint := job.GetenvList("Entrypoint"); Entrypoint != nil {
-		config.Entrypoint = Entrypoint
-	}
-
-	return config
-}
-
-type HostConfig struct {
-	Binds           []string
-	ContainerIDFile string
-	LxcConf         []KeyValuePair
-	Privileged      bool
-	PortBindings    nat.PortMap
-	Links           []string
-	PublishAllPorts bool
-}
-
-func ContainerHostConfigFromJob(job *engine.Job) *HostConfig {
-	hostConfig := &HostConfig{
-		ContainerIDFile: job.Getenv("ContainerIDFile"),
-		Privileged:      job.GetenvBool("Privileged"),
-		PublishAllPorts: job.GetenvBool("PublishAllPorts"),
-	}
-	job.GetenvJson("LxcConf", &hostConfig.LxcConf)
-	job.GetenvJson("PortBindings", &hostConfig.PortBindings)
-	if Binds := job.GetenvList("Binds"); Binds != nil {
-		hostConfig.Binds = Binds
-	}
-	if Links := job.GetenvList("Links"); Links != nil {
-		hostConfig.Links = Links
-	}
-
-	return hostConfig
-}
-
 type BindMap struct {
 	SrcPath string
 	DstPath string
@@ -178,18 +81,10 @@ type BindMap struct {
 }
 
 var (
-	ErrContainerStart           = errors.New("The container failed to start. Unknown error")
-	ErrContainerStartTimeout    = errors.New("The container failed to start due to timed out.")
-	ErrInvalidWorikingDirectory = errors.New("The working directory is invalid. It needs to be an absolute path.")
-	ErrConflictAttachDetach     = errors.New("Conflicting options: -a and -d")
-	ErrConflictDetachAutoRemove = errors.New("Conflicting options: -rm and -d")
+	ErrContainerStart        = errors.New("The container failed to start. Unknown error")
+	ErrContainerStartTimeout = errors.New("The container failed to start due to timed out.")
 )
 
-type KeyValuePair struct {
-	Key   string
-	Value string
-}
-
 // FIXME: move deprecated port stuff to nat to clean up the core.
 type PortMapping map[string]string // Deprecated
 
@@ -292,7 +187,7 @@ func (container *Container) ToDisk() (err error) {
 }
 
 func (container *Container) readHostConfig() error {
-	container.hostConfig = &HostConfig{}
+	container.hostConfig = &runconfig.HostConfig{}
 	// If the hostconfig file does not exist, do not read it.
 	// (We still have to initialize container.hostConfig,
 	// but that's OK, since we just did that above.)
diff --git a/components/engine/container_unit_test.go b/components/engine/container_unit_test.go
index dd915ad2e4..3877b7f0da 100644
--- a/components/engine/container_unit_test.go
+++ b/components/engine/container_unit_test.go
@@ -5,23 +5,6 @@ import (
 	"testing"
 )
 
-func TestParseLxcConfOpt(t *testing.T) {
-	opts := []string{"lxc.utsname=docker", "lxc.utsname = docker "}
-
-	for _, o := range opts {
-		k, v, err := parseLxcOpt(o)
-		if err != nil {
-			t.FailNow()
-		}
-		if k != "lxc.utsname" {
-			t.Fail()
-		}
-		if v != "docker" {
-			t.Fail()
-		}
-	}
-}
-
 func TestParseNetworkOptsPrivateOnly(t *testing.T) {
 	ports, bindings, err := nat.ParsePortSpecs([]string{"192.168.1.100::80"})
 	if err != nil {
diff --git a/components/engine/graph.go b/components/engine/graph.go
index 138c7b8613..01cd50f4f0 100644
--- a/components/engine/graph.go
+++ b/components/engine/graph.go
@@ -5,6 +5,7 @@ import (
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/graphdriver"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"io/ioutil"
@@ -126,7 +127,7 @@ func (graph *Graph) Get(name string) (*Image, error) {
 }
 
 // Create creates a new image and registers it in the graph.
-func (graph *Graph) Create(layerData archive.Archive, container *Container, comment, author string, config *Config) (*Image, error) {
+func (graph *Graph) Create(layerData archive.Archive, container *Container, comment, author string, config *runconfig.Config) (*Image, error) {
 	img := &Image{
 		ID:            GenerateID(),
 		Comment:       comment,
diff --git a/components/engine/image.go b/components/engine/image.go
index dbd2173597..593dc14f00 100644
--- a/components/engine/image.go
+++ b/components/engine/image.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/graphdriver"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"io/ioutil"
@@ -18,17 +19,17 @@ import (
 )
 
 type Image struct {
-	ID              string    `json:"id"`
-	Parent          string    `json:"parent,omitempty"`
-	Comment         string    `json:"comment,omitempty"`
-	Created         time.Time `json:"created"`
-	Container       string    `json:"container,omitempty"`
-	ContainerConfig Config    `json:"container_config,omitempty"`
-	DockerVersion   string    `json:"docker_version,omitempty"`
-	Author          string    `json:"author,omitempty"`
-	Config          *Config   `json:"config,omitempty"`
-	Architecture    string    `json:"architecture,omitempty"`
-	OS              string    `json:"os,omitempty"`
+	ID              string            `json:"id"`
+	Parent          string            `json:"parent,omitempty"`
+	Comment         string            `json:"comment,omitempty"`
+	Created         time.Time         `json:"created"`
+	Container       string            `json:"container,omitempty"`
+	ContainerConfig runconfig.Config  `json:"container_config,omitempty"`
+	DockerVersion   string            `json:"docker_version,omitempty"`
+	Author          string            `json:"author,omitempty"`
+	Config          *runconfig.Config `json:"config,omitempty"`
+	Architecture    string            `json:"architecture,omitempty"`
+	OS              string            `json:"os,omitempty"`
 	graph           *Graph
 	Size            int64
 }
diff --git a/components/engine/integration/api_test.go b/components/engine/integration/api_test.go
index d3efb75969..c587f111a2 100644
--- a/components/engine/integration/api_test.go
+++ b/components/engine/integration/api_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/dotcloud/docker/api"
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"net"
@@ -309,7 +310,7 @@ func TestGetContainersJSON(t *testing.T) {
 	}
 	beginLen := len(outs.Data)
 
-	containerID := createTestContainer(eng, &docker.Config{
+	containerID := createTestContainer(eng, &runconfig.Config{
 		Image: unitTestImageID,
 		Cmd:   []string{"echo", "test"},
 	}, t)
@@ -346,7 +347,7 @@ func TestGetContainersExport(t *testing.T) {
 
 	// Create a container and remove a file
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image: unitTestImageID,
 			Cmd:   []string{"touch", "/test"},
 		},
@@ -394,7 +395,7 @@ func TestGetContainersChanges(t *testing.T) {
 
 	// Create a container and remove a file
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image: unitTestImageID,
 			Cmd:   []string{"/bin/rm", "/etc/passwd"},
 		},
@@ -433,7 +434,7 @@ func TestGetContainersTop(t *testing.T) {
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/sh", "-c", "cat"},
 			OpenStdin: true,
@@ -510,7 +511,7 @@ func TestGetContainersByName(t *testing.T) {
 
 	// Create a container and remove a file
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image: unitTestImageID,
 			Cmd:   []string{"echo", "test"},
 		},
@@ -542,7 +543,7 @@ func TestPostCommit(t *testing.T) {
 
 	// Create a container and remove a file
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image: unitTestImageID,
 			Cmd:   []string{"touch", "/test"},
 		},
@@ -578,7 +579,7 @@ func TestPostContainersCreate(t *testing.T) {
 	eng := NewTestEngine(t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
-	configJSON, err := json.Marshal(&docker.Config{
+	configJSON, err := json.Marshal(&runconfig.Config{
 		Image:  unitTestImageID,
 		Memory: 33554432,
 		Cmd:    []string{"touch", "/test"},
@@ -620,7 +621,7 @@ func TestPostContainersKill(t *testing.T) {
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/cat"},
 			OpenStdin: true,
@@ -659,7 +660,7 @@ func TestPostContainersRestart(t *testing.T) {
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/top"},
 			OpenStdin: true,
@@ -705,7 +706,7 @@ func TestPostContainersStart(t *testing.T) {
 
 	containerID := createTestContainer(
 		eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/cat"},
 			OpenStdin: true,
@@ -713,7 +714,7 @@ func TestPostContainersStart(t *testing.T) {
 		t,
 	)
 
-	hostConfigJSON, err := json.Marshal(&docker.HostConfig{})
+	hostConfigJSON, err := json.Marshal(&runconfig.HostConfig{})
 
 	req, err := http.NewRequest("POST", "/containers/"+containerID+"/start", bytes.NewReader(hostConfigJSON))
 	if err != nil {
@@ -758,7 +759,7 @@ func TestRunErrorBindMountRootSource(t *testing.T) {
 
 	containerID := createTestContainer(
 		eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/cat"},
 			OpenStdin: true,
@@ -766,7 +767,7 @@ func TestRunErrorBindMountRootSource(t *testing.T) {
 		t,
 	)
 
-	hostConfigJSON, err := json.Marshal(&docker.HostConfig{
+	hostConfigJSON, err := json.Marshal(&runconfig.HostConfig{
 		Binds: []string{"/:/tmp"},
 	})
 
@@ -792,7 +793,7 @@ func TestPostContainersStop(t *testing.T) {
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/top"},
 			OpenStdin: true,
@@ -832,7 +833,7 @@ func TestPostContainersWait(t *testing.T) {
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/sleep", "1"},
 			OpenStdin: true,
@@ -870,7 +871,7 @@ func TestPostContainersAttach(t *testing.T) {
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/cat"},
 			OpenStdin: true,
@@ -948,7 +949,7 @@ func TestPostContainersAttachStderr(t *testing.T) {
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image:     unitTestImageID,
 			Cmd:       []string{"/bin/sh", "-c", "/bin/cat >&2"},
 			OpenStdin: true,
@@ -1029,7 +1030,7 @@ func TestDeleteContainers(t *testing.T) {
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image: unitTestImageID,
 			Cmd:   []string{"touch", "/test"},
 		},
@@ -1164,7 +1165,7 @@ func TestPostContainersCopy(t *testing.T) {
 
 	// Create a container and remove a file
 	containerID := createTestContainer(eng,
-		&docker.Config{
+		&runconfig.Config{
 			Image: unitTestImageID,
 			Cmd:   []string{"touch", "/test.txt"},
 		},
diff --git a/components/engine/integration/container_test.go b/components/engine/integration/container_test.go
index 97f4cd282f..b961e1d147 100644
--- a/components/engine/integration/container_test.go
+++ b/components/engine/integration/container_test.go
@@ -3,7 +3,7 @@ package docker
 import (
 	"bufio"
 	"fmt"
-	"github.com/dotcloud/docker"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"io/ioutil"
@@ -20,7 +20,7 @@ func TestIDFormat(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 	container1, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image: GetTestImage(runtime).ID,
 			Cmd:   []string{"/bin/sh", "-c", "echo hello world"},
 		},
@@ -234,7 +234,7 @@ func TestCommitAutoRun(t *testing.T) {
 		t.Errorf("Container shouldn't be running")
 	}
 
-	img, err := runtime.Commit(container1, "", "", "unit test commited image", "", &docker.Config{Cmd: []string{"cat", "/world"}})
+	img, err := runtime.Commit(container1, "", "", "unit test commited image", "", &runconfig.Config{Cmd: []string{"cat", "/world"}})
 	if err != nil {
 		t.Error(err)
 	}
@@ -415,7 +415,7 @@ func TestOutput(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 	container, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image: GetTestImage(runtime).ID,
 			Cmd:   []string{"echo", "-n", "foobar"},
 		},
@@ -438,7 +438,7 @@ func TestContainerNetwork(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 	container, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image: GetTestImage(runtime).ID,
 			Cmd:   []string{"ping", "-c", "1", "127.0.0.1"},
 		},
@@ -460,7 +460,7 @@ func TestKillDifferentUser(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image:     GetTestImage(runtime).ID,
 		Cmd:       []string{"cat"},
 		OpenStdin: true,
@@ -520,7 +520,7 @@ func TestCreateVolume(t *testing.T) {
 	runtime := mkRuntimeFromEngine(eng, t)
 	defer nuke(runtime)
 
-	config, hc, _, err := docker.ParseRun([]string{"-v", "/var/lib/data", unitTestImageID, "echo", "hello", "world"}, nil)
+	config, hc, _, err := runconfig.Parse([]string{"-v", "/var/lib/data", unitTestImageID, "echo", "hello", "world"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -552,7 +552,7 @@ func TestCreateVolume(t *testing.T) {
 func TestKill(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"sleep", "2"},
 	},
@@ -596,7 +596,7 @@ func TestExitCode(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 
-	trueContainer, _, err := runtime.Create(&docker.Config{
+	trueContainer, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"/bin/true"},
 	}, "")
@@ -611,7 +611,7 @@ func TestExitCode(t *testing.T) {
 		t.Fatalf("Unexpected exit code %d (expected 0)", code)
 	}
 
-	falseContainer, _, err := runtime.Create(&docker.Config{
+	falseContainer, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"/bin/false"},
 	}, "")
@@ -630,7 +630,7 @@ func TestExitCode(t *testing.T) {
 func TestRestart(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"echo", "-n", "foobar"},
 	},
@@ -661,7 +661,7 @@ func TestRestart(t *testing.T) {
 func TestRestartStdin(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"cat"},
 
@@ -739,7 +739,7 @@ func TestUser(t *testing.T) {
 	defer nuke(runtime)
 
 	// Default user must be root
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"id"},
 	},
@@ -758,7 +758,7 @@ func TestUser(t *testing.T) {
 	}
 
 	// Set a username
-	container, _, err = runtime.Create(&docker.Config{
+	container, _, err = runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"id"},
 
@@ -779,7 +779,7 @@ func TestUser(t *testing.T) {
 	}
 
 	// Set a UID
-	container, _, err = runtime.Create(&docker.Config{
+	container, _, err = runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"id"},
 
@@ -800,7 +800,7 @@ func TestUser(t *testing.T) {
 	}
 
 	// Set a different user by uid
-	container, _, err = runtime.Create(&docker.Config{
+	container, _, err = runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"id"},
 
@@ -823,7 +823,7 @@ func TestUser(t *testing.T) {
 	}
 
 	// Set a different user by username
-	container, _, err = runtime.Create(&docker.Config{
+	container, _, err = runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"id"},
 
@@ -844,7 +844,7 @@ func TestUser(t *testing.T) {
 	}
 
 	// Test an wrong username
-	container, _, err = runtime.Create(&docker.Config{
+	container, _, err = runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"id"},
 
@@ -866,7 +866,7 @@ func TestMultipleContainers(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 
-	container1, _, err := runtime.Create(&docker.Config{
+	container1, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"sleep", "2"},
 	},
@@ -877,7 +877,7 @@ func TestMultipleContainers(t *testing.T) {
 	}
 	defer runtime.Destroy(container1)
 
-	container2, _, err := runtime.Create(&docker.Config{
+	container2, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"sleep", "2"},
 	},
@@ -921,7 +921,7 @@ func TestMultipleContainers(t *testing.T) {
 func TestStdin(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"cat"},
 
@@ -966,7 +966,7 @@ func TestStdin(t *testing.T) {
 func TestTty(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"cat"},
 
@@ -1013,7 +1013,7 @@ func TestEnv(t *testing.T) {
 	os.Setenv("TRICKY", "tri\ncky\n")
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
-	config, _, _, err := docker.ParseRun([]string{"-e=FALSE=true", "-e=TRUE", "-e=TRICKY", GetTestImage(runtime).ID, "env"}, nil)
+	config, _, _, err := runconfig.Parse([]string{"-e=FALSE=true", "-e=TRUE", "-e=TRICKY", GetTestImage(runtime).ID, "env"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1067,7 +1067,7 @@ func TestEntrypoint(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 	container, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:      GetTestImage(runtime).ID,
 			Entrypoint: []string{"/bin/echo"},
 			Cmd:        []string{"-n", "foobar"},
@@ -1091,7 +1091,7 @@ func TestEntrypointNoCmd(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 	container, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:      GetTestImage(runtime).ID,
 			Entrypoint: []string{"/bin/echo", "foobar"},
 		},
@@ -1114,7 +1114,7 @@ func BenchmarkRunSequencial(b *testing.B) {
 	runtime := mkRuntime(b)
 	defer nuke(runtime)
 	for i := 0; i < b.N; i++ {
-		container, _, err := runtime.Create(&docker.Config{
+		container, _, err := runtime.Create(&runconfig.Config{
 			Image: GetTestImage(runtime).ID,
 			Cmd:   []string{"echo", "-n", "foo"},
 		},
@@ -1147,7 +1147,7 @@ func BenchmarkRunParallel(b *testing.B) {
 		complete := make(chan error)
 		tasks = append(tasks, complete)
 		go func(i int, complete chan error) {
-			container, _, err := runtime.Create(&docker.Config{
+			container, _, err := runtime.Create(&runconfig.Config{
 				Image: GetTestImage(runtime).ID,
 				Cmd:   []string{"echo", "-n", "foo"},
 			},
@@ -1301,7 +1301,7 @@ func TestFromVolumesInReadonlyMode(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 	container, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:   GetTestImage(runtime).ID,
 			Cmd:     []string{"/bin/echo", "-n", "foobar"},
 			Volumes: map[string]struct{}{"/test": {}},
@@ -1321,7 +1321,7 @@ func TestFromVolumesInReadonlyMode(t *testing.T) {
 	}
 
 	container2, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:       GetTestImage(runtime).ID,
 			Cmd:         []string{"/bin/echo", "-n", "foobar"},
 			VolumesFrom: container.ID + ":ro",
@@ -1362,7 +1362,7 @@ func TestVolumesFromReadonlyMount(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 	container, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:   GetTestImage(runtime).ID,
 			Cmd:     []string{"/bin/echo", "-n", "foobar"},
 			Volumes: map[string]struct{}{"/test": {}},
@@ -1382,7 +1382,7 @@ func TestVolumesFromReadonlyMount(t *testing.T) {
 	}
 
 	container2, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:       GetTestImage(runtime).ID,
 			Cmd:         []string{"/bin/echo", "-n", "foobar"},
 			VolumesFrom: container.ID,
@@ -1418,7 +1418,7 @@ func TestRestartWithVolumes(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image:   GetTestImage(runtime).ID,
 		Cmd:     []string{"echo", "-n", "foobar"},
 		Volumes: map[string]struct{}{"/test": {}},
@@ -1462,7 +1462,7 @@ func TestVolumesFromWithVolumes(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image:   GetTestImage(runtime).ID,
 		Cmd:     []string{"sh", "-c", "echo -n bar > /test/foo"},
 		Volumes: map[string]struct{}{"/test": {}},
@@ -1491,7 +1491,7 @@ func TestVolumesFromWithVolumes(t *testing.T) {
 	}
 
 	container2, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:       GetTestImage(runtime).ID,
 			Cmd:         []string{"cat", "/test/foo"},
 			VolumesFrom: container.ID,
@@ -1529,7 +1529,7 @@ func TestOnlyLoopbackExistsWhenUsingDisableNetworkOption(t *testing.T) {
 	runtime := mkRuntimeFromEngine(eng, t)
 	defer nuke(runtime)
 
-	config, hc, _, err := docker.ParseRun([]string{"-n=false", GetTestImage(runtime).ID, "ip", "addr", "show"}, nil)
+	config, hc, _, err := runconfig.Parse([]string{"-n=false", GetTestImage(runtime).ID, "ip", "addr", "show"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1617,7 +1617,7 @@ func TestMultipleVolumesFrom(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image:   GetTestImage(runtime).ID,
 		Cmd:     []string{"sh", "-c", "echo -n bar > /test/foo"},
 		Volumes: map[string]struct{}{"/test": {}},
@@ -1646,7 +1646,7 @@ func TestMultipleVolumesFrom(t *testing.T) {
 	}
 
 	container2, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:   GetTestImage(runtime).ID,
 			Cmd:     []string{"sh", "-c", "echo -n bar > /other/foo"},
 			Volumes: map[string]struct{}{"/other": {}},
@@ -1668,7 +1668,7 @@ func TestMultipleVolumesFrom(t *testing.T) {
 	}
 
 	container3, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:       GetTestImage(runtime).ID,
 			Cmd:         []string{"/bin/echo", "-n", "foobar"},
 			VolumesFrom: strings.Join([]string{container.ID, container2.ID}, ","),
@@ -1696,7 +1696,7 @@ func TestRestartGhost(t *testing.T) {
 	defer nuke(runtime)
 
 	container, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image:   GetTestImage(runtime).ID,
 			Cmd:     []string{"sh", "-c", "echo -n bar > /test/foo"},
 			Volumes: map[string]struct{}{"/test": {}},
diff --git a/components/engine/integration/runtime_test.go b/components/engine/integration/runtime_test.go
index 70dde8f497..170f4c9638 100644
--- a/components/engine/integration/runtime_test.go
+++ b/components/engine/integration/runtime_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/nat"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/sysinit"
 	"github.com/dotcloud/docker/utils"
 	"io"
@@ -200,7 +201,7 @@ func TestRuntimeCreate(t *testing.T) {
 		t.Errorf("Expected 0 containers, %v found", len(runtime.List()))
 	}
 
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"ls", "-al"},
 	},
@@ -243,23 +244,23 @@ func TestRuntimeCreate(t *testing.T) {
 
 	// Test that conflict error displays correct details
 	testContainer, _, _ := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image: GetTestImage(runtime).ID,
 			Cmd:   []string{"ls", "-al"},
 		},
 		"conflictname",
 	)
-	if _, _, err := runtime.Create(&docker.Config{Image: GetTestImage(runtime).ID, Cmd: []string{"ls", "-al"}}, testContainer.Name); err == nil || !strings.Contains(err.Error(), utils.TruncateID(testContainer.ID)) {
+	if _, _, err := runtime.Create(&runconfig.Config{Image: GetTestImage(runtime).ID, Cmd: []string{"ls", "-al"}}, testContainer.Name); err == nil || !strings.Contains(err.Error(), utils.TruncateID(testContainer.ID)) {
 		t.Fatalf("Name conflict error doesn't include the correct short id. Message was: %s", err.Error())
 	}
 
 	// Make sure create with bad parameters returns an error
-	if _, _, err = runtime.Create(&docker.Config{Image: GetTestImage(runtime).ID}, ""); err == nil {
+	if _, _, err = runtime.Create(&runconfig.Config{Image: GetTestImage(runtime).ID}, ""); err == nil {
 		t.Fatal("Builder.Create should throw an error when Cmd is missing")
 	}
 
 	if _, _, err := runtime.Create(
-		&docker.Config{
+		&runconfig.Config{
 			Image: GetTestImage(runtime).ID,
 			Cmd:   []string{},
 		},
@@ -268,7 +269,7 @@ func TestRuntimeCreate(t *testing.T) {
 		t.Fatal("Builder.Create should throw an error when Cmd is empty")
 	}
 
-	config := &docker.Config{
+	config := &runconfig.Config{
 		Image:     GetTestImage(runtime).ID,
 		Cmd:       []string{"/bin/ls"},
 		PortSpecs: []string{"80"},
@@ -281,7 +282,7 @@ func TestRuntimeCreate(t *testing.T) {
 	}
 
 	// test expose 80:8000
-	container, warnings, err := runtime.Create(&docker.Config{
+	container, warnings, err := runtime.Create(&runconfig.Config{
 		Image:     GetTestImage(runtime).ID,
 		Cmd:       []string{"ls", "-al"},
 		PortSpecs: []string{"80:8000"},
@@ -300,7 +301,7 @@ func TestDestroy(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"ls", "-al"},
 	}, "")
@@ -712,7 +713,7 @@ func TestDefaultContainerName(t *testing.T) {
 	runtime := mkRuntimeFromEngine(eng, t)
 	defer nuke(runtime)
 
-	config, _, _, err := docker.ParseRun([]string{unitTestImageID, "echo test"}, nil)
+	config, _, _, err := runconfig.Parse([]string{unitTestImageID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -736,7 +737,7 @@ func TestRandomContainerName(t *testing.T) {
 	runtime := mkRuntimeFromEngine(eng, t)
 	defer nuke(runtime)
 
-	config, _, _, err := docker.ParseRun([]string{GetTestImage(runtime).ID, "echo test"}, nil)
+	config, _, _, err := runconfig.Parse([]string{GetTestImage(runtime).ID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -767,7 +768,7 @@ func TestContainerNameValidation(t *testing.T) {
 		{"abc-123_AAA.1", true},
 		{"\000asdf", false},
 	} {
-		config, _, _, err := docker.ParseRun([]string{unitTestImageID, "echo test"}, nil)
+		config, _, _, err := runconfig.Parse([]string{unitTestImageID, "echo test"}, nil)
 		if err != nil {
 			if !test.Valid {
 				continue
@@ -808,7 +809,7 @@ func TestLinkChildContainer(t *testing.T) {
 	runtime := mkRuntimeFromEngine(eng, t)
 	defer nuke(runtime)
 
-	config, _, _, err := docker.ParseRun([]string{unitTestImageID, "echo test"}, nil)
+	config, _, _, err := runconfig.Parse([]string{unitTestImageID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -824,7 +825,7 @@ func TestLinkChildContainer(t *testing.T) {
 		t.Fatalf("Expect webapp id to match container id: %s != %s", webapp.ID, container.ID)
 	}
 
-	config, _, _, err = docker.ParseRun([]string{GetTestImage(runtime).ID, "echo test"}, nil)
+	config, _, _, err = runconfig.Parse([]string{GetTestImage(runtime).ID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -850,7 +851,7 @@ func TestGetAllChildren(t *testing.T) {
 	runtime := mkRuntimeFromEngine(eng, t)
 	defer nuke(runtime)
 
-	config, _, _, err := docker.ParseRun([]string{unitTestImageID, "echo test"}, nil)
+	config, _, _, err := runconfig.Parse([]string{unitTestImageID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -866,7 +867,7 @@ func TestGetAllChildren(t *testing.T) {
 		t.Fatalf("Expect webapp id to match container id: %s != %s", webapp.ID, container.ID)
 	}
 
-	config, _, _, err = docker.ParseRun([]string{unitTestImageID, "echo test"}, nil)
+	config, _, _, err = runconfig.Parse([]string{unitTestImageID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -903,7 +904,7 @@ func TestDestroyWithInitLayer(t *testing.T) {
 	runtime := mkRuntime(t)
 	defer nuke(runtime)
 
-	container, _, err := runtime.Create(&docker.Config{
+	container, _, err := runtime.Create(&runconfig.Config{
 		Image: GetTestImage(runtime).ID,
 		Cmd:   []string{"ls", "-al"},
 	}, "")
diff --git a/components/engine/integration/server_test.go b/components/engine/integration/server_test.go
index 45d4930ad7..2b7ef13cbd 100644
--- a/components/engine/integration/server_test.go
+++ b/components/engine/integration/server_test.go
@@ -3,6 +3,7 @@ package docker
 import (
 	"github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/runconfig"
 	"strings"
 	"testing"
 	"time"
@@ -71,7 +72,7 @@ func TestCreateRm(t *testing.T) {
 	eng := NewTestEngine(t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
-	config, _, _, err := docker.ParseRun([]string{unitTestImageID, "echo test"}, nil)
+	config, _, _, err := runconfig.Parse([]string{unitTestImageID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -118,7 +119,7 @@ func TestCreateNumberHostname(t *testing.T) {
 	eng := NewTestEngine(t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
-	config, _, _, err := docker.ParseRun([]string{"-h", "web.0", unitTestImageID, "echo test"}, nil)
+	config, _, _, err := runconfig.Parse([]string{"-h", "web.0", unitTestImageID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -130,7 +131,7 @@ func TestCreateNumberUsername(t *testing.T) {
 	eng := NewTestEngine(t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
-	config, _, _, err := docker.ParseRun([]string{"-u", "1002", unitTestImageID, "echo test"}, nil)
+	config, _, _, err := runconfig.Parse([]string{"-u", "1002", unitTestImageID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -142,7 +143,7 @@ func TestCreateRmVolumes(t *testing.T) {
 	eng := NewTestEngine(t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
-	config, hostConfig, _, err := docker.ParseRun([]string{"-v", "/srv", unitTestImageID, "echo", "test"}, nil)
+	config, hostConfig, _, err := runconfig.Parse([]string{"-v", "/srv", unitTestImageID, "echo", "test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -202,7 +203,7 @@ func TestCommit(t *testing.T) {
 	eng := NewTestEngine(t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
-	config, _, _, err := docker.ParseRun([]string{unitTestImageID, "/bin/cat"}, nil)
+	config, _, _, err := runconfig.Parse([]string{unitTestImageID, "/bin/cat"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -224,7 +225,7 @@ func TestRestartKillWait(t *testing.T) {
 	runtime := mkRuntimeFromEngine(eng, t)
 	defer runtime.Nuke()
 
-	config, hostConfig, _, err := docker.ParseRun([]string{"-i", unitTestImageID, "/bin/cat"}, nil)
+	config, hostConfig, _, err := runconfig.Parse([]string{"-i", unitTestImageID, "/bin/cat"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -302,7 +303,7 @@ func TestCreateStartRestartStopStartKillRm(t *testing.T) {
 	srv := mkServerFromEngine(eng, t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
-	config, hostConfig, _, err := docker.ParseRun([]string{"-i", unitTestImageID, "/bin/cat"}, nil)
+	config, hostConfig, _, err := runconfig.Parse([]string{"-i", unitTestImageID, "/bin/cat"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -401,7 +402,7 @@ func TestRmi(t *testing.T) {
 
 	initialImages := getAllImages(eng, t)
 
-	config, hostConfig, _, err := docker.ParseRun([]string{unitTestImageID, "echo", "test"}, nil)
+	config, hostConfig, _, err := runconfig.Parse([]string{unitTestImageID, "echo", "test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -548,7 +549,7 @@ func TestListContainers(t *testing.T) {
 	srv := mkServerFromEngine(eng, t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
-	config := docker.Config{
+	config := runconfig.Config{
 		Image:     unitTestImageID,
 		Cmd:       []string{"/bin/sh", "-c", "cat"},
 		OpenStdin: true,
@@ -671,7 +672,7 @@ func TestDeleteTagWithExistingContainers(t *testing.T) {
 	}
 
 	// Create a container from the image
-	config, _, _, err := docker.ParseRun([]string{unitTestImageID, "echo test"}, nil)
+	config, _, _, err := runconfig.Parse([]string{unitTestImageID, "echo test"}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/components/engine/integration/utils_test.go b/components/engine/integration/utils_test.go
index 450cb7527f..6b0f458564 100644
--- a/components/engine/integration/utils_test.go
+++ b/components/engine/integration/utils_test.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 )
 
@@ -48,7 +49,7 @@ func mkRuntime(f utils.Fataler) *docker.Runtime {
 	return r
 }
 
-func createNamedTestContainer(eng *engine.Engine, config *docker.Config, f utils.Fataler, name string) (shortId string) {
+func createNamedTestContainer(eng *engine.Engine, config *runconfig.Config, f utils.Fataler, name string) (shortId string) {
 	job := eng.Job("create", name)
 	if err := job.ImportEnv(config); err != nil {
 		f.Fatal(err)
@@ -60,7 +61,7 @@ func createNamedTestContainer(eng *engine.Engine, config *docker.Config, f utils
 	return
 }
 
-func createTestContainer(eng *engine.Engine, config *docker.Config, f utils.Fataler) (shortId string) {
+func createTestContainer(eng *engine.Engine, config *runconfig.Config, f utils.Fataler) (shortId string) {
 	return createNamedTestContainer(eng, config, f, "")
 }
 
@@ -252,8 +253,8 @@ func readFile(src string, t *testing.T) (content string) {
 // dynamically replaced by the current test image.
 // The caller is responsible for destroying the container.
 // Call t.Fatal() at the first error.
-func mkContainer(r *docker.Runtime, args []string, t *testing.T) (*docker.Container, *docker.HostConfig, error) {
-	config, hc, _, err := docker.ParseRun(args, nil)
+func mkContainer(r *docker.Runtime, args []string, t *testing.T) (*docker.Container, *runconfig.HostConfig, error) {
+	config, hc, _, err := runconfig.Parse(args, nil)
 	defer func() {
 		if err != nil && t != nil {
 			t.Fatal(err)
diff --git a/components/engine/links_test.go b/components/engine/links_test.go
index 0286d2395b..7b85a8e86d 100644
--- a/components/engine/links_test.go
+++ b/components/engine/links_test.go
@@ -2,13 +2,14 @@ package docker
 
 import (
 	"github.com/dotcloud/docker/nat"
+	"github.com/dotcloud/docker/runconfig"
 	"strings"
 	"testing"
 )
 
 func newMockLinkContainer(id string, ip string) *Container {
 	return &Container{
-		Config: &Config{},
+		Config: &runconfig.Config{},
 		ID:     id,
 		NetworkSettings: &NetworkSettings{
 			IPAddress: ip,
diff --git a/components/engine/runconfig/compare.go b/components/engine/runconfig/compare.go
new file mode 100644
index 0000000000..c09f897716
--- /dev/null
+++ b/components/engine/runconfig/compare.go
@@ -0,0 +1,67 @@
+package runconfig
+
+// Compare two Config struct. Do not compare the "Image" nor "Hostname" fields
+// If OpenStdin is set, then it differs
+func Compare(a, b *Config) bool {
+	if a == nil || b == nil ||
+		a.OpenStdin || b.OpenStdin {
+		return false
+	}
+	if a.AttachStdout != b.AttachStdout ||
+		a.AttachStderr != b.AttachStderr ||
+		a.User != b.User ||
+		a.Memory != b.Memory ||
+		a.MemorySwap != b.MemorySwap ||
+		a.CpuShares != b.CpuShares ||
+		a.OpenStdin != b.OpenStdin ||
+		a.Tty != b.Tty ||
+		a.VolumesFrom != b.VolumesFrom {
+		return false
+	}
+	if len(a.Cmd) != len(b.Cmd) ||
+		len(a.Dns) != len(b.Dns) ||
+		len(a.Env) != len(b.Env) ||
+		len(a.PortSpecs) != len(b.PortSpecs) ||
+		len(a.ExposedPorts) != len(b.ExposedPorts) ||
+		len(a.Entrypoint) != len(b.Entrypoint) ||
+		len(a.Volumes) != len(b.Volumes) {
+		return false
+	}
+
+	for i := 0; i < len(a.Cmd); i++ {
+		if a.Cmd[i] != b.Cmd[i] {
+			return false
+		}
+	}
+	for i := 0; i < len(a.Dns); i++ {
+		if a.Dns[i] != b.Dns[i] {
+			return false
+		}
+	}
+	for i := 0; i < len(a.Env); i++ {
+		if a.Env[i] != b.Env[i] {
+			return false
+		}
+	}
+	for i := 0; i < len(a.PortSpecs); i++ {
+		if a.PortSpecs[i] != b.PortSpecs[i] {
+			return false
+		}
+	}
+	for k := range a.ExposedPorts {
+		if _, exists := b.ExposedPorts[k]; !exists {
+			return false
+		}
+	}
+	for i := 0; i < len(a.Entrypoint); i++ {
+		if a.Entrypoint[i] != b.Entrypoint[i] {
+			return false
+		}
+	}
+	for key := range a.Volumes {
+		if _, exists := b.Volumes[key]; !exists {
+			return false
+		}
+	}
+	return true
+}
diff --git a/components/engine/runconfig/config.go b/components/engine/runconfig/config.go
new file mode 100644
index 0000000000..9faa823a57
--- /dev/null
+++ b/components/engine/runconfig/config.go
@@ -0,0 +1,76 @@
+package runconfig
+
+import (
+	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/nat"
+)
+
+// Note: the Config structure should hold only portable information about the container.
+// Here, "portable" means "independent from the host we are running on".
+// Non-portable information *should* appear in HostConfig.
+type Config struct {
+	Hostname        string
+	Domainname      string
+	User            string
+	Memory          int64 // Memory limit (in bytes)
+	MemorySwap      int64 // Total memory usage (memory + swap); set `-1' to disable swap
+	CpuShares       int64 // CPU shares (relative weight vs. other containers)
+	AttachStdin     bool
+	AttachStdout    bool
+	AttachStderr    bool
+	PortSpecs       []string // Deprecated - Can be in the format of 8080/tcp
+	ExposedPorts    map[nat.Port]struct{}
+	Tty             bool // Attach standard streams to a tty, including stdin if it is not closed.
+	OpenStdin       bool // Open stdin
+	StdinOnce       bool // If true, close stdin after the 1 attached client disconnects.
+	Env             []string
+	Cmd             []string
+	Dns             []string
+	Image           string // Name of the image as it was passed by the operator (eg. could be symbolic)
+	Volumes         map[string]struct{}
+	VolumesFrom     string
+	WorkingDir      string
+	Entrypoint      []string
+	NetworkDisabled bool
+	OnBuild         []string
+}
+
+func ContainerConfigFromJob(job *engine.Job) *Config {
+	config := &Config{
+		Hostname:        job.Getenv("Hostname"),
+		Domainname:      job.Getenv("Domainname"),
+		User:            job.Getenv("User"),
+		Memory:          job.GetenvInt64("Memory"),
+		MemorySwap:      job.GetenvInt64("MemorySwap"),
+		CpuShares:       job.GetenvInt64("CpuShares"),
+		AttachStdin:     job.GetenvBool("AttachStdin"),
+		AttachStdout:    job.GetenvBool("AttachStdout"),
+		AttachStderr:    job.GetenvBool("AttachStderr"),
+		Tty:             job.GetenvBool("Tty"),
+		OpenStdin:       job.GetenvBool("OpenStdin"),
+		StdinOnce:       job.GetenvBool("StdinOnce"),
+		Image:           job.Getenv("Image"),
+		VolumesFrom:     job.Getenv("VolumesFrom"),
+		WorkingDir:      job.Getenv("WorkingDir"),
+		NetworkDisabled: job.GetenvBool("NetworkDisabled"),
+	}
+	job.GetenvJson("ExposedPorts", &config.ExposedPorts)
+	job.GetenvJson("Volumes", &config.Volumes)
+	if PortSpecs := job.GetenvList("PortSpecs"); PortSpecs != nil {
+		config.PortSpecs = PortSpecs
+	}
+	if Env := job.GetenvList("Env"); Env != nil {
+		config.Env = Env
+	}
+	if Cmd := job.GetenvList("Cmd"); Cmd != nil {
+		config.Cmd = Cmd
+	}
+	if Dns := job.GetenvList("Dns"); Dns != nil {
+		config.Dns = Dns
+	}
+	if Entrypoint := job.GetenvList("Entrypoint"); Entrypoint != nil {
+		config.Entrypoint = Entrypoint
+	}
+
+	return config
+}
diff --git a/components/engine/config_test.go b/components/engine/runconfig/config_test.go
similarity index 83%
rename from components/engine/config_test.go
rename to components/engine/runconfig/config_test.go
index 1c808163e2..3ef31491fc 100644
--- a/components/engine/config_test.go
+++ b/components/engine/runconfig/config_test.go
@@ -1,11 +1,11 @@
-package docker
+package runconfig
 
 import (
 	"github.com/dotcloud/docker/nat"
 	"testing"
 )
 
-func TestCompareConfig(t *testing.T) {
+func TestCompare(t *testing.T) {
 	volumes1 := make(map[string]struct{})
 	volumes1["/test1"] = struct{}{}
 	config1 := Config{
@@ -45,24 +45,24 @@ func TestCompareConfig(t *testing.T) {
 		VolumesFrom: "11111111",
 		Volumes:     volumes2,
 	}
-	if CompareConfig(&config1, &config2) {
-		t.Fatalf("CompareConfig should return false, Dns are different")
+	if Compare(&config1, &config2) {
+		t.Fatalf("Compare should return false, Dns are different")
 	}
-	if CompareConfig(&config1, &config3) {
-		t.Fatalf("CompareConfig should return false, PortSpecs are different")
+	if Compare(&config1, &config3) {
+		t.Fatalf("Compare should return false, PortSpecs are different")
 	}
-	if CompareConfig(&config1, &config4) {
-		t.Fatalf("CompareConfig should return false, VolumesFrom are different")
+	if Compare(&config1, &config4) {
+		t.Fatalf("Compare should return false, VolumesFrom are different")
 	}
-	if CompareConfig(&config1, &config5) {
-		t.Fatalf("CompareConfig should return false, Volumes are different")
+	if Compare(&config1, &config5) {
+		t.Fatalf("Compare should return false, Volumes are different")
 	}
-	if !CompareConfig(&config1, &config1) {
-		t.Fatalf("CompareConfig should return true")
+	if !Compare(&config1, &config1) {
+		t.Fatalf("Compare should return true")
 	}
 }
 
-func TestMergeConfig(t *testing.T) {
+func TestMerge(t *testing.T) {
 	volumesImage := make(map[string]struct{})
 	volumesImage["/test1"] = struct{}{}
 	volumesImage["/test2"] = struct{}{}
@@ -83,7 +83,7 @@ func TestMergeConfig(t *testing.T) {
 		Volumes:   volumesUser,
 	}
 
-	if err := MergeConfig(configUser, configImage); err != nil {
+	if err := Merge(configUser, configImage); err != nil {
 		t.Error(err)
 	}
 
@@ -134,7 +134,7 @@ func TestMergeConfig(t *testing.T) {
 		ExposedPorts: ports,
 	}
 
-	if err := MergeConfig(configUser, configImage2); err != nil {
+	if err := Merge(configUser, configImage2); err != nil {
 		t.Error(err)
 	}
 
diff --git a/components/engine/runconfig/hostconfig.go b/components/engine/runconfig/hostconfig.go
new file mode 100644
index 0000000000..6c8618ee81
--- /dev/null
+++ b/components/engine/runconfig/hostconfig.go
@@ -0,0 +1,39 @@
+package runconfig
+
+import (
+	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/nat"
+)
+
+type HostConfig struct {
+	Binds           []string
+	ContainerIDFile string
+	LxcConf         []KeyValuePair
+	Privileged      bool
+	PortBindings    nat.PortMap
+	Links           []string
+	PublishAllPorts bool
+}
+
+type KeyValuePair struct {
+	Key   string
+	Value string
+}
+
+func ContainerHostConfigFromJob(job *engine.Job) *HostConfig {
+	hostConfig := &HostConfig{
+		ContainerIDFile: job.Getenv("ContainerIDFile"),
+		Privileged:      job.GetenvBool("Privileged"),
+		PublishAllPorts: job.GetenvBool("PublishAllPorts"),
+	}
+	job.GetenvJson("LxcConf", &hostConfig.LxcConf)
+	job.GetenvJson("PortBindings", &hostConfig.PortBindings)
+	if Binds := job.GetenvList("Binds"); Binds != nil {
+		hostConfig.Binds = Binds
+	}
+	if Links := job.GetenvList("Links"); Links != nil {
+		hostConfig.Links = Links
+	}
+
+	return hostConfig
+}
diff --git a/components/engine/runconfig/merge.go b/components/engine/runconfig/merge.go
new file mode 100644
index 0000000000..a8d677baa8
--- /dev/null
+++ b/components/engine/runconfig/merge.go
@@ -0,0 +1,119 @@
+package runconfig
+
+import (
+	"github.com/dotcloud/docker/nat"
+	"github.com/dotcloud/docker/utils"
+	"strings"
+)
+
+func Merge(userConf, imageConf *Config) error {
+	if userConf.User == "" {
+		userConf.User = imageConf.User
+	}
+	if userConf.Memory == 0 {
+		userConf.Memory = imageConf.Memory
+	}
+	if userConf.MemorySwap == 0 {
+		userConf.MemorySwap = imageConf.MemorySwap
+	}
+	if userConf.CpuShares == 0 {
+		userConf.CpuShares = imageConf.CpuShares
+	}
+	if userConf.ExposedPorts == nil || len(userConf.ExposedPorts) == 0 {
+		userConf.ExposedPorts = imageConf.ExposedPorts
+	} else if imageConf.ExposedPorts != nil {
+		if userConf.ExposedPorts == nil {
+			userConf.ExposedPorts = make(nat.PortSet)
+		}
+		for port := range imageConf.ExposedPorts {
+			if _, exists := userConf.ExposedPorts[port]; !exists {
+				userConf.ExposedPorts[port] = struct{}{}
+			}
+		}
+	}
+
+	if userConf.PortSpecs != nil && len(userConf.PortSpecs) > 0 {
+		if userConf.ExposedPorts == nil {
+			userConf.ExposedPorts = make(nat.PortSet)
+		}
+		ports, _, err := nat.ParsePortSpecs(userConf.PortSpecs)
+		if err != nil {
+			return err
+		}
+		for port := range ports {
+			if _, exists := userConf.ExposedPorts[port]; !exists {
+				userConf.ExposedPorts[port] = struct{}{}
+			}
+		}
+		userConf.PortSpecs = nil
+	}
+	if imageConf.PortSpecs != nil && len(imageConf.PortSpecs) > 0 {
+		// FIXME: I think we can safely remove this. Leaving it for now for the sake of reverse-compat paranoia.
+		utils.Debugf("Migrating image port specs to containter: %s", strings.Join(imageConf.PortSpecs, ", "))
+		if userConf.ExposedPorts == nil {
+			userConf.ExposedPorts = make(nat.PortSet)
+		}
+
+		ports, _, err := nat.ParsePortSpecs(imageConf.PortSpecs)
+		if err != nil {
+			return err
+		}
+		for port := range ports {
+			if _, exists := userConf.ExposedPorts[port]; !exists {
+				userConf.ExposedPorts[port] = struct{}{}
+			}
+		}
+	}
+	if !userConf.Tty {
+		userConf.Tty = imageConf.Tty
+	}
+	if !userConf.OpenStdin {
+		userConf.OpenStdin = imageConf.OpenStdin
+	}
+	if !userConf.StdinOnce {
+		userConf.StdinOnce = imageConf.StdinOnce
+	}
+	if userConf.Env == nil || len(userConf.Env) == 0 {
+		userConf.Env = imageConf.Env
+	} else {
+		for _, imageEnv := range imageConf.Env {
+			found := false
+			imageEnvKey := strings.Split(imageEnv, "=")[0]
+			for _, userEnv := range userConf.Env {
+				userEnvKey := strings.Split(userEnv, "=")[0]
+				if imageEnvKey == userEnvKey {
+					found = true
+				}
+			}
+			if !found {
+				userConf.Env = append(userConf.Env, imageEnv)
+			}
+		}
+	}
+	if userConf.Cmd == nil || len(userConf.Cmd) == 0 {
+		userConf.Cmd = imageConf.Cmd
+	}
+	if userConf.Dns == nil || len(userConf.Dns) == 0 {
+		userConf.Dns = imageConf.Dns
+	} else {
+		//duplicates aren't an issue here
+		userConf.Dns = append(userConf.Dns, imageConf.Dns...)
+	}
+	if userConf.Entrypoint == nil || len(userConf.Entrypoint) == 0 {
+		userConf.Entrypoint = imageConf.Entrypoint
+	}
+	if userConf.WorkingDir == "" {
+		userConf.WorkingDir = imageConf.WorkingDir
+	}
+	if userConf.VolumesFrom == "" {
+		userConf.VolumesFrom = imageConf.VolumesFrom
+	}
+	if userConf.Volumes == nil || len(userConf.Volumes) == 0 {
+		userConf.Volumes = imageConf.Volumes
+	} else {
+		for k, v := range imageConf.Volumes {
+			userConf.Volumes[k] = v
+		}
+	}
+	return nil
+}
diff --git a/components/engine/runconfig/parse.go b/components/engine/runconfig/parse.go
new file mode 100644
index 0000000000..fb08c068b2
--- /dev/null
+++ b/components/engine/runconfig/parse.go
@@ -0,0 +1,246 @@
+package runconfig
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/nat"
+	flag "github.com/dotcloud/docker/pkg/mflag"
+	"github.com/dotcloud/docker/pkg/opts"
+	"github.com/dotcloud/docker/pkg/sysinfo"
+	"github.com/dotcloud/docker/utils"
+	"io/ioutil"
+	"path"
+	"strings"
+)
+
+var (
+	ErrInvalidWorikingDirectory = fmt.Errorf("The working directory is invalid. It needs to be an absolute path.")
+	ErrConflictAttachDetach     = fmt.Errorf("Conflicting options: -a and -d")
+	ErrConflictDetachAutoRemove = fmt.Errorf("Conflicting options: -rm and -d")
+)
+
+//FIXME Only used in tests
+func Parse(args []string, sysInfo *sysinfo.SysInfo) (*Config, *HostConfig, *flag.FlagSet, error) {
+	cmd := flag.NewFlagSet("run", flag.ContinueOnError)
+	cmd.SetOutput(ioutil.Discard)
+	cmd.Usage = nil
+	return parseRun(cmd, args, sysInfo)
+}
+
+// FIXME: this maps the legacy commands.go code. It should be merged with Parse to only expose a single parse function.
+func ParseSubcommand(cmd *flag.FlagSet, args []string, sysInfo *sysinfo.SysInfo) (*Config, *HostConfig, *flag.FlagSet, error) {
+	return parseRun(cmd, args, sysInfo)
+}
+
+func parseRun(cmd *flag.FlagSet, args []string, sysInfo *sysinfo.SysInfo) (*Config, *HostConfig, *flag.FlagSet, error) {
+	var (
+		// FIXME: use utils.ListOpts for attach and volumes?
+		flAttach  = opts.NewListOpts(opts.ValidateAttach)
+		flVolumes = opts.NewListOpts(opts.ValidatePath)
+		flLinks   = opts.NewListOpts(opts.ValidateLink)
+		flEnv     = opts.NewListOpts(opts.ValidateEnv)
+
+		flPublish     opts.ListOpts
+		flExpose      opts.ListOpts
+		flDns         opts.ListOpts
+		flVolumesFrom opts.ListOpts
+		flLxcOpts     opts.ListOpts
+
+		flAutoRemove      = cmd.Bool([]string{"#rm", "-rm"}, false, "Automatically remove the container when it exits (incompatible with -d)")
+		flDetach          = cmd.Bool([]string{"d", "-detach"}, false, "Detached mode: Run container in the background, print new container id")
+		flNetwork         = cmd.Bool([]string{"n", "-networking"}, true, "Enable networking for this container")
+		flPrivileged      = cmd.Bool([]string{"#privileged", "-privileged"}, false, "Give extended privileges to this container")
+		flPublishAll      = cmd.Bool([]string{"P", "-publish-all"}, false, "Publish all exposed ports to the host interfaces")
+		flStdin           = cmd.Bool([]string{"i", "-interactive"}, false, "Keep stdin open even if not attached")
+		flTty             = cmd.Bool([]string{"t", "-tty"}, false, "Allocate a pseudo-tty")
+		flContainerIDFile = cmd.String([]string{"#cidfile", "-cidfile"}, "", "Write the container ID to the file")
+		flEntrypoint      = cmd.String([]string{"#entrypoint", "-entrypoint"}, "", "Overwrite the default entrypoint of the image")
+		flHostname        = cmd.String([]string{"h", "-hostname"}, "", "Container host name")
+		flMemoryString    = cmd.String([]string{"m", "-memory"}, "", "Memory limit (format: <number><optional unit>, where unit = b, k, m or g)")
+		flUser            = cmd.String([]string{"u", "-user"}, "", "Username or UID")
+		flWorkingDir      = cmd.String([]string{"w", "-workdir"}, "", "Working directory inside the container")
+		flCpuShares       = cmd.Int64([]string{"c", "-cpu-shares"}, 0, "CPU shares (relative weight)")
+
+		// For documentation purpose
+		_ = cmd.Bool([]string{"#sig-proxy", "-sig-proxy"}, true, "Proxify all received signal to the process (even in non-tty mode)")
+		_ = cmd.String([]string{"#name", "-name"}, "", "Assign a name to the container")
+	)
+
+	cmd.Var(&flAttach, []string{"a", "-attach"}, "Attach to stdin, stdout or stderr.")
+	cmd.Var(&flVolumes, []string{"v", "-volume"}, "Bind mount a volume (e.g. from the host: -v /host:/container, from docker: -v /container)")
+	cmd.Var(&flLinks, []string{"#link", "-link"}, "Add link to another container (name:alias)")
+	cmd.Var(&flEnv, []string{"e", "-env"}, "Set environment variables")
+
+	cmd.Var(&flPublish, []string{"p", "-publish"}, fmt.Sprintf("Publish a container's port to the host (format: %s) (use 'docker port' to see the actual mapping)", nat.PortSpecTemplateFormat))
+	cmd.Var(&flExpose, []string{"#expose", "-expose"}, "Expose a port from the container without publishing it to your host")
+	cmd.Var(&flDns, []string{"#dns", "-dns"}, "Set custom dns servers")
+	cmd.Var(&flVolumesFrom, []string{"#volumes-from", "-volumes-from"}, "Mount volumes from the specified container(s)")
+	cmd.Var(&flLxcOpts, []string{"#lxc-conf", "-lxc-conf"}, "Add custom lxc options -lxc-conf=\"lxc.cgroup.cpuset.cpus = 0,1\"")
+
+	if err := cmd.Parse(args); err != nil {
+		return nil, nil, cmd, err
+	}
+
+	// Check if the kernel supports memory limit cgroup.
+	if sysInfo != nil && *flMemoryString != "" && !sysInfo.MemoryLimit {
+		*flMemoryString = ""
+	}
+
+	// Validate input params
+	if *flDetach && flAttach.Len() > 0 {
+		return nil, nil, cmd, ErrConflictAttachDetach
+	}
+	if *flWorkingDir != "" && !path.IsAbs(*flWorkingDir) {
+		return nil, nil, cmd, ErrInvalidWorikingDirectory
+	}
+	if *flDetach && *flAutoRemove {
+		return nil, nil, cmd, ErrConflictDetachAutoRemove
+	}
+
+	// If neither -d or -a are set, attach to everything by default
+	if flAttach.Len() == 0 && !*flDetach {
+		if !*flDetach {
+			flAttach.Set("stdout")
+			flAttach.Set("stderr")
+			if *flStdin {
+				flAttach.Set("stdin")
+			}
+		}
+	}
+
+	var flMemory int64
+	if *flMemoryString != "" {
+		parsedMemory, err := utils.RAMInBytes(*flMemoryString)
+		if err != nil {
+			return nil, nil, cmd, err
+		}
+		flMemory = parsedMemory
+	}
+
+	var binds []string
+	// add any bind targets to the list of container volumes
+	for bind := range flVolumes.GetMap() {
+		if arr := strings.Split(bind, ":"); len(arr) > 1 {
+			if arr[0] == "/" {
+				return nil, nil, cmd, fmt.Errorf("Invalid bind mount: source can't be '/'")
+			}
+			dstDir := arr[1]
+			flVolumes.Set(dstDir)
+			binds = append(binds, bind)
+			flVolumes.Delete(bind)
+		} else if bind == "/" {
+			return nil, nil, cmd, fmt.Errorf("Invalid volume: path can't be '/'")
+		}
+	}
+
+	var (
+		parsedArgs = cmd.Args()
+		runCmd     []string
+		entrypoint []string
+		image      string
+	)
+	if len(parsedArgs) >= 1 {
+		image = cmd.Arg(0)
+	}
+	if len(parsedArgs) > 1 {
+		runCmd = parsedArgs[1:]
+	}
+	if *flEntrypoint != "" {
+		entrypoint = []string{*flEntrypoint}
+	}
+
+	lxcConf, err := parseLxcConfOpts(flLxcOpts)
+	if err != nil {
+		return nil, nil, cmd, err
+	}
+
+	var (
+		domainname string
+		hostname   = *flHostname
+		parts      = strings.SplitN(hostname, ".", 2)
+	)
+	if len(parts) > 1 {
+		hostname = parts[0]
+		domainname = parts[1]
+	}
+
+	ports, portBindings, err := nat.ParsePortSpecs(flPublish.GetAll())
+	if err != nil {
+		return nil, nil, cmd, err
+	}
+
+	// Merge in exposed ports to the map of published ports
+	for _, e := range flExpose.GetAll() {
+		if strings.Contains(e, ":") {
+			return nil, nil, cmd, fmt.Errorf("Invalid port format for --expose: %s", e)
+		}
+		p := nat.NewPort(nat.SplitProtoPort(e))
+		if _, exists := ports[p]; !exists {
+			ports[p] = struct{}{}
+		}
+	}
+
+	config := &Config{
+		Hostname:        hostname,
+		Domainname:      domainname,
+		PortSpecs:       nil, // Deprecated
+		ExposedPorts:    ports,
+		User:            *flUser,
+		Tty:             *flTty,
+		NetworkDisabled: !*flNetwork,
+		OpenStdin:       *flStdin,
+		Memory:          flMemory,
+		CpuShares:       *flCpuShares,
+		AttachStdin:     flAttach.Get("stdin"),
+		AttachStdout:    flAttach.Get("stdout"),
+		AttachStderr:    flAttach.Get("stderr"),
+		Env:             flEnv.GetAll(),
+		Cmd:             runCmd,
+		Dns:             flDns.GetAll(),
+		Image:           image,
+		Volumes:         flVolumes.GetMap(),
+		VolumesFrom:     strings.Join(flVolumesFrom.GetAll(), ","),
+		Entrypoint:      entrypoint,
+		WorkingDir:      *flWorkingDir,
+	}
+
+	hostConfig := &HostConfig{
+		Binds:           binds,
+		ContainerIDFile: *flContainerIDFile,
+		LxcConf:         lxcConf,
+		Privileged:      *flPrivileged,
+		PortBindings:    portBindings,
+		Links:           flLinks.GetAll(),
+		PublishAllPorts: *flPublishAll,
+	}
+
+	if sysInfo != nil && flMemory > 0 && !sysInfo.SwapLimit {
+		//fmt.Fprintf(stdout, "WARNING: Your kernel does not support swap limit capabilities. Limitation discarded.\n")
+		config.MemorySwap = -1
+	}
+
+	// When allocating stdin in attached mode, close stdin at client disconnect
+	if config.OpenStdin && config.AttachStdin {
+		config.StdinOnce = true
+	}
+	return config, hostConfig, cmd, nil
+}
+
+func parseLxcConfOpts(opts opts.ListOpts) ([]KeyValuePair, error) {
+	out := make([]KeyValuePair, opts.Len())
+	for i, o := range opts.GetAll() {
+		k, v, err := parseLxcOpt(o)
+		if err != nil {
+			return nil, err
+		}
+		out[i] = KeyValuePair{Key: k, Value: v}
+	}
+	return out, nil
+}
+
+func parseLxcOpt(opt string) (string, string, error) {
+	parts := strings.SplitN(opt, "=", 2)
+	if len(parts) != 2 {
+		return "", "", fmt.Errorf("Unable to parse lxc conf option: %s", opt)
+	}
+	return strings.TrimSpace(parts[0]), strings.TrimSpace(parts[1]), nil
+}
diff --git a/components/engine/runconfig/parse_test.go b/components/engine/runconfig/parse_test.go
new file mode 100644
index 0000000000..2b89e88ec3
--- /dev/null
+++ b/components/engine/runconfig/parse_test.go
@@ -0,0 +1,22 @@
+package runconfig
+
+import (
+	"testing"
+)
+
+func TestParseLxcConfOpt(t *testing.T) {
+	opts := []string{"lxc.utsname=docker", "lxc.utsname = docker "}
+
+	for _, o := range opts {
+		k, v, err := parseLxcOpt(o)
+		if err != nil {
+			t.FailNow()
+		}
+		if k != "lxc.utsname" {
+			t.Fail()
+		}
+		if v != "docker" {
+			t.Fail()
+		}
+	}
+}
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index cec5444090..828d3f0e66 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -18,6 +18,7 @@ import (
 	"github.com/dotcloud/docker/networkdriver/portallocator"
 	"github.com/dotcloud/docker/pkg/graphdb"
 	"github.com/dotcloud/docker/pkg/sysinfo"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"io/ioutil"
@@ -329,7 +330,7 @@ func (runtime *Runtime) restore() error {
 }
 
 // Create creates a new container from the given configuration with a given name.
-func (runtime *Runtime) Create(config *Config, name string) (*Container, []string, error) {
+func (runtime *Runtime) Create(config *runconfig.Config, name string) (*Container, []string, error) {
 	// Lookup image
 	img, err := runtime.repositories.LookupImage(config.Image)
 	if err != nil {
@@ -347,7 +348,7 @@ func (runtime *Runtime) Create(config *Config, name string) (*Container, []strin
 		return nil, nil, fmt.Errorf("Cannot create container with more than %d parents", MaxImageDepth)
 	}
 
-	checkDeprecatedExpose := func(config *Config) bool {
+	checkDeprecatedExpose := func(config *runconfig.Config) bool {
 		if config != nil {
 			if config.PortSpecs != nil {
 				for _, p := range config.PortSpecs {
@@ -366,7 +367,7 @@ func (runtime *Runtime) Create(config *Config, name string) (*Container, []strin
 	}
 
 	if img.Config != nil {
-		if err := MergeConfig(config, img.Config); err != nil {
+		if err := runconfig.Merge(config, img.Config); err != nil {
 			return nil, nil, err
 		}
 	}
@@ -441,7 +442,7 @@ func (runtime *Runtime) Create(config *Config, name string) (*Container, []strin
 		Path:            entrypoint,
 		Args:            args, //FIXME: de-duplicate from config
 		Config:          config,
-		hostConfig:      &HostConfig{},
+		hostConfig:      &runconfig.HostConfig{},
 		Image:           img.ID, // Always use the resolved image id
 		NetworkSettings: &NetworkSettings{},
 		Name:            name,
@@ -518,7 +519,7 @@ func (runtime *Runtime) Create(config *Config, name string) (*Container, []strin
 
 // Commit creates a new filesystem image from the current state of a container.
 // The image can optionally be tagged into a repository
-func (runtime *Runtime) Commit(container *Container, repository, tag, comment, author string, config *Config) (*Image, error) {
+func (runtime *Runtime) Commit(container *Container, repository, tag, comment, author string, config *runconfig.Config) (*Image, error) {
 	// FIXME: freeze the container before copying it to avoid data corruption?
 	// FIXME: this shouldn't be in commands.
 	if err := container.Mount(); err != nil {
diff --git a/components/engine/server.go b/components/engine/server.go
index cb677266e5..7c60f29378 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -10,6 +10,7 @@ import (
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/pkg/graphdb"
 	"github.com/dotcloud/docker/registry"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
 	"io/ioutil"
@@ -662,7 +663,7 @@ func (srv *Server) ImageInsert(job *engine.Job) engine.Status {
 	}
 	defer file.Body.Close()
 
-	config, _, _, err := ParseRun([]string{img.ID, "echo", "insert", url, path}, srv.runtime.sysInfo)
+	config, _, _, err := runconfig.Parse([]string{img.ID, "echo", "insert", url, path}, srv.runtime.sysInfo)
 	if err != nil {
 		return job.Error(err)
 	}
@@ -1043,7 +1044,7 @@ func (srv *Server) ContainerCommit(job *engine.Job) engine.Status {
 	if container == nil {
 		return job.Errorf("No such container: %s", name)
 	}
-	var config Config
+	var config runconfig.Config
 	if err := job.GetenvJson("config", &config); err != nil {
 		return job.Error(err)
 	}
@@ -1623,7 +1624,7 @@ func (srv *Server) ContainerCreate(job *engine.Job) engine.Status {
 	} else if len(job.Args) > 1 {
 		return job.Errorf("Usage: %s", job.Name)
 	}
-	config := ContainerConfigFromJob(job)
+	config := runconfig.ContainerConfigFromJob(job)
 	if config.Memory != 0 && config.Memory < 524288 {
 		return job.Errorf("Minimum memory limit allowed is 512k")
 	}
@@ -1989,7 +1990,7 @@ func (srv *Server) canDeleteImage(imgID string) error {
 	return nil
 }
 
-func (srv *Server) ImageGetCached(imgID string, config *Config) (*Image, error) {
+func (srv *Server) ImageGetCached(imgID string, config *runconfig.Config) (*Image, error) {
 
 	// Retrieve all images
 	images, err := srv.runtime.graph.Map()
@@ -2013,7 +2014,7 @@ func (srv *Server) ImageGetCached(imgID string, config *Config) (*Image, error)
 		if err != nil {
 			return nil, err
 		}
-		if CompareConfig(&img.ContainerConfig, config) {
+		if runconfig.Compare(&img.ContainerConfig, config) {
 			if match == nil || match.Created.Before(img.Created) {
 				match = img
 			}
@@ -2022,7 +2023,7 @@ func (srv *Server) ImageGetCached(imgID string, config *Config) (*Image, error)
 	return match, nil
 }
 
-func (srv *Server) RegisterLinks(container *Container, hostConfig *HostConfig) error {
+func (srv *Server) RegisterLinks(container *Container, hostConfig *runconfig.HostConfig) error {
 	runtime := srv.runtime
 
 	if hostConfig != nil && hostConfig.Links != nil {
@@ -2066,7 +2067,7 @@ func (srv *Server) ContainerStart(job *engine.Job) engine.Status {
 	}
 	// If no environment was set, then no hostconfig was passed.
 	if len(job.Environ()) > 0 {
-		hostConfig := ContainerHostConfigFromJob(job)
+		hostConfig := runconfig.ContainerHostConfigFromJob(job)
 		// Validate the HostConfig binds. Make sure that:
 		// 1) the source of a bind mount isn't /
 		//         The bind mount "/:/foo" isn't allowed.
@@ -2310,7 +2311,7 @@ func (srv *Server) JobInspect(job *engine.Job) engine.Status {
 		}
 		object = &struct {
 			*Container
-			HostConfig *HostConfig
+			HostConfig *runconfig.HostConfig
 		}{container, container.hostConfig}
 	default:
 		return job.Errorf("Unknown kind: %s", kind)
diff --git a/components/engine/utils.go b/components/engine/utils.go
index e3a58cc67e..68cd2f24e5 100644
--- a/components/engine/utils.go
+++ b/components/engine/utils.go
@@ -1,14 +1,12 @@
 package docker
 
 import (
-	"fmt"
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/nat"
 	"github.com/dotcloud/docker/pkg/namesgenerator"
-	"github.com/dotcloud/docker/pkg/opts"
+	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
-	"strings"
 	"sync/atomic"
 )
 
@@ -16,204 +14,7 @@ type Change struct {
 	archive.Change
 }
 
-// Compare two Config struct. Do not compare the "Image" nor "Hostname" fields
-// If OpenStdin is set, then it differs
-func CompareConfig(a, b *Config) bool {
-	if a == nil || b == nil ||
-		a.OpenStdin || b.OpenStdin {
-		return false
-	}
-	if a.AttachStdout != b.AttachStdout ||
-		a.AttachStderr != b.AttachStderr ||
-		a.User != b.User ||
-		a.Memory != b.Memory ||
-		a.MemorySwap != b.MemorySwap ||
-		a.CpuShares != b.CpuShares ||
-		a.OpenStdin != b.OpenStdin ||
-		a.Tty != b.Tty ||
-		a.VolumesFrom != b.VolumesFrom {
-		return false
-	}
-	if len(a.Cmd) != len(b.Cmd) ||
-		len(a.Dns) != len(b.Dns) ||
-		len(a.Env) != len(b.Env) ||
-		len(a.PortSpecs) != len(b.PortSpecs) ||
-		len(a.ExposedPorts) != len(b.ExposedPorts) ||
-		len(a.Entrypoint) != len(b.Entrypoint) ||
-		len(a.Volumes) != len(b.Volumes) {
-		return false
-	}
-
-	for i := 0; i < len(a.Cmd); i++ {
-		if a.Cmd[i] != b.Cmd[i] {
-			return false
-		}
-	}
-	for i := 0; i < len(a.Dns); i++ {
-		if a.Dns[i] != b.Dns[i] {
-			return false
-		}
-	}
-	for i := 0; i < len(a.Env); i++ {
-		if a.Env[i] != b.Env[i] {
-			return false
-		}
-	}
-	for i := 0; i < len(a.PortSpecs); i++ {
-		if a.PortSpecs[i] != b.PortSpecs[i] {
-			return false
-		}
-	}
-	for k := range a.ExposedPorts {
-		if _, exists := b.ExposedPorts[k]; !exists {
-			return false
-		}
-	}
-	for i := 0; i < len(a.Entrypoint); i++ {
-		if a.Entrypoint[i] != b.Entrypoint[i] {
-			return false
-		}
-	}
-	for key := range a.Volumes {
-		if _, exists := b.Volumes[key]; !exists {
-			return false
-		}
-	}
-	return true
-}
-
-func MergeConfig(userConf, imageConf *Config) error {
-	if userConf.User == "" {
-		userConf.User = imageConf.User
-	}
-	if userConf.Memory == 0 {
-		userConf.Memory = imageConf.Memory
-	}
-	if userConf.MemorySwap == 0 {
-		userConf.MemorySwap = imageConf.MemorySwap
-	}
-	if userConf.CpuShares == 0 {
-		userConf.CpuShares = imageConf.CpuShares
-	}
-	if userConf.ExposedPorts == nil || len(userConf.ExposedPorts) == 0 {
-		userConf.ExposedPorts = imageConf.ExposedPorts
-	} else if imageConf.ExposedPorts != nil {
-		if userConf.ExposedPorts == nil {
-			userConf.ExposedPorts = make(nat.PortSet)
-		}
-		for port := range imageConf.ExposedPorts {
-			if _, exists := userConf.ExposedPorts[port]; !exists {
-				userConf.ExposedPorts[port] = struct{}{}
-			}
-		}
-	}
-
-	if userConf.PortSpecs != nil && len(userConf.PortSpecs) > 0 {
-		if userConf.ExposedPorts == nil {
-			userConf.ExposedPorts = make(nat.PortSet)
-		}
-		ports, _, err := nat.ParsePortSpecs(userConf.PortSpecs)
-		if err != nil {
-			return err
-		}
-		for port := range ports {
-			if _, exists := userConf.ExposedPorts[port]; !exists {
-				userConf.ExposedPorts[port] = struct{}{}
-			}
-		}
-		userConf.PortSpecs = nil
-	}
-	if imageConf.PortSpecs != nil && len(imageConf.PortSpecs) > 0 {
-		utils.Debugf("Migrating image port specs to containter: %s", strings.Join(imageConf.PortSpecs, ", "))
-		if userConf.ExposedPorts == nil {
-			userConf.ExposedPorts = make(nat.PortSet)
-		}
-
-		ports, _, err := nat.ParsePortSpecs(imageConf.PortSpecs)
-		if err != nil {
-			return err
-		}
-		for port := range ports {
-			if _, exists := userConf.ExposedPorts[port]; !exists {
-				userConf.ExposedPorts[port] = struct{}{}
-			}
-		}
-	}
-	if !userConf.Tty {
-		userConf.Tty = imageConf.Tty
-	}
-	if !userConf.OpenStdin {
-		userConf.OpenStdin = imageConf.OpenStdin
-	}
-	if !userConf.StdinOnce {
-		userConf.StdinOnce = imageConf.StdinOnce
-	}
-	if userConf.Env == nil || len(userConf.Env) == 0 {
-		userConf.Env = imageConf.Env
-	} else {
-		for _, imageEnv := range imageConf.Env {
-			found := false
-			imageEnvKey := strings.Split(imageEnv, "=")[0]
-			for _, userEnv := range userConf.Env {
-				userEnvKey := strings.Split(userEnv, "=")[0]
-				if imageEnvKey == userEnvKey {
-					found = true
-				}
-			}
-			if !found {
-				userConf.Env = append(userConf.Env, imageEnv)
-			}
-		}
-	}
-	if userConf.Cmd == nil || len(userConf.Cmd) == 0 {
-		userConf.Cmd = imageConf.Cmd
-	}
-	if userConf.Dns == nil || len(userConf.Dns) == 0 {
-		userConf.Dns = imageConf.Dns
-	} else {
-		//duplicates aren't an issue here
-		userConf.Dns = append(userConf.Dns, imageConf.Dns...)
-	}
-	if userConf.Entrypoint == nil || len(userConf.Entrypoint) == 0 {
-		userConf.Entrypoint = imageConf.Entrypoint
-	}
-	if userConf.WorkingDir == "" {
-		userConf.WorkingDir = imageConf.WorkingDir
-	}
-	if userConf.VolumesFrom == "" {
-		userConf.VolumesFrom = imageConf.VolumesFrom
-	}
-	if userConf.Volumes == nil || len(userConf.Volumes) == 0 {
-		userConf.Volumes = imageConf.Volumes
-	} else {
-		for k, v := range imageConf.Volumes {
-			userConf.Volumes[k] = v
-		}
-	}
-	return nil
-}
-
-func parseLxcConfOpts(opts opts.ListOpts) ([]KeyValuePair, error) {
-	out := make([]KeyValuePair, opts.Len())
-	for i, o := range opts.GetAll() {
-		k, v, err := parseLxcOpt(o)
-		if err != nil {
-			return nil, err
-		}
-		out[i] = KeyValuePair{Key: k, Value: v}
-	}
-	return out, nil
-}
-
-func parseLxcOpt(opt string) (string, string, error) {
-	parts := strings.SplitN(opt, "=", 2)
-	if len(parts) != 2 {
-		return "", "", fmt.Errorf("Unable to parse lxc conf option: %s", opt)
-	}
-	return strings.TrimSpace(parts[0]), strings.TrimSpace(parts[1]), nil
-}
-
-func migratePortMappings(config *Config, hostConfig *HostConfig) error {
+func migratePortMappings(config *runconfig.Config, hostConfig *runconfig.HostConfig) error {
 	if config.PortSpecs != nil {
 		ports, bindings, err := nat.ParsePortSpecs(config.PortSpecs)
 		if err != nil {
@@ -222,7 +23,7 @@ func migratePortMappings(config *Config, hostConfig *HostConfig) error {
 		config.PortSpecs = nil
 		if len(bindings) > 0 {
 			if hostConfig == nil {
-				hostConfig = &HostConfig{}
+				hostConfig = &runconfig.HostConfig{}
 			}
 			hostConfig.PortBindings = bindings
 		}

From 3648d21c65db28b2bdade852e34cf677f6b773cf Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Wed, 12 Feb 2014 16:30:18 +1000
Subject: [PATCH 067/403] tell the reader that they need git and make for this
 tutorial

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: d9f215eb2a48e6e836af9cc4015c73f17dc5be9e
Component: engine
---
 .../docs/sources/contributing/devenvironment.rst | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/components/engine/docs/sources/contributing/devenvironment.rst b/components/engine/docs/sources/contributing/devenvironment.rst
index 6675173584..cab4c71afb 100644
--- a/components/engine/docs/sources/contributing/devenvironment.rst
+++ b/components/engine/docs/sources/contributing/devenvironment.rst
@@ -24,7 +24,17 @@ a working, up-to-date docker installation, then continue to the next
 step.
 
 
-Step 2: Check out the Source
+Step 2: Install tools used for this tutorial
+--------------------------------------------
+
+Install ``git``; honest, it's very good. You can use other ways to get the Docker
+source, but they're not anywhere near as easy.
+
+Install ``make``. This tutorial uses our base Makefile to kick off the docker
+containers in a repeatable and consistent way. Again, you can do it in other ways
+but you need to do more work.
+
+Step 3: Check out the Source
 ----------------------------
 
 .. code-block:: bash
@@ -35,7 +45,7 @@ Step 2: Check out the Source
 To checkout a different revision just use ``git checkout`` with the name of branch or revision number.
 
 
-Step 3: Build the Environment
+Step 4: Build the Environment
 -----------------------------
 
 This following command will build a development environment using the Dockerfile in the current directory. Essentially, it will install all the build and runtime dependencies necessary to build and test Docker. This command will take some time to complete when you first execute it.
@@ -48,7 +58,7 @@ If the build is successful, congratulations! You have produced a clean build of
 docker, neatly encapsulated in a standard build environment. 
 
 
-Step 4: Build the Docker Binary
+Step 5: Build the Docker Binary
 -------------------------------
 
 To create the Docker binary, run this command:

From bcb95a48949644bad3fbe3ed201894bf4cf2d429 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Wed, 12 Feb 2014 04:09:56 -0800
Subject: [PATCH 068/403] Implement create veth

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 2d2c237f50b7954993f6cd1db67c6f8c6d06f881
Component: engine
---
 .../engine/pkg/netlink/netlink_linux.go       | 84 ++++++++++++-------
 1 file changed, 53 insertions(+), 31 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 23dba0c884..b16dec0612 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -142,29 +142,61 @@ func rtaAlignOf(attrlen int) int {
 
 type RtAttr struct {
 	syscall.RtAttr
-	Data []byte
+	Data     []byte
+	children []*RtAttr
+	prefix   int
 }
 
 func newRtAttr(attrType int, data []byte) *RtAttr {
-	attr := &RtAttr{}
+	attr := &RtAttr{
+		children: []*RtAttr{},
+	}
 	attr.Type = uint16(attrType)
 	attr.Data = data
 
 	return attr
 }
 
-func (attr *RtAttr) ToWireFormat() []byte {
+func newRtAttrChild(parent *RtAttr, attrType int, data []byte) *RtAttr {
+	attr := newRtAttr(attrType, data)
+	parent.children = append(parent.children, attr)
+	return attr
+}
+
+func (a *RtAttr) length() int {
+	l := 0
+	for _, child := range a.children {
+		l += child.length() + syscall.SizeofRtAttr + child.prefix
+	}
+	if l == 0 {
+		l++
+	}
+	return rtaAlignOf(l + len(a.Data))
+}
+
+func (a *RtAttr) ToWireFormat() []byte {
 	native := nativeEndian()
 
-	len := syscall.SizeofRtAttr + len(attr.Data)
-	b := make([]byte, rtaAlignOf(len))
-	native.PutUint16(b[0:2], uint16(len))
-	native.PutUint16(b[2:4], attr.Type)
-	for i, d := range attr.Data {
-		b[4+i] = d
+	length := a.length()
+	buf := make([]byte, rtaAlignOf(length+syscall.SizeofRtAttr))
+
+	if a.Data != nil {
+		copy(buf[4:], a.Data)
+	} else {
+		next := 4
+		for _, child := range a.children {
+			childBuf := child.ToWireFormat()
+			copy(buf[next+child.prefix:], childBuf)
+			next += rtaAlignOf(len(childBuf))
+		}
 	}
 
-	return b
+	if l := uint16(rtaAlignOf(length)); l != 0 {
+		native.PutUint16(buf[0:2], l+1)
+	}
+	native.PutUint16(buf[2:4], a.Type)
+
+	return buf
 }
 
 type NetlinkRequest struct {
@@ -501,12 +533,7 @@ func NetworkLinkAddIp(iface *net.Interface, ip net.IP, ipNet *net.IPNet) error {
 }
 
 func zeroTerminated(s string) []byte {
-	bytes := make([]byte, len(s)+1)
-	for i := 0; i < len(s); i++ {
-		bytes[i] = s[i]
-	}
-	bytes[len(s)] = 0
-	return bytes
+	return []byte(s + "\000")
 }
 
 func nonZeroTerminated(s string) []byte {
@@ -697,24 +724,19 @@ func NetworkCreateVethPair(name1, name2 string) error {
 	msg := newIfInfomsg(syscall.AF_UNSPEC)
 	wb.AddData(msg)
 
-	kindData := newRtAttr(IFLA_INFO_KIND, nonZeroTerminated("veth"))
-	info := newRtAttr(syscall.IFLA_LINKINFO, kindData.ToWireFormat())
-	//	wb.AddData(info)
-
-	peerName := newRtAttr(syscall.IFLA_IFNAME, nonZeroTerminated(name2))
-	peer := newRtAttr(VETH_PEER, peerName.ToWireFormat())
-	//	wb.AddData(peer)
-
-	b := []byte{}
-	b = append(b, peer.ToWireFormat()...)
-	b = append(b, info.ToWireFormat()...)
-
-	infoData := newRtAttr(IFLA_INFO_DATA, b)
-	wb.AddData(infoData)
-
 	nameData := newRtAttr(syscall.IFLA_IFNAME, zeroTerminated(name1))
 	wb.AddData(nameData)
 
+	nest1 := newRtAttr(syscall.IFLA_LINKINFO, nil)
+	newRtAttrChild(nest1, IFLA_INFO_KIND, zeroTerminated("veth"))
+	nest2 := newRtAttrChild(nest1, IFLA_INFO_DATA, nil)
+	nest3 := newRtAttrChild(nest2, VETH_PEER, nil)
+
+	last := newRtAttrChild(nest3, syscall.IFLA_IFNAME, zeroTerminated(name2))
+	last.prefix = syscall.SizeofIfInfomsg
+
+	wb.AddData(nest1)
+
 	if err := s.Send(wb); err != nil {
 		return err
 	}

From 8f6a38f17aadef2cb5a5a0346a4eda9a47facb5d Mon Sep 17 00:00:00 2001
From: "Chris St. Pierre" <chris.a.st.pierre@gmail.com>
Date: Wed, 12 Feb 2014 08:02:36 -0500
Subject: [PATCH 069/403] Fix bogus variable reference in mkimage-yum.sh

Fixes this: https://github.com/dotcloud/docker/commit/d419da7227826e84e9375ece4fd9d4978a42cbf7#commitcomment-5344982

Docker-DCO-1.1-Signed-off-by: Chris St. Pierre <chris.a.st.pierre@gmail.com> (github: stpierre)
Upstream-commit: 85263cdee894d1f1e3bca21a8d18264ef530c4d5
Component: engine
---
 components/engine/contrib/mkimage-yum.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/contrib/mkimage-yum.sh b/components/engine/contrib/mkimage-yum.sh
index 54e99f1f04..d7ffdc1902 100755
--- a/components/engine/contrib/mkimage-yum.sh
+++ b/components/engine/contrib/mkimage-yum.sh
@@ -51,7 +51,7 @@ done
 
 yum -c "$yum_config" --installroot="$target" --setopt=tsflags=nodocs \
     --setopt=group_package_types=mandatory -y groupinstall Core
-yum -c "$yum_config" --installroot="$mount" -y clean all
+yum -c "$yum_config" --installroot="$target" -y clean all
 
 cat > "$target"/etc/sysconfig/network <<EOF
 NETWORKING=yes

From 22e2031a29b190755ea0613c80a64ccf52ec7f49 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Wed, 12 Feb 2014 16:02:53 +0100
Subject: [PATCH 070/403] Avoid extra mount/unmount during build

CmdRun() calls first run() and then wait() to wait for it to exit,
then it runs commit(). The run command will mount the container and
the container exiting will unmount it. Then the commit will
immediately mount it again to do a diff.

This seems minor, but this is actually problematic, as the Get/Put
pair will create a spurious mount/unmount cycle that is not needed and
slows things down. Additionally it will create a supurious
devicemapper activate/deactivate cycle that causes races with udev as
seen in https://github.com/dotcloud/docker/issues/4036.

To ensure that we only unmount once we split up run() into create()
and run() and reference the mount until after the commit().

With this change docker build on devicemapper is now race-free, and
slightly faster.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 59347fa66dfdd059c270a5f72e24320b4d0203ea
Component: engine
---
 components/engine/buildfile.go | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/components/engine/buildfile.go b/components/engine/buildfile.go
index a121276c21..3279fd6e25 100644
--- a/components/engine/buildfile.go
+++ b/components/engine/buildfile.go
@@ -180,11 +180,20 @@ func (b *buildFile) CmdRun(args string) error {
 		return nil
 	}
 
-	cid, err := b.run()
+	c, err := b.create()
 	if err != nil {
 		return err
 	}
-	if err := b.commit(cid, cmd, "run"); err != nil {
+	// Ensure that we keep the container mounted until the commit
+	// to avoid unmounting and then mounting directly again
+	c.Mount()
+	defer c.Unmount()
+
+	err = b.run(c)
+	if err != nil {
+		return err
+	}
+	if err := b.commit(c.ID, cmd, "run"); err != nil {
 		return err
 	}
 
@@ -555,16 +564,16 @@ func (sf *StderrFormater) Write(buf []byte) (int, error) {
 	return len(buf), err
 }
 
-func (b *buildFile) run() (string, error) {
+func (b *buildFile) create() (*Container, error) {
 	if b.image == "" {
-		return "", fmt.Errorf("Please provide a source image with `from` prior to run")
+		return nil, fmt.Errorf("Please provide a source image with `from` prior to run")
 	}
 	b.config.Image = b.image
 
 	// Create the container and start it
 	c, _, err := b.runtime.Create(b.config, "")
 	if err != nil {
-		return "", err
+		return nil, err
 	}
 	b.tmpContainers[c.ID] = struct{}{}
 	fmt.Fprintf(b.outStream, " ---> Running in %s\n", utils.TruncateID(c.ID))
@@ -573,6 +582,10 @@ func (b *buildFile) run() (string, error) {
 	c.Path = b.config.Cmd[0]
 	c.Args = b.config.Cmd[1:]
 
+	return c, nil
+}
+
+func (b *buildFile) run(c *Container) error {
 	var errCh chan error
 
 	if b.verbose {
@@ -583,12 +596,12 @@ func (b *buildFile) run() (string, error) {
 
 	//start the container
 	if err := c.Start(); err != nil {
-		return "", err
+		return err
 	}
 
 	if errCh != nil {
 		if err := <-errCh; err != nil {
-			return "", err
+			return err
 		}
 	}
 
@@ -598,10 +611,10 @@ func (b *buildFile) run() (string, error) {
 			Message: fmt.Sprintf("The command %v returned a non-zero code: %d", b.config.Cmd, ret),
 			Code:    ret,
 		}
-		return "", err
+		return err
 	}
 
-	return c.ID, nil
+	return nil
 }
 
 // Commit the container <id> with the autorun command <autoCmd>

From 68a1243dca3995e8c9966347bfda3c3f1854ed37 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Wed, 12 Feb 2014 09:29:06 -0800
Subject: [PATCH 071/403] Simplify code + Allow more generic attr children +
 remove prefix

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 38e5b4e70fb6b93aa2b86e4d625a0032b97b991a
Component: engine
---
 components/engine/pkg/netlink/netlink.go      |  10 +-
 .../engine/pkg/netlink/netlink_linux.go       | 131 ++++++++++--------
 2 files changed, 79 insertions(+), 62 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink.go b/components/engine/pkg/netlink/netlink.go
index 5098b4b816..5cc756256d 100644
--- a/components/engine/pkg/netlink/netlink.go
+++ b/components/engine/pkg/netlink/netlink.go
@@ -5,7 +5,15 @@
 // netlink_darwin.go
 package netlink
 
-import "net"
+import (
+	"errors"
+	"net"
+)
+
+var (
+	ErrWrongSockType = errors.New("Wrong socket type")
+	ErrShortResponse = errors.New("Got short response from netlink")
+)
 
 // A Route is a subnet associated with the interface to reach it.
 type Route struct {
diff --git a/components/engine/pkg/netlink/netlink_linux.go b/components/engine/pkg/netlink/netlink_linux.go
index 1f48a6425c..f8bb6bac3c 100644
--- a/components/engine/pkg/netlink/netlink_linux.go
+++ b/components/engine/pkg/netlink/netlink_linux.go
@@ -45,6 +45,7 @@ func getIpFamily(ip net.IP) int {
 }
 
 type NetlinkRequestData interface {
+	Len() int
 	ToWireFormat() []byte
 }
 
@@ -53,21 +54,24 @@ type IfInfomsg struct {
 }
 
 func newIfInfomsg(family int) *IfInfomsg {
-	msg := &IfInfomsg{}
-	msg.Family = uint8(family)
-	msg.Type = uint16(0)
-	msg.Index = int32(0)
-	msg.Flags = uint32(0)
-	msg.Change = uint32(0)
+	return &IfInfomsg{
+		IfInfomsg: syscall.IfInfomsg{
+			Family: uint8(family),
+		},
+	}
+}
 
+func newIfInfomsgChild(parent *RtAttr, family int) *IfInfomsg {
+	msg := newIfInfomsg(family)
+	parent.children = append(parent.children, msg)
 	return msg
 }
 
 func (msg *IfInfomsg) ToWireFormat() []byte {
 	native := nativeEndian()
 
-	len := syscall.SizeofIfInfomsg
-	b := make([]byte, len)
+	length := syscall.SizeofIfInfomsg
+	b := make([]byte, length)
 	b[0] = msg.Family
 	b[1] = 0
 	native.PutUint16(b[2:4], msg.Type)
@@ -77,26 +81,27 @@ func (msg *IfInfomsg) ToWireFormat() []byte {
 	return b
 }
 
+func (msg *IfInfomsg) Len() int {
+	return syscall.SizeofIfInfomsg
+}
+
 type IfAddrmsg struct {
 	syscall.IfAddrmsg
 }
 
 func newIfAddrmsg(family int) *IfAddrmsg {
-	msg := &IfAddrmsg{}
-	msg.Family = uint8(family)
-	msg.Prefixlen = uint8(0)
-	msg.Flags = uint8(0)
-	msg.Scope = uint8(0)
-	msg.Index = uint32(0)
-
-	return msg
+	return &IfAddrmsg{
+		IfAddrmsg: syscall.IfAddrmsg{
+			Family: uint8(family),
+		},
+	}
 }
 
 func (msg *IfAddrmsg) ToWireFormat() []byte {
 	native := nativeEndian()
 
-	len := syscall.SizeofIfAddrmsg
-	b := make([]byte, len)
+	length := syscall.SizeofIfAddrmsg
+	b := make([]byte, length)
 	b[0] = msg.Family
 	b[1] = msg.Prefixlen
 	b[2] = msg.Flags
@@ -105,26 +110,31 @@ func (msg *IfAddrmsg) ToWireFormat() []byte {
 	return b
 }
 
+func (msg *IfAddrmsg) Len() int {
+	return syscall.SizeofIfAddrmsg
+}
+
 type RtMsg struct {
 	syscall.RtMsg
 }
 
 func newRtMsg(family int) *RtMsg {
-	msg := &RtMsg{}
-	msg.Family = uint8(family)
-	msg.Table = syscall.RT_TABLE_MAIN
-	msg.Scope = syscall.RT_SCOPE_UNIVERSE
-	msg.Protocol = syscall.RTPROT_BOOT
-	msg.Type = syscall.RTN_UNICAST
-
-	return msg
+	return &RtMsg{
+		RtMsg: syscall.RtMsg{
+			Family:   uint8(family),
+			Table:    syscall.RT_TABLE_MAIN,
+			Scope:    syscall.RT_SCOPE_UNIVERSE,
+			Protocol: syscall.RTPROT_BOOT,
+			Type:     syscall.RTN_UNICAST,
+		},
+	}
 }
 
 func (msg *RtMsg) ToWireFormat() []byte {
 	native := nativeEndian()
 
-	len := syscall.SizeofRtMsg
-	b := make([]byte, len)
+	length := syscall.SizeofRtMsg
+	b := make([]byte, length)
 	b[0] = msg.Family
 	b[1] = msg.Dst_len
 	b[2] = msg.Src_len
@@ -137,6 +147,10 @@ func (msg *RtMsg) ToWireFormat() []byte {
 	return b
 }
 
+func (msg *RtMsg) Len() int {
+	return syscall.SizeofRtMsg
+}
+
 func rtaAlignOf(attrlen int) int {
 	return (attrlen + syscall.RTA_ALIGNTO - 1) & ^(syscall.RTA_ALIGNTO - 1)
 }
@@ -144,18 +158,17 @@ func rtaAlignOf(attrlen int) int {
 type RtAttr struct {
 	syscall.RtAttr
 	Data     []byte
-	children []*RtAttr
-	prefix   int
+	children []NetlinkRequestData
 }
 
 func newRtAttr(attrType int, data []byte) *RtAttr {
-	attr := &RtAttr{
-		children: []*RtAttr{},
+	return &RtAttr{
+		RtAttr: syscall.RtAttr{
+			Type: uint16(attrType),
+		},
+		children: []NetlinkRequestData{},
+		Data:     data,
 	}
-	attr.Type = uint16(attrType)
-	attr.Data = data
-
-	return attr
 }
 
 func newRtAttrChild(parent *RtAttr, attrType int, data []byte) *RtAttr {
@@ -164,10 +177,10 @@ func newRtAttrChild(parent *RtAttr, attrType int, data []byte) *RtAttr {
 	return attr
 }
 
-func (a *RtAttr) length() int {
+func (a *RtAttr) Len() int {
 	l := 0
 	for _, child := range a.children {
-		l += child.length() + syscall.SizeofRtAttr + child.prefix
+		l += child.Len() + syscall.SizeofRtAttr
 	}
 	if l == 0 {
 		l++
@@ -178,7 +191,7 @@ func (a *RtAttr) length() int {
 func (a *RtAttr) ToWireFormat() []byte {
 	native := nativeEndian()
 
-	length := a.length()
+	length := a.Len()
 	buf := make([]byte, rtaAlignOf(length+syscall.SizeofRtAttr))
 
 	if a.Data != nil {
@@ -187,7 +200,7 @@ func (a *RtAttr) ToWireFormat() []byte {
 		next := 4
 		for _, child := range a.children {
 			childBuf := child.ToWireFormat()
-			copy(buf[next+child.prefix:], childBuf)
+			copy(buf[next:], childBuf)
 			next += rtaAlignOf(len(childBuf))
 		}
 	}
@@ -212,7 +225,7 @@ func (rr *NetlinkRequest) ToWireFormat() []byte {
 	dataBytes := make([][]byte, len(rr.Data))
 	for i, data := range rr.Data {
 		dataBytes[i] = data.ToWireFormat()
-		length = length + uint32(len(dataBytes[i]))
+		length += uint32(len(dataBytes[i]))
 	}
 	b := make([]byte, length)
 	native.PutUint32(b[0:4], length)
@@ -221,12 +234,10 @@ func (rr *NetlinkRequest) ToWireFormat() []byte {
 	native.PutUint32(b[8:12], rr.Seq)
 	native.PutUint32(b[12:16], rr.Pid)
 
-	i := 16
+	next := 16
 	for _, data := range dataBytes {
-		for _, dataByte := range data {
-			b[i] = dataByte
-			i = i + 1
-		}
+		copy(b[next:], data)
+		next += len(data)
 	}
 	return b
 }
@@ -238,12 +249,14 @@ func (rr *NetlinkRequest) AddData(data NetlinkRequestData) {
 }
 
 func newNetlinkRequest(proto, flags int) *NetlinkRequest {
-	rr := &NetlinkRequest{}
-	rr.Len = uint32(syscall.NLMSG_HDRLEN)
-	rr.Type = uint16(proto)
-	rr.Flags = syscall.NLM_F_REQUEST | uint16(flags)
-	rr.Seq = uint32(getSeq())
-	return rr
+	return &NetlinkRequest{
+		NlMsghdr: syscall.NlMsghdr{
+			Len:   uint32(syscall.NLMSG_HDRLEN),
+			Type:  uint16(proto),
+			Flags: syscall.NLM_F_REQUEST | uint16(flags),
+			Seq:   uint32(getSeq()),
+		},
+	}
 }
 
 type NetlinkSocket struct {
@@ -286,7 +299,7 @@ func (s *NetlinkSocket) Receive() ([]syscall.NetlinkMessage, error) {
 		return nil, err
 	}
 	if nr < syscall.NLMSG_HDRLEN {
-		return nil, fmt.Errorf("Got short response from netlink")
+		return nil, ErrShortResponse
 	}
 	rb = rb[:nr]
 	return syscall.ParseNetlinkMessage(rb)
@@ -301,7 +314,7 @@ func (s *NetlinkSocket) GetPid() (uint32, error) {
 	case *syscall.SockaddrNetlink:
 		return v.Pid, nil
 	}
-	return 0, fmt.Errorf("Wrong socket type")
+	return 0, ErrWrongSockType
 }
 
 func (s *NetlinkSocket) HandleAck(seq uint32) error {
@@ -592,11 +605,7 @@ func zeroTerminated(s string) []byte {
 }
 
 func nonZeroTerminated(s string) []byte {
-	bytes := make([]byte, len(s))
-	for i := 0; i < len(s); i++ {
-		bytes[i] = s[i]
-	}
-	return bytes
+	return []byte(s)
 }
 
 // Add a new network link of a specified type. This is identical to
@@ -789,8 +798,8 @@ func NetworkCreateVethPair(name1, name2 string) error {
 	nest2 := newRtAttrChild(nest1, IFLA_INFO_DATA, nil)
 	nest3 := newRtAttrChild(nest2, VETH_INFO_PEER, nil)
 
-	last := newRtAttrChild(nest3, syscall.IFLA_IFNAME, zeroTerminated(name2))
-	last.prefix = syscall.SizeofIfInfomsg
+	newIfInfomsgChild(nest3, syscall.AF_UNSPEC)
+	newRtAttrChild(nest3, syscall.IFLA_IFNAME, zeroTerminated(name2))
 
 	wb.AddData(nest1)
 

From b2a134f727cd50d3d8b06214bed297c7af27c3e9 Mon Sep 17 00:00:00 2001
From: Adam Miller <admiller@redhat.com>
Date: Wed, 5 Feb 2014 14:35:44 -0600
Subject: [PATCH 072/403] Added sysvinit/sysconfig files for redhat family of
 distros (RHEL/CentOS/SL/etc.)

Docker-DCO-1.1-Signed-off-by: Adam Miller <admiller@redhat.com> (github: maxamillion)
Upstream-commit: 2222cba5acd3fe663d492d7bc3fd4787d4c9869f
Component: engine
---
 .../contrib/init/sysvinit-redhat/docker       | 128 ++++++++++++++++++
 .../init/sysvinit-redhat/docker.sysconfig     |   7 +
 2 files changed, 135 insertions(+)
 create mode 100755 components/engine/contrib/init/sysvinit-redhat/docker
 create mode 100644 components/engine/contrib/init/sysvinit-redhat/docker.sysconfig

diff --git a/components/engine/contrib/init/sysvinit-redhat/docker b/components/engine/contrib/init/sysvinit-redhat/docker
new file mode 100755
index 0000000000..4ee46bb02b
--- /dev/null
+++ b/components/engine/contrib/init/sysvinit-redhat/docker
@@ -0,0 +1,128 @@
+#!/bin/sh
+#
+#       /etc/rc.d/init.d/docker
+#
+#       Daemon for docker.io
+#       
+# chkconfig:   2345 95 95
+# description: Daemon for docker.io
+
+### BEGIN INIT INFO
+# Provides:       docker
+# Required-Start: $network cgconfig
+# Required-Stop:
+# Should-Start:
+# Should-Stop:
+# Default-Start: 2 3 4 5
+# Default-Stop:  0 1 6
+# Short-Description: start and stop docker
+# Description: Daemon for docker.io
+### END INIT INFO
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+prog="docker"
+exec="/usr/bin/$prog"
+pidfile="/var/run/$prog.pid"
+lockfile="/var/lock/subsys/$prog"
+logfile="/var/log/$prog"
+
+[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
+
+prestart() {
+    service cgconfig status > /dev/null
+
+    if [[ $? != 0 ]]; then
+        service cgconfig start
+    fi
+
+    preexec="/sbin/sysctl"
+    [ -x $preexec ] || exit 6
+    $preexec -w net.ipv4.ip_forward=1 > /dev/null 2>&1
+    $preexec -w net.ipv6.conf.all.forwarding=1 > /dev/null 2>&1
+
+}
+
+start() {
+    [ -x $exec ] || exit 5
+
+    if ! [ -f $pidfile ]; then
+        prestart
+        printf "Starting $prog:\t"
+        echo "\n$(date)\n" >> $logfile
+        $exec -d $other_args &>> $logfile &
+        pid=$!
+        touch $lockfile
+        success
+        echo
+    else
+        failure
+        echo
+        printf "$pidfile still exists...\n"
+        exit 7
+    fi
+}
+
+stop() {
+    echo -n $"Stopping $prog: "
+    killproc -p $pidfile $prog
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && rm -f $lockfile
+    return $retval
+}
+
+restart() {
+    stop
+    start
+}
+
+reload() {
+    restart
+}
+
+force_reload() {
+    restart
+}
+
+rh_status() {
+    status -p $pidfile $prog
+}
+
+rh_status_q() {
+    rh_status >/dev/null 2>&1
+}
+
+case "$1" in
+    start)
+        rh_status_q && exit 0
+        $1
+        ;;
+    stop)
+        rh_status_q || exit 0
+        $1
+        ;;
+    restart)
+        $1
+        ;;
+    reload)
+        rh_status_q || exit 7
+        $1
+        ;;
+    force-reload)
+        force_reload
+        ;;
+    status)
+        rh_status
+        ;;
+    condrestart|try-restart)
+        rh_status_q || exit 0
+        restart
+        ;;
+    *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
+        exit 2
+esac
+
+exit $?
diff --git a/components/engine/contrib/init/sysvinit-redhat/docker.sysconfig b/components/engine/contrib/init/sysvinit-redhat/docker.sysconfig
new file mode 100644
index 0000000000..9c99dd1966
--- /dev/null
+++ b/components/engine/contrib/init/sysvinit-redhat/docker.sysconfig
@@ -0,0 +1,7 @@
+# /etc/sysconfig/docker
+# 
+# Other arguments to pass to the docker daemon process
+# These will be parsed by the sysv initscript and appended
+# to the arguments list passed to docker -d
+
+other_args=""

From 1e41d2ac045c1cec79250334d4df33df8d66847b Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Wed, 12 Feb 2014 23:23:42 +0000
Subject: [PATCH 073/403] add error to docekr build --rm

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: a895c7238d3f32b22989c409a5a3b09aa3463054
Component: engine
---
 components/engine/buildfile.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/components/engine/buildfile.go b/components/engine/buildfile.go
index a121276c21..b4024bd8c8 100644
--- a/components/engine/buildfile.go
+++ b/components/engine/buildfile.go
@@ -65,8 +65,11 @@ type buildFile struct {
 func (b *buildFile) clearTmp(containers map[string]struct{}) {
 	for c := range containers {
 		tmp := b.runtime.Get(c)
-		b.runtime.Destroy(tmp)
-		fmt.Fprintf(b.outStream, "Removing intermediate container %s\n", utils.TruncateID(c))
+		if err := b.runtime.Destroy(tmp); err != nil {
+			fmt.Fprintf(b.outStream, "Error removing intermediate container %s: %s\n", utils.TruncateID(c), err.Error())
+		} else {
+			fmt.Fprintf(b.outStream, "Removing intermediate container %s\n", utils.TruncateID(c))
+		}
 	}
 }
 

From 8934e64a02f2593d1ce49220e3c7d5923295d2aa Mon Sep 17 00:00:00 2001
From: Charles Merriam <charles.merriam@gmail.com>
Date: Wed, 12 Feb 2014 18:11:01 -0800
Subject: [PATCH 074/403] (resubmit) Add notes about OS/X and remote daemons

Docker-DCO-1.1-Signed-off-by: Charles Merriam <charles.merriam@gmail.com> (github: merriam)
Upstream-commit: 2a17bdce9e6e25e9be225fede7aac0b12729d82f
Component: engine
---
 .../engine/docs/sources/use/working_with_volumes.rst   | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/components/engine/docs/sources/use/working_with_volumes.rst b/components/engine/docs/sources/use/working_with_volumes.rst
index 34728cbd3d..c639efff4f 100644
--- a/components/engine/docs/sources/use/working_with_volumes.rst
+++ b/components/engine/docs/sources/use/working_with_volumes.rst
@@ -108,6 +108,16 @@ container with read only permissions as ``/var/host_logs``.
 
 .. versionadded:: v0.5.0
 
+
+Note for OS/X users and remote daemon users:
+--------------------------------------------
+ 
+OS/X users run ``boot2docker`` to create a minimalist virtual machine running the docker daemon.  That 
+virtual machine then launches docker commands on behalf of the OS/X command line.   The means that ``host
+directories`` refer to directories in the ``boot2docker`` virtual machine, not the OS/X filesystem.
+
+Similarly, anytime when the docker daemon is on a remote machine, the ``host directories`` always refer to directories on the daemon's machine.
+
 Known Issues
 ............
 

From 60f7a02d072884f03780c4c6becfa452a79a5220 Mon Sep 17 00:00:00 2001
From: Charles Merriam <charles.merriam@gmail.com>
Date: Wed, 12 Feb 2014 18:13:46 -0800
Subject: [PATCH 075/403] Minor error in example code (resubmit #4109)

Docker-DCO-1.1-Signed-off-by: Charles Merriam <charles.merriam@gmail.com> (github: merriam)
Upstream-commit: ba650e05177bcc2597606b998a104a29698d5064
Component: engine
---
 components/engine/docs/sources/use/working_with_volumes.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/use/working_with_volumes.rst b/components/engine/docs/sources/use/working_with_volumes.rst
index 34728cbd3d..d0fc5efef8 100644
--- a/components/engine/docs/sources/use/working_with_volumes.rst
+++ b/components/engine/docs/sources/use/working_with_volumes.rst
@@ -101,7 +101,7 @@ might not work on any other machine.
 
 For example::
 
-  sudo docker run -v /var/logs:/var/host_logs:ro ubuntu bash
+  sudo docker run -t -i -v /var/logs:/var/host_logs:ro ubuntu bash
 
 The command above mounts the host directory ``/var/logs`` into the
 container with read only permissions as ``/var/host_logs``.

From 171ba8d692f686f7600736091fcbb83156d97f3b Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Thu, 13 Feb 2014 03:26:35 +0200
Subject: [PATCH 076/403] disallow tcp:// from defaulting to 127.0.0.1:4243

This stops docker from accepting tcp:// as a valid bind address.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 31dde3ea05e1cf4c1f45083c1b6129e8c2a362df
Component: engine
---
 components/engine/api/api.go                  |  3 +--
 .../engine/docs/sources/installation/mac.rst  |  2 +-
 .../sources/reference/commandline/cli.rst     |  2 +-
 components/engine/utils/utils.go              |  9 ++++---
 components/engine/utils/utils_test.go         | 24 ++++++++++---------
 5 files changed, 22 insertions(+), 18 deletions(-)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index e0077a94e3..5ec9b778e0 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -31,12 +31,11 @@ import (
 const (
 	APIVERSION        = 1.9
 	DEFAULTHTTPHOST   = "127.0.0.1"
-	DEFAULTHTTPPORT   = 4243
 	DEFAULTUNIXSOCKET = "/var/run/docker.sock"
 )
 
 func ValidateHost(val string) (string, error) {
-	host, err := utils.ParseHost(DEFAULTHTTPHOST, DEFAULTHTTPPORT, DEFAULTUNIXSOCKET, val)
+	host, err := utils.ParseHost(DEFAULTHTTPHOST, DEFAULTUNIXSOCKET, val)
 	if err != nil {
 		return val, err
 	}
diff --git a/components/engine/docs/sources/installation/mac.rst b/components/engine/docs/sources/installation/mac.rst
index fce9b00f7e..efb999ee1f 100644
--- a/components/engine/docs/sources/installation/mac.rst
+++ b/components/engine/docs/sources/installation/mac.rst
@@ -72,7 +72,7 @@ Run the following commands to get it downloaded and set up:
     chmod +x docker
 
     # Set the environment variable for the docker daemon
-    export DOCKER_HOST=tcp://
+    export DOCKER_HOST=tcp://127.0.0.1:4243
 
     # Copy the executable file
     sudo cp docker /usr/local/bin/
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 18cef685aa..032076b941 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -12,7 +12,7 @@ To list available commands, either run ``docker`` with no parameters or execute
 
   $ sudo docker
     Usage: docker [OPTIONS] COMMAND [arg...]
-      -H=[unix:///var/run/docker.sock]: tcp://[host[:port]] to bind/connect to or unix://[/path/to/socket] to use. When host=[0.0.0.0], port=[4243] or path=[/var/run/docker.sock] is omitted, default values are used.
+      -H=[unix:///var/run/docker.sock]: tcp://[host]:port to bind/connect to or unix://[/path/to/socket] to use. When host=[127.0.0.1] is omitted for tcp or path=[/var/run/docker.sock] is omitted for unix sockets, default values are used.
 
     A self-sufficient runtime for linux containers.
 
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 60952606d5..2f7e408621 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -745,7 +745,7 @@ func GetNameserversAsCIDR(resolvConf []byte) []string {
 }
 
 // FIXME: Change this not to receive default value as parameter
-func ParseHost(defaultHost string, defaultPort int, defaultUnix, addr string) (string, error) {
+func ParseHost(defaultHost string, defaultUnix, addr string) (string, error) {
 	var (
 		proto string
 		host  string
@@ -753,6 +753,8 @@ func ParseHost(defaultHost string, defaultPort int, defaultUnix, addr string) (s
 	)
 	addr = strings.TrimSpace(addr)
 	switch {
+	case addr == "tcp://":
+		return "", fmt.Errorf("Invalid bind address format: %s", addr)
 	case strings.HasPrefix(addr, "unix://"):
 		proto = "unix"
 		addr = strings.TrimPrefix(addr, "unix://")
@@ -788,12 +790,13 @@ func ParseHost(defaultHost string, defaultPort int, defaultUnix, addr string) (s
 		if p, err := strconv.Atoi(hostParts[1]); err == nil && p != 0 {
 			port = p
 		} else {
-			port = defaultPort
+			return "", fmt.Errorf("Invalid bind address format: %s", addr)
 		}
 
+	} else if proto == "tcp" && !strings.Contains(addr, ":") {
+		return "", fmt.Errorf("Invalid bind address format: %s", addr)
 	} else {
 		host = addr
-		port = defaultPort
 	}
 	if proto == "unix" {
 		return fmt.Sprintf("%s://%s", proto, host), nil
diff --git a/components/engine/utils/utils_test.go b/components/engine/utils/utils_test.go
index b0a5acb170..7e63a45cf7 100644
--- a/components/engine/utils/utils_test.go
+++ b/components/engine/utils/utils_test.go
@@ -301,34 +301,36 @@ func assertRAMInBytes(t *testing.T, size string, expectError bool, expectedBytes
 func TestParseHost(t *testing.T) {
 	var (
 		defaultHttpHost = "127.0.0.1"
-		defaultHttpPort = 4243
 		defaultUnix     = "/var/run/docker.sock"
 	)
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, "0.0.0.0"); err != nil || addr != "tcp://0.0.0.0:4243" {
-		t.Errorf("0.0.0.0 -> expected tcp://0.0.0.0:4243, got %s", addr)
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, "0.0.0.0"); err == nil {
+		t.Errorf("tcp 0.0.0.0 address expected error return, but err == nil, got %s", addr)
 	}
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, "0.0.0.1:5555"); err != nil || addr != "tcp://0.0.0.1:5555" {
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, "tcp://"); err == nil {
+		t.Errorf("default tcp:// address expected error return, but err == nil, got %s", addr)
+	}
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, "0.0.0.1:5555"); err != nil || addr != "tcp://0.0.0.1:5555" {
 		t.Errorf("0.0.0.1:5555 -> expected tcp://0.0.0.1:5555, got %s", addr)
 	}
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, ":6666"); err != nil || addr != "tcp://127.0.0.1:6666" {
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, ":6666"); err != nil || addr != "tcp://127.0.0.1:6666" {
 		t.Errorf(":6666 -> expected tcp://127.0.0.1:6666, got %s", addr)
 	}
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, "tcp://:7777"); err != nil || addr != "tcp://127.0.0.1:7777" {
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, "tcp://:7777"); err != nil || addr != "tcp://127.0.0.1:7777" {
 		t.Errorf("tcp://:7777 -> expected tcp://127.0.0.1:7777, got %s", addr)
 	}
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, ""); err != nil || addr != "unix:///var/run/docker.sock" {
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, ""); err != nil || addr != "unix:///var/run/docker.sock" {
 		t.Errorf("empty argument -> expected unix:///var/run/docker.sock, got %s", addr)
 	}
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, "unix:///var/run/docker.sock"); err != nil || addr != "unix:///var/run/docker.sock" {
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, "unix:///var/run/docker.sock"); err != nil || addr != "unix:///var/run/docker.sock" {
 		t.Errorf("unix:///var/run/docker.sock -> expected unix:///var/run/docker.sock, got %s", addr)
 	}
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, "unix://"); err != nil || addr != "unix:///var/run/docker.sock" {
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, "unix://"); err != nil || addr != "unix:///var/run/docker.sock" {
 		t.Errorf("unix:///var/run/docker.sock -> expected unix:///var/run/docker.sock, got %s", addr)
 	}
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, "udp://127.0.0.1"); err == nil {
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, "udp://127.0.0.1"); err == nil {
 		t.Errorf("udp protocol address expected error return, but err == nil. Got %s", addr)
 	}
-	if addr, err := ParseHost(defaultHttpHost, defaultHttpPort, defaultUnix, "udp://127.0.0.1:4243"); err == nil {
+	if addr, err := ParseHost(defaultHttpHost, defaultUnix, "udp://127.0.0.1:4243"); err == nil {
 		t.Errorf("udp protocol address expected error return, but err == nil. Got %s", addr)
 	}
 }

From 173cbcacdb43b73ac7371acbced6ab91fd094d12 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Thu, 13 Feb 2014 10:07:53 -0700
Subject: [PATCH 077/403] Add shasum fallback to hack/make/dynbinary for Darwin
 (where sha1sum is not available)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: c7840f522c37d2c964e442c5acac745f702b8801
Component: engine
---
 components/engine/hack/make/dynbinary | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/components/engine/hack/make/dynbinary b/components/engine/hack/make/dynbinary
index 7de3a6cb59..d5ea6ebe54 100644
--- a/components/engine/hack/make/dynbinary
+++ b/components/engine/hack/make/dynbinary
@@ -7,8 +7,19 @@ CGO_ENABLED=0 go build -o $DEST/dockerinit-$VERSION -ldflags "$LDFLAGS -d" $BUIL
 echo "Created binary: $DEST/dockerinit-$VERSION"
 ln -sf dockerinit-$VERSION $DEST/dockerinit
 
+sha1sum=
+if command -v sha1sum &> /dev/null; then
+	sha1sum=sha1sum
+elif command -v shasum &> /dev/null; then
+	# Mac OS X - why couldn't they just use the same command name and be happy?
+	sha1sum=shasum
+else
+	echo >&2 'error: cannot find sha1sum command or equivalent'
+	exit 1
+fi
+
 # sha1 our new dockerinit to ensure separate docker and dockerinit always run in a perfect pair compiled for one another
-export DOCKER_INITSHA1="$(sha1sum $DEST/dockerinit-$VERSION | cut -d' ' -f1)"
+export DOCKER_INITSHA1="$($sha1sum $DEST/dockerinit-$VERSION | cut -d' ' -f1)"
 # exported so that "dyntest" can easily access it later without recalculating it
 
 (

From 9d6155e45c3da9e90251a6453e2c90eda626eb52 Mon Sep 17 00:00:00 2001
From: apocas <petermdias@gmail.com>
Date: Thu, 13 Feb 2014 13:34:04 +0000
Subject: [PATCH 078/403] Image tag  endpoint doc typo.

Docker-DCO-1.1-Signed-off-by: Pedro Dias <petermdias@gmail.com> (github: apocas)
Upstream-commit: 3417dd4b3bef88d4da0deac520bbf150ba9c183b
Component: engine
---
 .../docs/sources/reference/api/docker_remote_api_v1.0.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.1.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.2.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.3.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.4.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.5.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.6.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.7.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.8.rst     | 4 ++--
 .../docs/sources/reference/api/docker_remote_api_v1.9.rst     | 4 ++--
 10 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.0.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.0.rst
index dc06a27fc0..fa4b969758 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.0.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.0.rst
@@ -732,11 +732,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
 	:query repo: The repository to tag in
 	:query force: 1/True/true or 0/False/false, default false
-	:statuscode 200: no error
+	:statuscode 201: no error
 	:statuscode 400: bad parameter
 	:statuscode 404: no such image
         :statuscode 500: server error
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.1.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.1.rst
index 31b34caf5a..92b5039aa6 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.1.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.1.rst
@@ -742,11 +742,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
 	:query repo: The repository to tag in
 	:query force: 1/True/true or 0/False/false, default false
-	:statuscode 200: no error
+	:statuscode 201: no error
 	:statuscode 400: bad parameter
 	:statuscode 404: no such image
 	:statuscode 409: conflict
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.2.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.2.rst
index 555ec14b75..1ae2db696f 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.2.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.2.rst
@@ -761,11 +761,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
 	:query repo: The repository to tag in
 	:query force: 1/True/true or 0/False/false, default false
-	:statuscode 200: no error
+	:statuscode 201: no error
 	:statuscode 400: bad parameter
 	:statuscode 404: no such image
 	:statuscode 409: conflict
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.3.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.3.rst
index ab452798b9..cb4c54642d 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.3.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.3.rst
@@ -808,11 +808,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
 	:query repo: The repository to tag in
 	:query force: 1/True/true or 0/False/false, default false
-	:statuscode 200: no error
+	:statuscode 201: no error
 	:statuscode 400: bad parameter
 	:statuscode 404: no such image
 	:statuscode 409: conflict
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.4.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.4.rst
index 5c8884b16f..39c8839653 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.4.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.4.rst
@@ -852,11 +852,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
 	:query repo: The repository to tag in
 	:query force: 1/True/true or 0/False/false, default false
-	:statuscode 200: no error
+	:statuscode 201: no error
 	:statuscode 400: bad parameter
 	:statuscode 404: no such image
 	:statuscode 409: conflict
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.5.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.5.rst
index 609fc6b056..0cdbaf747a 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.5.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.5.rst
@@ -831,11 +831,11 @@ Tag an image into a repository
 
   .. sourcecode:: http
 
-    HTTP/1.1 200 OK
+    HTTP/1.1 201 OK
 
   :query repo: The repository to tag in
   :query force: 1/True/true or 0/False/false, default false
-  :statuscode 200: no error
+  :statuscode 201: no error
   :statuscode 400: bad parameter
   :statuscode 404: no such image
   :statuscode 409: conflict
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.6.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.6.rst
index df53275a4f..a9ddfb2c13 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.6.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.6.rst
@@ -958,11 +958,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
 	:query repo: The repository to tag in
 	:query force: 1/True/true or 0/False/false, default false
-	:statuscode 200: no error
+	:statuscode 201: no error
 	:statuscode 400: bad parameter
 	:statuscode 404: no such image
 	:statuscode 409: conflict
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.7.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.7.rst
index 28c5ba30f2..cacd7ab6f7 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.7.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.7.rst
@@ -877,11 +877,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
 	:query repo: The repository to tag in
 	:query force: 1/True/true or 0/False/false, default false
-	:statuscode 200: no error
+	:statuscode 201: no error
 	:statuscode 400: bad parameter
 	:statuscode 404: no such image
 	:statuscode 409: conflict
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.8.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.8.rst
index 6ccc6eca94..5033f34210 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.8.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.8.rst
@@ -892,11 +892,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
         :query repo: The repository to tag in
         :query force: 1/True/true or 0/False/false, default false
-        :statuscode 200: no error
+        :statuscode 201: no error
         :statuscode 400: bad parameter
         :statuscode 404: no such image
         :statuscode 409: conflict
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
index cb406da82b..47cdb46b28 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
@@ -892,11 +892,11 @@ Tag an image into a repository
 
         .. sourcecode:: http
 
-           HTTP/1.1 200 OK
+           HTTP/1.1 201 OK
 
         :query repo: The repository to tag in
         :query force: 1/True/true or 0/False/false, default false
-        :statuscode 200: no error
+        :statuscode 201: no error
         :statuscode 400: bad parameter
         :statuscode 404: no such image
         :statuscode 409: conflict

From f734c535334b35787803b7c24b3405eacbe81c9b Mon Sep 17 00:00:00 2001
From: Adam Miller <admiller@redhat.com>
Date: Thu, 13 Feb 2014 12:11:38 -0600
Subject: [PATCH 079/403] remove unneeded sysctl changes in sysvinit-redhat
 init script

Docker-DCO-1.1-Signed-off-by: Adam Miller <admiller@redhat.com> (github: maxamillion)
Upstream-commit: 4317011e21b4e4025a9c92c7dc255fbf62af573a
Component: engine
---
 components/engine/contrib/init/sysvinit-redhat/docker | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/components/engine/contrib/init/sysvinit-redhat/docker b/components/engine/contrib/init/sysvinit-redhat/docker
index 4ee46bb02b..2b75c6903f 100755
--- a/components/engine/contrib/init/sysvinit-redhat/docker
+++ b/components/engine/contrib/init/sysvinit-redhat/docker
@@ -37,11 +37,6 @@ prestart() {
         service cgconfig start
     fi
 
-    preexec="/sbin/sysctl"
-    [ -x $preexec ] || exit 6
-    $preexec -w net.ipv4.ip_forward=1 > /dev/null 2>&1
-    $preexec -w net.ipv6.conf.all.forwarding=1 > /dev/null 2>&1
-
 }
 
 start() {

From 1395c9829d11863ed6e64e225d7df9bc2dc767c6 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Thu, 13 Feb 2014 19:21:27 +0000
Subject: [PATCH 080/403] fix content-type for job.Stdout.Add

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 4611a6bdd3270e4a404cae2d23c54dd94521c4ae
Component: engine
---
 components/engine/api/api.go | 63 +++++++++++++++++++++++-------------
 1 file changed, 41 insertions(+), 22 deletions(-)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index e0077a94e3..efab08ab3d 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -108,6 +108,15 @@ func writeJSON(w http.ResponseWriter, code int, v engine.Env) error {
 	return v.Encode(w)
 }
 
+func streamJSON(job *engine.Job, w http.ResponseWriter, flush bool) {
+	w.Header().Set("Content-Type", "application/json")
+	if flush {
+		job.Stdout.Add(utils.NewWriteFlusher(w))
+	} else {
+		job.Stdout.Add(w)
+	}
+}
+
 func getBoolParam(value string) (bool, error) {
 	if value == "" {
 		return false, nil
@@ -214,7 +223,7 @@ func getImagesJSON(eng *engine.Engine, version float64, w http.ResponseWriter, r
 	job.Setenv("all", r.Form.Get("all"))
 
 	if version >= 1.7 {
-		job.Stdout.Add(w)
+		streamJSON(job, w, false)
 	} else if outs, err = job.Stdout.AddListTable(); err != nil {
 		return err
 	}
@@ -265,9 +274,8 @@ func getEvents(eng *engine.Engine, version float64, w http.ResponseWriter, r *ht
 		return err
 	}
 
-	w.Header().Set("Content-Type", "application/json")
 	var job = eng.Job("events", r.RemoteAddr)
-	job.Stdout.Add(utils.NewWriteFlusher(w))
+	streamJSON(job, w, true)
 	job.Setenv("since", r.Form.Get("since"))
 	return job.Run()
 }
@@ -278,7 +286,7 @@ func getImagesHistory(eng *engine.Engine, version float64, w http.ResponseWriter
 	}
 
 	var job = eng.Job("history", vars["name"])
-	job.Stdout.Add(w)
+	streamJSON(job, w, false)
 
 	if err := job.Run(); err != nil {
 		return err
@@ -291,7 +299,7 @@ func getContainersChanges(eng *engine.Engine, version float64, w http.ResponseWr
 		return fmt.Errorf("Missing parameter")
 	}
 	var job = eng.Job("changes", vars["name"])
-	job.Stdout.Add(w)
+	streamJSON(job, w, false)
 
 	return job.Run()
 }
@@ -308,7 +316,7 @@ func getContainersTop(eng *engine.Engine, version float64, w http.ResponseWriter
 	}
 
 	job := eng.Job("top", vars["name"], r.Form.Get("ps_args"))
-	job.Stdout.Add(w)
+	streamJSON(job, w, false)
 	return job.Run()
 }
 
@@ -329,8 +337,7 @@ func getContainersJSON(eng *engine.Engine, version float64, w http.ResponseWrite
 	job.Setenv("limit", r.Form.Get("limit"))
 
 	if version >= 1.5 {
-		w.Header().Set("Content-Type", "application/json")
-		job.Stdout.Add(w)
+		streamJSON(job, w, false)
 	} else if outs, err = job.Stdout.AddTable(); err != nil {
 		return err
 	}
@@ -435,8 +442,12 @@ func postImagesCreate(eng *engine.Engine, version float64, w http.ResponseWriter
 		job.Stdin.Add(r.Body)
 	}
 
-	job.SetenvBool("json", version > 1.0)
-	job.Stdout.Add(utils.NewWriteFlusher(w))
+	if version > 1.0 {
+		job.SetenvBool("json", true)
+		streamJSON(job, w, true)
+	} else {
+		job.Stdout.Add(utils.NewWriteFlusher(w))
+	}
 	if err := job.Run(); err != nil {
 		if !job.Stdout.Used() {
 			return err
@@ -475,7 +486,7 @@ func getImagesSearch(eng *engine.Engine, version float64, w http.ResponseWriter,
 	var job = eng.Job("search", r.Form.Get("term"))
 	job.SetenvJson("metaHeaders", metaHeaders)
 	job.SetenvJson("authConfig", authConfig)
-	job.Stdout.Add(w)
+	streamJSON(job, w, false)
 
 	return job.Run()
 }
@@ -492,8 +503,12 @@ func postImagesInsert(eng *engine.Engine, version float64, w http.ResponseWriter
 	}
 
 	job := eng.Job("insert", vars["name"], r.Form.Get("url"), r.Form.Get("path"))
-	job.SetenvBool("json", version > 1.0)
-	job.Stdout.Add(w)
+	if version > 1.0 {
+		job.SetenvBool("json", true)
+		streamJSON(job, w, false)
+	} else {
+		job.Stdout.Add(w)
+	}
 	if err := job.Run(); err != nil {
 		if !job.Stdout.Used() {
 			return err
@@ -542,8 +557,12 @@ func postImagesPush(eng *engine.Engine, version float64, w http.ResponseWriter,
 	job := eng.Job("push", vars["name"])
 	job.SetenvJson("metaHeaders", metaHeaders)
 	job.SetenvJson("authConfig", authConfig)
-	job.SetenvBool("json", version > 1.0)
-	job.Stdout.Add(utils.NewWriteFlusher(w))
+	if version > 1.0 {
+		job.SetenvBool("json", true)
+		streamJSON(job, w, true)
+	} else {
+		job.Stdout.Add(utils.NewWriteFlusher(w))
+	}
 
 	if err := job.Run(); err != nil {
 		if !job.Stdout.Used() {
@@ -645,7 +664,7 @@ func deleteImages(eng *engine.Engine, version float64, w http.ResponseWriter, r
 		return fmt.Errorf("Missing parameter")
 	}
 	var job = eng.Job("image_delete", vars["name"])
-	job.Stdout.Add(w)
+	streamJSON(job, w, false)
 	job.SetenvBool("autoPrune", version > 1.1)
 
 	return job.Run()
@@ -825,7 +844,7 @@ func getContainersByName(eng *engine.Engine, version float64, w http.ResponseWri
 		return fmt.Errorf("Missing parameter")
 	}
 	var job = eng.Job("inspect", vars["name"], "container")
-	job.Stdout.Add(w)
+	streamJSON(job, w, false)
 	job.SetenvBool("conflict", true) //conflict=true to detect conflict between containers and images in the job
 	return job.Run()
 }
@@ -835,7 +854,7 @@ func getImagesByName(eng *engine.Engine, version float64, w http.ResponseWriter,
 		return fmt.Errorf("Missing parameter")
 	}
 	var job = eng.Job("inspect", vars["name"], "image")
-	job.Stdout.Add(w)
+	streamJSON(job, w, false)
 	job.SetenvBool("conflict", true) //conflict=true to detect conflict between containers and images in the job
 	return job.Run()
 }
@@ -875,11 +894,11 @@ func postBuild(eng *engine.Engine, version float64, w http.ResponseWriter, r *ht
 	}
 
 	if version >= 1.8 {
-		w.Header().Set("Content-Type", "application/json")
 		job.SetenvBool("json", true)
+		streamJSON(job, w, true)
+	} else {
+		job.Stdout.Add(utils.NewWriteFlusher(w))
 	}
-
-	job.Stdout.Add(utils.NewWriteFlusher(w))
 	job.Stdin.Add(r.Body)
 	job.Setenv("remote", r.FormValue("remote"))
 	job.Setenv("t", r.FormValue("t"))
@@ -920,7 +939,7 @@ func postContainersCopy(eng *engine.Engine, version float64, w http.ResponseWrit
 	}
 
 	job := eng.Job("container_copy", vars["name"], copyData.Get("Resource"))
-	job.Stdout.Add(w)
+	streamJSON(job, w, false)
 	if err := job.Run(); err != nil {
 		utils.Errorf("%s", err.Error())
 	}

From 6ca6193a8d91bb4fc8cfe6d3fefac73857bdf37f Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Thu, 13 Feb 2014 19:24:40 +0000
Subject: [PATCH 081/403] fix content-type for legacy

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 0b403b35318a68d848bd9d7cddcf850d2fa7bfa7
Component: engine
---
 components/engine/api/api.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index efab08ab3d..67f1d909cf 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -247,6 +247,7 @@ func getImagesJSON(eng *engine.Engine, version float64, w http.ResponseWriter, r
 				outsLegacy.Add(outLegacy)
 			}
 		}
+		w.Header().Set("Content-Type", "application/json")
 		if _, err := outsLegacy.WriteListTo(w); err != nil {
 			return err
 		}
@@ -350,6 +351,7 @@ func getContainersJSON(eng *engine.Engine, version float64, w http.ResponseWrite
 			ports.ReadListFrom([]byte(out.Get("Ports")))
 			out.Set("Ports", displayablePorts(ports))
 		}
+		w.Header().Set("Content-Type", "application/json")
 		if _, err = outs.WriteListTo(w); err != nil {
 			return err
 		}

From 4415a052720dd36f6c79af5f50acf9f56cfc29f7 Mon Sep 17 00:00:00 2001
From: Johan Euphrosine <proppy@google.com>
Date: Thu, 13 Feb 2014 11:42:14 -0800
Subject: [PATCH 082/403] hack/RELEASE: add step for updating doc branch

Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: google)
Upstream-commit: da3a52746b3ec43049dc3a8ca58b44d0188f043e
Component: engine
---
 components/engine/hack/RELEASE-CHECKLIST.md | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/components/engine/hack/RELEASE-CHECKLIST.md b/components/engine/hack/RELEASE-CHECKLIST.md
index a7ae45f2ff..84a0ff70e1 100644
--- a/components/engine/hack/RELEASE-CHECKLIST.md
+++ b/components/engine/hack/RELEASE-CHECKLIST.md
@@ -173,9 +173,13 @@ git push origin $VERSION
 It's very important that we don't make the tag until after the official
 release is uploaded to get.docker.io!
 
-### 10. Go to github to merge the `bump_$VERSION` into release
+### 10. Go to github to merge the `bump_$VERSION` branch into release
 
-Merging the pull request to the release branch will automatically
+Don't delete the leftover branch just yet, as we will need it for the next step.
+
+### 11. Go to github to merge the `bump_$VERSION` branch into docs
+
+Merging the pull request to the docs branch will automatically
 update the documentation on the "latest" revision of the docs. You
 should see the updated docs 5-10 minutes after the merge. The docs
 will appear on http://docs.docker.io/. For more information about
@@ -184,7 +188,7 @@ documentation releases, see `docs/README.md`.
 Don't forget to push that pretty blue button to delete the leftover
 branch afterwards!
 
-### 11. Create a new pull request to merge release back into master
+### 12. Create a new pull request to merge release back into master
 
 ```bash
 git checkout master
@@ -202,7 +206,7 @@ echo "https://github.com/dotcloud/docker/compare/master...merge_release_$VERSION
 Again, get two maintainers to validate, then merge, then push that pretty
 blue button to delete your branch.
 
-### 12. Rejoice and Evangelize!
+### 13. Rejoice and Evangelize!
 
 Congratulations! You're done.
 

From 20b4cea3236dce641d7599e469b13c460d09e19b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 13 Feb 2014 17:18:38 -0800
Subject: [PATCH 083/403] Fix regression with ADD of tar files
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 cad7f7ee5002206511daee4a29f399e6665f5fab Component: engine

---
 components/engine/buildfile.go | 36 ++++++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/components/engine/buildfile.go b/components/engine/buildfile.go
index a121276c21..995e995490 100644
--- a/components/engine/buildfile.go
+++ b/components/engine/buildfile.go
@@ -359,20 +359,36 @@ func (b *buildFile) addContext(container *Container, orig, dest string) error {
 		}
 		return err
 	}
+
 	if fi.IsDir() {
 		if err := archive.CopyWithTar(origPath, destPath); err != nil {
 			return err
 		}
-		// First try to unpack the source as an archive
-	} else if err := archive.UntarPath(origPath, destPath); err != nil {
-		utils.Debugf("Couldn't untar %s to %s: %s", origPath, destPath, err)
-		// If that fails, just copy it as a regular file
-		if err := os.MkdirAll(path.Dir(destPath), 0755); err != nil {
-			return err
-		}
-		if err := archive.CopyWithTar(origPath, destPath); err != nil {
-			return err
-		}
+		return nil
+	}
+
+	// First try to unpack the source as an archive
+	// to support the untar feature we need to clean up the path a little bit
+	// because tar is very forgiving.  First we need to strip off the archive's
+	// filename from the path but this is only added if it does not end in / .
+	tarDest := destPath
+	if strings.HasSuffix(tarDest, "/") {
+		tarDest = filepath.Dir(destPath)
+	}
+
+	// try to successfully untar the orig
+	if err := archive.UntarPath(origPath, tarDest); err == nil {
+		return nil
+	}
+	utils.Debugf("Couldn't untar %s to %s: %s", origPath, destPath, err)
+
+	// If that fails, just copy it as a regular file
+	// but do not use all the magic path handling for the tar path
+	if err := os.MkdirAll(path.Dir(destPath), 0755); err != nil {
+		return err
+	}
+	if err := archive.CopyWithTar(origPath, destPath); err != nil {
+		return err
 	}
 	return nil
 }

From 3dbd63bc33062958bd766716952fb3b630e655b0 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 13 Feb 2014 17:23:09 -0800
Subject: [PATCH 084/403] Mount-bind the PTY as container console - allow for
 tmux/screen to run

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 408ea0771a9cb3046b8e484dcfefe5233fcbb27a
Component: engine
---
 components/engine/container.go                   | 1 +
 components/engine/execdriver/driver.go           | 2 ++
 components/engine/execdriver/lxc/lxc_template.go | 4 ++++
 3 files changed, 7 insertions(+)

diff --git a/components/engine/container.go b/components/engine/container.go
index b3c139269b..af28689810 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -231,6 +231,7 @@ func (container *Container) setupPty() error {
 	container.ptyMaster = ptyMaster
 	container.command.Stdout = ptySlave
 	container.command.Stderr = ptySlave
+	container.command.Console = ptySlave.Name()
 
 	// Copy the PTYs to our broadcasters
 	go func() {
diff --git a/components/engine/execdriver/driver.go b/components/engine/execdriver/driver.go
index 1ea086075d..32b39771b6 100644
--- a/components/engine/execdriver/driver.go
+++ b/components/engine/execdriver/driver.go
@@ -99,6 +99,8 @@ type Command struct {
 	Network    *Network   `json:"network"` // if network is nil then networking is disabled
 	Config     []string   `json:"config"`  //  generic values that specific drivers can consume
 	Resources  *Resources `json:"resources"`
+
+	Console string `json:"-"`
 }
 
 // Return the pid of the process
diff --git a/components/engine/execdriver/lxc/lxc_template.go b/components/engine/execdriver/lxc/lxc_template.go
index a89365f989..639780f5d8 100644
--- a/components/engine/execdriver/lxc/lxc_template.go
+++ b/components/engine/execdriver/lxc/lxc_template.go
@@ -80,6 +80,10 @@ lxc.mount.entry = proc {{escapeFstabSpaces $ROOTFS}}/proc proc nosuid,nodev,noex
 # if your userspace allows it. eg. see http://bit.ly/T9CkqJ
 lxc.mount.entry = sysfs {{escapeFstabSpaces $ROOTFS}}/sys sysfs nosuid,nodev,noexec 0 0
 
+{{if .Tty}}
+lxc.mount.entry = {{.Console}} {{escapeFstabSpaces $ROOTFS}}/dev/console none bind,rw 0 0
+{{end}}
+
 lxc.mount.entry = devpts {{escapeFstabSpaces $ROOTFS}}/dev/pts devpts newinstance,ptmxmode=0666,nosuid,noexec 0 0
 lxc.mount.entry = shm {{escapeFstabSpaces $ROOTFS}}/dev/shm tmpfs size=65536k,nosuid,nodev,noexec 0 0
 

From ef1966871e0e7cabec76dcae8a809c1a9e0ed28f Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Thu, 13 Feb 2014 16:12:21 +1000
Subject: [PATCH 085/403] update the sshd example to use just a Dockerfile

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: a6182dc62ea335c40961c7e528b38b85d2569d07
Component: engine
---
 .../examples/running_ssh_service.Dockerfile   |  17 +++
 .../sources/examples/running_ssh_service.rst  | 112 ++++--------------
 2 files changed, 43 insertions(+), 86 deletions(-)
 create mode 100644 components/engine/docs/sources/examples/running_ssh_service.Dockerfile

diff --git a/components/engine/docs/sources/examples/running_ssh_service.Dockerfile b/components/engine/docs/sources/examples/running_ssh_service.Dockerfile
new file mode 100644
index 0000000000..dd2acb7a4b
--- /dev/null
+++ b/components/engine/docs/sources/examples/running_ssh_service.Dockerfile
@@ -0,0 +1,17 @@
+# sshd
+#
+# VERSION               0.0.1
+
+FROM     ubuntu
+MAINTAINER Thatcher R. Peskens "thatcher@dotcloud.com"
+
+# make sure the package repository is up to date
+RUN echo "deb http://archive.ubuntu.com/ubuntu precise main universe" > /etc/apt/sources.list
+RUN apt-get update
+
+RUN apt-get install -y openssh-server
+RUN mkdir /var/run/sshd 
+RUN echo 'root:screencast' |chpasswd
+
+EXPOSE 22
+CMD    /usr/sbin/sshd -D
diff --git a/components/engine/docs/sources/examples/running_ssh_service.rst b/components/engine/docs/sources/examples/running_ssh_service.rst
index 52fe1f5914..d27799bee7 100644
--- a/components/engine/docs/sources/examples/running_ssh_service.rst
+++ b/components/engine/docs/sources/examples/running_ssh_service.rst
@@ -1,5 +1,5 @@
 :title: Running an SSH service
-:description: A screencast of installing and running an sshd service
+:description: Installing and running an sshd service
 :keywords: docker, example, package installation, networking
 
 .. _running_ssh_service:
@@ -9,101 +9,41 @@ SSH Daemon Service
 
 .. include:: example_header.inc
 
+The following Dockerfile sets up an sshd service in a container that you can use
+to connect to and inspect other container's volumes, or to get quick access to a
+test container.
 
-**Video:**
+.. literalinclude:: running_ssh_service.Dockerfile
 
-I've created a little screencast to show how to create an SSHd service
-and connect to it. It is something like 11 minutes and not entirely
-smooth, but it gives you a good idea.
-
-.. note::
-   This screencast was created before Docker version 0.5.2, so the
-   daemon is unprotected and available via a TCP port. When you run
-   through the same steps in a newer version of Docker, you will
-   need to add ``sudo`` in front of each ``docker`` command in order
-   to reach the daemon over its protected Unix socket.
-
-.. raw:: html
-
-   <iframe width="815" height="450" frameborder="0"
-           sandbox="allow-same-origin allow-scripts" 
-   srcdoc="<body><script type=&quot;text/javascript&quot; 
-           src=&quot;https://asciinema.org/a/2637.js&quot; 
-           id=&quot;asciicast-2637&quot; async></script></body>">
-   </iframe>
-        
-You can also get this sshd container by using:
+Build the image using:
 
 .. code-block:: bash
 
-    sudo docker pull dhrp/sshd
+    $ sudo docker build -rm -t eg_sshd .
 
-
-The password is ``screencast``.
-
-**Video's Transcription:**
+Then run it. You can then use ``docker port`` to find out what host port the container's
+port 22 is mapped to:
 
 .. code-block:: bash
 
-         # Hello! We are going to try and install openssh on a container and run it as a service
-         # let's pull ubuntu to get a base ubuntu image. 
-         $ docker pull ubuntu
-         # I had it so it was quick
-         # now let's connect using -i for interactive and with -t for terminal 
-         # we execute /bin/bash to get a prompt.
-         $ docker run -i -t ubuntu /bin/bash
-         # yes! we are in!
-         # now lets install openssh
-         $ apt-get update
-         $ apt-get install openssh-server
-         # ok. lets see if we can run it.
-         $ which sshd
-         # we need to create privilege separation directory
-         $ mkdir /var/run/sshd
-         $ /usr/sbin/sshd
-         $ exit
-         # now let's commit it 
-         # which container was it?
-         $ docker ps -a |more
-         $ docker commit a30a3a2f2b130749995f5902f079dc6ad31ea0621fac595128ec59c6da07feea dhrp/sshd 
-         # I gave the name dhrp/sshd for the container
-         # now we can run it again 
-         $ docker run -d dhrp/sshd /usr/sbin/sshd -D # D for daemon mode 
-         # is it running?
-         $ docker ps
-         # yes!
-         # let's stop it 
-         $ docker stop 0ebf7cec294755399d063f4b1627980d4cbff7d999f0bc82b59c300f8536a562
-         $ docker ps
-         # and reconnect, but now open a port to it
-         $ docker run -d -p 22 dhrp/sshd /usr/sbin/sshd -D 
-         $ docker port b2b407cf22cf8e7fa3736fa8852713571074536b1d31def3fdfcd9fa4fd8c8c5 22
-         # it has now given us a port to connect to
-         # we have to connect using a public ip of our host
-         $ hostname
-         # *ifconfig* is deprecated, better use *ip addr show* now
-         $ ifconfig
-         $ ssh root@192.168.33.10 -p 49153
-         # Ah! forgot to set root passwd
-         $ docker commit b2b407cf22cf8e7fa3736fa8852713571074536b1d31def3fdfcd9fa4fd8c8c5 dhrp/sshd 
-         $ docker ps -a
-         $ docker run -i -t dhrp/sshd /bin/bash
-         $ passwd
-         $ exit
-         $ docker commit 9e863f0ca0af31c8b951048ba87641d67c382d08d655c2e4879c51410e0fedc1 dhrp/sshd
-         $ docker run -d -p 22 dhrp/sshd /usr/sbin/sshd -D
-         $ docker port a0aaa9558c90cf5c7782648df904a82365ebacce523e4acc085ac1213bfe2206 22
-         # *ifconfig* is deprecated, better use *ip addr show* now
-         $ ifconfig
-         $ ssh root@192.168.33.10 -p 49154
-         # Thanks for watching, Thatcher thatcher@dotcloud.com
-         
-Update:
--------
+    $ sudo docker run -d -P -name test_sshd eg_sshd
+    $ sudo docker port test_sshd 22
+    0.0.0.0:49154
 
-For Ubuntu 13.10 using stackbrew/ubuntu, you may need do these additional steps:
+And now you can ssh to port ``49154`` on the Docker daemon's host IP address 
+(``ip address`` or ``ifconfig`` can tell you that):
 
-1. change /etc/pam.d/sshd, pam_loginuid line 'required' to 'optional'
-2. echo LANG=\"en_US.UTF-8\" > /etc/default/locale
+.. code-block:: bash
 
+    $ ssh root@192.168.1.2 -p 49154
+    # The password is ``screencast``.
+    $$
 
+Finally, clean up after your test by stopping and removing the container, and
+then removing the image.
+
+.. code-block:: bash
+
+    $ sudo docker stop test_sshd
+    $ sudo docker rm test_sshd
+    $ sudo docker rmi eg_sshd

From 77b539f03ccfe22a04bbc9c11bd1a82a82e2149b Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Fri, 14 Feb 2014 11:12:49 +0100
Subject: [PATCH 086/403] archive: Close decompressed streams

Various kinds of decompressed streams are really ReadClosers. For instance
gzip.NewReader() is, and the one returned from CmdStream is changed to be
because it returns a PipeReader which is a ReadCloser.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 0d9213f859e00459e9efee2c5164417c94d66d2f
Component: engine
---
 components/engine/archive/archive.go | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index 3a1c111ea2..a2b395d4b3 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -65,13 +65,13 @@ func DetectCompression(source []byte) Compression {
 	return Uncompressed
 }
 
-func xzDecompress(archive io.Reader) (io.Reader, error) {
+func xzDecompress(archive io.Reader) (io.ReadCloser, error) {
 	args := []string{"xz", "-d", "-c", "-q"}
 
 	return CmdStream(exec.Command(args[0], args[1:]...), archive)
 }
 
-func DecompressStream(archive io.Reader) (io.Reader, error) {
+func DecompressStream(archive io.Reader) (io.ReadCloser, error) {
 	buf := make([]byte, 10)
 	totalN := 0
 	for totalN < 10 {
@@ -90,11 +90,11 @@ func DecompressStream(archive io.Reader) (io.Reader, error) {
 
 	switch compression {
 	case Uncompressed:
-		return wrap, nil
+		return ioutil.NopCloser(wrap), nil
 	case Gzip:
 		return gzip.NewReader(wrap)
 	case Bzip2:
-		return bzip2.NewReader(wrap), nil
+		return ioutil.NopCloser(bzip2.NewReader(wrap)), nil
 	case Xz:
 		return xzDecompress(wrap)
 	default:
@@ -352,12 +352,13 @@ func Untar(archive io.Reader, dest string, options *TarOptions) error {
 		return fmt.Errorf("Empty archive")
 	}
 
-	archive, err := DecompressStream(archive)
+	decompressedArchive, err := DecompressStream(archive)
 	if err != nil {
 		return err
 	}
+	defer decompressedArchive.Close()
 
-	tr := tar.NewReader(archive)
+	tr := tar.NewReader(decompressedArchive)
 
 	var dirs []*tar.Header
 
@@ -528,7 +529,7 @@ func CopyFileWithTar(src, dst string) (err error) {
 // CmdStream executes a command, and returns its stdout as a stream.
 // If the command fails to run or doesn't complete successfully, an error
 // will be returned, including anything written on stderr.
-func CmdStream(cmd *exec.Cmd, input io.Reader) (io.Reader, error) {
+func CmdStream(cmd *exec.Cmd, input io.Reader) (io.ReadCloser, error) {
 	if input != nil {
 		stdin, err := cmd.StdinPipe()
 		if err != nil {

From 12b909af8857fe5f6cc17672e463b7c249acff7f Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Fri, 14 Feb 2014 11:33:40 +0100
Subject: [PATCH 087/403] archive.TarFilter() - properly close readers

CompressStream() now always returns a stream that is closable, and it never
closes the underlying writer. TarFilter() makes sure the decompressed stream
is closed at the and, as well as the PipeWriter.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 804690bd07dcc1da6d0707d081e40ec9a189a3b6
Component: engine
---
 components/engine/archive/archive.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index a2b395d4b3..dd7dd70b13 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -106,7 +106,7 @@ func CompressStream(dest io.WriteCloser, compression Compression) (io.WriteClose
 
 	switch compression {
 	case Uncompressed:
-		return dest, nil
+		return utils.NopWriteCloser(dest), nil
 	case Gzip:
 		return gzip.NewWriter(dest), nil
 	case Bzip2, Xz:
@@ -337,6 +337,9 @@ func TarFilter(srcPath string, options *TarOptions) (io.Reader, error) {
 		if err := compressWriter.Close(); err != nil {
 			utils.Debugf("Can't close compress writer: %s\n", err)
 		}
+		if err := pipeWriter.Close(); err != nil {
+			utils.Debugf("Can't close pipe writer: %s\n", err)
+		}
 	}()
 
 	return pipeReader, nil

From e12f62e6dff83331e2bbbf8d2e3218e67ac1e5d6 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Fri, 14 Feb 2014 12:41:46 +0100
Subject: [PATCH 088/403] Properly close archives

All archive that are created from somewhere generally have to be closed, because
at some point there is a file or a pipe or something that backs them. So, we
make archive.Archive a ReadCloser. However, code consuming archives does not
typically close them so we add an archive.ArchiveReader and use that when we're
only reading.

We then change all the Tar/Archive places to create ReadClosers, and to properly
close them everywhere.

As an added bonus we can use ReadCloserWrapper rather than EofReader in several places,
which is good as EofReader doesn't always work right. For instance, many compression
schemes like gzip knows it is EOF before having read the EOF from the stream, so the
EofCloser never sees an EOF.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: f198ee525ad6862dce3940e08c72e0a092380a7b
Component: engine
---
 components/engine/archive/archive.go        | 19 ++++++++++++-------
 components/engine/archive/archive_test.go   |  5 +++--
 components/engine/archive/diff.go           |  2 +-
 components/engine/buildfile.go              |  1 +
 components/engine/commands.go               |  4 ++--
 components/engine/container.go              | 18 +++++++++++++++---
 components/engine/graph.go                  |  8 +++++---
 components/engine/graphdriver/aufs/aufs.go  |  2 +-
 components/engine/graphdriver/driver.go     |  2 +-
 components/engine/image.go                  | 14 +++++++++++---
 components/engine/integration/utils_test.go |  4 ++--
 components/engine/runtime.go                |  8 +++++++-
 components/engine/server.go                 | 14 ++++++++++----
 13 files changed, 71 insertions(+), 30 deletions(-)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index dd7dd70b13..3bd3af2761 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -19,9 +19,10 @@ import (
 )
 
 type (
-	Archive     io.Reader
-	Compression int
-	TarOptions  struct {
+	Archive       io.ReadCloser
+	ArchiveReader io.Reader
+	Compression   int
+	TarOptions    struct {
 		Includes    []string
 		Compression Compression
 	}
@@ -269,7 +270,7 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader *tar.Reader)
 
 // Tar creates an archive from the directory at `path`, and returns it as a
 // stream of bytes.
-func Tar(path string, compression Compression) (io.Reader, error) {
+func Tar(path string, compression Compression) (io.ReadCloser, error) {
 	return TarFilter(path, &TarOptions{Compression: compression})
 }
 
@@ -291,7 +292,7 @@ func escapeName(name string) string {
 
 // Tar creates an archive from the directory at `path`, only including files whose relative
 // paths are included in `filter`. If `filter` is nil, then all files are included.
-func TarFilter(srcPath string, options *TarOptions) (io.Reader, error) {
+func TarFilter(srcPath string, options *TarOptions) (io.ReadCloser, error) {
 	pipeReader, pipeWriter := io.Pipe()
 
 	compressWriter, err := CompressStream(pipeWriter, options.Compression)
@@ -436,15 +437,19 @@ func TarUntar(src string, dst string) error {
 	if err != nil {
 		return err
 	}
+	defer archive.Close()
 	return Untar(archive, dst, nil)
 }
 
 // UntarPath is a convenience function which looks for an archive
 // at filesystem path `src`, and unpacks it at `dst`.
 func UntarPath(src, dst string) error {
-	if archive, err := os.Open(src); err != nil {
+	archive, err := os.Open(src)
+	if err != nil {
 		return err
-	} else if err := Untar(archive, dst, nil); err != nil {
+	}
+	defer archive.Close()
+	if err := Untar(archive, dst, nil); err != nil {
 		return err
 	}
 	return nil
diff --git a/components/engine/archive/archive_test.go b/components/engine/archive/archive_test.go
index 891f977dcf..164fc8fe27 100644
--- a/components/engine/archive/archive_test.go
+++ b/components/engine/archive/archive_test.go
@@ -67,12 +67,13 @@ func tarUntar(t *testing.T, origin string, compression Compression) error {
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer archive.Close()
 
 	buf := make([]byte, 10)
 	if _, err := archive.Read(buf); err != nil {
 		return err
 	}
-	archive = io.MultiReader(bytes.NewReader(buf), archive)
+	wrap := io.MultiReader(bytes.NewReader(buf), archive)
 
 	detectedCompression := DetectCompression(buf)
 	if detectedCompression.Extension() != compression.Extension() {
@@ -84,7 +85,7 @@ func tarUntar(t *testing.T, origin string, compression Compression) error {
 		return err
 	}
 	defer os.RemoveAll(tmp)
-	if err := Untar(archive, tmp, nil); err != nil {
+	if err := Untar(wrap, tmp, nil); err != nil {
 		return err
 	}
 	if _, err := os.Stat(tmp); err != nil {
diff --git a/components/engine/archive/diff.go b/components/engine/archive/diff.go
index cdf06dd055..de1efacf34 100644
--- a/components/engine/archive/diff.go
+++ b/components/engine/archive/diff.go
@@ -28,7 +28,7 @@ func timeToTimespec(time time.Time) (ts syscall.Timespec) {
 
 // ApplyLayer parses a diff in the standard layer format from `layer`, and
 // applies it to the directory `dest`.
-func ApplyLayer(dest string, layer Archive) error {
+func ApplyLayer(dest string, layer ArchiveReader) error {
 	// We need to be able to set any perms
 	oldmask := syscall.Umask(0)
 	defer syscall.Umask(oldmask)
diff --git a/components/engine/buildfile.go b/components/engine/buildfile.go
index 445c4ae8ac..3ee63ea3fb 100644
--- a/components/engine/buildfile.go
+++ b/components/engine/buildfile.go
@@ -464,6 +464,7 @@ func (b *buildFile) CmdAdd(args string) error {
 		}
 		tarSum := utils.TarSum{Reader: r, DisableCompression: true}
 		remoteHash = tarSum.Sum(nil)
+		r.Close()
 
 		// If the destination is a directory, figure out the filename.
 		if strings.HasSuffix(dest, "/") {
diff --git a/components/engine/commands.go b/components/engine/commands.go
index 7efbcc7085..2d897385c7 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -158,7 +158,7 @@ func MkBuildContext(dockerfile string, files [][2]string) (archive.Archive, erro
 	if err := tw.Close(); err != nil {
 		return nil, err
 	}
-	return buf, nil
+	return ioutil.NopCloser(buf), nil
 }
 
 func (cli *DockerCli) CmdBuild(args ...string) error {
@@ -206,7 +206,7 @@ func (cli *DockerCli) CmdBuild(args ...string) error {
 	// FIXME: ProgressReader shouldn't be this annoying to use
 	if context != nil {
 		sf := utils.NewStreamFormatter(false)
-		body = utils.ProgressReader(ioutil.NopCloser(context), 0, cli.err, sf, true, "", "Uploading context")
+		body = utils.ProgressReader(context, 0, cli.err, sf, true, "", "Uploading context")
 	}
 	// Upload the build context
 	v := &url.Values{}
diff --git a/components/engine/container.go b/components/engine/container.go
index af28689810..3740a7fb73 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -1288,7 +1288,11 @@ func (container *Container) ExportRw() (archive.Archive, error) {
 		container.Unmount()
 		return nil, err
 	}
-	return EofReader(archive, func() { container.Unmount() }), nil
+	return utils.NewReadCloserWrapper(archive, func() error {
+		err := archive.Close()
+		container.Unmount()
+		return err
+	}), nil
 }
 
 func (container *Container) Export() (archive.Archive, error) {
@@ -1301,7 +1305,11 @@ func (container *Container) Export() (archive.Archive, error) {
 		container.Unmount()
 		return nil, err
 	}
-	return EofReader(archive, func() { container.Unmount() }), nil
+	return utils.NewReadCloserWrapper(archive, func() error {
+		err := archive.Close()
+		container.Unmount()
+		return err
+	}), nil
 }
 
 func (container *Container) WaitTimeout(timeout time.Duration) error {
@@ -1455,7 +1463,11 @@ func (container *Container) Copy(resource string) (io.ReadCloser, error) {
 	if err != nil {
 		return nil, err
 	}
-	return utils.NewReadCloserWrapper(archive, container.Unmount), nil
+	return utils.NewReadCloserWrapper(archive, func() error {
+		err := archive.Close()
+		container.Unmount()
+		return err
+	}), nil
 }
 
 // Returns true if the container exposes a certain port
diff --git a/components/engine/graph.go b/components/engine/graph.go
index 01cd50f4f0..a16a6ab7f7 100644
--- a/components/engine/graph.go
+++ b/components/engine/graph.go
@@ -127,7 +127,7 @@ func (graph *Graph) Get(name string) (*Image, error) {
 }
 
 // Create creates a new image and registers it in the graph.
-func (graph *Graph) Create(layerData archive.Archive, container *Container, comment, author string, config *runconfig.Config) (*Image, error) {
+func (graph *Graph) Create(layerData archive.ArchiveReader, container *Container, comment, author string, config *runconfig.Config) (*Image, error) {
 	img := &Image{
 		ID:            GenerateID(),
 		Comment:       comment,
@@ -151,7 +151,7 @@ func (graph *Graph) Create(layerData archive.Archive, container *Container, comm
 
 // Register imports a pre-existing image into the graph.
 // FIXME: pass img as first argument
-func (graph *Graph) Register(jsonData []byte, layerData archive.Archive, img *Image) (err error) {
+func (graph *Graph) Register(jsonData []byte, layerData archive.ArchiveReader, img *Image) (err error) {
 	defer func() {
 		// If any error occurs, remove the new dir from the driver.
 		// Don't check for errors since the dir might not have been created.
@@ -226,7 +226,9 @@ func (graph *Graph) TempLayerArchive(id string, compression archive.Compression,
 	if err != nil {
 		return nil, err
 	}
-	return archive.NewTempArchive(utils.ProgressReader(ioutil.NopCloser(a), 0, output, sf, false, utils.TruncateID(id), "Buffering to disk"), tmp)
+	progress := utils.ProgressReader(a, 0, output, sf, false, utils.TruncateID(id), "Buffering to disk")
+	defer progress.Close()
+	return archive.NewTempArchive(progress, tmp)
 }
 
 // Mktemp creates a temporary sub-directory inside the graph's filesystem.
diff --git a/components/engine/graphdriver/aufs/aufs.go b/components/engine/graphdriver/aufs/aufs.go
index d1cf87d1a0..f2a88a7ace 100644
--- a/components/engine/graphdriver/aufs/aufs.go
+++ b/components/engine/graphdriver/aufs/aufs.go
@@ -271,7 +271,7 @@ func (a *Driver) Diff(id string) (archive.Archive, error) {
 	})
 }
 
-func (a *Driver) ApplyDiff(id string, diff archive.Archive) error {
+func (a *Driver) ApplyDiff(id string, diff archive.ArchiveReader) error {
 	return archive.Untar(diff, path.Join(a.rootPath(), "diff", id), nil)
 }
 
diff --git a/components/engine/graphdriver/driver.go b/components/engine/graphdriver/driver.go
index c0ed00b0ad..89fd03a624 100644
--- a/components/engine/graphdriver/driver.go
+++ b/components/engine/graphdriver/driver.go
@@ -28,7 +28,7 @@ type Driver interface {
 type Differ interface {
 	Diff(id string) (archive.Archive, error)
 	Changes(id string) ([]archive.Change, error)
-	ApplyDiff(id string, diff archive.Archive) error
+	ApplyDiff(id string, diff archive.ArchiveReader) error
 	DiffSize(id string) (bytes int64, err error)
 }
 
diff --git a/components/engine/image.go b/components/engine/image.go
index 593dc14f00..fa5b65787c 100644
--- a/components/engine/image.go
+++ b/components/engine/image.go
@@ -67,7 +67,7 @@ func LoadImage(root string) (*Image, error) {
 	return img, nil
 }
 
-func StoreImage(img *Image, jsonData []byte, layerData archive.Archive, root, layer string) error {
+func StoreImage(img *Image, jsonData []byte, layerData archive.ArchiveReader, root, layer string) error {
 	// Store the layer
 	var (
 		size   int64
@@ -174,7 +174,11 @@ func (img *Image) TarLayer() (arch archive.Archive, err error) {
 		if err != nil {
 			return nil, err
 		}
-		return EofReader(archive, func() { driver.Put(img.ID) }), nil
+		return utils.NewReadCloserWrapper(archive, func() error {
+			err := archive.Close()
+			driver.Put(img.ID)
+			return err
+		}), nil
 	}
 
 	parentFs, err := driver.Get(img.Parent)
@@ -190,7 +194,11 @@ func (img *Image) TarLayer() (arch archive.Archive, err error) {
 	if err != nil {
 		return nil, err
 	}
-	return EofReader(archive, func() { driver.Put(img.ID) }), nil
+	return utils.NewReadCloserWrapper(archive, func() error {
+		err := archive.Close()
+		driver.Put(img.ID)
+		return err
+	}), nil
 }
 
 func ValidateID(id string) error {
diff --git a/components/engine/integration/utils_test.go b/components/engine/integration/utils_test.go
index 6b0f458564..77328b2511 100644
--- a/components/engine/integration/utils_test.go
+++ b/components/engine/integration/utils_test.go
@@ -319,7 +319,7 @@ func runContainer(eng *engine.Engine, r *docker.Runtime, args []string, t *testi
 }
 
 // FIXME: this is duplicated from graph_test.go in the docker package.
-func fakeTar() (io.Reader, error) {
+func fakeTar() (io.ReadCloser, error) {
 	content := []byte("Hello world!\n")
 	buf := new(bytes.Buffer)
 	tw := tar.NewWriter(buf)
@@ -333,7 +333,7 @@ func fakeTar() (io.Reader, error) {
 		tw.Write([]byte(content))
 	}
 	tw.Close()
-	return buf, nil
+	return ioutil.NopCloser(buf), nil
 }
 
 func getAllImages(eng *engine.Engine, t *testing.T) *engine.Table {
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 828d3f0e66..872808d941 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -531,6 +531,8 @@ func (runtime *Runtime) Commit(container *Container, repository, tag, comment, a
 	if err != nil {
 		return nil, err
 	}
+	defer rwTar.Close()
+
 	// Create a new image from the container's base layers + a new layer from container changes
 	img, err := runtime.graph.Create(rwTar, container, comment, author, config)
 	if err != nil {
@@ -817,7 +819,11 @@ func (runtime *Runtime) Diff(container *Container) (archive.Archive, error) {
 	if err != nil {
 		return nil, err
 	}
-	return EofReader(archive, func() { runtime.driver.Put(container.ID) }), nil
+	return utils.NewReadCloserWrapper(archive, func() error {
+		err := archive.Close()
+		runtime.driver.Put(container.ID)
+		return err
+	}), nil
 }
 
 func (runtime *Runtime) Run(c *Container, startCallback execdriver.StartCallback) (int, error) {
diff --git a/components/engine/server.go b/components/engine/server.go
index 440bab2bbd..daf05ec67a 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -292,6 +292,7 @@ func (srv *Server) ContainerExport(job *engine.Job) engine.Status {
 		if err != nil {
 			return job.Errorf("%s: %s", name, err)
 		}
+		defer data.Close()
 
 		// Stream the entire contents of the container (basically a volatile snapshot)
 		if _, err := io.Copy(job.Stdout, data); err != nil {
@@ -361,6 +362,7 @@ func (srv *Server) ImageExport(job *engine.Job) engine.Status {
 	if err != nil {
 		return job.Error(err)
 	}
+	defer fs.Close()
 
 	if _, err := io.Copy(job.Stdout, fs); err != nil {
 		return job.Error(err)
@@ -400,6 +402,7 @@ func (srv *Server) exportImage(image *Image, tempdir string) error {
 		if err != nil {
 			return err
 		}
+		defer fs.Close()
 
 		fsTar, err := os.Create(path.Join(tmpImageDir, "layer.tar"))
 		if err != nil {
@@ -436,14 +439,14 @@ func (srv *Server) Build(job *engine.Job) engine.Status {
 		authConfig     = &auth.AuthConfig{}
 		configFile     = &auth.ConfigFile{}
 		tag            string
-		context        io.Reader
+		context        io.ReadCloser
 	)
 	job.GetenvJson("authConfig", authConfig)
 	job.GetenvJson("configFile", configFile)
 	repoName, tag = utils.ParseRepositoryTag(repoName)
 
 	if remoteURL == "" {
-		context = job.Stdin
+		context = ioutil.NopCloser(job.Stdin)
 	} else if utils.IsGIT(remoteURL) {
 		if !strings.HasPrefix(remoteURL, "git://") {
 			remoteURL = "https://" + remoteURL
@@ -479,6 +482,7 @@ func (srv *Server) Build(job *engine.Job) engine.Status {
 		}
 		context = c
 	}
+	defer context.Close()
 
 	sf := utils.NewStreamFormatter(job.GetenvBool("json"))
 	b := NewBuildFile(srv,
@@ -1575,7 +1579,7 @@ func (srv *Server) ImageImport(job *engine.Job) engine.Status {
 		repo    = job.Args[1]
 		tag     string
 		sf      = utils.NewStreamFormatter(job.GetenvBool("json"))
-		archive io.Reader
+		archive archive.ArchiveReader
 		resp    *http.Response
 	)
 	if len(job.Args) > 2 {
@@ -1601,7 +1605,9 @@ func (srv *Server) ImageImport(job *engine.Job) engine.Status {
 		if err != nil {
 			return job.Error(err)
 		}
-		archive = utils.ProgressReader(resp.Body, int(resp.ContentLength), job.Stdout, sf, true, "", "Importing")
+		progressReader := utils.ProgressReader(resp.Body, int(resp.ContentLength), job.Stdout, sf, true, "", "Importing")
+		defer progressReader.Close()
+		archive = progressReader
 	}
 	img, err := srv.runtime.graph.Create(archive, nil, "Imported from "+src, "", nil)
 	if err != nil {

From 13aaf53921c4020482f0c7869dd75ed97fd1d28f Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Fri, 14 Feb 2014 13:00:18 +0100
Subject: [PATCH 089/403] Drop EofReader

This is not used any more

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: d8c888b3f85a99e9f94348bb71a852b59162464a
Component: engine
---
 components/engine/utils.go | 27 ---------------------------
 1 file changed, 27 deletions(-)

diff --git a/components/engine/utils.go b/components/engine/utils.go
index 68cd2f24e5..ef666b0de1 100644
--- a/components/engine/utils.go
+++ b/components/engine/utils.go
@@ -6,8 +6,6 @@ import (
 	"github.com/dotcloud/docker/pkg/namesgenerator"
 	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
-	"io"
-	"sync/atomic"
 )
 
 type Change struct {
@@ -56,28 +54,3 @@ func (c *checker) Exists(name string) bool {
 func generateRandomName(runtime *Runtime) (string, error) {
 	return namesgenerator.GenerateRandomName(&checker{runtime})
 }
-
-// Read an io.Reader and call a function when it returns EOF
-func EofReader(r io.Reader, callback func()) *eofReader {
-	return &eofReader{
-		Reader:   r,
-		callback: callback,
-	}
-}
-
-type eofReader struct {
-	io.Reader
-	gotEOF   int32
-	callback func()
-}
-
-func (r *eofReader) Read(p []byte) (n int, err error) {
-	n, err = r.Reader.Read(p)
-	if err == io.EOF {
-		// Use atomics to make the gotEOF check threadsafe
-		if atomic.CompareAndSwapInt32(&r.gotEOF, 0, 1) {
-			r.callback()
-		}
-	}
-	return
-}

From c4982cc0521a53ff159d5bd79fbf0c4e8787e3ed Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 11:42:47 -0800
Subject: [PATCH 090/403] Improve error message for 404 returned by daemon
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 190504472b4598eff7d7f6f53df4f813975ff5bb Component: engine

---
 components/engine/commands.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/components/engine/commands.go b/components/engine/commands.go
index 7efbcc7085..bd9bdfd876 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -2118,7 +2118,9 @@ func (cli *DockerCli) call(method, path string, data interface{}, passAuthInfo b
 		return nil, -1, err
 	}
 
-	if resp.StatusCode < 200 || resp.StatusCode >= 400 {
+	if resp.StatusCode == 404 {
+		return nil, resp.StatusCode, fmt.Errorf("Error: request for %s returned 404 Not Found for the api version", req.URL)
+	} else if resp.StatusCode < 200 || resp.StatusCode >= 400 {
 		body, err := ioutil.ReadAll(resp.Body)
 		if err != nil {
 			return nil, -1, err

From 07f1d747db96ced7924cb20a4775290197d3965f Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 12:12:35 -0800
Subject: [PATCH 091/403] Add new functions to unsupported file
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 17719cab91e175a7bd11f9852e27638df1202b8b Component: engine

---
 .../engine/pkg/netlink/netlink_unsupported.go | 42 +++++++++++++++----
 1 file changed, 35 insertions(+), 7 deletions(-)

diff --git a/components/engine/pkg/netlink/netlink_unsupported.go b/components/engine/pkg/netlink/netlink_unsupported.go
index cd796b373f..bd9e962d35 100644
--- a/components/engine/pkg/netlink/netlink_unsupported.go
+++ b/components/engine/pkg/netlink/netlink_unsupported.go
@@ -3,31 +3,59 @@
 package netlink
 
 import (
-	"fmt"
+	"errors"
 	"net"
 )
 
+var (
+	ErrNotImplemented = errors.New("not implemented")
+)
+
 func NetworkGetRoutes() ([]Route, error) {
-	return nil, fmt.Errorf("Not implemented")
+	return nil, ErrNotImplemented
 }
 
 func NetworkLinkAdd(name string, linkType string) error {
-	return fmt.Errorf("Not implemented")
+	return ErrNotImplemented
 }
 
 func NetworkLinkUp(iface *net.Interface) error {
-	return fmt.Errorf("Not implemented")
+	return ErrNotImplemented
 }
 
 func NetworkLinkAddIp(iface *net.Interface, ip net.IP, ipNet *net.IPNet) error {
-	return fmt.Errorf("Not implemented")
+	return ErrNotImplemented
 }
 
 func AddDefaultGw(ip net.IP) error {
-	return fmt.Errorf("Not implemented")
+	return ErrNotImplemented
 
 }
 
 func NetworkSetMTU(iface *net.Interface, mtu int) error {
-	return fmt.Errorf("Not implemented")
+	return ErrNotImplemented
+}
+
+func NetworkCreateVethPair(name1, name2 string) error {
+	return ErrNotImplemented
+}
+
+func NetworkChangeName(iface *net.Interface, newName string) error {
+	return ErrNotImplemented
+}
+
+func NetworkSetNsFd(iface *net.Interface, fd int) error {
+	return ErrNotImplemented
+}
+
+func NetworkSetNsPid(iface *net.Interface, nspid int) error {
+	return ErrNotImplemented
+}
+
+func NetworkSetMaster(iface, master *net.Interface) error {
+	return ErrNotImplemented
+}
+
+func NetworkLinkDown(iface *net.Interface) error {
+	return ErrNotImplemented
 }

From afbbdb7fc1a7d9fc78ed96e8aa9f17407c50743e Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 15:17:12 -0800
Subject: [PATCH 092/403] Update fixme Docker-DCO-1.1-Signed-off-by: Michael
 Crosby <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 106079daca36e8c5595c3f05eb183c9919016e4e Component: engine

---
 components/engine/FIXME | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/components/engine/FIXME b/components/engine/FIXME
index 91c8d92835..4f27d36856 100644
--- a/components/engine/FIXME
+++ b/components/engine/FIXME
@@ -11,20 +11,14 @@ They are just like FIXME comments in the source code, except we're not sure wher
 to put them - so we put them here :)
 
 
-* Merge Runtime, Server and Builder into Runtime
 * Run linter on codebase
 * Unify build commands and regular commands
 * Move source code into src/ subdir for clarity
 * docker build: on non-existent local path for ADD, don't show full absolute path on the host
-* docker tag foo REPO:TAG
 * use size header for progress bar in pull
 * Clean up context upload in build!!!
 * Parallel pull
-* Always generate a resolv.conf per container, to avoid changing resolv.conf under thne container's feet
-* Save metadata with import/export (#1974)
 * Upgrade dockerd without stopping containers
 * Simple command to remove all untagged images (`docker rmi $(docker images | awk '/^<none>/ { print $3 }')`)
 * Simple command to clean up containers for disk space
-* Caching after an ADD (#880)
 * Clean up the ProgressReader api, it's a PITA to use
-* Use netlink instead of iproute2/iptables (#925)

From 48bceec5a64412ac1b38acab904046808822b9aa Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 15:32:39 -0800
Subject: [PATCH 093/403] Remove unused reflink files
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 055bfb699bb232c7e490c38d3a71c81870781c74 Component: engine

---
 components/engine/reflink_copy_linux.go       | 55 -------------------
 components/engine/reflink_copy_unsupported.go | 16 ------
 2 files changed, 71 deletions(-)
 delete mode 100644 components/engine/reflink_copy_linux.go
 delete mode 100644 components/engine/reflink_copy_unsupported.go

diff --git a/components/engine/reflink_copy_linux.go b/components/engine/reflink_copy_linux.go
deleted file mode 100644
index 74a0cb98f7..0000000000
--- a/components/engine/reflink_copy_linux.go
+++ /dev/null
@@ -1,55 +0,0 @@
-// +build amd64
-
-package docker
-
-// FIXME: This could be easily rewritten in pure Go
-
-/*
-#include <sys/ioctl.h>
-#include <linux/fs.h>
-#include <errno.h>
-
-// See linux.git/fs/btrfs/ioctl.h
-#define BTRFS_IOCTL_MAGIC 0x94
-#define BTRFS_IOC_CLONE _IOW(BTRFS_IOCTL_MAGIC, 9, int)
-
-int
-btrfs_reflink(int fd_out, int fd_in)
-{
-  int res;
-  res = ioctl(fd_out, BTRFS_IOC_CLONE, fd_in);
-  if (res < 0)
-    return errno;
-  return 0;
-}
-
-*/
-import "C"
-
-import (
-	"io"
-	"os"
-	"syscall"
-)
-
-// FIXME: Move this to btrfs package?
-
-func BtrfsReflink(fd_out, fd_in uintptr) error {
-	res := C.btrfs_reflink(C.int(fd_out), C.int(fd_in))
-	if res != 0 {
-		return syscall.Errno(res)
-	}
-	return nil
-}
-
-func CopyFile(dstFile, srcFile *os.File) error {
-	err := BtrfsReflink(dstFile.Fd(), srcFile.Fd())
-	if err == nil {
-		return nil
-	}
-
-	// Fall back to normal copy
-	// FIXME: Check the return of Copy and compare with dstFile.Stat().Size
-	_, err = io.Copy(dstFile, srcFile)
-	return err
-}
diff --git a/components/engine/reflink_copy_unsupported.go b/components/engine/reflink_copy_unsupported.go
deleted file mode 100644
index 271ed0178f..0000000000
--- a/components/engine/reflink_copy_unsupported.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// +build !linux !amd64
-
-package docker
-
-import (
-	"io"
-	"os"
-)
-
-func CopyFile(dstFile, srcFile *os.File) error {
-	// No BTRFS reflink suppport, Fall back to normal copy
-
-	// FIXME: Check the return of Copy and compare with dstFile.Stat().Size
-	_, err := io.Copy(dstFile, srcFile)
-	return err
-}

From 690b93143ab879f8b0b347ae1e1be521cceaa873 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 15:25:25 -0800
Subject: [PATCH 094/403] Move proxy into pkg Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 8c39db8f96ac2a7ec479a679bc060410cee1a567 Component: engine

---
 .../engine/networkdriver/portmapper/mapper.go |  2 +-
 .../networkdriver/portmapper/mapper_test.go   |  2 +-
 components/engine/{ => pkg}/proxy/MAINTAINERS |  0
 .../{ => pkg}/proxy/network_proxy_test.go     |  0
 components/engine/{ => pkg}/proxy/proxy.go    |  0
 .../engine/{ => pkg}/proxy/stub_proxy.go      |  0
 .../engine/{ => pkg}/proxy/tcp_proxy.go       | 10 +++----
 .../engine/{ => pkg}/proxy/udp_proxy.go       | 26 +++++++++++++------
 components/engine/utils/utils.go              | 10 -------
 9 files changed, 25 insertions(+), 25 deletions(-)
 rename components/engine/{ => pkg}/proxy/MAINTAINERS (100%)
 rename components/engine/{ => pkg}/proxy/network_proxy_test.go (100%)
 rename components/engine/{ => pkg}/proxy/proxy.go (100%)
 rename components/engine/{ => pkg}/proxy/stub_proxy.go (100%)
 rename components/engine/{ => pkg}/proxy/tcp_proxy.go (81%)
 rename components/engine/{ => pkg}/proxy/udp_proxy.go (77%)

diff --git a/components/engine/networkdriver/portmapper/mapper.go b/components/engine/networkdriver/portmapper/mapper.go
index f052c48143..e29959a245 100644
--- a/components/engine/networkdriver/portmapper/mapper.go
+++ b/components/engine/networkdriver/portmapper/mapper.go
@@ -4,7 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/iptables"
-	"github.com/dotcloud/docker/proxy"
+	"github.com/dotcloud/docker/pkg/proxy"
 	"net"
 	"sync"
 )
diff --git a/components/engine/networkdriver/portmapper/mapper_test.go b/components/engine/networkdriver/portmapper/mapper_test.go
index 05718063e3..4c09f3c651 100644
--- a/components/engine/networkdriver/portmapper/mapper_test.go
+++ b/components/engine/networkdriver/portmapper/mapper_test.go
@@ -2,7 +2,7 @@ package portmapper
 
 import (
 	"github.com/dotcloud/docker/pkg/iptables"
-	"github.com/dotcloud/docker/proxy"
+	"github.com/dotcloud/docker/pkg/proxy"
 	"net"
 	"testing"
 )
diff --git a/components/engine/proxy/MAINTAINERS b/components/engine/pkg/proxy/MAINTAINERS
similarity index 100%
rename from components/engine/proxy/MAINTAINERS
rename to components/engine/pkg/proxy/MAINTAINERS
diff --git a/components/engine/proxy/network_proxy_test.go b/components/engine/pkg/proxy/network_proxy_test.go
similarity index 100%
rename from components/engine/proxy/network_proxy_test.go
rename to components/engine/pkg/proxy/network_proxy_test.go
diff --git a/components/engine/proxy/proxy.go b/components/engine/pkg/proxy/proxy.go
similarity index 100%
rename from components/engine/proxy/proxy.go
rename to components/engine/pkg/proxy/proxy.go
diff --git a/components/engine/proxy/stub_proxy.go b/components/engine/pkg/proxy/stub_proxy.go
similarity index 100%
rename from components/engine/proxy/stub_proxy.go
rename to components/engine/pkg/proxy/stub_proxy.go
diff --git a/components/engine/proxy/tcp_proxy.go b/components/engine/pkg/proxy/tcp_proxy.go
similarity index 81%
rename from components/engine/proxy/tcp_proxy.go
rename to components/engine/pkg/proxy/tcp_proxy.go
index e7c460f61d..b84483eff9 100644
--- a/components/engine/proxy/tcp_proxy.go
+++ b/components/engine/pkg/proxy/tcp_proxy.go
@@ -1,7 +1,6 @@
 package proxy
 
 import (
-	"github.com/dotcloud/docker/utils"
 	"io"
 	"log"
 	"net"
@@ -49,7 +48,8 @@ func (proxy *TCPProxy) clientLoop(client *net.TCPConn, quit chan bool) {
 		to.CloseRead()
 		event <- written
 	}
-	utils.Debugf("Forwarding traffic between tcp/%v and tcp/%v", client.RemoteAddr(), backend.RemoteAddr())
+
+	log.Printf("Forwarding traffic between tcp/%v and tcp/%v", client.RemoteAddr(), backend.RemoteAddr())
 	go broker(client, backend)
 	go broker(backend, client)
 
@@ -71,17 +71,17 @@ func (proxy *TCPProxy) clientLoop(client *net.TCPConn, quit chan bool) {
 	client.Close()
 	backend.Close()
 done:
-	utils.Debugf("%v bytes transferred between tcp/%v and tcp/%v", transferred, client.RemoteAddr(), backend.RemoteAddr())
+	log.Printf("%v bytes transferred between tcp/%v and tcp/%v", transferred, client.RemoteAddr(), backend.RemoteAddr())
 }
 
 func (proxy *TCPProxy) Run() {
 	quit := make(chan bool)
 	defer close(quit)
-	utils.Debugf("Starting proxy on tcp/%v for tcp/%v", proxy.frontendAddr, proxy.backendAddr)
+	log.Printf("Starting proxy on tcp/%v for tcp/%v", proxy.frontendAddr, proxy.backendAddr)
 	for {
 		client, err := proxy.listener.Accept()
 		if err != nil {
-			utils.Debugf("Stopping proxy on tcp/%v for tcp/%v (%v)", proxy.frontendAddr, proxy.backendAddr, err.Error())
+			log.Printf("Stopping proxy on tcp/%v for tcp/%v (%v)", proxy.frontendAddr, proxy.backendAddr, err.Error())
 			return
 		}
 		go proxy.clientLoop(client.(*net.TCPConn), quit)
diff --git a/components/engine/proxy/udp_proxy.go b/components/engine/pkg/proxy/udp_proxy.go
similarity index 77%
rename from components/engine/proxy/udp_proxy.go
rename to components/engine/pkg/proxy/udp_proxy.go
index 7d34988f70..9395516464 100644
--- a/components/engine/proxy/udp_proxy.go
+++ b/components/engine/pkg/proxy/udp_proxy.go
@@ -2,9 +2,9 @@ package proxy
 
 import (
 	"encoding/binary"
-	"github.com/dotcloud/docker/utils"
 	"log"
 	"net"
+	"strings"
 	"sync"
 	"syscall"
 	"time"
@@ -66,7 +66,7 @@ func (proxy *UDPProxy) replyLoop(proxyConn *net.UDPConn, clientAddr *net.UDPAddr
 		proxy.connTrackLock.Lock()
 		delete(proxy.connTrackTable, *clientKey)
 		proxy.connTrackLock.Unlock()
-		utils.Debugf("Done proxying between udp/%v and udp/%v", clientAddr.String(), proxy.backendAddr.String())
+		log.Printf("Done proxying between udp/%v and udp/%v", clientAddr.String(), proxy.backendAddr.String())
 		proxyConn.Close()
 	}()
 
@@ -92,24 +92,24 @@ func (proxy *UDPProxy) replyLoop(proxyConn *net.UDPConn, clientAddr *net.UDPAddr
 				return
 			}
 			i += written
-			utils.Debugf("Forwarded %v/%v bytes to udp/%v", i, read, clientAddr.String())
+			log.Printf("Forwarded %v/%v bytes to udp/%v", i, read, clientAddr.String())
 		}
 	}
 }
 
 func (proxy *UDPProxy) Run() {
 	readBuf := make([]byte, UDPBufSize)
-	utils.Debugf("Starting proxy on udp/%v for udp/%v", proxy.frontendAddr, proxy.backendAddr)
+	log.Printf("Starting proxy on udp/%v for udp/%v", proxy.frontendAddr, proxy.backendAddr)
 	for {
 		read, from, err := proxy.listener.ReadFromUDP(readBuf)
 		if err != nil {
 			// NOTE: Apparently ReadFrom doesn't return
 			// ECONNREFUSED like Read do (see comment in
 			// UDPProxy.replyLoop)
-			if utils.IsClosedError(err) {
-				utils.Debugf("Stopping proxy on udp/%v for udp/%v (socket was closed)", proxy.frontendAddr, proxy.backendAddr)
+			if isClosedError(err) {
+				log.Printf("Stopping proxy on udp/%v for udp/%v (socket was closed)", proxy.frontendAddr, proxy.backendAddr)
 			} else {
-				utils.Errorf("Stopping proxy on udp/%v for udp/%v (%v)", proxy.frontendAddr, proxy.backendAddr, err.Error())
+				log.Printf("Stopping proxy on udp/%v for udp/%v (%v)", proxy.frontendAddr, proxy.backendAddr, err.Error())
 			}
 			break
 		}
@@ -134,7 +134,7 @@ func (proxy *UDPProxy) Run() {
 				break
 			}
 			i += written
-			utils.Debugf("Forwarded %v/%v bytes to udp/%v", i, read, proxy.backendAddr.String())
+			log.Printf("Forwarded %v/%v bytes to udp/%v", i, read, proxy.backendAddr.String())
 		}
 	}
 }
@@ -150,3 +150,13 @@ func (proxy *UDPProxy) Close() {
 
 func (proxy *UDPProxy) FrontendAddr() net.Addr { return proxy.frontendAddr }
 func (proxy *UDPProxy) BackendAddr() net.Addr  { return proxy.backendAddr }
+
+func isClosedError(err error) bool {
+	/* This comparison is ugly, but unfortunately, net.go doesn't export errClosing.
+	 * See:
+	 * http://golang.org/src/pkg/net/net.go
+	 * https://code.google.com/p/go/issues/detail?id=4337
+	 * https://groups.google.com/forum/#!msg/golang-nuts/0_aaCvBmOcM/SptmDyX1XJMJ
+	 */
+	return strings.HasSuffix(err.Error(), "use of closed network connection")
+}
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 2f7e408621..1aba80ff41 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -879,16 +879,6 @@ func ShellQuoteArguments(args []string) string {
 	return buf.String()
 }
 
-func IsClosedError(err error) bool {
-	/* This comparison is ugly, but unfortunately, net.go doesn't export errClosing.
-	 * See:
-	 * http://golang.org/src/pkg/net/net.go
-	 * https://code.google.com/p/go/issues/detail?id=4337
-	 * https://groups.google.com/forum/#!msg/golang-nuts/0_aaCvBmOcM/SptmDyX1XJMJ
-	 */
-	return strings.HasSuffix(err.Error(), "use of closed network connection")
-}
-
 func PartParser(template, data string) (map[string]string, error) {
 	// ip:public:private
 	var (

From 39bda86fa5f3d6bb9331e109fcf26d7f062a2767 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 17:15:40 -0800
Subject: [PATCH 095/403] Move volumes out of container.go and into volumes.go

This helps clean up the container file and move volumes into
one location.  We currently cannot move volumes to a sub pkg
because they depend on Container and also modify fields on the
container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: bd54d40f68f78093d6a252e96f8d17f7021af7b5
Component: engine
---
 components/engine/container.go | 308 +-----------------------------
 components/engine/volumes.go   | 332 +++++++++++++++++++++++++++++++++
 2 files changed, 339 insertions(+), 301 deletions(-)
 create mode 100644 components/engine/volumes.go

diff --git a/components/engine/container.go b/components/engine/container.go
index 3740a7fb73..95b48e07f7 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -9,7 +9,6 @@ import (
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/nat"
-	"github.com/dotcloud/docker/pkg/mount"
 	"github.com/dotcloud/docker/pkg/term"
 	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
@@ -19,7 +18,6 @@ import (
 	"log"
 	"os"
 	"path"
-	"path/filepath"
 	"strings"
 	"sync"
 	"syscall"
@@ -27,8 +25,10 @@ import (
 )
 
 var (
-	ErrNotATTY = errors.New("The PTY is not a file")
-	ErrNoTTY   = errors.New("No PTY found")
+	ErrNotATTY               = errors.New("The PTY is not a file")
+	ErrNoTTY                 = errors.New("No PTY found")
+	ErrContainerStart        = errors.New("The container failed to start. Unknown error")
+	ErrContainerStartTimeout = errors.New("The container failed to start due to timed out.")
 )
 
 type Container struct {
@@ -74,17 +74,6 @@ type Container struct {
 	activeLinks map[string]*Link
 }
 
-type BindMap struct {
-	SrcPath string
-	DstPath string
-	Mode    string
-}
-
-var (
-	ErrContainerStart        = errors.New("The container failed to start. Unknown error")
-	ErrContainerStartTimeout = errors.New("The container failed to start due to timed out.")
-)
-
 // FIXME: move deprecated port stuff to nat to clean up the core.
 type PortMapping map[string]string // Deprecated
 
@@ -503,17 +492,7 @@ func (container *Container) Start() (err error) {
 		log.Printf("WARNING: IPv4 forwarding is disabled. Networking will not work")
 	}
 
-	if container.Volumes == nil || len(container.Volumes) == 0 {
-		container.Volumes = make(map[string]string)
-		container.VolumesRW = make(map[string]bool)
-	}
-
-	// Apply volumes from another container if requested
-	if err := container.applyExternalVolumes(); err != nil {
-		return err
-	}
-
-	if err := container.createVolumes(); err != nil {
+	if err := prepareVolumesForContainer(container); err != nil {
 		return err
 	}
 
@@ -587,62 +566,10 @@ func (container *Container) Start() (err error) {
 		return err
 	}
 
-	// Setup the root fs as a bind mount of the base fs
-	root := container.RootfsPath()
-	if err := os.MkdirAll(root, 0755); err != nil && !os.IsExist(err) {
-		return nil
-	}
-
-	// Create a bind mount of the base fs as a place where we can add mounts
-	// without affecting the ability to access the base fs
-	if err := mount.Mount(container.basefs, root, "none", "bind,rw"); err != nil {
+	if err := mountVolumesForContainer(container, envPath); err != nil {
 		return err
 	}
 
-	// Make sure the root fs is private so the mounts here don't propagate to basefs
-	if err := mount.ForceMount(root, root, "none", "private"); err != nil {
-		return err
-	}
-
-	// Mount docker specific files into the containers root fs
-	if err := mount.Mount(runtime.sysInitPath, path.Join(root, "/.dockerinit"), "none", "bind,ro"); err != nil {
-		return err
-	}
-	if err := mount.Mount(envPath, path.Join(root, "/.dockerenv"), "none", "bind,ro"); err != nil {
-		return err
-	}
-	if err := mount.Mount(container.ResolvConfPath, path.Join(root, "/etc/resolv.conf"), "none", "bind,ro"); err != nil {
-		return err
-	}
-
-	if container.HostnamePath != "" && container.HostsPath != "" {
-		if err := mount.Mount(container.HostnamePath, path.Join(root, "/etc/hostname"), "none", "bind,ro"); err != nil {
-			return err
-		}
-		if err := mount.Mount(container.HostsPath, path.Join(root, "/etc/hosts"), "none", "bind,ro"); err != nil {
-			return err
-		}
-	}
-
-	// Mount user specified volumes
-	for r, v := range container.Volumes {
-		mountAs := "ro"
-		if container.VolumesRW[r] {
-			mountAs = "rw"
-		}
-
-		r = path.Join(root, r)
-		if p, err := utils.FollowSymlinkInScope(r, root); err != nil {
-			return err
-		} else {
-			r = p
-		}
-
-		if err := mount.Mount(v, r, "none", fmt.Sprintf("bind,%s", mountAs)); err != nil {
-			return err
-		}
-	}
-
 	populateCommand(container)
 
 	// Setup logging of stdout and stderr to disk
@@ -695,205 +622,6 @@ func (container *Container) Start() (err error) {
 	return nil
 }
 
-func (container *Container) getBindMap() (map[string]BindMap, error) {
-	// Create the requested bind mounts
-	binds := make(map[string]BindMap)
-	// Define illegal container destinations
-	illegalDsts := []string{"/", "."}
-
-	for _, bind := range container.hostConfig.Binds {
-		// FIXME: factorize bind parsing in parseBind
-		var src, dst, mode string
-		arr := strings.Split(bind, ":")
-		if len(arr) == 2 {
-			src = arr[0]
-			dst = arr[1]
-			mode = "rw"
-		} else if len(arr) == 3 {
-			src = arr[0]
-			dst = arr[1]
-			mode = arr[2]
-		} else {
-			return nil, fmt.Errorf("Invalid bind specification: %s", bind)
-		}
-
-		// Bail if trying to mount to an illegal destination
-		for _, illegal := range illegalDsts {
-			if dst == illegal {
-				return nil, fmt.Errorf("Illegal bind destination: %s", dst)
-			}
-		}
-
-		bindMap := BindMap{
-			SrcPath: src,
-			DstPath: dst,
-			Mode:    mode,
-		}
-		binds[path.Clean(dst)] = bindMap
-	}
-	return binds, nil
-}
-
-func (container *Container) createVolumes() error {
-	binds, err := container.getBindMap()
-	if err != nil {
-		return err
-	}
-	volumesDriver := container.runtime.volumes.driver
-	// Create the requested volumes if they don't exist
-	for volPath := range container.Config.Volumes {
-		volPath = path.Clean(volPath)
-		volIsDir := true
-		// Skip existing volumes
-		if _, exists := container.Volumes[volPath]; exists {
-			continue
-		}
-		var srcPath string
-		var isBindMount bool
-		srcRW := false
-		// If an external bind is defined for this volume, use that as a source
-		if bindMap, exists := binds[volPath]; exists {
-			isBindMount = true
-			srcPath = bindMap.SrcPath
-			if strings.ToLower(bindMap.Mode) == "rw" {
-				srcRW = true
-			}
-			if stat, err := os.Stat(bindMap.SrcPath); err != nil {
-				return err
-			} else {
-				volIsDir = stat.IsDir()
-			}
-			// Otherwise create an directory in $ROOT/volumes/ and use that
-		} else {
-
-			// Do not pass a container as the parameter for the volume creation.
-			// The graph driver using the container's information ( Image ) to
-			// create the parent.
-			c, err := container.runtime.volumes.Create(nil, nil, "", "", nil)
-			if err != nil {
-				return err
-			}
-			srcPath, err = volumesDriver.Get(c.ID)
-			if err != nil {
-				return fmt.Errorf("Driver %s failed to get volume rootfs %s: %s", volumesDriver, c.ID, err)
-			}
-			srcRW = true // RW by default
-		}
-
-		if p, err := filepath.EvalSymlinks(srcPath); err != nil {
-			return err
-		} else {
-			srcPath = p
-		}
-
-		container.Volumes[volPath] = srcPath
-		container.VolumesRW[volPath] = srcRW
-
-		// Create the mountpoint
-		volPath = path.Join(container.basefs, volPath)
-		rootVolPath, err := utils.FollowSymlinkInScope(volPath, container.basefs)
-		if err != nil {
-			return err
-		}
-
-		if _, err := os.Stat(rootVolPath); err != nil {
-			if os.IsNotExist(err) {
-				if volIsDir {
-					if err := os.MkdirAll(rootVolPath, 0755); err != nil {
-						return err
-					}
-				} else {
-					if err := os.MkdirAll(path.Dir(rootVolPath), 0755); err != nil {
-						return err
-					}
-					if f, err := os.OpenFile(rootVolPath, os.O_CREATE, 0755); err != nil {
-						return err
-					} else {
-						f.Close()
-					}
-				}
-			}
-		}
-
-		// Do not copy or change permissions if we are mounting from the host
-		if srcRW && !isBindMount {
-			volList, err := ioutil.ReadDir(rootVolPath)
-			if err != nil {
-				return err
-			}
-			if len(volList) > 0 {
-				srcList, err := ioutil.ReadDir(srcPath)
-				if err != nil {
-					return err
-				}
-				if len(srcList) == 0 {
-					// If the source volume is empty copy files from the root into the volume
-					if err := archive.CopyWithTar(rootVolPath, srcPath); err != nil {
-						return err
-					}
-
-					var stat syscall.Stat_t
-					if err := syscall.Stat(rootVolPath, &stat); err != nil {
-						return err
-					}
-					var srcStat syscall.Stat_t
-					if err := syscall.Stat(srcPath, &srcStat); err != nil {
-						return err
-					}
-					// Change the source volume's ownership if it differs from the root
-					// files that were just copied
-					if stat.Uid != srcStat.Uid || stat.Gid != srcStat.Gid {
-						if err := os.Chown(srcPath, int(stat.Uid), int(stat.Gid)); err != nil {
-							return err
-						}
-					}
-				}
-			}
-		}
-	}
-	return nil
-}
-
-func (container *Container) applyExternalVolumes() error {
-	if container.Config.VolumesFrom != "" {
-		containerSpecs := strings.Split(container.Config.VolumesFrom, ",")
-		for _, containerSpec := range containerSpecs {
-			mountRW := true
-			specParts := strings.SplitN(containerSpec, ":", 2)
-			switch len(specParts) {
-			case 0:
-				return fmt.Errorf("Malformed volumes-from specification: %s", container.Config.VolumesFrom)
-			case 2:
-				switch specParts[1] {
-				case "ro":
-					mountRW = false
-				case "rw": // mountRW is already true
-				default:
-					return fmt.Errorf("Malformed volumes-from specification: %s", containerSpec)
-				}
-			}
-			c := container.runtime.Get(specParts[0])
-			if c == nil {
-				return fmt.Errorf("Container %s not found. Impossible to mount its volumes", container.ID)
-			}
-			for volPath, id := range c.Volumes {
-				if _, exists := container.Volumes[volPath]; exists {
-					continue
-				}
-				if err := os.MkdirAll(path.Join(container.basefs, volPath), 0755); err != nil {
-					return err
-				}
-				container.Volumes[volPath] = id
-				if isRW, exists := c.VolumesRW[volPath]; exists {
-					container.VolumesRW[volPath] = isRW && mountRW
-				}
-			}
-
-		}
-	}
-	return nil
-}
-
 func (container *Container) Run() error {
 	if err := container.Start(); err != nil {
 		return err
@@ -1166,29 +894,7 @@ func (container *Container) cleanup() {
 		}
 	}
 
-	var (
-		root   = container.RootfsPath()
-		mounts = []string{
-			root,
-			path.Join(root, "/.dockerinit"),
-			path.Join(root, "/.dockerenv"),
-			path.Join(root, "/etc/resolv.conf"),
-		}
-	)
-
-	if container.HostnamePath != "" && container.HostsPath != "" {
-		mounts = append(mounts, path.Join(root, "/etc/hostname"), path.Join(root, "/etc/hosts"))
-	}
-
-	for r := range container.Volumes {
-		mounts = append(mounts, path.Join(root, r))
-	}
-
-	for i := len(mounts) - 1; i >= 0; i-- {
-		if lastError := mount.Unmount(mounts[i]); lastError != nil {
-			log.Printf("Failed to umount %v: %v", mounts[i], lastError)
-		}
-	}
+	unmountVolumesForContainer(container)
 
 	if err := container.Unmount(); err != nil {
 		log.Printf("%v: Failed to umount filesystem: %v", container.ID, err)
diff --git a/components/engine/volumes.go b/components/engine/volumes.go
new file mode 100644
index 0000000000..a53ef722e7
--- /dev/null
+++ b/components/engine/volumes.go
@@ -0,0 +1,332 @@
+package docker
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/archive"
+	"github.com/dotcloud/docker/pkg/mount"
+	"github.com/dotcloud/docker/utils"
+	"io/ioutil"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+type BindMap struct {
+	SrcPath string
+	DstPath string
+	Mode    string
+}
+
+func prepareVolumesForContainer(container *Container) error {
+	if container.Volumes == nil || len(container.Volumes) == 0 {
+		container.Volumes = make(map[string]string)
+		container.VolumesRW = make(map[string]bool)
+	}
+
+	if err := applyVolumesFrom(container); err != nil {
+		return err
+	}
+	if err := createVolumes(container); err != nil {
+		return err
+	}
+	return nil
+}
+
+func mountVolumesForContainer(container *Container, envPath string) error {
+	// Setup the root fs as a bind mount of the base fs
+	var (
+		root    = container.RootfsPath()
+		runtime = container.runtime
+	)
+	if err := os.MkdirAll(root, 0755); err != nil && !os.IsExist(err) {
+		return nil
+	}
+
+	// Create a bind mount of the base fs as a place where we can add mounts
+	// without affecting the ability to access the base fs
+	if err := mount.Mount(container.basefs, root, "none", "bind,rw"); err != nil {
+		return err
+	}
+
+	// Make sure the root fs is private so the mounts here don't propagate to basefs
+	if err := mount.ForceMount(root, root, "none", "private"); err != nil {
+		return err
+	}
+
+	// Mount docker specific files into the containers root fs
+	if err := mount.Mount(runtime.sysInitPath, filepath.Join(root, "/.dockerinit"), "none", "bind,ro"); err != nil {
+		return err
+	}
+	if err := mount.Mount(envPath, filepath.Join(root, "/.dockerenv"), "none", "bind,ro"); err != nil {
+		return err
+	}
+	if err := mount.Mount(container.ResolvConfPath, filepath.Join(root, "/etc/resolv.conf"), "none", "bind,ro"); err != nil {
+		return err
+	}
+
+	if container.HostnamePath != "" && container.HostsPath != "" {
+		if err := mount.Mount(container.HostnamePath, filepath.Join(root, "/etc/hostname"), "none", "bind,ro"); err != nil {
+			return err
+		}
+		if err := mount.Mount(container.HostsPath, filepath.Join(root, "/etc/hosts"), "none", "bind,ro"); err != nil {
+			return err
+		}
+	}
+
+	// Mount user specified volumes
+	for r, v := range container.Volumes {
+		mountAs := "ro"
+		if container.VolumesRW[r] {
+			mountAs = "rw"
+		}
+
+		r = filepath.Join(root, r)
+		if p, err := utils.FollowSymlinkInScope(r, root); err != nil {
+			return err
+		} else {
+			r = p
+		}
+
+		if err := mount.Mount(v, r, "none", fmt.Sprintf("bind,%s", mountAs)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func unmountVolumesForContainer(container *Container) {
+	var (
+		root   = container.RootfsPath()
+		mounts = []string{
+			root,
+			filepath.Join(root, "/.dockerinit"),
+			filepath.Join(root, "/.dockerenv"),
+			filepath.Join(root, "/etc/resolv.conf"),
+		}
+	)
+
+	if container.HostnamePath != "" && container.HostsPath != "" {
+		mounts = append(mounts, filepath.Join(root, "/etc/hostname"), filepath.Join(root, "/etc/hosts"))
+	}
+
+	for r := range container.Volumes {
+		mounts = append(mounts, filepath.Join(root, r))
+	}
+
+	for i := len(mounts) - 1; i >= 0; i-- {
+		if lastError := mount.Unmount(mounts[i]); lastError != nil {
+			log.Printf("Failed to umount %v: %v", mounts[i], lastError)
+		}
+	}
+}
+
+func applyVolumesFrom(container *Container) error {
+	if container.Config.VolumesFrom != "" {
+		for _, containerSpec := range strings.Split(container.Config.VolumesFrom, ",") {
+			var (
+				mountRW   = true
+				specParts = strings.SplitN(containerSpec, ":", 2)
+			)
+
+			switch len(specParts) {
+			case 0:
+				return fmt.Errorf("Malformed volumes-from specification: %s", container.Config.VolumesFrom)
+			case 2:
+				switch specParts[1] {
+				case "ro":
+					mountRW = false
+				case "rw": // mountRW is already true
+				default:
+					return fmt.Errorf("Malformed volumes-from specification: %s", containerSpec)
+				}
+			}
+
+			c := container.runtime.Get(specParts[0])
+			if c == nil {
+				return fmt.Errorf("Container %s not found. Impossible to mount its volumes", container.ID)
+			}
+
+			for volPath, id := range c.Volumes {
+				if _, exists := container.Volumes[volPath]; exists {
+					continue
+				}
+				if err := os.MkdirAll(filepath.Join(container.basefs, volPath), 0755); err != nil {
+					return err
+				}
+				container.Volumes[volPath] = id
+				if isRW, exists := c.VolumesRW[volPath]; exists {
+					container.VolumesRW[volPath] = isRW && mountRW
+				}
+			}
+
+		}
+	}
+	return nil
+}
+
+func getBindMap(container *Container) (map[string]BindMap, error) {
+	var (
+		// Create the requested bind mounts
+		binds = make(map[string]BindMap)
+		// Define illegal container destinations
+		illegalDsts = []string{"/", "."}
+	)
+
+	for _, bind := range container.hostConfig.Binds {
+		// FIXME: factorize bind parsing in parseBind
+		var (
+			src, dst, mode string
+			arr            = strings.Split(bind, ":")
+		)
+
+		if len(arr) == 2 {
+			src = arr[0]
+			dst = arr[1]
+			mode = "rw"
+		} else if len(arr) == 3 {
+			src = arr[0]
+			dst = arr[1]
+			mode = arr[2]
+		} else {
+			return nil, fmt.Errorf("Invalid bind specification: %s", bind)
+		}
+
+		// Bail if trying to mount to an illegal destination
+		for _, illegal := range illegalDsts {
+			if dst == illegal {
+				return nil, fmt.Errorf("Illegal bind destination: %s", dst)
+			}
+		}
+
+		bindMap := BindMap{
+			SrcPath: src,
+			DstPath: dst,
+			Mode:    mode,
+		}
+		binds[filepath.Clean(dst)] = bindMap
+	}
+	return binds, nil
+}
+
+func createVolumes(container *Container) error {
+	binds, err := getBindMap(container)
+	if err != nil {
+		return err
+	}
+
+	volumesDriver := container.runtime.volumes.driver
+	// Create the requested volumes if they don't exist
+	for volPath := range container.Config.Volumes {
+		volPath = filepath.Clean(volPath)
+		volIsDir := true
+		// Skip existing volumes
+		if _, exists := container.Volumes[volPath]; exists {
+			continue
+		}
+		var srcPath string
+		var isBindMount bool
+		srcRW := false
+		// If an external bind is defined for this volume, use that as a source
+		if bindMap, exists := binds[volPath]; exists {
+			isBindMount = true
+			srcPath = bindMap.SrcPath
+			if strings.ToLower(bindMap.Mode) == "rw" {
+				srcRW = true
+			}
+			if stat, err := os.Stat(bindMap.SrcPath); err != nil {
+				return err
+			} else {
+				volIsDir = stat.IsDir()
+			}
+			// Otherwise create an directory in $ROOT/volumes/ and use that
+		} else {
+
+			// Do not pass a container as the parameter for the volume creation.
+			// The graph driver using the container's information ( Image ) to
+			// create the parent.
+			c, err := container.runtime.volumes.Create(nil, nil, "", "", nil)
+			if err != nil {
+				return err
+			}
+			srcPath, err = volumesDriver.Get(c.ID)
+			if err != nil {
+				return fmt.Errorf("Driver %s failed to get volume rootfs %s: %s", volumesDriver, c.ID, err)
+			}
+			srcRW = true // RW by default
+		}
+
+		if p, err := filepath.EvalSymlinks(srcPath); err != nil {
+			return err
+		} else {
+			srcPath = p
+		}
+
+		container.Volumes[volPath] = srcPath
+		container.VolumesRW[volPath] = srcRW
+
+		// Create the mountpoint
+		volPath = filepath.Join(container.basefs, volPath)
+		rootVolPath, err := utils.FollowSymlinkInScope(volPath, container.basefs)
+		if err != nil {
+			return err
+		}
+
+		if _, err := os.Stat(rootVolPath); err != nil {
+			if os.IsNotExist(err) {
+				if volIsDir {
+					if err := os.MkdirAll(rootVolPath, 0755); err != nil {
+						return err
+					}
+				} else {
+					if err := os.MkdirAll(filepath.Dir(rootVolPath), 0755); err != nil {
+						return err
+					}
+					if f, err := os.OpenFile(rootVolPath, os.O_CREATE, 0755); err != nil {
+						return err
+					} else {
+						f.Close()
+					}
+				}
+			}
+		}
+
+		// Do not copy or change permissions if we are mounting from the host
+		if srcRW && !isBindMount {
+			volList, err := ioutil.ReadDir(rootVolPath)
+			if err != nil {
+				return err
+			}
+			if len(volList) > 0 {
+				srcList, err := ioutil.ReadDir(srcPath)
+				if err != nil {
+					return err
+				}
+				if len(srcList) == 0 {
+					// If the source volume is empty copy files from the root into the volume
+					if err := archive.CopyWithTar(rootVolPath, srcPath); err != nil {
+						return err
+					}
+
+					var stat syscall.Stat_t
+					if err := syscall.Stat(rootVolPath, &stat); err != nil {
+						return err
+					}
+					var srcStat syscall.Stat_t
+					if err := syscall.Stat(srcPath, &srcStat); err != nil {
+						return err
+					}
+					// Change the source volume's ownership if it differs from the root
+					// files that were just copied
+					if stat.Uid != srcStat.Uid || stat.Gid != srcStat.Gid {
+						if err := os.Chown(srcPath, int(stat.Uid), int(stat.Gid)); err != nil {
+							return err
+						}
+					}
+				}
+			}
+		}
+	}
+	return nil
+}

From a7d9996138921a5ef49b9b7e3d807994177fd9b0 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 17:28:50 -0800
Subject: [PATCH 096/403] Cleanup some statements from exec driver work
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 9e3da87a3a6fea21194ceb9dbd30a39d043a48a4 Component: engine

---
 components/engine/execdriver/lxc/init.go |  1 -
 components/engine/runtime.go             | 14 --------------
 components/engine/sysinit/sysinit.go     |  8 +-------
 3 files changed, 1 insertion(+), 22 deletions(-)

diff --git a/components/engine/execdriver/lxc/init.go b/components/engine/execdriver/lxc/init.go
index 1ed0606631..e138915212 100644
--- a/components/engine/execdriver/lxc/init.go
+++ b/components/engine/execdriver/lxc/init.go
@@ -100,7 +100,6 @@ func changeUser(args *execdriver.InitArgs) error {
 }
 
 func setupCapabilities(args *execdriver.InitArgs) error {
-
 	if args.Privileged {
 		return nil
 	}
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 872808d941..eed28f92ab 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -7,7 +7,6 @@ import (
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/execdriver"
-	"github.com/dotcloud/docker/execdriver/chroot"
 	"github.com/dotcloud/docker/execdriver/lxc"
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/graphdriver/aufs"
@@ -704,19 +703,6 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 
 	sysInfo := sysinfo.New(false)
 
-	/*
-		temporarilly disabled.
-	*/
-	if false {
-		var ed execdriver.Driver
-		if driver := os.Getenv("EXEC_DRIVER"); driver == "lxc" {
-			ed, err = lxc.NewDriver(config.Root, sysInfo.AppArmor)
-		} else {
-			ed, err = chroot.NewDriver()
-		}
-		if ed != nil {
-		}
-	}
 	ed, err := lxc.NewDriver(config.Root, sysInfo.AppArmor)
 	if err != nil {
 		return nil, err
diff --git a/components/engine/sysinit/sysinit.go b/components/engine/sysinit/sysinit.go
index dcf0eddf56..b02cf027aa 100644
--- a/components/engine/sysinit/sysinit.go
+++ b/components/engine/sysinit/sysinit.go
@@ -27,18 +27,12 @@ func setupEnv(args *execdriver.InitArgs) {
 
 func executeProgram(args *execdriver.InitArgs) error {
 	setupEnv(args)
+
 	dockerInitFct, err := execdriver.GetInitFunc(args.Driver)
 	if err != nil {
 		panic(err)
 	}
 	return dockerInitFct(args)
-
-	if args.Driver == "lxc" {
-		// Will never reach
-	} else if args.Driver == "chroot" {
-	}
-
-	return nil
 }
 
 // Sys Init code

From 8a2b18fccdba04aac5325181f392e6258ecbf3ad Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 18:07:33 -0800
Subject: [PATCH 097/403] Remove container dependency for links
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 fc952e0de94aa4283c677ce6c153b1a766db2fc0 Component: engine

---
 components/engine/container.go  | 15 +++++++++++--
 components/engine/links.go      | 23 +++++++++-----------
 components/engine/links_test.go | 37 ++-------------------------------
 3 files changed, 25 insertions(+), 50 deletions(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index 3740a7fb73..d054bcf50d 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -548,8 +548,19 @@ func (container *Container) Start() (err error) {
 			container.activeLinks = nil
 		}
 
-		for p, child := range children {
-			link, err := NewLink(container, child, p, runtime.eng)
+		for linkAlias, child := range children {
+			if !child.State.IsRunning() {
+				return fmt.Errorf("Cannot link to a non running container: %s AS %s", child.Name, linkAlias)
+			}
+
+			link, err := NewLink(
+				container.NetworkSettings.IPAddress,
+				child.NetworkSettings.IPAddress,
+				linkAlias,
+				child.Config.Env,
+				child.Config.ExposedPorts,
+				runtime.eng)
+
 			if err != nil {
 				rollback()
 				return err
diff --git a/components/engine/links.go b/components/engine/links.go
index ff39947a0d..1a198b0814 100644
--- a/components/engine/links.go
+++ b/components/engine/links.go
@@ -18,26 +18,23 @@ type Link struct {
 	eng              *engine.Engine
 }
 
-func NewLink(parent, child *Container, name string, eng *engine.Engine) (*Link, error) {
-	if parent.ID == child.ID {
-		return nil, fmt.Errorf("Cannot link to self: %s == %s", parent.ID, child.ID)
-	}
-	if !child.State.IsRunning() {
-		return nil, fmt.Errorf("Cannot link to a non running container: %s AS %s", child.Name, name)
-	}
+func NewLink(parentIP, childIP, name string, env []string, exposedPorts map[nat.Port]struct{}, eng *engine.Engine) (*Link, error) {
 
-	ports := make([]nat.Port, len(child.Config.ExposedPorts))
-	var i int
-	for p := range child.Config.ExposedPorts {
+	var (
+		i     int
+		ports = make([]nat.Port, len(exposedPorts))
+	)
+
+	for p := range exposedPorts {
 		ports[i] = p
 		i++
 	}
 
 	l := &Link{
 		Name:             name,
-		ChildIP:          child.NetworkSettings.IPAddress,
-		ParentIP:         parent.NetworkSettings.IPAddress,
-		ChildEnvironment: child.Config.Env,
+		ChildIP:          childIP,
+		ParentIP:         parentIP,
+		ChildEnvironment: env,
 		Ports:            ports,
 		eng:              eng,
 	}
diff --git a/components/engine/links_test.go b/components/engine/links_test.go
index 7b85a8e86d..d84fe04061 100644
--- a/components/engine/links_test.go
+++ b/components/engine/links_test.go
@@ -2,37 +2,15 @@ package docker
 
 import (
 	"github.com/dotcloud/docker/nat"
-	"github.com/dotcloud/docker/runconfig"
 	"strings"
 	"testing"
 )
 
-func newMockLinkContainer(id string, ip string) *Container {
-	return &Container{
-		Config: &runconfig.Config{},
-		ID:     id,
-		NetworkSettings: &NetworkSettings{
-			IPAddress: ip,
-		},
-	}
-}
-
 func TestLinkNew(t *testing.T) {
-	toID := GenerateID()
-	fromID := GenerateID()
-
-	from := newMockLinkContainer(fromID, "172.0.17.2")
-	from.Config.Env = []string{}
-	from.State = State{Running: true}
 	ports := make(nat.PortSet)
-
 	ports[nat.Port("6379/tcp")] = struct{}{}
 
-	from.Config.ExposedPorts = ports
-
-	to := newMockLinkContainer(toID, "172.0.17.3")
-
-	link, err := NewLink(to, from, "/db/docker", nil)
+	link, err := NewLink("172.0.17.3", "172.0.17.2", "/db/docker", nil, ports, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -60,21 +38,10 @@ func TestLinkNew(t *testing.T) {
 }
 
 func TestLinkEnv(t *testing.T) {
-	toID := GenerateID()
-	fromID := GenerateID()
-
-	from := newMockLinkContainer(fromID, "172.0.17.2")
-	from.Config.Env = []string{"PASSWORD=gordon"}
-	from.State = State{Running: true}
 	ports := make(nat.PortSet)
-
 	ports[nat.Port("6379/tcp")] = struct{}{}
 
-	from.Config.ExposedPorts = ports
-
-	to := newMockLinkContainer(toID, "172.0.17.3")
-
-	link, err := NewLink(to, from, "/db/docker", nil)
+	link, err := NewLink("172.0.17.3", "172.0.17.2", "/db/docker", []string{"PASSWORD=gordon"}, ports, nil)
 	if err != nil {
 		t.Fatal(err)
 	}

From a10cdc2a0cba6a135fe542e072bc912145e082a3 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 14 Feb 2014 18:18:16 -0800
Subject: [PATCH 098/403] Move links to sub pkg Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 147b09fae9527e760d74b5ef2f9558ee109f4009 Component: engine

---
 components/engine/container.go              | 7 ++++---
 components/engine/{ => links}/links.go      | 2 +-
 components/engine/{ => links}/links_test.go | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)
 rename components/engine/{ => links}/links.go (99%)
 rename components/engine/{ => links}/links_test.go (99%)

diff --git a/components/engine/container.go b/components/engine/container.go
index d054bcf50d..361dfeaf67 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -8,6 +8,7 @@ import (
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/graphdriver"
+	"github.com/dotcloud/docker/links"
 	"github.com/dotcloud/docker/nat"
 	"github.com/dotcloud/docker/pkg/mount"
 	"github.com/dotcloud/docker/pkg/term"
@@ -71,7 +72,7 @@ type Container struct {
 	VolumesRW  map[string]bool
 	hostConfig *runconfig.HostConfig
 
-	activeLinks map[string]*Link
+	activeLinks map[string]*links.Link
 }
 
 type BindMap struct {
@@ -537,7 +538,7 @@ func (container *Container) Start() (err error) {
 	}
 
 	if len(children) > 0 {
-		container.activeLinks = make(map[string]*Link, len(children))
+		container.activeLinks = make(map[string]*links.Link, len(children))
 
 		// If we encounter an error make sure that we rollback any network
 		// config and ip table changes
@@ -553,7 +554,7 @@ func (container *Container) Start() (err error) {
 				return fmt.Errorf("Cannot link to a non running container: %s AS %s", child.Name, linkAlias)
 			}
 
-			link, err := NewLink(
+			link, err := links.NewLink(
 				container.NetworkSettings.IPAddress,
 				child.NetworkSettings.IPAddress,
 				linkAlias,
diff --git a/components/engine/links.go b/components/engine/links/links.go
similarity index 99%
rename from components/engine/links.go
rename to components/engine/links/links.go
index 1a198b0814..68ac98ee07 100644
--- a/components/engine/links.go
+++ b/components/engine/links/links.go
@@ -1,4 +1,4 @@
-package docker
+package links
 
 import (
 	"fmt"
diff --git a/components/engine/links_test.go b/components/engine/links/links_test.go
similarity index 99%
rename from components/engine/links_test.go
rename to components/engine/links/links_test.go
index d84fe04061..e66f9bfb78 100644
--- a/components/engine/links_test.go
+++ b/components/engine/links/links_test.go
@@ -1,4 +1,4 @@
-package docker
+package links
 
 import (
 	"github.com/dotcloud/docker/nat"

From d029fb179f659f24205b57f6517ffcb84323b78a Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Sat, 15 Feb 2014 14:27:01 -0800
Subject: [PATCH 099/403] Fix engine tests on systems where temp directories
 are symlinked.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 353cc8c2a5d9ae4c02dc94e14cd2ad6d3393992d
Component: engine
---
 components/engine/engine/engine_test.go | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/components/engine/engine/engine_test.go b/components/engine/engine/engine_test.go
index 065a19f492..da59610727 100644
--- a/components/engine/engine/engine_test.go
+++ b/components/engine/engine/engine_test.go
@@ -4,6 +4,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path"
+	"path/filepath"
 	"testing"
 )
 
@@ -64,6 +65,18 @@ func TestEngineRoot(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer os.RemoveAll(tmp)
+	// We expect Root to resolve to an absolute path.
+	// FIXME: this should not be necessary.
+	// Until the above FIXME is implemented, let's check for the
+	// current behavior.
+	tmp, err = filepath.EvalSymlinks(tmp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tmp, err = filepath.Abs(tmp)
+	if err != nil {
+		t.Fatal(err)
+	}
 	dir := path.Join(tmp, "dir")
 	eng, err := New(dir)
 	if err != nil {

From 0efb658af55bd59a2862577bf862d75b1c3ce1cc Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Sat, 15 Feb 2014 14:37:51 -0800
Subject: [PATCH 100/403] Document Darwin test failure in a FIXME

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 7286842a12e3620224e4de65730a3b40d17f1f3a
Component: engine
---
 components/engine/tags_unit_test.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/engine/tags_unit_test.go b/components/engine/tags_unit_test.go
index 1341b989fe..b6236280a8 100644
--- a/components/engine/tags_unit_test.go
+++ b/components/engine/tags_unit_test.go
@@ -31,6 +31,8 @@ func mkTestTagStore(root string, t *testing.T) *TagStore {
 		t.Fatal(err)
 	}
 	img := &Image{ID: testImageID}
+	// FIXME: this fails on Darwin with:
+	// tags_unit_test.go:36: mkdir /var/folders/7g/b3ydb5gx4t94ndr_cljffbt80000gq/T/docker-test569b-tRunner-075013689/vfs/dir/foo/etc/postgres: permission denied
 	if err := graph.Register(nil, archive, img); err != nil {
 		t.Fatal(err)
 	}

From 0f43c3eb059a9986cde87372daad805d344a1871 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Wed, 12 Feb 2014 15:10:41 -0800
Subject: [PATCH 101/403] Refactor utility `MkBuildContext` to the more generic
 `archive.Generate`

This facilitates refactoring commands.go.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 9b56da78e0b1e4e1da9b2bacc44a22143745a2b0
Component: engine
---
 components/engine/archive/wrap.go             | 59 +++++++++++++++++++
 components/engine/commands.go                 | 28 +--------
 .../engine/integration/buildfile_test.go      | 28 +++++----
 components/engine/server.go                   |  2 +-
 4 files changed, 76 insertions(+), 41 deletions(-)
 create mode 100644 components/engine/archive/wrap.go

diff --git a/components/engine/archive/wrap.go b/components/engine/archive/wrap.go
new file mode 100644
index 0000000000..dfb335c0b6
--- /dev/null
+++ b/components/engine/archive/wrap.go
@@ -0,0 +1,59 @@
+package archive
+
+import (
+	"archive/tar"
+	"bytes"
+	"io/ioutil"
+)
+
+// Generate generates a new archive from the content provided
+// as input.
+//
+// `files` is a sequence of path/content pairs. A new file is
+// added to the archive for each pair.
+// If the last pair is incomplete, the file is created with an
+// empty content. For example:
+//
+// Generate("foo.txt", "hello world", "emptyfile")
+//
+// The above call will return an archive with 2 files:
+//  * ./foo.txt with content "hello world"
+//  * ./empty with empty content
+//
+// FIXME: stream content instead of buffering
+// FIXME: specify permissions and other archive metadata
+func Generate(input ...string) (Archive, error) {
+	files := parseStringPairs(input...)
+	buf := new(bytes.Buffer)
+	tw := tar.NewWriter(buf)
+	for _, file := range files {
+		name, content := file[0], file[1]
+		hdr := &tar.Header{
+			Name: name,
+			Size: int64(len(content)),
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return nil, err
+		}
+		if _, err := tw.Write([]byte(content)); err != nil {
+			return nil, err
+		}
+	}
+	if err := tw.Close(); err != nil {
+		return nil, err
+	}
+	return ioutil.NopCloser(buf), nil
+}
+
+func parseStringPairs(input ...string) (output [][2]string) {
+	output = make([][2]string, 0, len(input)/2+1)
+	for i := 0; i < len(input); i += 2 {
+		var pair [2]string
+		pair[0] = input[i]
+		if i+1 < len(input) {
+			pair[1] = input[i+1]
+		}
+		output = append(output, pair)
+	}
+	return
+}
diff --git a/components/engine/commands.go b/components/engine/commands.go
index e272d9b94a..96608aa674 100644
--- a/components/engine/commands.go
+++ b/components/engine/commands.go
@@ -1,7 +1,6 @@
 package docker
 
 import (
-	"archive/tar"
 	"bufio"
 	"bytes"
 	"encoding/base64"
@@ -136,31 +135,6 @@ func (cli *DockerCli) CmdInsert(args ...string) error {
 	return cli.stream("POST", "/images/"+cmd.Arg(0)+"/insert?"+v.Encode(), nil, cli.out, nil)
 }
 
-// mkBuildContext returns an archive of an empty context with the contents
-// of `dockerfile` at the path ./Dockerfile
-func MkBuildContext(dockerfile string, files [][2]string) (archive.Archive, error) {
-	buf := new(bytes.Buffer)
-	tw := tar.NewWriter(buf)
-	files = append(files, [2]string{"Dockerfile", dockerfile})
-	for _, file := range files {
-		name, content := file[0], file[1]
-		hdr := &tar.Header{
-			Name: name,
-			Size: int64(len(content)),
-		}
-		if err := tw.WriteHeader(hdr); err != nil {
-			return nil, err
-		}
-		if _, err := tw.Write([]byte(content)); err != nil {
-			return nil, err
-		}
-	}
-	if err := tw.Close(); err != nil {
-		return nil, err
-	}
-	return ioutil.NopCloser(buf), nil
-}
-
 func (cli *DockerCli) CmdBuild(args ...string) error {
 	cmd := cli.Subcmd("build", "[OPTIONS] PATH | URL | -", "Build a new container image from the source code at PATH")
 	tag := cmd.String([]string{"t", "-tag"}, "", "Repository name (and optionally a tag) to be applied to the resulting image in case of success")
@@ -188,7 +162,7 @@ func (cli *DockerCli) CmdBuild(args ...string) error {
 		if err != nil {
 			return err
 		}
-		context, err = MkBuildContext(string(dockerfile), nil)
+		context, err = archive.Generate("Dockerfile", string(dockerfile))
 	} else if utils.IsURL(cmd.Arg(0)) || utils.IsGIT(cmd.Arg(0)) {
 		isRemote = true
 	} else {
diff --git a/components/engine/integration/buildfile_test.go b/components/engine/integration/buildfile_test.go
index 199637789e..805932b57a 100644
--- a/components/engine/integration/buildfile_test.go
+++ b/components/engine/integration/buildfile_test.go
@@ -14,16 +14,6 @@ import (
 	"testing"
 )
 
-// mkTestContext generates a build context from the contents of the provided dockerfile.
-// This context is suitable for use as an argument to BuildFile.Build()
-func mkTestContext(dockerfile string, files [][2]string, t *testing.T) archive.Archive {
-	context, err := docker.MkBuildContext(dockerfile, files)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return context
-}
-
 // A testContextTemplate describes a build context and how to test it
 type testContextTemplate struct {
 	// Contents of the Dockerfile
@@ -34,6 +24,18 @@ type testContextTemplate struct {
 	remoteFiles [][2]string
 }
 
+func (context testContextTemplate) Archive(dockerfile string, t *testing.T) archive.Archive {
+	input := []string{"Dockerfile", dockerfile}
+	for _, pair := range context.files {
+		input = append(input, pair[0], pair[1])
+	}
+	a, err := archive.Generate(input...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return a
+}
+
 // A table of all the contexts to build and test.
 // A new docker runtime will be created and torn down for each context.
 var testContexts = []testContextTemplate{
@@ -381,7 +383,7 @@ func buildImage(context testContextTemplate, t *testing.T, eng *engine.Engine, u
 	dockerfile := constructDockerfile(context.dockerfile, ip, port)
 
 	buildfile := docker.NewBuildFile(srv, ioutil.Discard, ioutil.Discard, false, useCache, false, ioutil.Discard, utils.NewStreamFormatter(false), nil, nil)
-	id, err := buildfile.Build(mkTestContext(dockerfile, context.files, t))
+	id, err := buildfile.Build(context.Archive(dockerfile, t))
 	if err != nil {
 		return nil, err
 	}
@@ -785,7 +787,7 @@ func TestForbiddenContextPath(t *testing.T) {
 	dockerfile := constructDockerfile(context.dockerfile, ip, port)
 
 	buildfile := docker.NewBuildFile(srv, ioutil.Discard, ioutil.Discard, false, true, false, ioutil.Discard, utils.NewStreamFormatter(false), nil, nil)
-	_, err = buildfile.Build(mkTestContext(dockerfile, context.files, t))
+	_, err = buildfile.Build(context.Archive(dockerfile, t))
 
 	if err == nil {
 		t.Log("Error should not be nil")
@@ -831,7 +833,7 @@ func TestBuildADDFileNotFound(t *testing.T) {
 	dockerfile := constructDockerfile(context.dockerfile, ip, port)
 
 	buildfile := docker.NewBuildFile(mkServerFromEngine(eng, t), ioutil.Discard, ioutil.Discard, false, true, false, ioutil.Discard, utils.NewStreamFormatter(false), nil, nil)
-	_, err = buildfile.Build(mkTestContext(dockerfile, context.files, t))
+	_, err = buildfile.Build(context.Archive(dockerfile, t))
 
 	if err == nil {
 		t.Log("Error should not be nil")
diff --git a/components/engine/server.go b/components/engine/server.go
index daf05ec67a..bad8d8bfb5 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -476,7 +476,7 @@ func (srv *Server) Build(job *engine.Job) engine.Status {
 		if err != nil {
 			return job.Error(err)
 		}
-		c, err := MkBuildContext(string(dockerFile), nil)
+		c, err := archive.Generate("Dockerfile", string(dockerFile))
 		if err != nil {
 			return job.Error(err)
 		}

From 024e6f564e1dbbda68901d57f38bd89fd1415de1 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 17:59:00 -0800
Subject: [PATCH 102/403] Move remote api client to api/

This moves `commands.go` out of the core and into `api/client.go`

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: ee59ba969fdd1837fe0151638cc01637e18139c3
Component: engine
---
 .../engine/{commands.go => api/client.go}     | 13 +++---
 components/engine/docker/docker.go            |  3 +-
 .../engine/integration/commands_test.go       | 45 ++++++++++---------
 3 files changed, 30 insertions(+), 31 deletions(-)
 rename components/engine/{commands.go => api/client.go} (99%)

diff --git a/components/engine/commands.go b/components/engine/api/client.go
similarity index 99%
rename from components/engine/commands.go
rename to components/engine/api/client.go
index 96608aa674..a7098c1bea 100644
--- a/components/engine/commands.go
+++ b/components/engine/api/client.go
@@ -1,4 +1,4 @@
-package docker
+package api
 
 import (
 	"bufio"
@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/dotcloud/docker/api"
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/auth"
 	"github.com/dotcloud/docker/dockerversion"
@@ -76,7 +75,7 @@ func (cli *DockerCli) CmdHelp(args ...string) error {
 			return nil
 		}
 	}
-	help := fmt.Sprintf("Usage: docker [OPTIONS] COMMAND [arg...]\n -H=[unix://%s]: tcp://host:port to bind/connect to or unix://path/to/socket to use\n\nA self-sufficient runtime for linux containers.\n\nCommands:\n", api.DEFAULTUNIXSOCKET)
+	help := fmt.Sprintf("Usage: docker [OPTIONS] COMMAND [arg...]\n -H=[unix://%s]: tcp://host:port to bind/connect to or unix://path/to/socket to use\n\nA self-sufficient runtime for linux containers.\n\nCommands:\n", DEFAULTUNIXSOCKET)
 	for _, command := range [][]string{
 		{"attach", "Attach to a running container"},
 		{"build", "Build a container from a Dockerfile"},
@@ -2044,7 +2043,7 @@ func (cli *DockerCli) call(method, path string, data interface{}, passAuthInfo b
 	re := regexp.MustCompile("/+")
 	path = re.ReplaceAllString(path, "/")
 
-	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", api.APIVERSION, path), params)
+	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", APIVERSION, path), params)
 	if err != nil {
 		return nil, -1, err
 	}
@@ -2123,7 +2122,7 @@ func (cli *DockerCli) stream(method, path string, in io.Reader, out io.Writer, h
 	re := regexp.MustCompile("/+")
 	path = re.ReplaceAllString(path, "/")
 
-	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", api.APIVERSION, path), in)
+	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", APIVERSION, path), in)
 	if err != nil {
 		return err
 	}
@@ -2168,7 +2167,7 @@ func (cli *DockerCli) stream(method, path string, in io.Reader, out io.Writer, h
 		return fmt.Errorf("Error: %s", bytes.TrimSpace(body))
 	}
 
-	if api.MatchesContentType(resp.Header.Get("Content-Type"), "application/json") {
+	if MatchesContentType(resp.Header.Get("Content-Type"), "application/json") {
 		return utils.DisplayJSONMessagesStream(resp.Body, out, cli.terminalFd, cli.isTerminal)
 	}
 	if _, err := io.Copy(out, resp.Body); err != nil {
@@ -2187,7 +2186,7 @@ func (cli *DockerCli) hijack(method, path string, setRawTerminal bool, in io.Rea
 	re := regexp.MustCompile("/+")
 	path = re.ReplaceAllString(path, "/")
 
-	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", api.APIVERSION, path), nil)
+	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", APIVERSION, path), nil)
 	if err != nil {
 		return err
 	}
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 5ab8f65d65..5b0d279a5b 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -6,7 +6,6 @@ import (
 	"os"
 	"strings"
 
-	"github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/api"
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
@@ -108,7 +107,7 @@ func main() {
 			log.Fatal("Please specify only one -H")
 		}
 		protoAddrParts := strings.SplitN(flHosts.GetAll()[0], "://", 2)
-		if err := docker.ParseCommands(protoAddrParts[0], protoAddrParts[1], flag.Args()...); err != nil {
+		if err := api.ParseCommands(protoAddrParts[0], protoAddrParts[1], flag.Args()...); err != nil {
 			if sterr, ok := err.(*utils.StatusError); ok {
 				if sterr.Status != "" {
 					log.Println(sterr.Status)
diff --git a/components/engine/integration/commands_test.go b/components/engine/integration/commands_test.go
index a0fc4b9523..a3359ec631 100644
--- a/components/engine/integration/commands_test.go
+++ b/components/engine/integration/commands_test.go
@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"fmt"
 	"github.com/dotcloud/docker"
+	"github.com/dotcloud/docker/api"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/pkg/term"
 	"github.com/dotcloud/docker/utils"
@@ -119,7 +120,7 @@ func assertPipe(input, output string, r io.Reader, w io.Writer, count int) error
 func TestRunHostname(t *testing.T) {
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c := make(chan struct{})
@@ -164,7 +165,7 @@ func TestRunHostname(t *testing.T) {
 func TestRunWorkdir(t *testing.T) {
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c := make(chan struct{})
@@ -209,7 +210,7 @@ func TestRunWorkdir(t *testing.T) {
 func TestRunWorkdirExists(t *testing.T) {
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c := make(chan struct{})
@@ -254,7 +255,7 @@ func TestRunExit(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c1 := make(chan struct{})
@@ -307,7 +308,7 @@ func TestRunDisconnect(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c1 := make(chan struct{})
@@ -353,7 +354,7 @@ func TestRunDisconnectTty(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c1 := make(chan struct{})
@@ -405,7 +406,7 @@ func TestRunAttachStdin(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	ch := make(chan struct{})
@@ -469,7 +470,7 @@ func TestRunDetach(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	ch := make(chan struct{})
@@ -516,7 +517,7 @@ func TestAttachDetach(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	ch := make(chan struct{})
@@ -549,7 +550,7 @@ func TestAttachDetach(t *testing.T) {
 
 	stdin, stdinPipe = io.Pipe()
 	stdout, stdoutPipe = io.Pipe()
-	cli = docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli = api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 
 	ch = make(chan struct{})
 	go func() {
@@ -597,7 +598,7 @@ func TestAttachDetachTruncatedID(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	// Discard the CmdRun output
@@ -615,7 +616,7 @@ func TestAttachDetachTruncatedID(t *testing.T) {
 
 	stdin, stdinPipe = io.Pipe()
 	stdout, stdoutPipe = io.Pipe()
-	cli = docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli = api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 
 	ch := make(chan struct{})
 	go func() {
@@ -662,7 +663,7 @@ func TestAttachDisconnect(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	go func() {
@@ -731,7 +732,7 @@ func TestAttachDisconnect(t *testing.T) {
 func TestRunAutoRemove(t *testing.T) {
 	t.Skip("Fixme. Skipping test for now, race condition")
 	stdout, stdoutPipe := io.Pipe()
-	cli := docker.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c := make(chan struct{})
@@ -767,7 +768,7 @@ func TestRunAutoRemove(t *testing.T) {
 
 func TestCmdLogs(t *testing.T) {
 	t.Skip("Test not impemented")
-	cli := docker.NewDockerCli(nil, ioutil.Discard, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, ioutil.Discard, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	if err := cli.CmdRun(unitTestImageID, "sh", "-c", "ls -l"); err != nil {
@@ -785,7 +786,7 @@ func TestCmdLogs(t *testing.T) {
 // Expected behaviour: error out when attempting to bind mount non-existing source paths
 func TestRunErrorBindNonExistingSource(t *testing.T) {
 
-	cli := docker.NewDockerCli(nil, nil, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, nil, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c := make(chan struct{})
@@ -805,7 +806,7 @@ func TestRunErrorBindNonExistingSource(t *testing.T) {
 func TestImagesViz(t *testing.T) {
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	image := buildTestImages(t, globalEngine)
@@ -855,7 +856,7 @@ func TestImagesViz(t *testing.T) {
 func TestImagesTree(t *testing.T) {
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	image := buildTestImages(t, globalEngine)
@@ -938,7 +939,7 @@ func TestRunCidFile(t *testing.T) {
 	}
 	tmpCidFile := path.Join(tmpDir, "cid")
 
-	cli := docker.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	c := make(chan struct{})
@@ -988,7 +989,7 @@ func TestContainerOrphaning(t *testing.T) {
 	defer os.RemoveAll(tmpDir)
 
 	// setup a CLI and server
-	cli := docker.NewDockerCli(nil, ioutil.Discard, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(nil, ioutil.Discard, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 	srv := mkServerFromEngine(globalEngine, t)
 
@@ -1045,8 +1046,8 @@ func TestCmdKill(t *testing.T) {
 	stdin, stdinPipe := io.Pipe()
 	stdout, stdoutPipe := io.Pipe()
 
-	cli := docker.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
-	cli2 := docker.NewDockerCli(nil, ioutil.Discard, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	cli2 := api.NewDockerCli(nil, ioutil.Discard, ioutil.Discard, testDaemonProto, testDaemonAddr)
 	defer cleanup(globalEngine, t)
 
 	ch := make(chan struct{})

From 377e1023122e4f7442578e587063da77ea0978a2 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 18:03:50 -0800
Subject: [PATCH 103/403] Remove duplicate function displayablePorts

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 567a422a65f71a58c3000aa66a42853c7e005bb4
Component: engine
---
 components/engine/api/client.go | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index a7098c1bea..c724d08269 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -29,7 +29,6 @@ import (
 	"reflect"
 	"regexp"
 	"runtime"
-	"sort"
 	"strconv"
 	"strings"
 	"syscall"
@@ -1279,19 +1278,6 @@ func (cli *DockerCli) printTreeNode(noTrunc bool, image *engine.Env, prefix stri
 	}
 }
 
-func displayablePorts(ports *engine.Table) string {
-	result := []string{}
-	for _, port := range ports.Data {
-		if port.Get("IP") == "" {
-			result = append(result, fmt.Sprintf("%d/%s", port.GetInt("PublicPort"), port.Get("Type")))
-		} else {
-			result = append(result, fmt.Sprintf("%s:%d->%d/%s", port.Get("IP"), port.GetInt("PublicPort"), port.GetInt("PrivatePort"), port.Get("Type")))
-		}
-	}
-	sort.Strings(result)
-	return strings.Join(result, ", ")
-}
-
 func (cli *DockerCli) CmdPs(args ...string) error {
 	cmd := cli.Subcmd("ps", "[OPTIONS]", "List containers")
 	quiet := cmd.Bool([]string{"q", "-quiet"}, false, "Only display numeric IDs")

From 9c1c314fd97094bf805a25d7aac4e5dae3f05d51 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Tue, 11 Feb 2014 17:59:45 -0800
Subject: [PATCH 104/403] api/container.go: an API-specific representation of a
 container

This breaks the dependency from the remote API implementation to the
internal representation of a container. Instead it uses its own partial
representation of a container, with only required fields.

* This preserves reverse-compatibility with all past implementations of the remote API.

* This clarifies which fields are guaranteed to be present in a response
	A docker remote api server *may* return more fields in a Container
	object, but their presence and semantics are not guaranteed and should
	not be relied upon by client implementations.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 44e10433c7a3811d4d0897192418cb6b62996584
Component: engine
---
 components/engine/api/client.go    |  4 ++--
 components/engine/api/container.go | 18 ++++++++++++++++++
 components/engine/docker/docker.go |  1 +
 3 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 components/engine/api/container.go

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index c724d08269..f1f336d5f4 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -1572,7 +1572,7 @@ func (cli *DockerCli) CmdAttach(args ...string) error {
 		return err
 	}
 
-	if !container.State.IsRunning() {
+	if !container.State.Running {
 		return fmt.Errorf("Impossible to attach to a stopped container, start it first")
 	}
 
@@ -2355,7 +2355,7 @@ func getExitCode(cli *DockerCli, containerId string) (bool, int, error) {
 	if err := json.Unmarshal(body, c); err != nil {
 		return false, -1, err
 	}
-	return c.State.IsRunning(), c.State.GetExitCode(), nil
+	return c.State.Running, c.State.ExitCode, nil
 }
 
 func readBody(stream io.ReadCloser, statusCode int, err error) ([]byte, int, error) {
diff --git a/components/engine/api/container.go b/components/engine/api/container.go
new file mode 100644
index 0000000000..4cc73b2252
--- /dev/null
+++ b/components/engine/api/container.go
@@ -0,0 +1,18 @@
+package api
+
+import (
+	"github.com/dotcloud/docker/nat"
+	"github.com/dotcloud/docker/runconfig"
+)
+
+type Container struct {
+	Config     runconfig.Config
+	HostConfig runconfig.HostConfig
+	State      struct {
+		Running  bool
+		ExitCode int
+	}
+	NetworkSettings struct {
+		Ports nat.PortMap
+	}
+}
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 5b0d279a5b..b4d7879397 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"strings"
 
+	_ "github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/api"
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"

From 7473a46910eda135316d20e58c9564d47ca133a7 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 15 Feb 2014 20:02:54 -0800
Subject: [PATCH 105/403] Add socket activation for go apps
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 cfb7711a74dc4b54d879f79bc2f6435ed71163b9 Component: engine

---
 .../engine/pkg/socketactivation/activation.go | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 components/engine/pkg/socketactivation/activation.go

diff --git a/components/engine/pkg/socketactivation/activation.go b/components/engine/pkg/socketactivation/activation.go
new file mode 100644
index 0000000000..0edbcaac23
--- /dev/null
+++ b/components/engine/pkg/socketactivation/activation.go
@@ -0,0 +1,61 @@
+/*
+   Package to allow go applications to immediately start
+   listening on a socket, unix, tcp, udp but hold connections
+   until the application has booted and is ready to accept them
+*/
+package socketactivation
+
+import (
+	"fmt"
+	"net"
+	"time"
+)
+
+// NewActivationListener returns a listener listening on addr with the protocol.  It sets the
+// timeout to wait on first connection before an error is returned
+func NewActivationListener(proto, addr string, activate chan struct{}, timeout time.Duration) (net.Listener, error) {
+	wrapped, err := net.Listen(proto, addr)
+	if err != nil {
+		return nil, err
+	}
+
+	return &defaultListener{
+		wrapped:  wrapped,
+		activate: activate,
+		timeout:  timeout,
+	}, nil
+}
+
+type defaultListener struct {
+	wrapped  net.Listener // the real listener to wrap
+	ready    bool         // is the listner ready to start accpeting connections
+	activate chan struct{}
+	timeout  time.Duration // how long to wait before we consider this an error
+}
+
+func (l *defaultListener) Close() error {
+	return l.wrapped.Close()
+}
+
+func (l *defaultListener) Addr() net.Addr {
+	return l.wrapped.Addr()
+}
+
+func (l *defaultListener) Accept() (net.Conn, error) {
+	// if the listen has been told it is ready then we can go ahead and
+	// start returning connections
+	if l.ready {
+		return l.wrapped.Accept()
+	}
+
+	select {
+	case <-time.After(l.timeout):
+		// close the connection so any clients are disconnected
+		l.Close()
+		return nil, fmt.Errorf("timeout (%s) reached waiting for listener to become ready", l.timeout.String())
+	case <-l.activate:
+		l.ready = true
+		return l.Accept()
+	}
+	panic("unreachable")
+}

From 09d6a6c5dd981178401db046a36787d6c191c5ec Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 15 Feb 2014 20:24:55 -0800
Subject: [PATCH 106/403] Use socket activation pkg for listeners
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 64716a21e464ac63dd9b287c832ae3431e1418d0 Component: engine

---
 components/engine/api/api.go | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index 2cfc75631e..ed8c8bb795 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/auth"
 	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/pkg/socketactivation"
 	"github.com/dotcloud/docker/pkg/systemd"
 	"github.com/dotcloud/docker/utils"
 	"github.com/gorilla/mux"
@@ -25,6 +26,7 @@ import (
 	"strconv"
 	"strings"
 	"syscall"
+	"time"
 )
 
 // FIXME: move code common to client and server to common.go
@@ -34,6 +36,10 @@ const (
 	DEFAULTUNIXSOCKET = "/var/run/docker.sock"
 )
 
+var (
+	activationLock chan struct{}
+)
+
 func ValidateHost(val string) (string, error) {
 	host, err := utils.ParseHost(DEFAULTHTTPHOST, DEFAULTUNIXSOCKET, val)
 	if err != nil {
@@ -46,6 +52,7 @@ type HttpApiFunc func(eng *engine.Engine, version float64, w http.ResponseWriter
 
 func init() {
 	engine.Register("serveapi", ServeApi)
+	engine.Register("acceptconnections", AcceptConnections)
 }
 
 func hijackServer(w http.ResponseWriter) (io.ReadCloser, io.Writer, error) {
@@ -1156,7 +1163,7 @@ func ListenAndServe(proto, addr string, eng *engine.Engine, logging, enableCors
 		}
 	}
 
-	l, err := net.Listen(proto, addr)
+	l, err := socketactivation.NewActivationListener(proto, addr, activationLock, 15*time.Minute)
 	if err != nil {
 		return err
 	}
@@ -1198,8 +1205,11 @@ func ListenAndServe(proto, addr string, eng *engine.Engine, logging, enableCors
 // ServeApi loops through all of the protocols sent in to docker and spawns
 // off a go routine to setup a serving http.Server for each.
 func ServeApi(job *engine.Job) engine.Status {
-	protoAddrs := job.Args
-	chErrors := make(chan error, len(protoAddrs))
+	var (
+		protoAddrs = job.Args
+		chErrors   = make(chan error, len(protoAddrs))
+	)
+	activationLock = make(chan struct{})
 
 	for _, protoAddr := range protoAddrs {
 		protoAddrParts := strings.SplitN(protoAddr, "://", 2)
@@ -1209,6 +1219,8 @@ func ServeApi(job *engine.Job) engine.Status {
 		}()
 	}
 
+	AcceptConnections(nil)
+
 	for i := 0; i < len(protoAddrs); i += 1 {
 		err := <-chErrors
 		if err != nil {
@@ -1216,8 +1228,15 @@ func ServeApi(job *engine.Job) engine.Status {
 		}
 	}
 
+	return engine.StatusOK
+}
+
+func AcceptConnections(job *engine.Job) engine.Status {
 	// Tell the init daemon we are accepting requests
 	go systemd.SdNotify("READY=1")
 
+	// close the lock so the listeners start accepting connections
+	close(activationLock)
+
 	return engine.StatusOK
 }

From 9fff3868b1e8e480bc4e3aac87b8ef708054e3f1 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 15 Feb 2014 20:49:50 -0800
Subject: [PATCH 107/403] Integration generic socket wait for docker api
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 778f1bf6639e52004608ca2289e04b8f7bddb14b Component: engine

---
 components/engine/api/api.go                  |  2 -
 components/engine/docker/docker.go            | 47 ++++++++++++-------
 components/engine/integration/runtime_test.go |  5 ++
 3 files changed, 34 insertions(+), 20 deletions(-)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index ed8c8bb795..8f6729ab61 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -1219,8 +1219,6 @@ func ServeApi(job *engine.Job) engine.Status {
 		}()
 	}
 
-	AcceptConnections(nil)
-
 	for i := 0; i < len(protoAddrs); i += 1 {
 		err := <-chErrors
 		if err != nil {
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index b4d7879397..fe214811cf 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -78,25 +78,36 @@ func main() {
 		if err != nil {
 			log.Fatal(err)
 		}
-		// Load plugin: httpapi
-		job := eng.Job("initserver")
-		job.Setenv("Pidfile", *pidfile)
-		job.Setenv("Root", *flRoot)
-		job.SetenvBool("AutoRestart", *flAutoRestart)
-		job.SetenvList("Dns", flDns.GetAll())
-		job.SetenvBool("EnableIptables", *flEnableIptables)
-		job.SetenvBool("EnableIpForward", *flEnableIpForward)
-		job.Setenv("BridgeIface", *bridgeName)
-		job.Setenv("BridgeIP", *bridgeIp)
-		job.Setenv("DefaultIp", *flDefaultIp)
-		job.SetenvBool("InterContainerCommunication", *flInterContainerComm)
-		job.Setenv("GraphDriver", *flGraphDriver)
-		job.SetenvInt("Mtu", *flMtu)
-		if err := job.Run(); err != nil {
-			log.Fatal(err)
-		}
+		// load the daemon in the background so we can immediately start
+		// the http api so that connections don't fail while the daemon
+		// is booting
+		go func() {
+			// Load plugin: httpapi
+			job := eng.Job("initserver")
+			job.Setenv("Pidfile", *pidfile)
+			job.Setenv("Root", *flRoot)
+			job.SetenvBool("AutoRestart", *flAutoRestart)
+			job.SetenvList("Dns", flDns.GetAll())
+			job.SetenvBool("EnableIptables", *flEnableIptables)
+			job.SetenvBool("EnableIpForward", *flEnableIpForward)
+			job.Setenv("BridgeIface", *bridgeName)
+			job.Setenv("BridgeIP", *bridgeIp)
+			job.Setenv("DefaultIp", *flDefaultIp)
+			job.SetenvBool("InterContainerCommunication", *flInterContainerComm)
+			job.Setenv("GraphDriver", *flGraphDriver)
+			job.SetenvInt("Mtu", *flMtu)
+			if err := job.Run(); err != nil {
+				log.Fatal(err)
+			}
+			// after the daemon is done setting up we can tell the api to start
+			// accepting connections
+			if err := eng.Job("acceptconnections").Run(); err != nil {
+				log.Fatal(err)
+			}
+		}()
+
 		// Serve api
-		job = eng.Job("serveapi", flHosts.GetAll()...)
+		job := eng.Job("serveapi", flHosts.GetAll()...)
 		job.SetenvBool("Logging", true)
 		job.SetenvBool("EnableCors", *flEnableCors)
 		job.Setenv("Version", dockerversion.VERSION)
diff --git a/components/engine/integration/runtime_test.go b/components/engine/integration/runtime_test.go
index 170f4c9638..ca2119ce1f 100644
--- a/components/engine/integration/runtime_test.go
+++ b/components/engine/integration/runtime_test.go
@@ -171,9 +171,14 @@ func spawnGlobalDaemon() {
 			log.Fatalf("Unable to spawn the test daemon: %s", err)
 		}
 	}()
+
 	// Give some time to ListenAndServer to actually start
 	// FIXME: use inmem transports instead of tcp
 	time.Sleep(time.Second)
+
+	if err := eng.Job("acceptconnections").Run(); err != nil {
+		log.Fatalf("Unable to accept connections for test api: %s", err)
+	}
 }
 
 // FIXME: test that ImagePull(json=true) send correct json output

From 9fdd3cd967beaa871158b52edb78d2e899af0a00 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 15 Feb 2014 21:10:37 -0800
Subject: [PATCH 108/403] Change name to listenbuffer
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 d5e41c1cb67b7ccb86fbbd80079642afd5055c2a Component: engine

---
 components/engine/api/api.go                                | 4 ++--
 .../activation.go => listenbuffer/buffer.go}                | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename components/engine/pkg/{socketactivation/activation.go => listenbuffer/buffer.go} (85%)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index 8f6729ab61..8d7b1de685 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -10,7 +10,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/auth"
 	"github.com/dotcloud/docker/engine"
-	"github.com/dotcloud/docker/pkg/socketactivation"
+	"github.com/dotcloud/docker/pkg/listenbuffer"
 	"github.com/dotcloud/docker/pkg/systemd"
 	"github.com/dotcloud/docker/utils"
 	"github.com/gorilla/mux"
@@ -1163,7 +1163,7 @@ func ListenAndServe(proto, addr string, eng *engine.Engine, logging, enableCors
 		}
 	}
 
-	l, err := socketactivation.NewActivationListener(proto, addr, activationLock, 15*time.Minute)
+	l, err := listenbuffer.NewListenBuffer(proto, addr, activationLock, 15*time.Minute)
 	if err != nil {
 		return err
 	}
diff --git a/components/engine/pkg/socketactivation/activation.go b/components/engine/pkg/listenbuffer/buffer.go
similarity index 85%
rename from components/engine/pkg/socketactivation/activation.go
rename to components/engine/pkg/listenbuffer/buffer.go
index 0edbcaac23..c350805a7d 100644
--- a/components/engine/pkg/socketactivation/activation.go
+++ b/components/engine/pkg/listenbuffer/buffer.go
@@ -3,7 +3,7 @@
    listening on a socket, unix, tcp, udp but hold connections
    until the application has booted and is ready to accept them
 */
-package socketactivation
+package listenbuffer
 
 import (
 	"fmt"
@@ -11,9 +11,9 @@ import (
 	"time"
 )
 
-// NewActivationListener returns a listener listening on addr with the protocol.  It sets the
+// NewListenBuffer returns a listener listening on addr with the protocol.  It sets the
 // timeout to wait on first connection before an error is returned
-func NewActivationListener(proto, addr string, activate chan struct{}, timeout time.Duration) (net.Listener, error) {
+func NewListenBuffer(proto, addr string, activate chan struct{}, timeout time.Duration) (net.Listener, error) {
 	wrapped, err := net.Listen(proto, addr)
 	if err != nil {
 		return nil, err

From 1bea948b6b7e8fc634fdee53c3c214dc767f7226 Mon Sep 17 00:00:00 2001
From: Fabio Falci <fabiofalci@gmail.com>
Date: Sat, 15 Feb 2014 00:43:55 +0000
Subject: [PATCH 109/403] `docker cp` error when container doesn't exist

Fix cp api to return a 404 notfound if container doesn't exist.
Fixes #4119.

Docker-DCO-1.1-Signed-off-by: Fabio Falci <fabiofalci@gmail.com> (github: fabiofalci)
Upstream-commit: a51441278afbfde76ac1ec1e01c619fe5733b895
Component: engine
---
 components/engine/api/api.go              |  3 +++
 components/engine/api/client.go           |  3 +++
 components/engine/integration/api_test.go | 28 +++++++++++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index 2cfc75631e..2ba27288c0 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -943,6 +943,9 @@ func postContainersCopy(eng *engine.Engine, version float64, w http.ResponseWrit
 	streamJSON(job, w, false)
 	if err := job.Run(); err != nil {
 		utils.Errorf("%s", err.Error())
+		if strings.Contains(err.Error(), "No such container") {
+			w.WriteHeader(http.StatusNotFound)
+		}
 	}
 	return nil
 }
diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index f1f336d5f4..61cabc8798 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -1961,6 +1961,9 @@ func (cli *DockerCli) CmdCp(args ...string) error {
 	if stream != nil {
 		defer stream.Close()
 	}
+	if statusCode == 404 {
+		return fmt.Errorf("No such container: %v", info[0])
+	}
 	if err != nil {
 		return err
 	}
diff --git a/components/engine/integration/api_test.go b/components/engine/integration/api_test.go
index c587f111a2..9756ea1983 100644
--- a/components/engine/integration/api_test.go
+++ b/components/engine/integration/api_test.go
@@ -1217,6 +1217,34 @@ func TestPostContainersCopy(t *testing.T) {
 	}
 }
 
+func TestPostContainersCopyWhenContainerNotFound(t *testing.T) {
+	eng := NewTestEngine(t)
+	defer mkRuntimeFromEngine(eng, t).Nuke()
+
+	r := httptest.NewRecorder()
+
+	var copyData engine.Env
+	copyData.Set("Resource", "/test.txt")
+	copyData.Set("HostPath", ".")
+
+	jsonData := bytes.NewBuffer(nil)
+	if err := copyData.Encode(jsonData); err != nil {
+		t.Fatal(err)
+	}
+
+	req, err := http.NewRequest("POST", "/containers/id_not_found/copy", jsonData)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Add("Content-Type", "application/json")
+	if err := api.ServeRequest(eng, api.APIVERSION, r, req); err != nil {
+		t.Fatal(err)
+	}
+	if r.Code != http.StatusNotFound {
+		t.Fatalf("404 expected for id_not_found Container, received %v", r.Code)
+	}
+}
+
 // Mocked types for tests
 type NopConn struct {
 	io.ReadCloser

From ec297483f8bc7e7231cf7e0e23350158bb81f21d Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Mon, 17 Feb 2014 10:02:23 +1000
Subject: [PATCH 110/403] change the -H TCP / docker group warning to not
 reference a resolved issue

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 8871fd3a317240dbd6d5a9ae3309726281572bc1
Component: engine
---
 components/engine/docs/sources/use/basics.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/components/engine/docs/sources/use/basics.rst b/components/engine/docs/sources/use/basics.rst
index 6bd1f0b7a0..d62f778b9d 100644
--- a/components/engine/docs/sources/use/basics.rst
+++ b/components/engine/docs/sources/use/basics.rst
@@ -59,10 +59,10 @@ Bind Docker to another host/port or a Unix socket
 
 .. warning:: Changing the default ``docker`` daemon binding to a TCP
    port or Unix *docker* user group will increase your security risks
-   by allowing non-root users to potentially gain *root* access on the
-   host (`e.g. #1369
-   <https://github.com/dotcloud/docker/issues/1369>`_). Make sure you
-   control access to ``docker``.
+   by allowing non-root users to gain *root* access on the
+   host. Make sure you control access to ``docker``. If you are binding 
+   to a TCP port, anyone with access to that port has full Docker access;
+   so it is not advisable on an open network.
 
 With ``-H`` it is possible to make the Docker daemon to listen on a
 specific IP and port. By default, it will listen on

From 66f105510e64d81ba52a7e1a7b274c17d9c696ba Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Thu, 13 Feb 2014 14:48:55 +1000
Subject: [PATCH 111/403] add a little reenforcement to the help for docker
 build -q

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 797b7d3446304be01c220c29f3dc6c4dcc2711be
Component: engine
---
 components/engine/api/client.go                              | 2 +-
 components/engine/docs/sources/reference/commandline/cli.rst | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index f1f336d5f4..f3cdb456e3 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -136,7 +136,7 @@ func (cli *DockerCli) CmdInsert(args ...string) error {
 func (cli *DockerCli) CmdBuild(args ...string) error {
 	cmd := cli.Subcmd("build", "[OPTIONS] PATH | URL | -", "Build a new container image from the source code at PATH")
 	tag := cmd.String([]string{"t", "-tag"}, "", "Repository name (and optionally a tag) to be applied to the resulting image in case of success")
-	suppressOutput := cmd.Bool([]string{"q", "-quiet"}, false, "Suppress verbose build output")
+	suppressOutput := cmd.Bool([]string{"q", "-quiet"}, false, "Suppress the verbose output generated by the containers")
 	noCache := cmd.Bool([]string{"#no-cache", "-no-cache"}, false, "Do not use cache when building the image")
 	rm := cmd.Bool([]string{"#rm", "-rm"}, false, "Remove intermediate containers after a successful build")
 	if err := cmd.Parse(args); err != nil {
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 032076b941..191577eeec 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -186,7 +186,7 @@ Examples:
     Build a new container image from the source code at PATH
       -t, --time="": Repository name (and optionally a tag) to be applied 
              to the resulting image in case of success.
-      -q, --quiet=false: Suppress verbose build output.
+      -q, --quiet=false: Suppress the verbose output generated by the containers.
       --no-cache: Do not use the cache when building the image.
       --rm: Remove intermediate containers after a successful build
 

From e94461f78a72a69464ce62a968788e32d715c71e Mon Sep 17 00:00:00 2001
From: Fabio Falci <fabiofalci@gmail.com>
Date: Mon, 17 Feb 2014 01:44:25 +0000
Subject: [PATCH 112/403] Test for save and load commands

Improve test for save to tar and load from tar commands.
Docker-DCO-1.1-Signed-off-by: Fabio Falci <fabiofalci@gmail.com> (github: fabiofalci)
Upstream-commit: 4ab3c31b155997821d5f75689617235fa7386efa
Component: engine
---
 components/engine/integration/api_test.go | 71 +++++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/components/engine/integration/api_test.go b/components/engine/integration/api_test.go
index c587f111a2..73d6c4e78c 100644
--- a/components/engine/integration/api_test.go
+++ b/components/engine/integration/api_test.go
@@ -389,6 +389,77 @@ func TestGetContainersExport(t *testing.T) {
 	}
 }
 
+func TestSaveImageAndThenLoad(t *testing.T) {
+	eng := NewTestEngine(t)
+	defer mkRuntimeFromEngine(eng, t).Nuke()
+
+	// save image
+	r := httptest.NewRecorder()
+	req, err := http.NewRequest("GET", "/images/"+unitTestImageID+"/get", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := api.ServeRequest(eng, api.APIVERSION, r, req); err != nil {
+		t.Fatal(err)
+	}
+	if r.Code != http.StatusOK {
+		t.Fatalf("%d OK expected, received %d\n", http.StatusOK, r.Code)
+	}
+	tarball := r.Body
+
+	// delete the image
+	r = httptest.NewRecorder()
+	req, err = http.NewRequest("DELETE", "/images/"+unitTestImageID, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := api.ServeRequest(eng, api.APIVERSION, r, req); err != nil {
+		t.Fatal(err)
+	}
+	if r.Code != http.StatusOK {
+		t.Fatalf("%d OK expected, received %d\n", http.StatusOK, r.Code)
+	}
+
+	// make sure there is no image
+	r = httptest.NewRecorder()
+	req, err = http.NewRequest("GET", "/images/"+unitTestImageID+"/get", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := api.ServeRequest(eng, api.APIVERSION, r, req); err != nil {
+		t.Fatal(err)
+	}
+	if r.Code != http.StatusNotFound {
+		t.Fatalf("%d NotFound expected, received %d\n", http.StatusNotFound, r.Code)
+	}
+
+	// load the image
+	r = httptest.NewRecorder()
+	req, err = http.NewRequest("POST", "/images/load", tarball)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := api.ServeRequest(eng, api.APIVERSION, r, req); err != nil {
+		t.Fatal(err)
+	}
+	if r.Code != http.StatusOK {
+		t.Fatalf("%d OK expected, received %d\n", http.StatusOK, r.Code)
+	}
+
+	// finally make sure the image is there
+	r = httptest.NewRecorder()
+	req, err = http.NewRequest("GET", "/images/"+unitTestImageID+"/get", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := api.ServeRequest(eng, api.APIVERSION, r, req); err != nil {
+		t.Fatal(err)
+	}
+	if r.Code != http.StatusOK {
+		t.Fatalf("%d OK expected, received %d\n", http.StatusOK, r.Code)
+	}
+}
+
 func TestGetContainersChanges(t *testing.T) {
 	eng := NewTestEngine(t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()

From 4dc8b80613ae18f1d3c7dd67e56ce5163e2d0fa1 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Mon, 17 Feb 2014 12:24:19 +1000
Subject: [PATCH 113/403] add a little space above h2->h6 - it gets a bit dense
 in there when there are lots of steps

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 6a5a1d44f5d6c1281a66d562b7a4310dd6c3b997
Component: engine
---
 components/engine/docs/theme/docker/static/css/main.css  | 3 +++
 components/engine/docs/theme/docker/static/css/main.less | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/components/engine/docs/theme/docker/static/css/main.css b/components/engine/docs/theme/docker/static/css/main.css
index 1195801542..ce4ba7b869 100755
--- a/components/engine/docs/theme/docker/static/css/main.css
+++ b/components/engine/docs/theme/docker/static/css/main.css
@@ -428,6 +428,9 @@ dt:hover > a.headerlink {
   float: right;
   visibility: hidden;
 }
+h2, h3, h4, h5, h6 {
+  margin-top: 0.7em;
+}
 /* =====================================
   Miscellaneous information
 ====================================== */
diff --git a/components/engine/docs/theme/docker/static/css/main.less b/components/engine/docs/theme/docker/static/css/main.less
index 8c9296d979..e248e21c08 100644
--- a/components/engine/docs/theme/docker/static/css/main.less
+++ b/components/engine/docs/theme/docker/static/css/main.less
@@ -631,6 +631,10 @@ dt:hover > a.headerlink {
   visibility: hidden;
 }
 
+h2, h3, h4, h5, h6 {
+  margin-top: 0.7em;
+}
+
 /* =====================================
   Miscellaneous information
 ====================================== */

From 6180b3b39051d971665acb2ecd8466a4162576d3 Mon Sep 17 00:00:00 2001
From: Mike MacCana <mike.maccana@gmail.com>
Date: Tue, 11 Feb 2014 11:23:31 +0000
Subject: [PATCH 114/403] Add dockerode NodeJS implementation Also correctly
 case 'JavaScript'

Docker-DCO-1.1-Signed-off-by: Mike MacCana <mike.maccana@gmail.com> (github: mikemaccana)
Upstream-commit: 02d94dcf6ec2541c66b081d4dc251725f994747c
Component: engine
---
 .../reference/api/remote_api_client_libraries.rst   | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst b/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
index c7ced0055e..362fa6fe3d 100644
--- a/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
+++ b/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
@@ -1,6 +1,6 @@
 :title: Remote API Client Libraries
 :description: Various client libraries available to use with the Docker remote API
-:keywords: API, Docker, index, registry, REST, documentation, clients, Python, Ruby, Javascript, Erlang, Go
+:keywords: API, Docker, index, registry, REST, documentation, clients, Python, Ruby, JavaScript, Erlang, Go
 
 
 ==================================
@@ -21,15 +21,18 @@ and we will add the libraries here.
 +----------------------+----------------+--------------------------------------------+----------+
 | Ruby                 | docker-api     | https://github.com/swipely/docker-api      | Active   |
 +----------------------+----------------+--------------------------------------------+----------+
-| Javascript (NodeJS)  | docker.io      | https://github.com/appersonlabs/docker.io  | Active   |
+| JavaScript (NodeJS)  | dockerode      | https://github.com/apocas/dockerode        | Active   |
+|                      |                | Install via NPM: `npm install dockerode`   |          |
++----------------------+----------------+--------------------------------------------+----------+
+| JavaScript (NodeJS)  | docker.io      | https://github.com/appersonlabs/docker.io  | Active   |
 |                      |                | Install via NPM: `npm install docker.io`   |          |
 +----------------------+----------------+--------------------------------------------+----------+
-| Javascript           | docker-js      | https://github.com/dgoujard/docker-js      | Active   |
+| JavaScript           | docker-js      | https://github.com/dgoujard/docker-js      | Active   |
 +----------------------+----------------+--------------------------------------------+----------+
-| Javascript (Angular) | docker-cp      | https://github.com/13W/docker-cp           | Active   |
+| JavaScript (Angular) | docker-cp      | https://github.com/13W/docker-cp           | Active   |
 | **WebUI**            |                |                                            |          |
 +----------------------+----------------+--------------------------------------------+----------+
-| Javascript (Angular) | dockerui       | https://github.com/crosbymichael/dockerui  | Active   |
+| JavaScript (Angular) | dockerui       | https://github.com/crosbymichael/dockerui  | Active   |
 | **WebUI**            |                |                                            |          |
 +----------------------+----------------+--------------------------------------------+----------+
 | Java                 | docker-java    | https://github.com/kpelykh/docker-java     | Active   |

From de5db2558539e45d452e5c5be13f88acba3951f6 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Mon, 17 Feb 2014 16:10:54 +0100
Subject: [PATCH 115/403] Avoid temporarily unmounting the container when
 restarting it

Stopping the container will typicall cause it to unmount, to keep it mounted
over the stop/start cycle we aquire a temporary reference to it during this time.

This helps with https://github.com/dotcloud/docker/issues/4036

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: ab0f3f86c8d05aa69415e6909a88b621d5b37e81
Component: engine
---
 components/engine/container.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/components/engine/container.go b/components/engine/container.go
index 3740a7fb73..f55b8c3c7b 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -1256,6 +1256,13 @@ func (container *Container) Stop(seconds int) error {
 }
 
 func (container *Container) Restart(seconds int) error {
+	// Avoid unnecessarily unmounting and then directly mounting
+	// the container when the container stops and then starts
+	// again
+	if err := container.Mount(); err == nil {
+		defer container.Unmount()
+	}
+
 	if err := container.Stop(seconds); err != nil {
 		return err
 	}

From fc1f23f527dc7d12df58fc8726c7c329909ace98 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Thu, 13 Feb 2014 15:11:39 -0700
Subject: [PATCH 116/403] Add vendored archive/tar that includes xattrs patch

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: b762d3a7391dd526826a0a1f1c983ea5e54852f5
Component: engine
---
 components/engine/archive/archive.go          |   2 +-
 components/engine/archive/archive_test.go     |   2 +-
 components/engine/archive/changes.go          |   2 +-
 components/engine/archive/diff.go             |   2 +-
 components/engine/archive/wrap.go             |   2 +-
 components/engine/hack/vendor.sh              |   8 +
 components/engine/integration/api_test.go     |   2 +-
 components/engine/integration/utils_test.go   |   2 +-
 components/engine/utils/tarsum.go             |   2 +-
 components/engine/utils_test.go               |   2 +-
 .../p/go/src/pkg/archive/tar/common.go        | 304 ++++++++++++
 .../p/go/src/pkg/archive/tar/example_test.go  |  79 ++++
 .../p/go/src/pkg/archive/tar/reader.go        | 402 ++++++++++++++++
 .../p/go/src/pkg/archive/tar/reader_test.go   | 425 +++++++++++++++++
 .../p/go/src/pkg/archive/tar/stat_atim.go     |  20 +
 .../go/src/pkg/archive/tar/stat_atimespec.go  |  20 +
 .../p/go/src/pkg/archive/tar/stat_unix.go     |  32 ++
 .../p/go/src/pkg/archive/tar/tar_test.go      | 284 ++++++++++++
 .../p/go/src/pkg/archive/tar/testdata/gnu.tar | Bin 0 -> 3072 bytes
 .../src/pkg/archive/tar/testdata/nil-uid.tar  | Bin 0 -> 1024 bytes
 .../p/go/src/pkg/archive/tar/testdata/pax.tar | Bin 0 -> 10240 bytes
 .../go/src/pkg/archive/tar/testdata/small.txt |   1 +
 .../src/pkg/archive/tar/testdata/small2.txt   |   1 +
 .../go/src/pkg/archive/tar/testdata/star.tar  | Bin 0 -> 3072 bytes
 .../go/src/pkg/archive/tar/testdata/ustar.tar | Bin 0 -> 2048 bytes
 .../p/go/src/pkg/archive/tar/testdata/v7.tar  | Bin 0 -> 3584 bytes
 .../pkg/archive/tar/testdata/writer-big.tar   | Bin 0 -> 4096 bytes
 .../src/pkg/archive/tar/testdata/writer.tar   | Bin 0 -> 3584 bytes
 .../src/pkg/archive/tar/testdata/xattrs.tar   | Bin 0 -> 5120 bytes
 .../p/go/src/pkg/archive/tar/writer.go        | 383 ++++++++++++++++
 .../p/go/src/pkg/archive/tar/writer_test.go   | 433 ++++++++++++++++++
 31 files changed, 2401 insertions(+), 9 deletions(-)
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/common.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/example_test.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/reader.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/reader_test.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_atim.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_atimespec.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_unix.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/tar_test.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/gnu.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/nil-uid.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/pax.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/small.txt
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/small2.txt
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/star.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/ustar.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/v7.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/writer-big.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/writer.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/xattrs.tar
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/writer.go
 create mode 100644 components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/writer_test.go

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index 3bd3af2761..8212621bb9 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -1,8 +1,8 @@
 package archive
 
 import (
-	"archive/tar"
 	"bytes"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"compress/bzip2"
 	"compress/gzip"
 	"errors"
diff --git a/components/engine/archive/archive_test.go b/components/engine/archive/archive_test.go
index 164fc8fe27..8badd58bd7 100644
--- a/components/engine/archive/archive_test.go
+++ b/components/engine/archive/archive_test.go
@@ -1,8 +1,8 @@
 package archive
 
 import (
-	"archive/tar"
 	"bytes"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"fmt"
 	"io"
 	"io/ioutil"
diff --git a/components/engine/archive/changes.go b/components/engine/archive/changes.go
index 25406f5cec..b46b13bbe7 100644
--- a/components/engine/archive/changes.go
+++ b/components/engine/archive/changes.go
@@ -1,7 +1,7 @@
 package archive
 
 import (
-	"archive/tar"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"fmt"
 	"github.com/dotcloud/docker/utils"
 	"io"
diff --git a/components/engine/archive/diff.go b/components/engine/archive/diff.go
index de1efacf34..de93fc69b2 100644
--- a/components/engine/archive/diff.go
+++ b/components/engine/archive/diff.go
@@ -1,7 +1,7 @@
 package archive
 
 import (
-	"archive/tar"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 	"os"
 	"path/filepath"
diff --git a/components/engine/archive/wrap.go b/components/engine/archive/wrap.go
index dfb335c0b6..981420b3fe 100644
--- a/components/engine/archive/wrap.go
+++ b/components/engine/archive/wrap.go
@@ -1,8 +1,8 @@
 package archive
 
 import (
-	"archive/tar"
 	"bytes"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"io/ioutil"
 )
 
diff --git a/components/engine/hack/vendor.sh b/components/engine/hack/vendor.sh
index d3e7ea9f43..184cb750a5 100755
--- a/components/engine/hack/vendor.sh
+++ b/components/engine/hack/vendor.sh
@@ -50,3 +50,11 @@ clone git github.com/syndtr/gocapability 3454319be2
 clone hg code.google.com/p/go.net 84a4013f96e0
 
 clone hg code.google.com/p/gosqlite 74691fb6f837
+
+# get Go tip's archive/tar, for xattr support
+# TODO after Go 1.3 drops, bump our minimum supported version and drop this vendored dep
+clone hg code.google.com/p/go a15f344a9efa
+mv src/code.google.com/p/go/src/pkg/archive/tar tmp-tar
+rm -rf src/code.google.com/p/go
+mkdir -p src/code.google.com/p/go/src/pkg/archive
+mv tmp-tar src/code.google.com/p/go/src/pkg/archive/tar
diff --git a/components/engine/integration/api_test.go b/components/engine/integration/api_test.go
index c587f111a2..f0d0a7d097 100644
--- a/components/engine/integration/api_test.go
+++ b/components/engine/integration/api_test.go
@@ -1,9 +1,9 @@
 package docker
 
 import (
-	"archive/tar"
 	"bufio"
 	"bytes"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker"
diff --git a/components/engine/integration/utils_test.go b/components/engine/integration/utils_test.go
index 77328b2511..947ace11d9 100644
--- a/components/engine/integration/utils_test.go
+++ b/components/engine/integration/utils_test.go
@@ -1,8 +1,8 @@
 package docker
 
 import (
-	"archive/tar"
 	"bytes"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"fmt"
 	"io"
 	"io/ioutil"
diff --git a/components/engine/utils/tarsum.go b/components/engine/utils/tarsum.go
index 786196b6b4..ddeecfb450 100644
--- a/components/engine/utils/tarsum.go
+++ b/components/engine/utils/tarsum.go
@@ -1,8 +1,8 @@
 package utils
 
 import (
-	"archive/tar"
 	"bytes"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"compress/gzip"
 	"crypto/sha256"
 	"encoding/hex"
diff --git a/components/engine/utils_test.go b/components/engine/utils_test.go
index 4b8cfba39f..6917007575 100644
--- a/components/engine/utils_test.go
+++ b/components/engine/utils_test.go
@@ -1,8 +1,8 @@
 package docker
 
 import (
-	"archive/tar"
 	"bytes"
+	"code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 )
 
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/common.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/common.go
new file mode 100644
index 0000000000..e8b973c1fa
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/common.go
@@ -0,0 +1,304 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package tar implements access to tar archives.
+// It aims to cover most of the variations, including those produced
+// by GNU and BSD tars.
+//
+// References:
+//   http://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5
+//   http://www.gnu.org/software/tar/manual/html_node/Standard.html
+//   http://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html
+package tar
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"time"
+)
+
+const (
+	blockSize = 512
+
+	// Types
+	TypeReg           = '0'    // regular file
+	TypeRegA          = '\x00' // regular file
+	TypeLink          = '1'    // hard link
+	TypeSymlink       = '2'    // symbolic link
+	TypeChar          = '3'    // character device node
+	TypeBlock         = '4'    // block device node
+	TypeDir           = '5'    // directory
+	TypeFifo          = '6'    // fifo node
+	TypeCont          = '7'    // reserved
+	TypeXHeader       = 'x'    // extended header
+	TypeXGlobalHeader = 'g'    // global extended header
+	TypeGNULongName   = 'L'    // Next file has a long name
+	TypeGNULongLink   = 'K'    // Next file symlinks to a file w/ a long name
+)
+
+// A Header represents a single header in a tar archive.
+// Some fields may not be populated.
+type Header struct {
+	Name       string    // name of header file entry
+	Mode       int64     // permission and mode bits
+	Uid        int       // user id of owner
+	Gid        int       // group id of owner
+	Size       int64     // length in bytes
+	ModTime    time.Time // modified time
+	Typeflag   byte      // type of header entry
+	Linkname   string    // target name of link
+	Uname      string    // user name of owner
+	Gname      string    // group name of owner
+	Devmajor   int64     // major number of character or block device
+	Devminor   int64     // minor number of character or block device
+	AccessTime time.Time // access time
+	ChangeTime time.Time // status change time
+	Xattrs     map[string]string
+}
+
+// File name constants from the tar spec.
+const (
+	fileNameSize       = 100 // Maximum number of bytes in a standard tar name.
+	fileNamePrefixSize = 155 // Maximum number of ustar extension bytes.
+)
+
+// FileInfo returns an os.FileInfo for the Header.
+func (h *Header) FileInfo() os.FileInfo {
+	return headerFileInfo{h}
+}
+
+// headerFileInfo implements os.FileInfo.
+type headerFileInfo struct {
+	h *Header
+}
+
+func (fi headerFileInfo) Size() int64        { return fi.h.Size }
+func (fi headerFileInfo) IsDir() bool        { return fi.Mode().IsDir() }
+func (fi headerFileInfo) ModTime() time.Time { return fi.h.ModTime }
+func (fi headerFileInfo) Sys() interface{}   { return fi.h }
+
+// Name returns the base name of the file.
+func (fi headerFileInfo) Name() string {
+	if fi.IsDir() {
+		return path.Base(path.Clean(fi.h.Name))
+	}
+	return path.Base(fi.h.Name)
+}
+
+// Mode returns the permission and mode bits for the headerFileInfo.
+func (fi headerFileInfo) Mode() (mode os.FileMode) {
+	// Set file permission bits.
+	mode = os.FileMode(fi.h.Mode).Perm()
+
+	// Set setuid, setgid and sticky bits.
+	if fi.h.Mode&c_ISUID != 0 {
+		// setuid
+		mode |= os.ModeSetuid
+	}
+	if fi.h.Mode&c_ISGID != 0 {
+		// setgid
+		mode |= os.ModeSetgid
+	}
+	if fi.h.Mode&c_ISVTX != 0 {
+		// sticky
+		mode |= os.ModeSticky
+	}
+
+	// Set file mode bits.
+	// clear perm, setuid, setgid and sticky bits.
+	m := os.FileMode(fi.h.Mode) &^ 07777
+	if m == c_ISDIR {
+		// directory
+		mode |= os.ModeDir
+	}
+	if m == c_ISFIFO {
+		// named pipe (FIFO)
+		mode |= os.ModeNamedPipe
+	}
+	if m == c_ISLNK {
+		// symbolic link
+		mode |= os.ModeSymlink
+	}
+	if m == c_ISBLK {
+		// device file
+		mode |= os.ModeDevice
+	}
+	if m == c_ISCHR {
+		// Unix character device
+		mode |= os.ModeDevice
+		mode |= os.ModeCharDevice
+	}
+	if m == c_ISSOCK {
+		// Unix domain socket
+		mode |= os.ModeSocket
+	}
+
+	switch fi.h.Typeflag {
+	case TypeLink, TypeSymlink:
+		// hard link, symbolic link
+		mode |= os.ModeSymlink
+	case TypeChar:
+		// character device node
+		mode |= os.ModeDevice
+		mode |= os.ModeCharDevice
+	case TypeBlock:
+		// block device node
+		mode |= os.ModeDevice
+	case TypeDir:
+		// directory
+		mode |= os.ModeDir
+	case TypeFifo:
+		// fifo node
+		mode |= os.ModeNamedPipe
+	}
+
+	return mode
+}
+
+// sysStat, if non-nil, populates h from system-dependent fields of fi.
+var sysStat func(fi os.FileInfo, h *Header) error
+
+// Mode constants from the tar spec.
+const (
+	c_ISUID  = 04000   // Set uid
+	c_ISGID  = 02000   // Set gid
+	c_ISVTX  = 01000   // Save text (sticky bit)
+	c_ISDIR  = 040000  // Directory
+	c_ISFIFO = 010000  // FIFO
+	c_ISREG  = 0100000 // Regular file
+	c_ISLNK  = 0120000 // Symbolic link
+	c_ISBLK  = 060000  // Block special file
+	c_ISCHR  = 020000  // Character special file
+	c_ISSOCK = 0140000 // Socket
+)
+
+// Keywords for the PAX Extended Header
+const (
+	paxAtime    = "atime"
+	paxCharset  = "charset"
+	paxComment  = "comment"
+	paxCtime    = "ctime" // please note that ctime is not a valid pax header.
+	paxGid      = "gid"
+	paxGname    = "gname"
+	paxLinkpath = "linkpath"
+	paxMtime    = "mtime"
+	paxPath     = "path"
+	paxSize     = "size"
+	paxUid      = "uid"
+	paxUname    = "uname"
+	paxXattr    = "SCHILY.xattr."
+	paxNone     = ""
+)
+
+// FileInfoHeader creates a partially-populated Header from fi.
+// If fi describes a symlink, FileInfoHeader records link as the link target.
+// If fi describes a directory, a slash is appended to the name.
+// Because os.FileInfo's Name method returns only the base name of
+// the file it describes, it may be necessary to modify the Name field
+// of the returned header to provide the full path name of the file.
+func FileInfoHeader(fi os.FileInfo, link string) (*Header, error) {
+	if fi == nil {
+		return nil, errors.New("tar: FileInfo is nil")
+	}
+	fm := fi.Mode()
+	h := &Header{
+		Name:    fi.Name(),
+		ModTime: fi.ModTime(),
+		Mode:    int64(fm.Perm()), // or'd with c_IS* constants later
+	}
+	switch {
+	case fm.IsRegular():
+		h.Mode |= c_ISREG
+		h.Typeflag = TypeReg
+		h.Size = fi.Size()
+	case fi.IsDir():
+		h.Typeflag = TypeDir
+		h.Mode |= c_ISDIR
+		h.Name += "/"
+	case fm&os.ModeSymlink != 0:
+		h.Typeflag = TypeSymlink
+		h.Mode |= c_ISLNK
+		h.Linkname = link
+	case fm&os.ModeDevice != 0:
+		if fm&os.ModeCharDevice != 0 {
+			h.Mode |= c_ISCHR
+			h.Typeflag = TypeChar
+		} else {
+			h.Mode |= c_ISBLK
+			h.Typeflag = TypeBlock
+		}
+	case fm&os.ModeNamedPipe != 0:
+		h.Typeflag = TypeFifo
+		h.Mode |= c_ISFIFO
+	case fm&os.ModeSocket != 0:
+		h.Mode |= c_ISSOCK
+	default:
+		return nil, fmt.Errorf("archive/tar: unknown file mode %v", fm)
+	}
+	if fm&os.ModeSetuid != 0 {
+		h.Mode |= c_ISUID
+	}
+	if fm&os.ModeSetgid != 0 {
+		h.Mode |= c_ISGID
+	}
+	if fm&os.ModeSticky != 0 {
+		h.Mode |= c_ISVTX
+	}
+	if sysStat != nil {
+		return h, sysStat(fi, h)
+	}
+	return h, nil
+}
+
+var zeroBlock = make([]byte, blockSize)
+
+// POSIX specifies a sum of the unsigned byte values, but the Sun tar uses signed byte values.
+// We compute and return both.
+func checksum(header []byte) (unsigned int64, signed int64) {
+	for i := 0; i < len(header); i++ {
+		if i == 148 {
+			// The chksum field (header[148:156]) is special: it should be treated as space bytes.
+			unsigned += ' ' * 8
+			signed += ' ' * 8
+			i += 7
+			continue
+		}
+		unsigned += int64(header[i])
+		signed += int64(int8(header[i]))
+	}
+	return
+}
+
+type slicer []byte
+
+func (sp *slicer) next(n int) (b []byte) {
+	s := *sp
+	b, *sp = s[0:n], s[n:]
+	return
+}
+
+func isASCII(s string) bool {
+	for _, c := range s {
+		if c >= 0x80 {
+			return false
+		}
+	}
+	return true
+}
+
+func toASCII(s string) string {
+	if isASCII(s) {
+		return s
+	}
+	var buf bytes.Buffer
+	for _, c := range s {
+		if c < 0x80 {
+			buf.WriteByte(byte(c))
+		}
+	}
+	return buf.String()
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/example_test.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/example_test.go
new file mode 100644
index 0000000000..351eaa0e6c
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/example_test.go
@@ -0,0 +1,79 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tar_test
+
+import (
+	"archive/tar"
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"os"
+)
+
+func Example() {
+	// Create a buffer to write our archive to.
+	buf := new(bytes.Buffer)
+
+	// Create a new tar archive.
+	tw := tar.NewWriter(buf)
+
+	// Add some files to the archive.
+	var files = []struct {
+		Name, Body string
+	}{
+		{"readme.txt", "This archive contains some text files."},
+		{"gopher.txt", "Gopher names:\nGeorge\nGeoffrey\nGonzo"},
+		{"todo.txt", "Get animal handling licence."},
+	}
+	for _, file := range files {
+		hdr := &tar.Header{
+			Name: file.Name,
+			Size: int64(len(file.Body)),
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			log.Fatalln(err)
+		}
+		if _, err := tw.Write([]byte(file.Body)); err != nil {
+			log.Fatalln(err)
+		}
+	}
+	// Make sure to check the error on Close.
+	if err := tw.Close(); err != nil {
+		log.Fatalln(err)
+	}
+
+	// Open the tar archive for reading.
+	r := bytes.NewReader(buf.Bytes())
+	tr := tar.NewReader(r)
+
+	// Iterate through the files in the archive.
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			// end of tar archive
+			break
+		}
+		if err != nil {
+			log.Fatalln(err)
+		}
+		fmt.Printf("Contents of %s:\n", hdr.Name)
+		if _, err := io.Copy(os.Stdout, tr); err != nil {
+			log.Fatalln(err)
+		}
+		fmt.Println()
+	}
+
+	// Output:
+	// Contents of readme.txt:
+	// This archive contains some text files.
+	// Contents of gopher.txt:
+	// Gopher names:
+	// George
+	// Geoffrey
+	// Gonzo
+	// Contents of todo.txt:
+	// Get animal handling licence.
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/reader.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/reader.go
new file mode 100644
index 0000000000..7cb6e649c7
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/reader.go
@@ -0,0 +1,402 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tar
+
+// TODO(dsymonds):
+//   - pax extensions
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"io/ioutil"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+var (
+	ErrHeader = errors.New("archive/tar: invalid tar header")
+)
+
+const maxNanoSecondIntSize = 9
+
+// A Reader provides sequential access to the contents of a tar archive.
+// A tar archive consists of a sequence of files.
+// The Next method advances to the next file in the archive (including the first),
+// and then it can be treated as an io.Reader to access the file's data.
+type Reader struct {
+	r   io.Reader
+	err error
+	nb  int64 // number of unread bytes for current file entry
+	pad int64 // amount of padding (ignored) after current file entry
+}
+
+// NewReader creates a new Reader reading from r.
+func NewReader(r io.Reader) *Reader { return &Reader{r: r} }
+
+// Next advances to the next entry in the tar archive.
+func (tr *Reader) Next() (*Header, error) {
+	var hdr *Header
+	if tr.err == nil {
+		tr.skipUnread()
+	}
+	if tr.err != nil {
+		return hdr, tr.err
+	}
+	hdr = tr.readHeader()
+	if hdr == nil {
+		return hdr, tr.err
+	}
+	// Check for PAX/GNU header.
+	switch hdr.Typeflag {
+	case TypeXHeader:
+		//  PAX extended header
+		headers, err := parsePAX(tr)
+		if err != nil {
+			return nil, err
+		}
+		// We actually read the whole file,
+		// but this skips alignment padding
+		tr.skipUnread()
+		hdr = tr.readHeader()
+		mergePAX(hdr, headers)
+		return hdr, nil
+	case TypeGNULongName:
+		// We have a GNU long name header. Its contents are the real file name.
+		realname, err := ioutil.ReadAll(tr)
+		if err != nil {
+			return nil, err
+		}
+		hdr, err := tr.Next()
+		hdr.Name = cString(realname)
+		return hdr, err
+	case TypeGNULongLink:
+		// We have a GNU long link header.
+		realname, err := ioutil.ReadAll(tr)
+		if err != nil {
+			return nil, err
+		}
+		hdr, err := tr.Next()
+		hdr.Linkname = cString(realname)
+		return hdr, err
+	}
+	return hdr, tr.err
+}
+
+// mergePAX merges well known headers according to PAX standard.
+// In general headers with the same name as those found
+// in the header struct overwrite those found in the header
+// struct with higher precision or longer values. Esp. useful
+// for name and linkname fields.
+func mergePAX(hdr *Header, headers map[string]string) error {
+	for k, v := range headers {
+		switch k {
+		case paxPath:
+			hdr.Name = v
+		case paxLinkpath:
+			hdr.Linkname = v
+		case paxGname:
+			hdr.Gname = v
+		case paxUname:
+			hdr.Uname = v
+		case paxUid:
+			uid, err := strconv.ParseInt(v, 10, 0)
+			if err != nil {
+				return err
+			}
+			hdr.Uid = int(uid)
+		case paxGid:
+			gid, err := strconv.ParseInt(v, 10, 0)
+			if err != nil {
+				return err
+			}
+			hdr.Gid = int(gid)
+		case paxAtime:
+			t, err := parsePAXTime(v)
+			if err != nil {
+				return err
+			}
+			hdr.AccessTime = t
+		case paxMtime:
+			t, err := parsePAXTime(v)
+			if err != nil {
+				return err
+			}
+			hdr.ModTime = t
+		case paxCtime:
+			t, err := parsePAXTime(v)
+			if err != nil {
+				return err
+			}
+			hdr.ChangeTime = t
+		case paxSize:
+			size, err := strconv.ParseInt(v, 10, 0)
+			if err != nil {
+				return err
+			}
+			hdr.Size = int64(size)
+		default:
+			if strings.HasPrefix(k, paxXattr) {
+				if hdr.Xattrs == nil {
+					hdr.Xattrs = make(map[string]string)
+				}
+				hdr.Xattrs[k[len(paxXattr):]] = v
+			}
+		}
+	}
+	return nil
+}
+
+// parsePAXTime takes a string of the form %d.%d as described in
+// the PAX specification.
+func parsePAXTime(t string) (time.Time, error) {
+	buf := []byte(t)
+	pos := bytes.IndexByte(buf, '.')
+	var seconds, nanoseconds int64
+	var err error
+	if pos == -1 {
+		seconds, err = strconv.ParseInt(t, 10, 0)
+		if err != nil {
+			return time.Time{}, err
+		}
+	} else {
+		seconds, err = strconv.ParseInt(string(buf[:pos]), 10, 0)
+		if err != nil {
+			return time.Time{}, err
+		}
+		nano_buf := string(buf[pos+1:])
+		// Pad as needed before converting to a decimal.
+		// For example .030 -> .030000000 -> 30000000 nanoseconds
+		if len(nano_buf) < maxNanoSecondIntSize {
+			// Right pad
+			nano_buf += strings.Repeat("0", maxNanoSecondIntSize-len(nano_buf))
+		} else if len(nano_buf) > maxNanoSecondIntSize {
+			// Right truncate
+			nano_buf = nano_buf[:maxNanoSecondIntSize]
+		}
+		nanoseconds, err = strconv.ParseInt(string(nano_buf), 10, 0)
+		if err != nil {
+			return time.Time{}, err
+		}
+	}
+	ts := time.Unix(seconds, nanoseconds)
+	return ts, nil
+}
+
+// parsePAX parses PAX headers.
+// If an extended header (type 'x') is invalid, ErrHeader is returned
+func parsePAX(r io.Reader) (map[string]string, error) {
+	buf, err := ioutil.ReadAll(r)
+	if err != nil {
+		return nil, err
+	}
+	headers := make(map[string]string)
+	// Each record is constructed as
+	//     "%d %s=%s\n", length, keyword, value
+	for len(buf) > 0 {
+		// or the header was empty to start with.
+		var sp int
+		// The size field ends at the first space.
+		sp = bytes.IndexByte(buf, ' ')
+		if sp == -1 {
+			return nil, ErrHeader
+		}
+		// Parse the first token as a decimal integer.
+		n, err := strconv.ParseInt(string(buf[:sp]), 10, 0)
+		if err != nil {
+			return nil, ErrHeader
+		}
+		// Extract everything between the decimal and the n -1 on the
+		// beginning to to eat the ' ', -1 on the end to skip the newline.
+		var record []byte
+		record, buf = buf[sp+1:n-1], buf[n:]
+		// The first equals is guaranteed to mark the end of the key.
+		// Everything else is value.
+		eq := bytes.IndexByte(record, '=')
+		if eq == -1 {
+			return nil, ErrHeader
+		}
+		key, value := record[:eq], record[eq+1:]
+		headers[string(key)] = string(value)
+	}
+	return headers, nil
+}
+
+// cString parses bytes as a NUL-terminated C-style string.
+// If a NUL byte is not found then the whole slice is returned as a string.
+func cString(b []byte) string {
+	n := 0
+	for n < len(b) && b[n] != 0 {
+		n++
+	}
+	return string(b[0:n])
+}
+
+func (tr *Reader) octal(b []byte) int64 {
+	// Check for binary format first.
+	if len(b) > 0 && b[0]&0x80 != 0 {
+		var x int64
+		for i, c := range b {
+			if i == 0 {
+				c &= 0x7f // ignore signal bit in first byte
+			}
+			x = x<<8 | int64(c)
+		}
+		return x
+	}
+
+	// Because unused fields are filled with NULs, we need
+	// to skip leading NULs. Fields may also be padded with
+	// spaces or NULs.
+	// So we remove leading and trailing NULs and spaces to
+	// be sure.
+	b = bytes.Trim(b, " \x00")
+
+	if len(b) == 0 {
+		return 0
+	}
+	x, err := strconv.ParseUint(cString(b), 8, 64)
+	if err != nil {
+		tr.err = err
+	}
+	return int64(x)
+}
+
+// skipUnread skips any unread bytes in the existing file entry, as well as any alignment padding.
+func (tr *Reader) skipUnread() {
+	nr := tr.nb + tr.pad // number of bytes to skip
+	tr.nb, tr.pad = 0, 0
+	if sr, ok := tr.r.(io.Seeker); ok {
+		if _, err := sr.Seek(nr, os.SEEK_CUR); err == nil {
+			return
+		}
+	}
+	_, tr.err = io.CopyN(ioutil.Discard, tr.r, nr)
+}
+
+func (tr *Reader) verifyChecksum(header []byte) bool {
+	if tr.err != nil {
+		return false
+	}
+
+	given := tr.octal(header[148:156])
+	unsigned, signed := checksum(header)
+	return given == unsigned || given == signed
+}
+
+func (tr *Reader) readHeader() *Header {
+	header := make([]byte, blockSize)
+	if _, tr.err = io.ReadFull(tr.r, header); tr.err != nil {
+		return nil
+	}
+
+	// Two blocks of zero bytes marks the end of the archive.
+	if bytes.Equal(header, zeroBlock[0:blockSize]) {
+		if _, tr.err = io.ReadFull(tr.r, header); tr.err != nil {
+			return nil
+		}
+		if bytes.Equal(header, zeroBlock[0:blockSize]) {
+			tr.err = io.EOF
+		} else {
+			tr.err = ErrHeader // zero block and then non-zero block
+		}
+		return nil
+	}
+
+	if !tr.verifyChecksum(header) {
+		tr.err = ErrHeader
+		return nil
+	}
+
+	// Unpack
+	hdr := new(Header)
+	s := slicer(header)
+
+	hdr.Name = cString(s.next(100))
+	hdr.Mode = tr.octal(s.next(8))
+	hdr.Uid = int(tr.octal(s.next(8)))
+	hdr.Gid = int(tr.octal(s.next(8)))
+	hdr.Size = tr.octal(s.next(12))
+	hdr.ModTime = time.Unix(tr.octal(s.next(12)), 0)
+	s.next(8) // chksum
+	hdr.Typeflag = s.next(1)[0]
+	hdr.Linkname = cString(s.next(100))
+
+	// The remainder of the header depends on the value of magic.
+	// The original (v7) version of tar had no explicit magic field,
+	// so its magic bytes, like the rest of the block, are NULs.
+	magic := string(s.next(8)) // contains version field as well.
+	var format string
+	switch magic {
+	case "ustar\x0000": // POSIX tar (1003.1-1988)
+		if string(header[508:512]) == "tar\x00" {
+			format = "star"
+		} else {
+			format = "posix"
+		}
+	case "ustar  \x00": // old GNU tar
+		format = "gnu"
+	}
+
+	switch format {
+	case "posix", "gnu", "star":
+		hdr.Uname = cString(s.next(32))
+		hdr.Gname = cString(s.next(32))
+		devmajor := s.next(8)
+		devminor := s.next(8)
+		if hdr.Typeflag == TypeChar || hdr.Typeflag == TypeBlock {
+			hdr.Devmajor = tr.octal(devmajor)
+			hdr.Devminor = tr.octal(devminor)
+		}
+		var prefix string
+		switch format {
+		case "posix", "gnu":
+			prefix = cString(s.next(155))
+		case "star":
+			prefix = cString(s.next(131))
+			hdr.AccessTime = time.Unix(tr.octal(s.next(12)), 0)
+			hdr.ChangeTime = time.Unix(tr.octal(s.next(12)), 0)
+		}
+		if len(prefix) > 0 {
+			hdr.Name = prefix + "/" + hdr.Name
+		}
+	}
+
+	if tr.err != nil {
+		tr.err = ErrHeader
+		return nil
+	}
+
+	// Maximum value of hdr.Size is 64 GB (12 octal digits),
+	// so there's no risk of int64 overflowing.
+	tr.nb = int64(hdr.Size)
+	tr.pad = -tr.nb & (blockSize - 1) // blockSize is a power of two
+
+	return hdr
+}
+
+// Read reads from the current entry in the tar archive.
+// It returns 0, io.EOF when it reaches the end of that entry,
+// until Next is called to advance to the next entry.
+func (tr *Reader) Read(b []byte) (n int, err error) {
+	if tr.nb == 0 {
+		// file consumed
+		return 0, io.EOF
+	}
+
+	if int64(len(b)) > tr.nb {
+		b = b[0:tr.nb]
+	}
+	n, err = tr.r.Read(b)
+	tr.nb -= int64(n)
+
+	if err == io.EOF && tr.nb > 0 {
+		err = io.ErrUnexpectedEOF
+	}
+	tr.err = err
+	return
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/reader_test.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/reader_test.go
new file mode 100644
index 0000000000..f84dbebe98
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/reader_test.go
@@ -0,0 +1,425 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tar
+
+import (
+	"bytes"
+	"crypto/md5"
+	"fmt"
+	"io"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+)
+
+type untarTest struct {
+	file    string
+	headers []*Header
+	cksums  []string
+}
+
+var gnuTarTest = &untarTest{
+	file: "testdata/gnu.tar",
+	headers: []*Header{
+		{
+			Name:     "small.txt",
+			Mode:     0640,
+			Uid:      73025,
+			Gid:      5000,
+			Size:     5,
+			ModTime:  time.Unix(1244428340, 0),
+			Typeflag: '0',
+			Uname:    "dsymonds",
+			Gname:    "eng",
+		},
+		{
+			Name:     "small2.txt",
+			Mode:     0640,
+			Uid:      73025,
+			Gid:      5000,
+			Size:     11,
+			ModTime:  time.Unix(1244436044, 0),
+			Typeflag: '0',
+			Uname:    "dsymonds",
+			Gname:    "eng",
+		},
+	},
+	cksums: []string{
+		"e38b27eaccb4391bdec553a7f3ae6b2f",
+		"c65bd2e50a56a2138bf1716f2fd56fe9",
+	},
+}
+
+var untarTests = []*untarTest{
+	gnuTarTest,
+	{
+		file: "testdata/star.tar",
+		headers: []*Header{
+			{
+				Name:       "small.txt",
+				Mode:       0640,
+				Uid:        73025,
+				Gid:        5000,
+				Size:       5,
+				ModTime:    time.Unix(1244592783, 0),
+				Typeflag:   '0',
+				Uname:      "dsymonds",
+				Gname:      "eng",
+				AccessTime: time.Unix(1244592783, 0),
+				ChangeTime: time.Unix(1244592783, 0),
+			},
+			{
+				Name:       "small2.txt",
+				Mode:       0640,
+				Uid:        73025,
+				Gid:        5000,
+				Size:       11,
+				ModTime:    time.Unix(1244592783, 0),
+				Typeflag:   '0',
+				Uname:      "dsymonds",
+				Gname:      "eng",
+				AccessTime: time.Unix(1244592783, 0),
+				ChangeTime: time.Unix(1244592783, 0),
+			},
+		},
+	},
+	{
+		file: "testdata/v7.tar",
+		headers: []*Header{
+			{
+				Name:     "small.txt",
+				Mode:     0444,
+				Uid:      73025,
+				Gid:      5000,
+				Size:     5,
+				ModTime:  time.Unix(1244593104, 0),
+				Typeflag: '\x00',
+			},
+			{
+				Name:     "small2.txt",
+				Mode:     0444,
+				Uid:      73025,
+				Gid:      5000,
+				Size:     11,
+				ModTime:  time.Unix(1244593104, 0),
+				Typeflag: '\x00',
+			},
+		},
+	},
+	{
+		file: "testdata/pax.tar",
+		headers: []*Header{
+			{
+				Name:       "a/123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100",
+				Mode:       0664,
+				Uid:        1000,
+				Gid:        1000,
+				Uname:      "shane",
+				Gname:      "shane",
+				Size:       7,
+				ModTime:    time.Unix(1350244992, 23960108),
+				ChangeTime: time.Unix(1350244992, 23960108),
+				AccessTime: time.Unix(1350244992, 23960108),
+				Typeflag:   TypeReg,
+			},
+			{
+				Name:       "a/b",
+				Mode:       0777,
+				Uid:        1000,
+				Gid:        1000,
+				Uname:      "shane",
+				Gname:      "shane",
+				Size:       0,
+				ModTime:    time.Unix(1350266320, 910238425),
+				ChangeTime: time.Unix(1350266320, 910238425),
+				AccessTime: time.Unix(1350266320, 910238425),
+				Typeflag:   TypeSymlink,
+				Linkname:   "123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100",
+			},
+		},
+	},
+	{
+		file: "testdata/nil-uid.tar", // golang.org/issue/5290
+		headers: []*Header{
+			{
+				Name:     "P1050238.JPG.log",
+				Mode:     0664,
+				Uid:      0,
+				Gid:      0,
+				Size:     14,
+				ModTime:  time.Unix(1365454838, 0),
+				Typeflag: TypeReg,
+				Linkname: "",
+				Uname:    "eyefi",
+				Gname:    "eyefi",
+				Devmajor: 0,
+				Devminor: 0,
+			},
+		},
+	},
+	{
+		file: "testdata/xattrs.tar",
+		headers: []*Header{
+			{
+				Name:       "small.txt",
+				Mode:       0644,
+				Uid:        1000,
+				Gid:        10,
+				Size:       5,
+				ModTime:    time.Unix(1386065770, 448252320),
+				Typeflag:   '0',
+				Uname:      "alex",
+				Gname:      "wheel",
+				AccessTime: time.Unix(1389782991, 419875220),
+				ChangeTime: time.Unix(1389782956, 794414986),
+				Xattrs: map[string]string{
+					"user.key":  "value",
+					"user.key2": "value2",
+					// Interestingly, selinux encodes the terminating null inside the xattr
+					"security.selinux": "unconfined_u:object_r:default_t:s0\x00",
+				},
+			},
+			{
+				Name:       "small2.txt",
+				Mode:       0644,
+				Uid:        1000,
+				Gid:        10,
+				Size:       11,
+				ModTime:    time.Unix(1386065770, 449252304),
+				Typeflag:   '0',
+				Uname:      "alex",
+				Gname:      "wheel",
+				AccessTime: time.Unix(1389782991, 419875220),
+				ChangeTime: time.Unix(1386065770, 449252304),
+				Xattrs: map[string]string{
+					"security.selinux": "unconfined_u:object_r:default_t:s0\x00",
+				},
+			},
+		},
+	},
+}
+
+func TestReader(t *testing.T) {
+testLoop:
+	for i, test := range untarTests {
+		f, err := os.Open(test.file)
+		if err != nil {
+			t.Errorf("test %d: Unexpected error: %v", i, err)
+			continue
+		}
+		defer f.Close()
+		tr := NewReader(f)
+		for j, header := range test.headers {
+			hdr, err := tr.Next()
+			if err != nil || hdr == nil {
+				t.Errorf("test %d, entry %d: Didn't get entry: %v", i, j, err)
+				f.Close()
+				continue testLoop
+			}
+			if !reflect.DeepEqual(*hdr, *header) {
+				t.Errorf("test %d, entry %d: Incorrect header:\nhave %+v\nwant %+v",
+					i, j, *hdr, *header)
+			}
+		}
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			continue testLoop
+		}
+		if hdr != nil || err != nil {
+			t.Errorf("test %d: Unexpected entry or error: hdr=%v err=%v", i, hdr, err)
+		}
+	}
+}
+
+func TestPartialRead(t *testing.T) {
+	f, err := os.Open("testdata/gnu.tar")
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	defer f.Close()
+
+	tr := NewReader(f)
+
+	// Read the first four bytes; Next() should skip the last byte.
+	hdr, err := tr.Next()
+	if err != nil || hdr == nil {
+		t.Fatalf("Didn't get first file: %v", err)
+	}
+	buf := make([]byte, 4)
+	if _, err := io.ReadFull(tr, buf); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if expected := []byte("Kilt"); !bytes.Equal(buf, expected) {
+		t.Errorf("Contents = %v, want %v", buf, expected)
+	}
+
+	// Second file
+	hdr, err = tr.Next()
+	if err != nil || hdr == nil {
+		t.Fatalf("Didn't get second file: %v", err)
+	}
+	buf = make([]byte, 6)
+	if _, err := io.ReadFull(tr, buf); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if expected := []byte("Google"); !bytes.Equal(buf, expected) {
+		t.Errorf("Contents = %v, want %v", buf, expected)
+	}
+}
+
+func TestIncrementalRead(t *testing.T) {
+	test := gnuTarTest
+	f, err := os.Open(test.file)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	defer f.Close()
+
+	tr := NewReader(f)
+
+	headers := test.headers
+	cksums := test.cksums
+	nread := 0
+
+	// loop over all files
+	for ; ; nread++ {
+		hdr, err := tr.Next()
+		if hdr == nil || err == io.EOF {
+			break
+		}
+
+		// check the header
+		if !reflect.DeepEqual(*hdr, *headers[nread]) {
+			t.Errorf("Incorrect header:\nhave %+v\nwant %+v",
+				*hdr, headers[nread])
+		}
+
+		// read file contents in little chunks EOF,
+		// checksumming all the way
+		h := md5.New()
+		rdbuf := make([]uint8, 8)
+		for {
+			nr, err := tr.Read(rdbuf)
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				t.Errorf("Read: unexpected error %v\n", err)
+				break
+			}
+			h.Write(rdbuf[0:nr])
+		}
+		// verify checksum
+		have := fmt.Sprintf("%x", h.Sum(nil))
+		want := cksums[nread]
+		if want != have {
+			t.Errorf("Bad checksum on file %s:\nhave %+v\nwant %+v", hdr.Name, have, want)
+		}
+	}
+	if nread != len(headers) {
+		t.Errorf("Didn't process all files\nexpected: %d\nprocessed %d\n", len(headers), nread)
+	}
+}
+
+func TestNonSeekable(t *testing.T) {
+	test := gnuTarTest
+	f, err := os.Open(test.file)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	defer f.Close()
+
+	type readerOnly struct {
+		io.Reader
+	}
+	tr := NewReader(readerOnly{f})
+	nread := 0
+
+	for ; ; nread++ {
+		_, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+	}
+
+	if nread != len(test.headers) {
+		t.Errorf("Didn't process all files\nexpected: %d\nprocessed %d\n", len(test.headers), nread)
+	}
+}
+
+func TestParsePAXHeader(t *testing.T) {
+	paxTests := [][3]string{
+		{"a", "a=name", "10 a=name\n"}, // Test case involving multiple acceptable lengths
+		{"a", "a=name", "9 a=name\n"},  // Test case involving multiple acceptable length
+		{"mtime", "mtime=1350244992.023960108", "30 mtime=1350244992.023960108\n"}}
+	for _, test := range paxTests {
+		key, expected, raw := test[0], test[1], test[2]
+		reader := bytes.NewReader([]byte(raw))
+		headers, err := parsePAX(reader)
+		if err != nil {
+			t.Errorf("Couldn't parse correctly formatted headers: %v", err)
+			continue
+		}
+		if strings.EqualFold(headers[key], expected) {
+			t.Errorf("mtime header incorrectly parsed: got %s, wanted %s", headers[key], expected)
+			continue
+		}
+		trailer := make([]byte, 100)
+		n, err := reader.Read(trailer)
+		if err != io.EOF || n != 0 {
+			t.Error("Buffer wasn't consumed")
+		}
+	}
+	badHeader := bytes.NewReader([]byte("3 somelongkey="))
+	if _, err := parsePAX(badHeader); err != ErrHeader {
+		t.Fatal("Unexpected success when parsing bad header")
+	}
+}
+
+func TestParsePAXTime(t *testing.T) {
+	// Some valid PAX time values
+	timestamps := map[string]time.Time{
+		"1350244992.023960108":  time.Unix(1350244992, 23960108), // The commoon case
+		"1350244992.02396010":   time.Unix(1350244992, 23960100), // Lower precision value
+		"1350244992.0239601089": time.Unix(1350244992, 23960108), // Higher precision value
+		"1350244992":            time.Unix(1350244992, 0),        // Low precision value
+	}
+	for input, expected := range timestamps {
+		ts, err := parsePAXTime(input)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !ts.Equal(expected) {
+			t.Fatalf("Time parsing failure %s %s", ts, expected)
+		}
+	}
+}
+
+func TestMergePAX(t *testing.T) {
+	hdr := new(Header)
+	// Test a string, integer, and time based value.
+	headers := map[string]string{
+		"path":  "a/b/c",
+		"uid":   "1000",
+		"mtime": "1350244992.023960108",
+	}
+	err := mergePAX(hdr, headers)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := &Header{
+		Name:    "a/b/c",
+		Uid:     1000,
+		ModTime: time.Unix(1350244992, 23960108),
+	}
+	if !reflect.DeepEqual(hdr, want) {
+		t.Errorf("incorrect merge: got %+v, want %+v", hdr, want)
+	}
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_atim.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_atim.go
new file mode 100644
index 0000000000..cf9cc79c59
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_atim.go
@@ -0,0 +1,20 @@
+// Copyright 2012 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build linux dragonfly openbsd solaris
+
+package tar
+
+import (
+	"syscall"
+	"time"
+)
+
+func statAtime(st *syscall.Stat_t) time.Time {
+	return time.Unix(st.Atim.Unix())
+}
+
+func statCtime(st *syscall.Stat_t) time.Time {
+	return time.Unix(st.Ctim.Unix())
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_atimespec.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_atimespec.go
new file mode 100644
index 0000000000..6f17dbe307
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_atimespec.go
@@ -0,0 +1,20 @@
+// Copyright 2012 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build darwin freebsd netbsd
+
+package tar
+
+import (
+	"syscall"
+	"time"
+)
+
+func statAtime(st *syscall.Stat_t) time.Time {
+	return time.Unix(st.Atimespec.Unix())
+}
+
+func statCtime(st *syscall.Stat_t) time.Time {
+	return time.Unix(st.Ctimespec.Unix())
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_unix.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_unix.go
new file mode 100644
index 0000000000..cb843db4cf
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/stat_unix.go
@@ -0,0 +1,32 @@
+// Copyright 2012 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build linux darwin dragonfly freebsd openbsd netbsd solaris
+
+package tar
+
+import (
+	"os"
+	"syscall"
+)
+
+func init() {
+	sysStat = statUnix
+}
+
+func statUnix(fi os.FileInfo, h *Header) error {
+	sys, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return nil
+	}
+	h.Uid = int(sys.Uid)
+	h.Gid = int(sys.Gid)
+	// TODO(bradfitz): populate username & group.  os/user
+	// doesn't cache LookupId lookups, and lacks group
+	// lookup functions.
+	h.AccessTime = statAtime(sys)
+	h.ChangeTime = statCtime(sys)
+	// TODO(bradfitz): major/minor device numbers?
+	return nil
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/tar_test.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/tar_test.go
new file mode 100644
index 0000000000..ed333f3ea4
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/tar_test.go
@@ -0,0 +1,284 @@
+// Copyright 2012 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tar
+
+import (
+	"bytes"
+	"io/ioutil"
+	"os"
+	"path"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestFileInfoHeader(t *testing.T) {
+	fi, err := os.Stat("testdata/small.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	h, err := FileInfoHeader(fi, "")
+	if err != nil {
+		t.Fatalf("FileInfoHeader: %v", err)
+	}
+	if g, e := h.Name, "small.txt"; g != e {
+		t.Errorf("Name = %q; want %q", g, e)
+	}
+	if g, e := h.Mode, int64(fi.Mode().Perm())|c_ISREG; g != e {
+		t.Errorf("Mode = %#o; want %#o", g, e)
+	}
+	if g, e := h.Size, int64(5); g != e {
+		t.Errorf("Size = %v; want %v", g, e)
+	}
+	if g, e := h.ModTime, fi.ModTime(); !g.Equal(e) {
+		t.Errorf("ModTime = %v; want %v", g, e)
+	}
+	// FileInfoHeader should error when passing nil FileInfo
+	if _, err := FileInfoHeader(nil, ""); err == nil {
+		t.Fatalf("Expected error when passing nil to FileInfoHeader")
+	}
+}
+
+func TestFileInfoHeaderDir(t *testing.T) {
+	fi, err := os.Stat("testdata")
+	if err != nil {
+		t.Fatal(err)
+	}
+	h, err := FileInfoHeader(fi, "")
+	if err != nil {
+		t.Fatalf("FileInfoHeader: %v", err)
+	}
+	if g, e := h.Name, "testdata/"; g != e {
+		t.Errorf("Name = %q; want %q", g, e)
+	}
+	// Ignoring c_ISGID for golang.org/issue/4867
+	if g, e := h.Mode&^c_ISGID, int64(fi.Mode().Perm())|c_ISDIR; g != e {
+		t.Errorf("Mode = %#o; want %#o", g, e)
+	}
+	if g, e := h.Size, int64(0); g != e {
+		t.Errorf("Size = %v; want %v", g, e)
+	}
+	if g, e := h.ModTime, fi.ModTime(); !g.Equal(e) {
+		t.Errorf("ModTime = %v; want %v", g, e)
+	}
+}
+
+func TestFileInfoHeaderSymlink(t *testing.T) {
+	h, err := FileInfoHeader(symlink{}, "some-target")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if g, e := h.Name, "some-symlink"; g != e {
+		t.Errorf("Name = %q; want %q", g, e)
+	}
+	if g, e := h.Linkname, "some-target"; g != e {
+		t.Errorf("Linkname = %q; want %q", g, e)
+	}
+}
+
+type symlink struct{}
+
+func (symlink) Name() string       { return "some-symlink" }
+func (symlink) Size() int64        { return 0 }
+func (symlink) Mode() os.FileMode  { return os.ModeSymlink }
+func (symlink) ModTime() time.Time { return time.Time{} }
+func (symlink) IsDir() bool        { return false }
+func (symlink) Sys() interface{}   { return nil }
+
+func TestRoundTrip(t *testing.T) {
+	data := []byte("some file contents")
+
+	var b bytes.Buffer
+	tw := NewWriter(&b)
+	hdr := &Header{
+		Name:    "file.txt",
+		Uid:     1 << 21, // too big for 8 octal digits
+		Size:    int64(len(data)),
+		ModTime: time.Now(),
+	}
+	// tar only supports second precision.
+	hdr.ModTime = hdr.ModTime.Add(-time.Duration(hdr.ModTime.Nanosecond()) * time.Nanosecond)
+	if err := tw.WriteHeader(hdr); err != nil {
+		t.Fatalf("tw.WriteHeader: %v", err)
+	}
+	if _, err := tw.Write(data); err != nil {
+		t.Fatalf("tw.Write: %v", err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatalf("tw.Close: %v", err)
+	}
+
+	// Read it back.
+	tr := NewReader(&b)
+	rHdr, err := tr.Next()
+	if err != nil {
+		t.Fatalf("tr.Next: %v", err)
+	}
+	if !reflect.DeepEqual(rHdr, hdr) {
+		t.Errorf("Header mismatch.\n got %+v\nwant %+v", rHdr, hdr)
+	}
+	rData, err := ioutil.ReadAll(tr)
+	if err != nil {
+		t.Fatalf("Read: %v", err)
+	}
+	if !bytes.Equal(rData, data) {
+		t.Errorf("Data mismatch.\n got %q\nwant %q", rData, data)
+	}
+}
+
+type headerRoundTripTest struct {
+	h  *Header
+	fm os.FileMode
+}
+
+func TestHeaderRoundTrip(t *testing.T) {
+	golden := []headerRoundTripTest{
+		// regular file.
+		{
+			h: &Header{
+				Name:     "test.txt",
+				Mode:     0644 | c_ISREG,
+				Size:     12,
+				ModTime:  time.Unix(1360600916, 0),
+				Typeflag: TypeReg,
+			},
+			fm: 0644,
+		},
+		// hard link.
+		{
+			h: &Header{
+				Name:     "hard.txt",
+				Mode:     0644 | c_ISLNK,
+				Size:     0,
+				ModTime:  time.Unix(1360600916, 0),
+				Typeflag: TypeLink,
+			},
+			fm: 0644 | os.ModeSymlink,
+		},
+		// symbolic link.
+		{
+			h: &Header{
+				Name:     "link.txt",
+				Mode:     0777 | c_ISLNK,
+				Size:     0,
+				ModTime:  time.Unix(1360600852, 0),
+				Typeflag: TypeSymlink,
+			},
+			fm: 0777 | os.ModeSymlink,
+		},
+		// character device node.
+		{
+			h: &Header{
+				Name:     "dev/null",
+				Mode:     0666 | c_ISCHR,
+				Size:     0,
+				ModTime:  time.Unix(1360578951, 0),
+				Typeflag: TypeChar,
+			},
+			fm: 0666 | os.ModeDevice | os.ModeCharDevice,
+		},
+		// block device node.
+		{
+			h: &Header{
+				Name:     "dev/sda",
+				Mode:     0660 | c_ISBLK,
+				Size:     0,
+				ModTime:  time.Unix(1360578954, 0),
+				Typeflag: TypeBlock,
+			},
+			fm: 0660 | os.ModeDevice,
+		},
+		// directory.
+		{
+			h: &Header{
+				Name:     "dir/",
+				Mode:     0755 | c_ISDIR,
+				Size:     0,
+				ModTime:  time.Unix(1360601116, 0),
+				Typeflag: TypeDir,
+			},
+			fm: 0755 | os.ModeDir,
+		},
+		// fifo node.
+		{
+			h: &Header{
+				Name:     "dev/initctl",
+				Mode:     0600 | c_ISFIFO,
+				Size:     0,
+				ModTime:  time.Unix(1360578949, 0),
+				Typeflag: TypeFifo,
+			},
+			fm: 0600 | os.ModeNamedPipe,
+		},
+		// setuid.
+		{
+			h: &Header{
+				Name:     "bin/su",
+				Mode:     0755 | c_ISREG | c_ISUID,
+				Size:     23232,
+				ModTime:  time.Unix(1355405093, 0),
+				Typeflag: TypeReg,
+			},
+			fm: 0755 | os.ModeSetuid,
+		},
+		// setguid.
+		{
+			h: &Header{
+				Name:     "group.txt",
+				Mode:     0750 | c_ISREG | c_ISGID,
+				Size:     0,
+				ModTime:  time.Unix(1360602346, 0),
+				Typeflag: TypeReg,
+			},
+			fm: 0750 | os.ModeSetgid,
+		},
+		// sticky.
+		{
+			h: &Header{
+				Name:     "sticky.txt",
+				Mode:     0600 | c_ISREG | c_ISVTX,
+				Size:     7,
+				ModTime:  time.Unix(1360602540, 0),
+				Typeflag: TypeReg,
+			},
+			fm: 0600 | os.ModeSticky,
+		},
+	}
+
+	for i, g := range golden {
+		fi := g.h.FileInfo()
+		h2, err := FileInfoHeader(fi, "")
+		if err != nil {
+			t.Error(err)
+			continue
+		}
+		if strings.Contains(fi.Name(), "/") {
+			t.Errorf("FileInfo of %q contains slash: %q", g.h.Name, fi.Name())
+		}
+		name := path.Base(g.h.Name)
+		if fi.IsDir() {
+			name += "/"
+		}
+		if got, want := h2.Name, name; got != want {
+			t.Errorf("i=%d: Name: got %v, want %v", i, got, want)
+		}
+		if got, want := h2.Size, g.h.Size; got != want {
+			t.Errorf("i=%d: Size: got %v, want %v", i, got, want)
+		}
+		if got, want := h2.Mode, g.h.Mode; got != want {
+			t.Errorf("i=%d: Mode: got %o, want %o", i, got, want)
+		}
+		if got, want := fi.Mode(), g.fm; got != want {
+			t.Errorf("i=%d: fi.Mode: got %o, want %o", i, got, want)
+		}
+		if got, want := h2.ModTime, g.h.ModTime; got != want {
+			t.Errorf("i=%d: ModTime: got %v, want %v", i, got, want)
+		}
+		if sysh, ok := fi.Sys().(*Header); !ok || sysh != g.h {
+			t.Errorf("i=%d: Sys didn't return original *Header", i)
+		}
+	}
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/gnu.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/gnu.tar
new file mode 100644
index 0000000000000000000000000000000000000000..fc899dc8dc2ad9952f5c5f67a0c76ca2d87249e9
GIT binary patch
literal 3072
zcmeHH%L>9U5Ztq0(Jv@FdDKtv;8zq|ijXv5BIw^6DOh^2UK)_HbK1>@VQ0c5`qsHR
zJrb1zXEcV16&lMRW}rdtKd=NSXg->JkvP|Esp4`g&CK_h+FMmo7oR?iU7RP&svn2t
z!9Ke4)upeR_aRYKtT+(g`B!B>fS>t?p7IZ9V9LKWlK+)w+iY|SVQ_tY3I4Ddrx1w)
M;($0H4*b6ZFWOBnBLDyZ

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/nil-uid.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/nil-uid.tar
new file mode 100644
index 0000000000000000000000000000000000000000..cc9cfaa33cc5de0a28b4183c1705d801f788c96a
GIT binary patch
literal 1024
zcmWGAG%z(VGPcn33UJrU$xmmX0WbgpGcywmlR@HOU}(l*Xk=(?U}j`)Zf3?{U<jnm
z859gKbkIPcw74X(NI`)iwK6p=6OZ|X<nd@7C@FB5ni!ZE85p31FS2_~Omu)Kz(3qI
O$lniHVw621LI421e;KL(

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/pax.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/pax.tar
new file mode 100644
index 0000000000000000000000000000000000000000..9bc24b6587d726c7fca4e533d9c61a3801a34688
GIT binary patch
literal 10240
zcmeH~&u-H|5XOD(Q}_vz`9HIV-Z}CL1|qeBRwxNlAD?kbq{vMJQj94uds*3I@2-Ed
zpXb|Q{eF0Qw;4Wdw!4)@_!@~t&7&b8A|a!oqM>78BOoLqCLtvwr=Z5b$i&RT%Er#Y
zO+ZjcSVUAHn~8MUp(~vBV+cg7LjpEKCCE6D7<T<rw?O;0+Yj4Z(zR0^zGPhdbGvr9
zrQRoy{_C*6yB&T*;!Rvanu2Cxl~q*L)HSpj7#bOyn3|beSaWc6a&~cbbNBET5Ev93
z5*ijB5v@VXo!D}hwH&DBLoGKe+%WVH`}>E@EwTcMv_>l+&bbg`j1Cv0A776ym5t@+
zSt9MDBFtXbKY&m4pMN0f`l~hhD>#q(-`x$5n+q@eEPmAevA;0XTM8XMYkTvSmQ-t5
zkihVw{(qQ#_JjT})&KMa&-FhG0c8or{CPvw|Jf69W<Ub#zuZ55K6rrnt=}JY0A@_E
zN^3xAA4n$-;7s(y0ZgN3(ESs)hV}e<pMn|npKk8d_aDyzKdR+K|CC3Dtp9n`nENR5
zazFm(^?#bHx-J4mpa>L!B2Wa1KoKYcMW6^2fg(@@ia-%40!5$*6oDd81d2cr_`3;w
E2V3|JA^-pY

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/small.txt b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/small.txt
new file mode 100644
index 0000000000..b249bfc518
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/small.txt
@@ -0,0 +1 @@
+Kilts
\ No newline at end of file
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/small2.txt b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/small2.txt
new file mode 100644
index 0000000000..394ee3ecd0
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/small2.txt
@@ -0,0 +1 @@
+Google.com
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/star.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/star.tar
new file mode 100644
index 0000000000000000000000000000000000000000..59e2d4e604611eeac3e2a0f3d6f71d2623c50449
GIT binary patch
literal 3072
zcmeHHT?)e>4DRzz;R#BjQ;)ERouag*479>@u-$$NbG3!-WyoMlUh?xvNIv}HZD&jy
zuA!-C5KZlY0Y@bP833Zfm_JQ2M2<pg$x$a<X%X>yBQ2dTK6K{>VDLBV=D{z>IvVF`
zUD#xgUGh?F1AikeIW6NnOIrMRGU4UU`62nAWxyx>^STEhN#m{lQEc_E<B1^sfB5T4
f&6ja*oAiHhZZc!rJG;we^27i!KnxHAf55;UI$1)v

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/ustar.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/ustar.tar
new file mode 100644
index 0000000000000000000000000000000000000000..29679d9a305fc0293f31212541335af824ab32c7
GIT binary patch
literal 2048
zcmYex%t_TNsVHHfAus>}GZPaA5N&Q|3Z@N=AbgM*P?o{a$k4#V#K6eR)QrKv#MIE(
zgh9c8hHiozU0Pg{SOj!ZaYkZZDqIwk0aTWjhA9jefq29K;yD8YhMfGo^t{B}RQ&;E
gz@3MSk&&8{lh1`qc2s;c1V%$(Gz3ONV7P_=0F<Om%m4rY

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/v7.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/v7.tar
new file mode 100644
index 0000000000000000000000000000000000000000..eb65fc9410721efd98cb7c5e274f547ec530252d
GIT binary patch
literal 3584
zcmeHH&ubGw6n?3{z(^13q0owB@t_Dbv)OD<qP9W<=F*#Zu|<OsHb$B#MLfilBFeB(
zSoNT!67<$TAs)OG!JCj{H}PP>Tf|dgec!sXT^AK{$jKc@-kWdUe(&uh-&e0L+xARj
zwLzm>LI~3|1sT#R<fI@Wr6qG5qg7zYkom%FVb;hoYUM10#ONkUne`1^zGXM+dP9_X
zf9{!k@}lkT-^GT?E=~8;_J-Sfc*0X(rakp_A<JKLSzr#wwI)%K`MZ;SC3bqMH1Ip|
z1{<-><Eg%KV|%16{)~l~IM!EAm?y(W(^K-Ur`8VhORW=CxX-71o<d*Dpz-3wx&t1}
zqB**~o+=Lf%pnHMS44X_c9{pYsHyN=;KOss!Fho3#oJp!j+%FT{yE&EUz{K3SbKkk
z===U0_xa&>&XkBIzWbfCPrYEK7fr^Q@7vXO;&pw$QCTT3-?&yO+jq(<{6qS`FS_vP
zIBhMBjnmsnS~{|C9LMN8#r!W{zj5l&zcE?^U_t*||1zJ{zqInH{-Zy}2$O|c?WSFx
zxn8RtM3-UpAJiW`Z@Zar#$ojz)NjtWBfnULUzD=jj5!>iG>O2k{o(=ZAg=$-urC7q
zVm{n!{kK`S@p|Vk`q%aFg#nw)bMB-40yAj*%7=F37m@ziFINBH7pTSD@Cfil^^9T6
zxL-iu+Aq)#ev#CF(l2&S@A^eC<`;^e4{ZQ#s9$Y4r}$iP3;;e3V;a&MNN*s$f%FFc
H(;N5+1FUK9

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/writer-big.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/writer-big.tar
new file mode 100644
index 0000000000000000000000000000000000000000..753e883cebf52ac1291f1b7bf1b7a37ae517b2d9
GIT binary patch
literal 4096
zcmeIuF%E+;3<XdRJxET_`a8w<L86KnpjDGf?Z(j?V1^B*|A$1fEm?kLc-`QsPuKD-
za!j<w?<#8WMj@(zLuFdmUFHukH;d4w&LP601YP^bzMov$cL>tu-|!r}ytVByrmfae
ipO37m$1T~NWs?FFpa2CZKmiI+fC3bt00k&;vcMnFf)<_t

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/writer.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/writer.tar
new file mode 100644
index 0000000000000000000000000000000000000000..e6d816ad0775d56d09242d6f5d1dbe56af310a32
GIT binary patch
literal 3584
zcmeHIK@P$o5ajGDd_l9j6nKIMUt!cVjT92WM1L<dt&JwF9!gRh_Cl9!$n3!ExaOdB
z;qRWM3kV@gU_dAZAOk>@81h#LhDgML6Bon)c?rO_kPgyt^3D0fH9$GJM`O*&4VCw=
zv#H)UKC-TtzNwGuV$*%C{b<jNMV*1o#ej?Yr?dkgN@G(0$fN$_Oh8U$tAC-g{^z>m
zsdIMLR{C5VZL^vBE!S4cfUeCYt@>GOiAt%sq7tp|_iN{x5cDreh9ME=K+wOCQm`$x
j!znSk-v6Dy)}|V_!f*AilYjI7l|Jj-R%ReG@B;%+QQ}au

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/xattrs.tar b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/testdata/xattrs.tar
new file mode 100644
index 0000000000000000000000000000000000000000..9701950edd1f0dc82858b7117136b37391be0b08
GIT binary patch
literal 5120
zcmeHJv2KGf5M|~o_yWg1+khiw>d;i}P^nX=$R$ooYd`|ilD{uBAv6g^kxC>6-(uu<
zHg^v_-l5r}td>fyRbC(vfcdOQq}Iq(#u+Ja9X?}Dv(|CCVoJF~09ZgF;2a!G7^%~|
zYNYoMUQ-rE=5<MfNf&^--n!;4I5LG45ME;9L@fvneeClfz=*LBI8bnFP`025LJ)!=
zMno8J0GDDfIs&<m0>KzzBJ^EKyr-Mx-NQ4gq%k=v3zee}wOxElT`HH-ei(K*xV|_}
zC{$GDvDu<R={PN`MVUrfx`|V@UX}Cg<y}Q)mCx5|BTH>oW?o>&odUrVuVHkt_w?IH
zW3PV_@V!Jxt@A^i>Yrj(>;K=H?5X8!tJS~MYVd#a^`?|QJKb&Uduf~MfN4M7$J!Lr
zF40zZMF!9x{tqJ#0F5+;{2!=)=Knre|G(mAKU`hAc#r>!#{V(9d;sW1hxVv7@B_zF
ze)#eKF~#1~>@WTI`#+&4`lkel_5U6!N8h^5vRAE8lqGgr9-Ul!p=H1_U>TS&1K)l2
B)fNB%

literal 0
HcmV?d00001

diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/writer.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/writer.go
new file mode 100644
index 0000000000..9ee9499297
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/writer.go
@@ -0,0 +1,383 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tar
+
+// TODO(dsymonds):
+// - catch more errors (no first header, etc.)
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+)
+
+var (
+	ErrWriteTooLong    = errors.New("archive/tar: write too long")
+	ErrFieldTooLong    = errors.New("archive/tar: header field too long")
+	ErrWriteAfterClose = errors.New("archive/tar: write after close")
+	errNameTooLong     = errors.New("archive/tar: name too long")
+	errInvalidHeader   = errors.New("archive/tar: header field too long or contains invalid values")
+)
+
+// A Writer provides sequential writing of a tar archive in POSIX.1 format.
+// A tar archive consists of a sequence of files.
+// Call WriteHeader to begin a new file, and then call Write to supply that file's data,
+// writing at most hdr.Size bytes in total.
+type Writer struct {
+	w          io.Writer
+	err        error
+	nb         int64 // number of unwritten bytes for current file entry
+	pad        int64 // amount of padding to write after current file entry
+	closed     bool
+	usedBinary bool // whether the binary numeric field extension was used
+	preferPax  bool // use pax header instead of binary numeric header
+}
+
+// NewWriter creates a new Writer writing to w.
+func NewWriter(w io.Writer) *Writer { return &Writer{w: w} }
+
+// Flush finishes writing the current file (optional).
+func (tw *Writer) Flush() error {
+	if tw.nb > 0 {
+		tw.err = fmt.Errorf("archive/tar: missed writing %d bytes", tw.nb)
+		return tw.err
+	}
+
+	n := tw.nb + tw.pad
+	for n > 0 && tw.err == nil {
+		nr := n
+		if nr > blockSize {
+			nr = blockSize
+		}
+		var nw int
+		nw, tw.err = tw.w.Write(zeroBlock[0:nr])
+		n -= int64(nw)
+	}
+	tw.nb = 0
+	tw.pad = 0
+	return tw.err
+}
+
+// Write s into b, terminating it with a NUL if there is room.
+// If the value is too long for the field and allowPax is true add a paxheader record instead
+func (tw *Writer) cString(b []byte, s string, allowPax bool, paxKeyword string, paxHeaders map[string]string) {
+	needsPaxHeader := allowPax && len(s) > len(b) || !isASCII(s)
+	if needsPaxHeader {
+		paxHeaders[paxKeyword] = s
+		return
+	}
+	if len(s) > len(b) {
+		if tw.err == nil {
+			tw.err = ErrFieldTooLong
+		}
+		return
+	}
+	ascii := toASCII(s)
+	copy(b, ascii)
+	if len(ascii) < len(b) {
+		b[len(ascii)] = 0
+	}
+}
+
+// Encode x as an octal ASCII string and write it into b with leading zeros.
+func (tw *Writer) octal(b []byte, x int64) {
+	s := strconv.FormatInt(x, 8)
+	// leading zeros, but leave room for a NUL.
+	for len(s)+1 < len(b) {
+		s = "0" + s
+	}
+	tw.cString(b, s, false, paxNone, nil)
+}
+
+// Write x into b, either as octal or as binary (GNUtar/star extension).
+// If the value is too long for the field and writingPax is enabled both for the field and the add a paxheader record instead
+func (tw *Writer) numeric(b []byte, x int64, allowPax bool, paxKeyword string, paxHeaders map[string]string) {
+	// Try octal first.
+	s := strconv.FormatInt(x, 8)
+	if len(s) < len(b) {
+		tw.octal(b, x)
+		return
+	}
+
+	// If it is too long for octal, and pax is preferred, use a pax header
+	if allowPax && tw.preferPax {
+		tw.octal(b, 0)
+		s := strconv.FormatInt(x, 10)
+		paxHeaders[paxKeyword] = s
+		return
+	}
+
+	// Too big: use binary (big-endian).
+	tw.usedBinary = true
+	for i := len(b) - 1; x > 0 && i >= 0; i-- {
+		b[i] = byte(x)
+		x >>= 8
+	}
+	b[0] |= 0x80 // highest bit indicates binary format
+}
+
+var (
+	minTime = time.Unix(0, 0)
+	// There is room for 11 octal digits (33 bits) of mtime.
+	maxTime = minTime.Add((1<<33 - 1) * time.Second)
+)
+
+// WriteHeader writes hdr and prepares to accept the file's contents.
+// WriteHeader calls Flush if it is not the first header.
+// Calling after a Close will return ErrWriteAfterClose.
+func (tw *Writer) WriteHeader(hdr *Header) error {
+	return tw.writeHeader(hdr, true)
+}
+
+// WriteHeader writes hdr and prepares to accept the file's contents.
+// WriteHeader calls Flush if it is not the first header.
+// Calling after a Close will return ErrWriteAfterClose.
+// As this method is called internally by writePax header to allow it to
+// suppress writing the pax header.
+func (tw *Writer) writeHeader(hdr *Header, allowPax bool) error {
+	if tw.closed {
+		return ErrWriteAfterClose
+	}
+	if tw.err == nil {
+		tw.Flush()
+	}
+	if tw.err != nil {
+		return tw.err
+	}
+
+	// a map to hold pax header records, if any are needed
+	paxHeaders := make(map[string]string)
+
+	// TODO(shanemhansen): we might want to use PAX headers for
+	// subsecond time resolution, but for now let's just capture
+	// too long fields or non ascii characters
+
+	header := make([]byte, blockSize)
+	s := slicer(header)
+
+	// keep a reference to the filename to allow to overwrite it later if we detect that we can use ustar longnames instead of pax
+	pathHeaderBytes := s.next(fileNameSize)
+
+	tw.cString(pathHeaderBytes, hdr.Name, true, paxPath, paxHeaders)
+
+	// Handle out of range ModTime carefully.
+	var modTime int64
+	if !hdr.ModTime.Before(minTime) && !hdr.ModTime.After(maxTime) {
+		modTime = hdr.ModTime.Unix()
+	}
+
+	tw.octal(s.next(8), hdr.Mode)                                   // 100:108
+	tw.numeric(s.next(8), int64(hdr.Uid), true, paxUid, paxHeaders) // 108:116
+	tw.numeric(s.next(8), int64(hdr.Gid), true, paxGid, paxHeaders) // 116:124
+	tw.numeric(s.next(12), hdr.Size, true, paxSize, paxHeaders)     // 124:136
+	tw.numeric(s.next(12), modTime, false, paxNone, nil)            // 136:148 --- consider using pax for finer granularity
+	s.next(8)                                                       // chksum (148:156)
+	s.next(1)[0] = hdr.Typeflag                                     // 156:157
+
+	tw.cString(s.next(100), hdr.Linkname, true, paxLinkpath, paxHeaders)
+
+	copy(s.next(8), []byte("ustar\x0000"))                        // 257:265
+	tw.cString(s.next(32), hdr.Uname, true, paxUname, paxHeaders) // 265:297
+	tw.cString(s.next(32), hdr.Gname, true, paxGname, paxHeaders) // 297:329
+	tw.numeric(s.next(8), hdr.Devmajor, false, paxNone, nil)      // 329:337
+	tw.numeric(s.next(8), hdr.Devminor, false, paxNone, nil)      // 337:345
+
+	// keep a reference to the prefix to allow to overwrite it later if we detect that we can use ustar longnames instead of pax
+	prefixHeaderBytes := s.next(155)
+	tw.cString(prefixHeaderBytes, "", false, paxNone, nil) // 345:500  prefix
+
+	// Use the GNU magic instead of POSIX magic if we used any GNU extensions.
+	if tw.usedBinary {
+		copy(header[257:265], []byte("ustar  \x00"))
+	}
+
+	_, paxPathUsed := paxHeaders[paxPath]
+	// try to use a ustar header when only the name is too long
+	if !tw.preferPax && len(paxHeaders) == 1 && paxPathUsed {
+		suffix := hdr.Name
+		prefix := ""
+		if len(hdr.Name) > fileNameSize && isASCII(hdr.Name) {
+			var err error
+			prefix, suffix, err = tw.splitUSTARLongName(hdr.Name)
+			if err == nil {
+				// ok we can use a ustar long name instead of pax, now correct the fields
+
+				// remove the path field from the pax header. this will suppress the pax header
+				delete(paxHeaders, paxPath)
+
+				// update the path fields
+				tw.cString(pathHeaderBytes, suffix, false, paxNone, nil)
+				tw.cString(prefixHeaderBytes, prefix, false, paxNone, nil)
+
+				// Use the ustar magic if we used ustar long names.
+				if len(prefix) > 0 {
+					copy(header[257:265], []byte("ustar\000"))
+				}
+			}
+		}
+	}
+
+	// The chksum field is terminated by a NUL and a space.
+	// This is different from the other octal fields.
+	chksum, _ := checksum(header)
+	tw.octal(header[148:155], chksum)
+	header[155] = ' '
+
+	if tw.err != nil {
+		// problem with header; probably integer too big for a field.
+		return tw.err
+	}
+
+	if allowPax {
+		for k, v := range hdr.Xattrs {
+			paxHeaders[paxXattr+k] = v
+		}
+	}
+
+	if len(paxHeaders) > 0 {
+		if !allowPax {
+			return errInvalidHeader
+		}
+		if err := tw.writePAXHeader(hdr, paxHeaders); err != nil {
+			return err
+		}
+	}
+	tw.nb = int64(hdr.Size)
+	tw.pad = (blockSize - (tw.nb % blockSize)) % blockSize
+
+	_, tw.err = tw.w.Write(header)
+	return tw.err
+}
+
+// writeUSTARLongName splits a USTAR long name hdr.Name.
+// name must be < 256 characters. errNameTooLong is returned
+// if hdr.Name can't be split. The splitting heuristic
+// is compatible with gnu tar.
+func (tw *Writer) splitUSTARLongName(name string) (prefix, suffix string, err error) {
+	length := len(name)
+	if length > fileNamePrefixSize+1 {
+		length = fileNamePrefixSize + 1
+	} else if name[length-1] == '/' {
+		length--
+	}
+	i := strings.LastIndex(name[:length], "/")
+	// nlen contains the resulting length in the name field.
+	// plen contains the resulting length in the prefix field.
+	nlen := len(name) - i - 1
+	plen := i
+	if i <= 0 || nlen > fileNameSize || nlen == 0 || plen > fileNamePrefixSize {
+		err = errNameTooLong
+		return
+	}
+	prefix, suffix = name[:i], name[i+1:]
+	return
+}
+
+// writePaxHeader writes an extended pax header to the
+// archive.
+func (tw *Writer) writePAXHeader(hdr *Header, paxHeaders map[string]string) error {
+	// Prepare extended header
+	ext := new(Header)
+	ext.Typeflag = TypeXHeader
+	// Setting ModTime is required for reader parsing to
+	// succeed, and seems harmless enough.
+	ext.ModTime = hdr.ModTime
+	// The spec asks that we namespace our pseudo files
+	// with the current pid.
+	pid := os.Getpid()
+	dir, file := path.Split(hdr.Name)
+	fullName := path.Join(dir,
+		fmt.Sprintf("PaxHeaders.%d", pid), file)
+
+	ascii := toASCII(fullName)
+	if len(ascii) > 100 {
+		ascii = ascii[:100]
+	}
+	ext.Name = ascii
+	// Construct the body
+	var buf bytes.Buffer
+
+	for k, v := range paxHeaders {
+		fmt.Fprint(&buf, paxHeader(k+"="+v))
+	}
+
+	ext.Size = int64(len(buf.Bytes()))
+	if err := tw.writeHeader(ext, false); err != nil {
+		return err
+	}
+	if _, err := tw.Write(buf.Bytes()); err != nil {
+		return err
+	}
+	if err := tw.Flush(); err != nil {
+		return err
+	}
+	return nil
+}
+
+// paxHeader formats a single pax record, prefixing it with the appropriate length
+func paxHeader(msg string) string {
+	const padding = 2 // Extra padding for space and newline
+	size := len(msg) + padding
+	size += len(strconv.Itoa(size))
+	record := fmt.Sprintf("%d %s\n", size, msg)
+	if len(record) != size {
+		// Final adjustment if adding size increased
+		// the number of digits in size
+		size = len(record)
+		record = fmt.Sprintf("%d %s\n", size, msg)
+	}
+	return record
+}
+
+// Write writes to the current entry in the tar archive.
+// Write returns the error ErrWriteTooLong if more than
+// hdr.Size bytes are written after WriteHeader.
+func (tw *Writer) Write(b []byte) (n int, err error) {
+	if tw.closed {
+		err = ErrWriteTooLong
+		return
+	}
+	overwrite := false
+	if int64(len(b)) > tw.nb {
+		b = b[0:tw.nb]
+		overwrite = true
+	}
+	n, err = tw.w.Write(b)
+	tw.nb -= int64(n)
+	if err == nil && overwrite {
+		err = ErrWriteTooLong
+		return
+	}
+	tw.err = err
+	return
+}
+
+// Close closes the tar archive, flushing any unwritten
+// data to the underlying writer.
+func (tw *Writer) Close() error {
+	if tw.err != nil || tw.closed {
+		return tw.err
+	}
+	tw.Flush()
+	tw.closed = true
+	if tw.err != nil {
+		return tw.err
+	}
+
+	// trailer: two zero blocks
+	for i := 0; i < 2; i++ {
+		_, tw.err = tw.w.Write(zeroBlock)
+		if tw.err != nil {
+			break
+		}
+	}
+	return tw.err
+}
diff --git a/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/writer_test.go b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/writer_test.go
new file mode 100644
index 0000000000..2b9ea658db
--- /dev/null
+++ b/components/engine/vendor/src/code.google.com/p/go/src/pkg/archive/tar/writer_test.go
@@ -0,0 +1,433 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tar
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+	"testing/iotest"
+	"time"
+)
+
+type writerTestEntry struct {
+	header   *Header
+	contents string
+}
+
+type writerTest struct {
+	file    string // filename of expected output
+	entries []*writerTestEntry
+}
+
+var writerTests = []*writerTest{
+	// The writer test file was produced with this command:
+	// tar (GNU tar) 1.26
+	//   ln -s small.txt link.txt
+	//   tar -b 1 --format=ustar -c -f writer.tar small.txt small2.txt link.txt
+	{
+		file: "testdata/writer.tar",
+		entries: []*writerTestEntry{
+			{
+				header: &Header{
+					Name:     "small.txt",
+					Mode:     0640,
+					Uid:      73025,
+					Gid:      5000,
+					Size:     5,
+					ModTime:  time.Unix(1246508266, 0),
+					Typeflag: '0',
+					Uname:    "dsymonds",
+					Gname:    "eng",
+				},
+				contents: "Kilts",
+			},
+			{
+				header: &Header{
+					Name:     "small2.txt",
+					Mode:     0640,
+					Uid:      73025,
+					Gid:      5000,
+					Size:     11,
+					ModTime:  time.Unix(1245217492, 0),
+					Typeflag: '0',
+					Uname:    "dsymonds",
+					Gname:    "eng",
+				},
+				contents: "Google.com\n",
+			},
+			{
+				header: &Header{
+					Name:     "link.txt",
+					Mode:     0777,
+					Uid:      1000,
+					Gid:      1000,
+					Size:     0,
+					ModTime:  time.Unix(1314603082, 0),
+					Typeflag: '2',
+					Linkname: "small.txt",
+					Uname:    "strings",
+					Gname:    "strings",
+				},
+				// no contents
+			},
+		},
+	},
+	// The truncated test file was produced using these commands:
+	//   dd if=/dev/zero bs=1048576 count=16384 > /tmp/16gig.txt
+	//   tar -b 1 -c -f- /tmp/16gig.txt | dd bs=512 count=8 > writer-big.tar
+	{
+		file: "testdata/writer-big.tar",
+		entries: []*writerTestEntry{
+			{
+				header: &Header{
+					Name:     "tmp/16gig.txt",
+					Mode:     0640,
+					Uid:      73025,
+					Gid:      5000,
+					Size:     16 << 30,
+					ModTime:  time.Unix(1254699560, 0),
+					Typeflag: '0',
+					Uname:    "dsymonds",
+					Gname:    "eng",
+				},
+				// fake contents
+				contents: strings.Repeat("\x00", 4<<10),
+			},
+		},
+	},
+	// This file was produced using gnu tar 1.17
+	// gnutar  -b 4 --format=ustar (longname/)*15 + file.txt
+	{
+		file: "testdata/ustar.tar",
+		entries: []*writerTestEntry{
+			{
+				header: &Header{
+					Name:     strings.Repeat("longname/", 15) + "file.txt",
+					Mode:     0644,
+					Uid:      0765,
+					Gid:      024,
+					Size:     06,
+					ModTime:  time.Unix(1360135598, 0),
+					Typeflag: '0',
+					Uname:    "shane",
+					Gname:    "staff",
+				},
+				contents: "hello\n",
+			},
+		},
+	},
+}
+
+// Render byte array in a two-character hexadecimal string, spaced for easy visual inspection.
+func bytestr(offset int, b []byte) string {
+	const rowLen = 32
+	s := fmt.Sprintf("%04x ", offset)
+	for _, ch := range b {
+		switch {
+		case '0' <= ch && ch <= '9', 'A' <= ch && ch <= 'Z', 'a' <= ch && ch <= 'z':
+			s += fmt.Sprintf("  %c", ch)
+		default:
+			s += fmt.Sprintf(" %02x", ch)
+		}
+	}
+	return s
+}
+
+// Render a pseudo-diff between two blocks of bytes.
+func bytediff(a []byte, b []byte) string {
+	const rowLen = 32
+	s := fmt.Sprintf("(%d bytes vs. %d bytes)\n", len(a), len(b))
+	for offset := 0; len(a)+len(b) > 0; offset += rowLen {
+		na, nb := rowLen, rowLen
+		if na > len(a) {
+			na = len(a)
+		}
+		if nb > len(b) {
+			nb = len(b)
+		}
+		sa := bytestr(offset, a[0:na])
+		sb := bytestr(offset, b[0:nb])
+		if sa != sb {
+			s += fmt.Sprintf("-%v\n+%v\n", sa, sb)
+		}
+		a = a[na:]
+		b = b[nb:]
+	}
+	return s
+}
+
+func TestWriter(t *testing.T) {
+testLoop:
+	for i, test := range writerTests {
+		expected, err := ioutil.ReadFile(test.file)
+		if err != nil {
+			t.Errorf("test %d: Unexpected error: %v", i, err)
+			continue
+		}
+
+		buf := new(bytes.Buffer)
+		tw := NewWriter(iotest.TruncateWriter(buf, 4<<10)) // only catch the first 4 KB
+		big := false
+		for j, entry := range test.entries {
+			big = big || entry.header.Size > 1<<10
+			if err := tw.WriteHeader(entry.header); err != nil {
+				t.Errorf("test %d, entry %d: Failed writing header: %v", i, j, err)
+				continue testLoop
+			}
+			if _, err := io.WriteString(tw, entry.contents); err != nil {
+				t.Errorf("test %d, entry %d: Failed writing contents: %v", i, j, err)
+				continue testLoop
+			}
+		}
+		// Only interested in Close failures for the small tests.
+		if err := tw.Close(); err != nil && !big {
+			t.Errorf("test %d: Failed closing archive: %v", i, err)
+			continue testLoop
+		}
+
+		actual := buf.Bytes()
+		if !bytes.Equal(expected, actual) {
+			t.Errorf("test %d: Incorrect result: (-=expected, +=actual)\n%v",
+				i, bytediff(expected, actual))
+		}
+		if testing.Short() { // The second test is expensive.
+			break
+		}
+	}
+}
+
+func TestPax(t *testing.T) {
+	// Create an archive with a large name
+	fileinfo, err := os.Stat("testdata/small.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	hdr, err := FileInfoHeader(fileinfo, "")
+	if err != nil {
+		t.Fatalf("os.Stat: %v", err)
+	}
+	// Force a PAX long name to be written
+	longName := strings.Repeat("ab", 100)
+	contents := strings.Repeat(" ", int(hdr.Size))
+	hdr.Name = longName
+	var buf bytes.Buffer
+	writer := NewWriter(&buf)
+	if err := writer.WriteHeader(hdr); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = writer.Write([]byte(contents)); err != nil {
+		t.Fatal(err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	// Simple test to make sure PAX extensions are in effect
+	if !bytes.Contains(buf.Bytes(), []byte("PaxHeaders.")) {
+		t.Fatal("Expected at least one PAX header to be written.")
+	}
+	// Test that we can get a long name back out of the archive.
+	reader := NewReader(&buf)
+	hdr, err = reader.Next()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hdr.Name != longName {
+		t.Fatal("Couldn't recover long file name")
+	}
+}
+
+func TestPaxSymlink(t *testing.T) {
+	// Create an archive with a large linkname
+	fileinfo, err := os.Stat("testdata/small.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	hdr, err := FileInfoHeader(fileinfo, "")
+	hdr.Typeflag = TypeSymlink
+	if err != nil {
+		t.Fatalf("os.Stat:1 %v", err)
+	}
+	// Force a PAX long linkname to be written
+	longLinkname := strings.Repeat("1234567890/1234567890", 10)
+	hdr.Linkname = longLinkname
+
+	hdr.Size = 0
+	var buf bytes.Buffer
+	writer := NewWriter(&buf)
+	if err := writer.WriteHeader(hdr); err != nil {
+		t.Fatal(err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	// Simple test to make sure PAX extensions are in effect
+	if !bytes.Contains(buf.Bytes(), []byte("PaxHeaders.")) {
+		t.Fatal("Expected at least one PAX header to be written.")
+	}
+	// Test that we can get a long name back out of the archive.
+	reader := NewReader(&buf)
+	hdr, err = reader.Next()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hdr.Linkname != longLinkname {
+		t.Fatal("Couldn't recover long link name")
+	}
+}
+
+func TestPaxNonAscii(t *testing.T) {
+	// Create an archive with non ascii. These should trigger a pax header
+	// because pax headers have a defined utf-8 encoding.
+	fileinfo, err := os.Stat("testdata/small.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	hdr, err := FileInfoHeader(fileinfo, "")
+	if err != nil {
+		t.Fatalf("os.Stat:1 %v", err)
+	}
+
+	// some sample data
+	chineseFilename := "文件名"
+	chineseGroupname := "組"
+	chineseUsername := "用戶名"
+
+	hdr.Name = chineseFilename
+	hdr.Gname = chineseGroupname
+	hdr.Uname = chineseUsername
+
+	contents := strings.Repeat(" ", int(hdr.Size))
+
+	var buf bytes.Buffer
+	writer := NewWriter(&buf)
+	if err := writer.WriteHeader(hdr); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = writer.Write([]byte(contents)); err != nil {
+		t.Fatal(err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	// Simple test to make sure PAX extensions are in effect
+	if !bytes.Contains(buf.Bytes(), []byte("PaxHeaders.")) {
+		t.Fatal("Expected at least one PAX header to be written.")
+	}
+	// Test that we can get a long name back out of the archive.
+	reader := NewReader(&buf)
+	hdr, err = reader.Next()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hdr.Name != chineseFilename {
+		t.Fatal("Couldn't recover unicode name")
+	}
+	if hdr.Gname != chineseGroupname {
+		t.Fatal("Couldn't recover unicode group")
+	}
+	if hdr.Uname != chineseUsername {
+		t.Fatal("Couldn't recover unicode user")
+	}
+}
+
+func TestPaxXattrs(t *testing.T) {
+	xattrs := map[string]string{
+		"user.key": "value",
+	}
+
+	// Create an archive with an xattr
+	fileinfo, err := os.Stat("testdata/small.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	hdr, err := FileInfoHeader(fileinfo, "")
+	if err != nil {
+		t.Fatalf("os.Stat: %v", err)
+	}
+	contents := "Kilts"
+	hdr.Xattrs = xattrs
+	var buf bytes.Buffer
+	writer := NewWriter(&buf)
+	if err := writer.WriteHeader(hdr); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = writer.Write([]byte(contents)); err != nil {
+		t.Fatal(err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	// Test that we can get the xattrs back out of the archive.
+	reader := NewReader(&buf)
+	hdr, err = reader.Next()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(hdr.Xattrs, xattrs) {
+		t.Fatalf("xattrs did not survive round trip: got %+v, want %+v",
+			hdr.Xattrs, xattrs)
+	}
+}
+
+func TestPAXHeader(t *testing.T) {
+	medName := strings.Repeat("CD", 50)
+	longName := strings.Repeat("AB", 100)
+	paxTests := [][2]string{
+		{paxPath + "=/etc/hosts", "19 path=/etc/hosts\n"},
+		{"a=b", "6 a=b\n"},          // Single digit length
+		{"a=names", "11 a=names\n"}, // Test case involving carries
+		{paxPath + "=" + longName, fmt.Sprintf("210 path=%s\n", longName)},
+		{paxPath + "=" + medName, fmt.Sprintf("110 path=%s\n", medName)}}
+
+	for _, test := range paxTests {
+		key, expected := test[0], test[1]
+		if result := paxHeader(key); result != expected {
+			t.Fatalf("paxHeader: got %s, expected %s", result, expected)
+		}
+	}
+}
+
+func TestUSTARLongName(t *testing.T) {
+	// Create an archive with a path that failed to split with USTAR extension in previous versions.
+	fileinfo, err := os.Stat("testdata/small.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	hdr, err := FileInfoHeader(fileinfo, "")
+	hdr.Typeflag = TypeDir
+	if err != nil {
+		t.Fatalf("os.Stat:1 %v", err)
+	}
+	// Force a PAX long name to be written. The name was taken from a practical example
+	// that fails and replaced ever char through numbers to anonymize the sample.
+	longName := "/0000_0000000/00000-000000000/0000_0000000/00000-0000000000000/0000_0000000/00000-0000000-00000000/0000_0000000/00000000/0000_0000000/000/0000_0000000/00000000v00/0000_0000000/000000/0000_0000000/0000000/0000_0000000/00000y-00/0000/0000/00000000/0x000000/"
+	hdr.Name = longName
+
+	hdr.Size = 0
+	var buf bytes.Buffer
+	writer := NewWriter(&buf)
+	if err := writer.WriteHeader(hdr); err != nil {
+		t.Fatal(err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	// Test that we can get a long name back out of the archive.
+	reader := NewReader(&buf)
+	hdr, err = reader.Next()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hdr.Name != longName {
+		t.Fatal("Couldn't recover long name")
+	}
+}

From e184f368050d01398e3fcd5a0ed353ad816bf982 Mon Sep 17 00:00:00 2001
From: Song Gao <song@gao.io>
Date: Mon, 6 Jan 2014 12:06:05 -0600
Subject: [PATCH 117/403] Support submodules when building from a gh repo

Docker-DCO-1.1-Signed-off-by: Song Gao <song@gao.io> (github: songgao)
Upstream-commit: c9ae66ffe375156ddf39cb41664224d6e1a6f096
Component: engine
---
 components/engine/docs/sources/reference/commandline/cli.rst | 3 ++-
 components/engine/server.go                                  | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 032076b941..87222484c5 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -194,7 +194,8 @@ The files at ``PATH`` or ``URL`` are called the "context" of the build. The
 build process may refer to any of the files in the context, for example when
 using an :ref:`ADD <dockerfile_add>` instruction.  When a single ``Dockerfile``
 is given as ``URL``, then no context is set.  When a Git repository is set as
-``URL``, then the repository is used as the context
+``URL``, then the repository is used as the context. Git repositories are
+cloned with their submodules (`git clone --recursive`).
 
 .. _cli_build_examples:
 
diff --git a/components/engine/server.go b/components/engine/server.go
index bad8d8bfb5..46ab33b467 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -457,7 +457,7 @@ func (srv *Server) Build(job *engine.Job) engine.Status {
 		}
 		defer os.RemoveAll(root)
 
-		if output, err := exec.Command("git", "clone", remoteURL, root).CombinedOutput(); err != nil {
+		if output, err := exec.Command("git", "clone", "--recursive", remoteURL, root).CombinedOutput(); err != nil {
 			return job.Errorf("Error trying to use git: %s (%s)", err, output)
 		}
 

From 077c2ff0d64d7d0004f4b4b3034dfee713e4d85e Mon Sep 17 00:00:00 2001
From: Travis Cline <travis.cline@gmail.com>
Date: Mon, 17 Feb 2014 10:23:07 -0800
Subject: [PATCH 118/403] Quote volume path to allow spaces

Docker-DCO-1.1-Signed-off-by: Travis Cline <travis.cline@gmail.com> (github: tmc)
Upstream-commit: 5006509131986093a9529a748e80e023e19548f3
Component: engine
---
 components/engine/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/Makefile b/components/engine/Makefile
index 168707a80f..e124d1d7e6 100644
--- a/components/engine/Makefile
+++ b/components/engine/Makefile
@@ -3,7 +3,7 @@
 GIT_BRANCH := $(shell git rev-parse --abbrev-ref HEAD)
 DOCKER_IMAGE := docker:$(GIT_BRANCH)
 DOCKER_DOCS_IMAGE := docker-docs:$(GIT_BRANCH)
-DOCKER_RUN_DOCKER := docker run -rm -i -t -privileged -e TESTFLAGS -v $(CURDIR)/bundles:/go/src/github.com/dotcloud/docker/bundles "$(DOCKER_IMAGE)"
+DOCKER_RUN_DOCKER := docker run -rm -i -t -privileged -e TESTFLAGS -v "$(CURDIR)/bundles:/go/src/github.com/dotcloud/docker/bundles" "$(DOCKER_IMAGE)"
 
 default: binary
 

From d96c32338087d2d4f61af1fa34985c2cfed62307 Mon Sep 17 00:00:00 2001
From: Daniel Mizyrycki <mzdaniel@glidelink.net>
Date: Fri, 14 Feb 2014 20:50:16 -0800
Subject: [PATCH 119/403] docker-ci 0.5.6: Fully dockerize docker-ci. Add build
 test coverage. Add backup builder.

Docker-DCO-1.1-Signed-off-by: Daniel Mizyrycki <daniel@docker.com> (github: mzdaniel)
Upstream-commit: b7db2d5f8022e24faff80d312977c49a4c0408f3
Component: engine
---
 .../engine/hack/infrastructure/docker-ci.rst  |  56 ------
 .../hack/infrastructure/docker-ci/Dockerfile  |  66 +++----
 .../hack/infrastructure/docker-ci/README.rst  |  75 ++++++--
 .../hack/infrastructure/docker-ci/VERSION     |   2 +-
 .../docker-ci/buildbot/README.rst             |   1 -
 .../docker-ci/buildbot/buildbot.conf          |  18 --
 .../docker-ci/buildbot/github.py              |   9 +-
 .../docker-ci/buildbot/master.cfg             | 179 ++++++++++--------
 .../docker-ci/buildbot/requirements.txt       |   9 -
 .../docker-ci/buildbot/setup.sh               |  59 ------
 .../docker-ci/dcr/prod/docker-ci.yml          |  22 +++
 .../docker-ci/dcr/prod/settings.yml           |   5 +
 .../docker-ci/dcr/stage/docker-ci.yml         |  22 +++
 .../docker-ci/dcr/stage/settings.yml          |   5 +
 .../infrastructure/docker-ci/deployment.py    | 171 -----------------
 .../docker-coverage/coverage-docker.sh        |  32 ----
 .../docker-ci/docker-test/Dockerfile          |  25 ---
 .../docker-ci/docker-test/test_docker.sh      |  33 ----
 .../docker-ci/dockertest/docker               |   1 +
 .../docker-ci/dockertest/docker-registry      |   1 +
 .../docker-ci/dockertest/nightlyrelease       |  13 ++
 .../docker-ci/dockertest/project              |   8 +
 .../infrastructure/docker-ci/nginx/nginx.conf |  12 ++
 .../docker-ci/nightlyrelease/Dockerfile       |  30 ---
 .../docker-ci/nightlyrelease/dockerbuild.sh   |  40 ----
 .../docker-ci/registry-coverage/Dockerfile    |  18 --
 .../registry-coverage/registry_coverage.sh    |  18 --
 .../hack/infrastructure/docker-ci/setup.sh    |  54 ++++++
 .../docker-ci/testbuilder/Dockerfile          |  12 ++
 .../docker-ci/testbuilder/docker-registry.sh  |  12 ++
 .../docker-ci/testbuilder/docker.sh           |  18 ++
 .../docker-ci/testbuilder/testbuilder.sh      |  40 ++++
 .../infrastructure/docker-ci/tool/backup.py   |  47 +++++
 33 files changed, 463 insertions(+), 650 deletions(-)
 delete mode 100644 components/engine/hack/infrastructure/docker-ci.rst
 delete mode 100644 components/engine/hack/infrastructure/docker-ci/buildbot/README.rst
 delete mode 100644 components/engine/hack/infrastructure/docker-ci/buildbot/buildbot.conf
 delete mode 100644 components/engine/hack/infrastructure/docker-ci/buildbot/requirements.txt
 delete mode 100755 components/engine/hack/infrastructure/docker-ci/buildbot/setup.sh
 create mode 100644 components/engine/hack/infrastructure/docker-ci/dcr/prod/docker-ci.yml
 create mode 100644 components/engine/hack/infrastructure/docker-ci/dcr/prod/settings.yml
 create mode 100644 components/engine/hack/infrastructure/docker-ci/dcr/stage/docker-ci.yml
 create mode 100644 components/engine/hack/infrastructure/docker-ci/dcr/stage/settings.yml
 delete mode 100755 components/engine/hack/infrastructure/docker-ci/deployment.py
 delete mode 100755 components/engine/hack/infrastructure/docker-ci/docker-coverage/coverage-docker.sh
 delete mode 100644 components/engine/hack/infrastructure/docker-ci/docker-test/Dockerfile
 delete mode 100755 components/engine/hack/infrastructure/docker-ci/docker-test/test_docker.sh
 create mode 120000 components/engine/hack/infrastructure/docker-ci/dockertest/docker
 create mode 120000 components/engine/hack/infrastructure/docker-ci/dockertest/docker-registry
 create mode 100755 components/engine/hack/infrastructure/docker-ci/dockertest/nightlyrelease
 create mode 100755 components/engine/hack/infrastructure/docker-ci/dockertest/project
 create mode 100644 components/engine/hack/infrastructure/docker-ci/nginx/nginx.conf
 delete mode 100644 components/engine/hack/infrastructure/docker-ci/nightlyrelease/Dockerfile
 delete mode 100644 components/engine/hack/infrastructure/docker-ci/nightlyrelease/dockerbuild.sh
 delete mode 100644 components/engine/hack/infrastructure/docker-ci/registry-coverage/Dockerfile
 delete mode 100755 components/engine/hack/infrastructure/docker-ci/registry-coverage/registry_coverage.sh
 create mode 100755 components/engine/hack/infrastructure/docker-ci/setup.sh
 create mode 100644 components/engine/hack/infrastructure/docker-ci/testbuilder/Dockerfile
 create mode 100755 components/engine/hack/infrastructure/docker-ci/testbuilder/docker-registry.sh
 create mode 100755 components/engine/hack/infrastructure/docker-ci/testbuilder/docker.sh
 create mode 100755 components/engine/hack/infrastructure/docker-ci/testbuilder/testbuilder.sh
 create mode 100755 components/engine/hack/infrastructure/docker-ci/tool/backup.py

diff --git a/components/engine/hack/infrastructure/docker-ci.rst b/components/engine/hack/infrastructure/docker-ci.rst
deleted file mode 100644
index 0be530d302..0000000000
--- a/components/engine/hack/infrastructure/docker-ci.rst
+++ /dev/null
@@ -1,56 +0,0 @@
-docker-ci
-=========
-
-docker-ci is our buildbot continuous integration server,
-building and testing docker, hosted on EC2 and reachable at
-http://docker-ci.dotcloud.com
-
-
-Deployment
-==========
-
-# Load AWS credentials
-export AWS_ACCESS_KEY_ID=''
-export AWS_SECRET_ACCESS_KEY=''
-export AWS_KEYPAIR_NAME=''
-export AWS_SSH_PRIVKEY=''
-
-# Load buildbot credentials and config
-export BUILDBOT_PWD=''
-export IRC_PWD=''
-export IRC_CHANNEL='docker-dev'
-export SMTP_USER=''
-export SMTP_PWD=''
-export EMAIL_RCP=''
-
-# Load registry test credentials
-export REGISTRY_USER=''
-export REGISTRY_PWD=''
-
-cd docker/testing
-vagrant up --provider=aws
-
-
-github pull request
-===================
-
-The entire docker pull request test workflow is event driven by github. Its
-usage is fully automatic and the results are logged in docker-ci.dotcloud.com
-
-Each time there is a pull request on docker's github project, github connects
-to docker-ci using github's rest API documented in http://developer.github.com/v3/repos/hooks
-The issued command to program github's notification PR event was:
-curl -u GITHUB_USER:GITHUB_PASSWORD -d '{"name":"web","active":true,"events":["pull_request"],"config":{"url":"http://docker-ci.dotcloud.com:8011/change_hook/github?project=docker"}}' https://api.github.com/repos/dotcloud/docker/hooks
-
-buildbot (0.8.7p1) was patched using ./testing/buildbot/github.py, so it
-can understand the PR data github sends to it. Originally PR #1603 (ee64e099e0)
-implemented this capability. Also we added a new scheduler to exclusively filter
-PRs. and the 'pullrequest' builder to rebase the PR on top of master and test it.
-
-
-nighthly release
-================
-
-The nightly release process is done by buildbot, running a DinD container that downloads
-the docker repository and builds the release container. The resulting docker
-binary is then tested, and if everything is fine, the release is done.
diff --git a/components/engine/hack/infrastructure/docker-ci/Dockerfile b/components/engine/hack/infrastructure/docker-ci/Dockerfile
index d894330ffa..fd795f4d45 100644
--- a/components/engine/hack/infrastructure/docker-ci/Dockerfile
+++ b/components/engine/hack/infrastructure/docker-ci/Dockerfile
@@ -1,47 +1,29 @@
-# VERSION:        0.25
-# DOCKER-VERSION  0.6.6
-# AUTHOR:         Daniel Mizyrycki <daniel@docker.com>
-# DESCRIPTION:    Deploy docker-ci on Digital Ocean
-# COMMENTS:
-#     CONFIG_JSON is an environment variable json string loaded as:
-#
-# export CONFIG_JSON='
-#     { "DROPLET_NAME":        "docker-ci",
-#       "DO_CLIENT_ID":        "Digital_Ocean_client_id",
-#       "DO_API_KEY":          "Digital_Ocean_api_key",
-#       "DOCKER_KEY_ID":       "Digital_Ocean_ssh_key_id",
-#       "DOCKER_CI_KEY_PATH":  "docker-ci_private_key_path",
-#       "DOCKER_CI_PUB":       "$(cat docker-ci_ssh_public_key.pub)",
-#       "DOCKER_CI_KEY":       "$(cat docker-ci_ssh_private_key.key)",
-#       "BUILDBOT_PWD":        "Buildbot_server_password",
-#       "IRC_PWD":             "Buildbot_IRC_password",
-#       "SMTP_USER":           "SMTP_server_user",
-#       "SMTP_PWD":            "SMTP_server_password",
-#       "PKG_ACCESS_KEY":      "Docker_release_S3_bucket_access_key",
-#       "PKG_SECRET_KEY":      "Docker_release_S3_bucket_secret_key",
-#       "PKG_GPG_PASSPHRASE":  "Docker_release_gpg_passphrase",
-#       "INDEX_AUTH":          "Index_encripted_user_password",
-#       "REGISTRY_USER":       "Registry_test_user",
-#       "REGISTRY_PWD":        "Registry_test_password",
-#       "REGISTRY_BUCKET":     "Registry_S3_bucket_name",
-#       "REGISTRY_ACCESS_KEY": "Registry_S3_bucket_access_key",
-#       "REGISTRY_SECRET_KEY": "Registry_S3_bucket_secret_key",
-#       "IRC_CHANNEL":         "Buildbot_IRC_channel",
-#       "EMAIL_RCP":           "Buildbot_mailing_receipient" }'
-#
-#
-# TO_BUILD:   docker build -t docker-ci .
-# TO_DEPLOY:  docker run -e CONFIG_JSON="${CONFIG_JSON}" docker-ci
+# DOCKER-VERSION: 0.7.6
+# AUTHOR:         Daniel Mizyrycki <daniel@dotcloud.com>
+# DESCRIPTION:    docker-ci continuous integration service
+# TO_BUILD:       docker build -rm -t docker-ci/docker-ci .
+# TO_RUN:         docker run -rm -i -t -p 8000:80 -p 2222:22 -v /run:/var/socket \
+#                     -v /data/docker-ci:/data/docker-ci docker-ci/docker-ci
 
 from ubuntu:12.04
+maintainer Daniel Mizyrycki <daniel@dotcloud.com>
 
-run echo 'deb http://archive.ubuntu.com/ubuntu precise main universe' \
-    > /etc/apt/sources.list
-run apt-get update; apt-get install -y git python2.7 python-dev libevent-dev \
-    python-pip ssh rsync less vim
-run pip install requests fabric
+ENV DEBIAN_FRONTEND noninteractive
+RUN echo 'deb http://archive.ubuntu.com/ubuntu precise main universe' > \
+    /etc/apt/sources.list; apt-get update
+RUN apt-get install -y --no-install-recommends  python2.7 python-dev \
+    libevent-dev git supervisor ssh rsync less vim sudo gcc wget nginx
+RUN cd /tmp; wget http://python-distribute.org/distribute_setup.py
+RUN cd /tmp; python distribute_setup.py; easy_install pip; rm distribute_setup.py
 
-# Add deployment code and set default container command
-add . /docker-ci
-cmd "/docker-ci/deployment.py"
+RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9
+RUN echo 'deb http://get.docker.io/ubuntu docker main' > \
+      /etc/apt/sources.list.d/docker.list; apt-get update
+RUN apt-get install -y lxc-docker-0.8.0
+RUN pip install SQLAlchemy==0.7.10 buildbot buildbot-slave pyopenssl boto
+RUN ln -s /var/socket/docker.sock /run/docker.sock
 
+ADD . /docker-ci
+RUN /docker-ci/setup.sh
+
+ENTRYPOINT ["supervisord", "-n"]
diff --git a/components/engine/hack/infrastructure/docker-ci/README.rst b/components/engine/hack/infrastructure/docker-ci/README.rst
index 33a14359bf..3e429ffdd5 100644
--- a/components/engine/hack/infrastructure/docker-ci/README.rst
+++ b/components/engine/hack/infrastructure/docker-ci/README.rst
@@ -1,26 +1,65 @@
-=======
-testing
-=======
+=========
+docker-ci
+=========
 
-This directory contains docker-ci testing related files.
+This directory contains docker-ci continuous integration system.
+As expected, it is a fully dockerized and deployed using
+docker-container-runner.
+docker-ci is based on Buildbot, a continuous integration system designed
+to automate the build/test cycle. By automatically rebuilding and testing
+the tree each time something has changed, build problems are pinpointed
+quickly, before other developers are inconvenienced by the failure.
+We are running buildbot at Rackspace to verify docker and docker-registry
+pass tests, and check for coverage code details.
+
+docker-ci instance is at https://docker-ci.docker.io/waterfall
+
+Inside docker-ci container we have the following directory structure:
+
+/docker-ci                       source code of docker-ci
+/data/backup/docker-ci/          daily backup (replicated over S3)
+/data/docker-ci/coverage/{docker,docker-registry}/    mapped to host volumes
+/data/buildbot/{master,slave}/   main docker-ci buildbot config and database
+/var/socket/{docker.sock}        host volume access to docker socket
 
 
-Buildbot
-========
+Production deployment
+=====================
 
-Buildbot is a continuous integration system designed to automate the
-build/test cycle. By automatically rebuilding and testing the tree each time
-something has changed, build problems are pinpointed quickly, before other
-developers are inconvenienced by the failure.
+::
 
-We are running buildbot in Amazon's EC2 to verify docker passes all
-tests when commits get pushed to the master branch and building
-nightly releases using Docker in Docker awesome implementation made
-by Jerome Petazzoni.
+  # Clone docker-ci repository
+  git clone https://github.com/dotcloud/docker
+  cd docker/hack/infrastructure/docker-ci
 
-https://github.com/jpetazzo/dind
+  export DOCKER_PROD=[PRODUCTION_SERVER_IP]
 
-Docker's buildbot instance is at http://docker-ci.dotcloud.com/waterfall
+  # Create data host volume. (only once)
+  docker -H $DOCKER_PROD run -v /home:/data ubuntu:12.04 \
+    mkdir -p /data/docker-ci/coverage/docker
+  docker -H $DOCKER_PROD run -v /home:/data ubuntu:12.04 \
+    mkdir -p /data/docker-ci/coverage/docker-registry
+  docker -H $DOCKER_PROD run -v /home:/data ubuntu:12.04 \
+    chown -R 1000.1000 /data/docker-ci
 
-For deployment instructions, please take a look at
-hack/infrastructure/docker-ci/Dockerfile
+  # dcr deployment. Define credentials and special environment dcr variables
+  # ( retrieved at /hack/infrastructure/docker-ci/dcr/prod/docker-ci.yml )
+  export WEB_USER=[DOCKER-CI-WEBSITE-USERNAME]
+  export WEB_IRC_PWD=[DOCKER-CI-WEBSITE-PASSWORD]
+  export BUILDBOT_PWD=[BUILDSLAVE_PASSWORD]
+  export AWS_ACCESS_KEY=[DOCKER_RELEASE_S3_ACCESS]
+  export AWS_SECRET_KEY=[DOCKER_RELEASE_S3_SECRET]
+  export GPG_PASSPHRASE=[DOCKER_RELEASE_PASSPHRASE]
+  export BACKUP_AWS_ID=[S3_BUCKET_CREDENTIAL_ACCESS]
+  export BACKUP_AWS_SECRET=[S3_BUCKET_CREDENTIAL_SECRET]
+  export SMTP_USER=[MAILGUN_SMTP_USERNAME]
+  export SMTP_PWD=[MAILGUN_SMTP_PASSWORD]
+  export EMAIL_RCP=[EMAIL_FOR_BUILD_ERRORS]
+
+  # Build docker-ci and testbuilder docker images
+  docker -H $DOCKER_PROD build -rm -t docker-ci/docker-ci .
+  (cd testbuilder; docker -H $DOCKER_PROD build -rm -t docker-ci/testbuilder .)
+
+  # Run docker-ci container ( assuming no previous container running )
+  (cd dcr/prod; dcr docker-ci.yml start)
+  (cd dcr/prod; dcr docker-ci.yml register docker-ci.docker.io)
diff --git a/components/engine/hack/infrastructure/docker-ci/VERSION b/components/engine/hack/infrastructure/docker-ci/VERSION
index 0bfccb0804..b49b25336d 100644
--- a/components/engine/hack/infrastructure/docker-ci/VERSION
+++ b/components/engine/hack/infrastructure/docker-ci/VERSION
@@ -1 +1 @@
-0.4.5
+0.5.6
diff --git a/components/engine/hack/infrastructure/docker-ci/buildbot/README.rst b/components/engine/hack/infrastructure/docker-ci/buildbot/README.rst
deleted file mode 100644
index 6cbcb8d93a..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/buildbot/README.rst
+++ /dev/null
@@ -1 +0,0 @@
-Buildbot configuration and setup files
diff --git a/components/engine/hack/infrastructure/docker-ci/buildbot/buildbot.conf b/components/engine/hack/infrastructure/docker-ci/buildbot/buildbot.conf
deleted file mode 100644
index e07b2e3c8c..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/buildbot/buildbot.conf
+++ /dev/null
@@ -1,18 +0,0 @@
-[program:buildmaster]
-command=twistd --nodaemon --no_save -y buildbot.tac
-directory=/data/buildbot/master
-chown= root:root
-redirect_stderr=true
-stdout_logfile=/var/log/supervisor/buildbot-master.log
-stderr_logfile=/var/log/supervisor/buildbot-master.log
-
-[program:buildworker]
-command=twistd --nodaemon --no_save -y buildbot.tac
-directory=/data/buildbot/slave
-chown= root:root
-redirect_stderr=true
-stdout_logfile=/var/log/supervisor/buildbot-slave.log
-stderr_logfile=/var/log/supervisor/buildbot-slave.log
-
-[group:buildbot]
-programs=buildmaster,buildworker
diff --git a/components/engine/hack/infrastructure/docker-ci/buildbot/github.py b/components/engine/hack/infrastructure/docker-ci/buildbot/github.py
index ff6b6c62dd..5316e13282 100644
--- a/components/engine/hack/infrastructure/docker-ci/buildbot/github.py
+++ b/components/engine/hack/infrastructure/docker-ci/buildbot/github.py
@@ -17,7 +17,7 @@
 """
 github_buildbot.py is based on git_buildbot.py
 
-github_buildbot.py will determine the repository information from the JSON 
+github_buildbot.py will determine the repository information from the JSON
 HTTP POST it receives from github.com and build the appropriate repository.
 If your github repository is private, you must add a ssh key to the github
 repository for the user who initiated the build on the buildslave.
@@ -88,7 +88,8 @@ def getChanges(request, options = None):
         payload = json.loads(request.args['payload'][0])
         import urllib,datetime
         fname = str(datetime.datetime.now()).replace(' ','_').replace(':','-')[:19]
-        open('github_{0}.json'.format(fname),'w').write(json.dumps(json.loads(urllib.unquote(request.args['payload'][0])), sort_keys = True, indent = 2))
+        # Github event debug
+        # open('github_{0}.json'.format(fname),'w').write(json.dumps(json.loads(urllib.unquote(request.args['payload'][0])), sort_keys = True, indent = 2))
 
         if 'pull_request' in payload:
             user = payload['pull_request']['user']['login']
@@ -142,13 +143,13 @@ def process_change(payload, user, repo, repo_url, project):
                     'category'   : 'github_pullrequest',
                     'who'        : '{0} - PR#{1}'.format(user,payload['number']),
                     'files'      : [],
-                    'comments'   : payload['pull_request']['title'], 
+                    'comments'   : payload['pull_request']['title'],
                     'revision'   : newrev,
                     'when'       : convertTime(payload['pull_request']['updated_at']),
                     'branch'     : branch,
                     'revlink'    : '{0}/commit/{1}'.format(repo_url,newrev),
                     'repository' : repo_url,
-                    'project'  : project  }] 
+                    'project'  : project  }]
                 return changes
             for commit in payload['commits']:
                 files = []
diff --git a/components/engine/hack/infrastructure/docker-ci/buildbot/master.cfg b/components/engine/hack/infrastructure/docker-ci/buildbot/master.cfg
index 9ca5fc035a..75605da8ab 100644
--- a/components/engine/hack/infrastructure/docker-ci/buildbot/master.cfg
+++ b/components/engine/hack/infrastructure/docker-ci/buildbot/master.cfg
@@ -1,4 +1,4 @@
-import os
+import os, re
 from buildbot.buildslave import BuildSlave
 from buildbot.schedulers.forcesched import ForceScheduler
 from buildbot.schedulers.basic import SingleBranchScheduler
@@ -6,127 +6,156 @@ from buildbot.schedulers.timed import Nightly
 from buildbot.changes import filter
 from buildbot.config import BuilderConfig
 from buildbot.process.factory import BuildFactory
-from buildbot.process.properties import Interpolate
+from buildbot.process.properties import Property
 from buildbot.steps.shell import ShellCommand
 from buildbot.status import html, words
 from buildbot.status.web import authz, auth
 from buildbot.status.mail import MailNotifier
 
-PORT_WEB = 80           # Buildbot webserver port
-PORT_GITHUB = 8011      # Buildbot github hook port
-PORT_MASTER = 9989      # Port where buildbot master listen buildworkers
-TEST_USER = 'buildbot'  # Credential to authenticate build triggers
-TEST_PWD = 'docker'     # Credential to authenticate build triggers
-GITHUB_DOCKER = 'github.com/dotcloud/docker'
-BUILDBOT_PATH = '/data/buildbot'
-DOCKER_PATH = '/go/src/github.com/dotcloud/docker'
-DOCKER_CI_PATH = '/docker-ci'
+
+def ENV(x):
+    '''Promote an environment variable for global use returning its value'''
+    retval = os.environ.get(x, '')
+    globals()[x] = retval
+    return retval
+
+
+class TestCommand(ShellCommand):
+    '''Extend ShellCommand with optional summary logs'''
+    def __init__(self, *args, **kwargs):
+        super(TestCommand, self).__init__(*args, **kwargs)
+
+    def createSummary(self, log):
+        exit_status = re.sub(r'.+\n\+ exit (\d+).+',
+            r'\1', log.getText()[-100:], flags=re.DOTALL)
+        if exit_status != '0':
+            return
+        # Infer coverage path from log
+        if '+ COVERAGE_PATH' in log.getText():
+            path = re.sub(r'.+\+ COVERAGE_PATH=((.+?)-\d+).+',
+              r'\2/\1', log.getText(), flags=re.DOTALL)
+            url = '{}coverage/{}/index.html'.format(c['buildbotURL'], path)
+            self.addURL('coverage', url)
+        elif 'COVERAGE_FILE' in log.getText():
+            path = re.sub(r'.+\+ COVERAGE_FILE=((.+?)-\d+).+',
+              r'\2/\1', log.getText(), flags=re.DOTALL)
+            url = '{}coverage/{}/index.html'.format(c['buildbotURL'], path)
+            self.addURL('coverage', url)
+
+
+PORT_WEB = 8000      # Buildbot webserver port
+PORT_GITHUB = 8011   # Buildbot github hook port
+PORT_MASTER = 9989   # Port where buildbot master listen buildworkers
+
+BUILDBOT_URL = '//localhost:{}/'.format(PORT_WEB)
+DOCKER_REPO = 'https://github.com/docker-test/docker'
+DOCKER_TEST_ARGV = 'HEAD {}'.format(DOCKER_REPO)
+REGISTRY_REPO = 'https://github.com/docker-test/docker-registry'
+REGISTRY_TEST_ARGV = 'HEAD {}'.format(REGISTRY_REPO)
+if ENV('DEPLOYMENT') == 'staging':
+    BUILDBOT_URL = "//docker-ci-stage.docker.io/"
+if ENV('DEPLOYMENT') == 'production':
+    BUILDBOT_URL = '//docker-ci.docker.io/'
+    DOCKER_REPO = 'https://github.com/dotcloud/docker'
+    DOCKER_TEST_ARGV = ''
+    REGISTRY_REPO = 'https://github.com/dotcloud/docker-registry'
+    REGISTRY_TEST_ARGV = ''
 
 # Credentials set by setup.sh from deployment.py
-BUILDBOT_PWD = ''
-IRC_PWD = ''
-IRC_CHANNEL = ''
-SMTP_USER = ''
-SMTP_PWD = ''
-EMAIL_RCP = ''
+ENV('WEB_USER')
+ENV('WEB_IRC_PWD')
+ENV('BUILDBOT_PWD')
+ENV('SMTP_USER')
+ENV('SMTP_PWD')
+ENV('EMAIL_RCP')
+ENV('IRC_CHANNEL')
 
 
 c = BuildmasterConfig = {}
 
-c['title'] = "Docker"
+c['title'] = "docker-ci"
 c['titleURL'] = "waterfall"
-c['buildbotURL'] = "http://docker-ci.dotcloud.com/"
+c['buildbotURL'] = BUILDBOT_URL
 c['db'] = {'db_url':"sqlite:///state.sqlite"}
 c['slaves'] = [BuildSlave('buildworker', BUILDBOT_PWD)]
 c['slavePortnum'] = PORT_MASTER
 
 
 # Schedulers
-c['schedulers'] = [ForceScheduler(name='trigger', builderNames=['docker',
-    'index','registry','docker-coverage','registry-coverage','nightlyrelease'])]
-c['schedulers'] += [SingleBranchScheduler(name="all", treeStableTimer=None,
+c['schedulers'] = [ForceScheduler(name='trigger', builderNames=[
+    'docker', 'docker-registry', 'nightlyrelease', 'backup'])]
+c['schedulers'] += [SingleBranchScheduler(name="docker", treeStableTimer=None,
     change_filter=filter.ChangeFilter(branch='master',
-    repository='https://github.com/dotcloud/docker'), builderNames=['docker'])]
-c['schedulers'] += [SingleBranchScheduler(name='pullrequest',
-    change_filter=filter.ChangeFilter(category='github_pullrequest'), treeStableTimer=None,
-    builderNames=['pullrequest'])]
-c['schedulers'] += [Nightly(name='daily', branch=None, builderNames=['nightlyrelease',
-    'docker-coverage','registry-coverage'], hour=7, minute=00)]
-c['schedulers'] += [Nightly(name='every4hrs', branch=None, builderNames=['registry','index'],
-    hour=range(0,24,4), minute=15)]
+    repository=DOCKER_REPO), builderNames=['docker'])]
+c['schedulers'] += [SingleBranchScheduler(name="registry", treeStableTimer=None,
+    change_filter=filter.ChangeFilter(branch='master',
+    repository=REGISTRY_REPO), builderNames=['docker-registry'])]
+c['schedulers'] += [SingleBranchScheduler(name='docker-pr', treeStableTimer=None,
+    change_filter=filter.ChangeFilter(category='github_pullrequest',
+    project='docker'), builderNames=['docker-pr'])]
+c['schedulers'] += [SingleBranchScheduler(name='docker-registry-pr', treeStableTimer=None,
+    change_filter=filter.ChangeFilter(category='github_pullrequest',
+    project='docker-registry'), builderNames=['docker-registry-pr'])]
+c['schedulers'] += [Nightly(name='daily', branch=None, builderNames=[
+    'nightlyrelease', 'backup'], hour=7, minute=00)]
+
 
 # Builders
-# Docker commit test
-test_cmd = ('docker run -privileged mzdaniel/test_docker hack/dind'
-    ' test_docker.sh %(src::revision)s')
+
+# Backup
 factory = BuildFactory()
-factory.addStep(ShellCommand(description='Docker', logEnviron=False,
-    usePTY=True, command=["sh", "-c", Interpolate(test_cmd)]))
-c['builders'] = [BuilderConfig(name='docker',slavenames=['buildworker'],
+factory.addStep(TestCommand(description='backup', logEnviron=False,
+    usePTY=True, command='/docker-ci/tool/backup.py'))
+c['builders'] = [BuilderConfig(name='backup',slavenames=['buildworker'],
+    factory=factory)]
+
+# Docker test
+factory = BuildFactory()
+factory.addStep(TestCommand(description='docker', logEnviron=False,
+    usePTY=True, command='/docker-ci/dockertest/docker {}'.format(DOCKER_TEST_ARGV)))
+c['builders'] += [BuilderConfig(name='docker',slavenames=['buildworker'],
     factory=factory)]
 
 # Docker pull request test
-test_cmd = ('docker run -privileged mzdaniel/test_docker hack/dind'
-    ' test_docker.sh %(src::revision)s %(src::repository)s %(src::branch)s')
 factory = BuildFactory()
-factory.addStep(ShellCommand(description='pull_request', logEnviron=False,
-    usePTY=True, command=["sh", "-c", Interpolate(test_cmd)]))
-c['builders'] += [BuilderConfig(name='pullrequest',slavenames=['buildworker'],
+factory.addStep(TestCommand(description='docker-pr', logEnviron=False,
+    usePTY=True, command=['/docker-ci/dockertest/docker',
+    Property('revision'), Property('repository'), Property('branch')]))
+c['builders'] += [BuilderConfig(name='docker-pr',slavenames=['buildworker'],
     factory=factory)]
 
-# Docker coverage test
+# docker-registry test
 factory = BuildFactory()
-factory.addStep(ShellCommand(description='docker-coverage', logEnviron=False,
-    usePTY=True, command='{0}/docker-coverage/coverage-docker.sh'.format(
-    DOCKER_CI_PATH)))
-c['builders'] += [BuilderConfig(name='docker-coverage',slavenames=['buildworker'],
+factory.addStep(TestCommand(description='docker-registry', logEnviron=False,
+    usePTY=True, command='/docker-ci/dockertest/docker-registry {}'.format(REGISTRY_TEST_ARGV)))
+c['builders'] += [BuilderConfig(name='docker-registry',slavenames=['buildworker'],
     factory=factory)]
 
-# Docker registry coverage test
+# Docker registry pull request test
 factory = BuildFactory()
-factory.addStep(ShellCommand(description='registry-coverage', logEnviron=False,
-    usePTY=True, command='docker run registry_coverage'.format(
-    DOCKER_CI_PATH)))
-c['builders'] += [BuilderConfig(name='registry-coverage',slavenames=['buildworker'],
-    factory=factory)]
-
-# Registry functional test
-factory = BuildFactory()
-factory.addStep(ShellCommand(description='registry', logEnviron=False,
-    command='. {0}/master/credentials.cfg; '
-    '{1}/functionaltests/test_registry.sh'.format(BUILDBOT_PATH, DOCKER_CI_PATH),
-    usePTY=True))
-c['builders'] += [BuilderConfig(name='registry',slavenames=['buildworker'],
-    factory=factory)]
-
-# Index functional test
-factory = BuildFactory()
-factory.addStep(ShellCommand(description='index', logEnviron=False,
-    command='. {0}/master/credentials.cfg; '
-    '{1}/functionaltests/test_index.py'.format(BUILDBOT_PATH, DOCKER_CI_PATH),
-    usePTY=True))
-c['builders'] += [BuilderConfig(name='index',slavenames=['buildworker'],
+factory.addStep(TestCommand(description='docker-registry-pr', logEnviron=False,
+    usePTY=True, command=['/docker-ci/dockertest/docker-registry',
+    Property('revision'), Property('repository'), Property('branch')]))
+c['builders'] += [BuilderConfig(name='docker-registry-pr',slavenames=['buildworker'],
     factory=factory)]
 
 # Docker nightly release
-nightlyrelease_cmd = ('docker version; docker run -i -t -privileged -e AWS_S3_BUCKET='
-    'test.docker.io dockerbuilder hack/dind dockerbuild.sh')
 factory = BuildFactory()
 factory.addStep(ShellCommand(description='NightlyRelease',logEnviron=False,
-    usePTY=True, command=nightlyrelease_cmd))
+    usePTY=True, command=['/docker-ci/dockertest/nightlyrelease']))
 c['builders'] += [BuilderConfig(name='nightlyrelease',slavenames=['buildworker'],
     factory=factory)]
 
 # Status
-authz_cfg = authz.Authz(auth=auth.BasicAuth([(TEST_USER, TEST_PWD)]),
+authz_cfg = authz.Authz(auth=auth.BasicAuth([(WEB_USER, WEB_IRC_PWD)]),
     forceBuild='auth')
 c['status'] = [html.WebStatus(http_port=PORT_WEB, authz=authz_cfg)]
 c['status'].append(html.WebStatus(http_port=PORT_GITHUB, allowForce=True,
     change_hook_dialects={ 'github': True }))
-c['status'].append(MailNotifier(fromaddr='buildbot@docker.io',
+c['status'].append(MailNotifier(fromaddr='docker-test@docker.io',
     sendToInterestedUsers=False, extraRecipients=[EMAIL_RCP],
     mode='failing', relayhost='smtp.mailgun.org', smtpPort=587, useTls=True,
     smtpUser=SMTP_USER, smtpPassword=SMTP_PWD))
 c['status'].append(words.IRC("irc.freenode.net", "dockerqabot",
-    channels=[IRC_CHANNEL], password=IRC_PWD, allowForce=True,
+    channels=[IRC_CHANNEL], password=WEB_IRC_PWD, allowForce=True,
     notify_events={'exception':1, 'successToFailure':1, 'failureToSuccess':1}))
diff --git a/components/engine/hack/infrastructure/docker-ci/buildbot/requirements.txt b/components/engine/hack/infrastructure/docker-ci/buildbot/requirements.txt
deleted file mode 100644
index d2dcf1d125..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/buildbot/requirements.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-sqlalchemy<=0.7.9
-sqlalchemy-migrate>=0.7.2
-buildbot==0.8.7p1
-buildbot_slave==0.8.7p1
-nose==1.2.1
-requests==1.1.0
-flask==0.10.1
-simplejson==2.3.2
-selenium==2.35.0
diff --git a/components/engine/hack/infrastructure/docker-ci/buildbot/setup.sh b/components/engine/hack/infrastructure/docker-ci/buildbot/setup.sh
deleted file mode 100755
index c5d9cb988e..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/buildbot/setup.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-
-# Setup of buildbot configuration. Package installation is being done by
-# Vagrantfile
-# Dependencies: buildbot, buildbot-slave, supervisor
-
-USER=$1
-CFG_PATH=$2
-DOCKER_PATH=$3
-BUILDBOT_PWD=$4
-IRC_PWD=$5
-IRC_CHANNEL=$6
-SMTP_USER=$7
-SMTP_PWD=$8
-EMAIL_RCP=$9
-REGISTRY_USER=${10}
-REGISTRY_PWD=${11}
-REGISTRY_BUCKET=${12}
-REGISTRY_ACCESS_KEY=${13}
-REGISTRY_SECRET_KEY=${14}
-BUILDBOT_PATH="/data/buildbot"
-SLAVE_NAME="buildworker"
-SLAVE_SOCKET="localhost:9989"
-
-export PATH="/bin:sbin:/usr/bin:/usr/sbin:/usr/local/bin"
-
-function run { su $USER -c "$1"; }
-
-# Exit if buildbot has already been installed
-[ -d "$BUILDBOT_PATH" ] && exit 0
-
-# Setup buildbot
-run "mkdir -p $BUILDBOT_PATH"
-cd $BUILDBOT_PATH
-run "buildbot create-master master"
-run "cp $CFG_PATH/master.cfg master"
-run "sed -i -E 's#(BUILDBOT_PWD = ).+#\1\"$BUILDBOT_PWD\"#' master/master.cfg"
-run "sed -i -E 's#(IRC_PWD = ).+#\1\"$IRC_PWD\"#' master/master.cfg"
-run "sed -i -E 's#(IRC_CHANNEL = ).+#\1\"$IRC_CHANNEL\"#' master/master.cfg"
-run "sed -i -E 's#(SMTP_USER = ).+#\1\"$SMTP_USER\"#' master/master.cfg"
-run "sed -i -E 's#(SMTP_PWD = ).+#\1\"$SMTP_PWD\"#' master/master.cfg"
-run "sed -i -E 's#(EMAIL_RCP = ).+#\1\"$EMAIL_RCP\"#' master/master.cfg"
-run "buildslave create-slave slave $SLAVE_SOCKET $SLAVE_NAME $BUILDBOT_PWD"
-run "echo 'export DOCKER_CREDS=\"$REGISTRY_USER:$REGISTRY_PWD\"' > $BUILDBOT_PATH/master/credentials.cfg"
-run "echo 'export S3_BUCKET=\"$REGISTRY_BUCKET\"' >> $BUILDBOT_PATH/master/credentials.cfg"
-run "echo 'export S3_ACCESS_KEY=\"$REGISTRY_ACCESS_KEY\"' >> $BUILDBOT_PATH/master/credentials.cfg"
-run "echo 'export S3_SECRET_KEY=\"$REGISTRY_SECRET_KEY\"' >> $BUILDBOT_PATH/master/credentials.cfg"
-
-# Patch github webstatus to capture pull requests
-cp $CFG_PATH/github.py /usr/local/lib/python2.7/dist-packages/buildbot/status/web/hooks
-
-# Allow buildbot subprocesses (docker tests) to properly run in containers,
-# in particular with docker -u
-run "sed -i 's/^umask = None/umask = 000/' slave/buildbot.tac"
-
-# Setup supervisor
-cp $CFG_PATH/buildbot.conf /etc/supervisor/conf.d/buildbot.conf
-sed -i -E "s/^chmod=0700.+/chmod=0770\nchown=root:$USER/" /etc/supervisor/supervisord.conf
-kill -HUP $(pgrep -f "/usr/bin/python /usr/bin/supervisord")
diff --git a/components/engine/hack/infrastructure/docker-ci/dcr/prod/docker-ci.yml b/components/engine/hack/infrastructure/docker-ci/dcr/prod/docker-ci.yml
new file mode 100644
index 0000000000..523535446a
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/dcr/prod/docker-ci.yml
@@ -0,0 +1,22 @@
+docker-ci:
+  image: "docker-ci/docker-ci"
+  release_name: "docker-ci-0.5.6"
+  ports: ["80","2222:22","8011:8011"]
+  register: "80"
+  volumes: ["/run:/var/socket","/home/docker-ci:/data/docker-ci"]
+  command: []
+  env:
+    - "DEPLOYMENT=production"
+    - "IRC_CHANNEL=docker-testing"
+    - "BACKUP_BUCKET=backup-ci"
+    - "$WEB_USER"
+    - "$WEB_IRC_PWD"
+    - "$BUILDBOT_PWD"
+    - "$AWS_ACCESS_KEY"
+    - "$AWS_SECRET_KEY"
+    - "$GPG_PASSPHRASE"
+    - "$BACKUP_AWS_ID"
+    - "$BACKUP_AWS_SECRET"
+    - "$SMTP_USER"
+    - "$SMTP_PWD"
+    - "$EMAIL_RCP"
diff --git a/components/engine/hack/infrastructure/docker-ci/dcr/prod/settings.yml b/components/engine/hack/infrastructure/docker-ci/dcr/prod/settings.yml
new file mode 100644
index 0000000000..9831afa6dd
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/dcr/prod/settings.yml
@@ -0,0 +1,5 @@
+default:
+  hipaches: ['192.168.100.67:6379']
+  daemons: ['192.168.100.67:4243']
+  use_ssh: False
+
diff --git a/components/engine/hack/infrastructure/docker-ci/dcr/stage/docker-ci.yml b/components/engine/hack/infrastructure/docker-ci/dcr/stage/docker-ci.yml
new file mode 100644
index 0000000000..8eba84825c
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/dcr/stage/docker-ci.yml
@@ -0,0 +1,22 @@
+docker-ci:
+  image: "docker-ci/docker-ci"
+  release_name: "docker-ci-stage"
+  ports: ["80","2222:22","8011:8011"]
+  register: "80"
+  volumes: ["/run:/var/socket","/home/docker-ci:/data/docker-ci"]
+  command: []
+  env:
+    - "DEPLOYMENT=staging"
+    - "IRC_CHANNEL=docker-testing-staging"
+    - "BACKUP_BUCKET=ci-backup-stage"
+    - "$BACKUP_AWS_ID"
+    - "$BACKUP_AWS_SECRET"
+    - "$WEB_USER"
+    - "$WEB_IRC_PWD"
+    - "$BUILDBOT_PWD"
+    - "$AWS_ACCESS_KEY"
+    - "$AWS_SECRET_KEY"
+    - "$GPG_PASSPHRASE"
+    - "$SMTP_USER"
+    - "$SMTP_PWD"
+    - "$EMAIL_RCP"
diff --git a/components/engine/hack/infrastructure/docker-ci/dcr/stage/settings.yml b/components/engine/hack/infrastructure/docker-ci/dcr/stage/settings.yml
new file mode 100644
index 0000000000..a7d37acff3
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/dcr/stage/settings.yml
@@ -0,0 +1,5 @@
+default:
+  hipaches: ['192.168.100.65:6379']
+  daemons: ['192.168.100.65:4243']
+  use_ssh: False
+
diff --git a/components/engine/hack/infrastructure/docker-ci/deployment.py b/components/engine/hack/infrastructure/docker-ci/deployment.py
deleted file mode 100755
index fd0fdb0fe8..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/deployment.py
+++ /dev/null
@@ -1,171 +0,0 @@
-#!/usr/bin/env python
-
-import os, sys, re, json, requests, base64
-from subprocess import call
-from fabric import api
-from fabric.api import cd, run, put, sudo
-from os import environ as env
-from datetime import datetime
-from time import sleep
-
-# Remove SSH private key as it needs more processing
-CONFIG = json.loads(re.sub(r'("DOCKER_CI_KEY".+?"(.+?)",)','',
-    env['CONFIG_JSON'], flags=re.DOTALL))
-
-# Populate environment variables
-for key in CONFIG:
-    env[key] = CONFIG[key]
-
-# Load SSH private key
-env['DOCKER_CI_KEY'] = re.sub('^.+"DOCKER_CI_KEY".+?"(.+?)".+','\\1',
-    env['CONFIG_JSON'],flags=re.DOTALL)
-
-DROPLET_NAME = env.get('DROPLET_NAME','docker-ci')
-TIMEOUT = 120            # Seconds before timeout droplet creation
-IMAGE_ID = 1004145       # Docker on Ubuntu 13.04
-REGION_ID = 4            # New York 2
-SIZE_ID = 62             # memory 2GB
-DO_IMAGE_USER = 'root'   # Image user on Digital Ocean
-API_URL = 'https://api.digitalocean.com/'
-DOCKER_PATH = '/go/src/github.com/dotcloud/docker'
-DOCKER_CI_PATH = '/docker-ci'
-CFG_PATH = '{}/buildbot'.format(DOCKER_CI_PATH)
-
-
-class DigitalOcean():
-
-    def __init__(self, key, client):
-        '''Set default API parameters'''
-        self.key = key
-        self.client = client
-        self.api_url = API_URL
-
-    def api(self, cmd_path, api_arg={}):
-        '''Make api call'''
-        api_arg.update({'api_key':self.key, 'client_id':self.client})
-        resp = requests.get(self.api_url + cmd_path, params=api_arg).text
-        resp = json.loads(resp)
-        if resp['status'] != 'OK':
-            raise Exception(resp['error_message'])
-        return resp
-
-    def droplet_data(self, name):
-        '''Get droplet data'''
-        data = self.api('droplets')
-        data = [droplet for droplet in data['droplets']
-            if droplet['name'] == name]
-        return data[0] if data else {}
-
-
-def json_fmt(data):
-    '''Format json output'''
-    return json.dumps(data, sort_keys = True, indent = 2)
-
-
-do = DigitalOcean(env['DO_API_KEY'], env['DO_CLIENT_ID'])
-
-# Get DROPLET_NAME data
-data = do.droplet_data(DROPLET_NAME)
-
-# Stop processing if DROPLET_NAME exists on Digital Ocean
-if data:
-    print ('Droplet: {} already deployed. Not further processing.'
-        .format(DROPLET_NAME))
-    exit(1)
-
-# Create droplet
-do.api('droplets/new', {'name':DROPLET_NAME, 'region_id':REGION_ID,
-    'image_id':IMAGE_ID, 'size_id':SIZE_ID,
-    'ssh_key_ids':[env['DOCKER_KEY_ID']]})
-
-# Wait for droplet to be created.
-start_time = datetime.now()
-while (data.get('status','') != 'active' and (
- datetime.now()-start_time).seconds < TIMEOUT):
-    data = do.droplet_data(DROPLET_NAME)
-    print data['status']
-    sleep(3)
-
-# Wait for the machine to boot
-sleep(15)
-
-# Get droplet IP
-ip = str(data['ip_address'])
-print 'droplet: {}    ip: {}'.format(DROPLET_NAME, ip)
-
-# Create docker-ci ssh private key so docker-ci docker container can communicate
-# with its EC2 instance
-os.makedirs('/root/.ssh')
-open('/root/.ssh/id_rsa','w').write(env['DOCKER_CI_KEY'])
-os.chmod('/root/.ssh/id_rsa',0600)
-open('/root/.ssh/config','w').write('StrictHostKeyChecking no\n')
-
-api.env.host_string = ip
-api.env.user = DO_IMAGE_USER
-api.env.key_filename = '/root/.ssh/id_rsa'
-
-# Correct timezone
-sudo('echo "America/Los_Angeles" >/etc/timezone')
-sudo('dpkg-reconfigure --frontend noninteractive tzdata')
-
-# Load public docker-ci key
-sudo("echo '{}' >> /root/.ssh/authorized_keys".format(env['DOCKER_CI_PUB']))
-
-# Create docker nightly release credentials file
-credentials = {
-    'AWS_ACCESS_KEY': env['PKG_ACCESS_KEY'],
-    'AWS_SECRET_KEY': env['PKG_SECRET_KEY'],
-    'GPG_PASSPHRASE': env['PKG_GPG_PASSPHRASE']}
-open(DOCKER_CI_PATH + '/nightlyrelease/release_credentials.json', 'w').write(
-    base64.b64encode(json.dumps(credentials)))
-
-# Transfer docker
-sudo('mkdir -p ' + DOCKER_CI_PATH)
-sudo('chown {}.{} {}'.format(DO_IMAGE_USER, DO_IMAGE_USER, DOCKER_CI_PATH))
-call('/usr/bin/rsync -aH {} {}@{}:{}'.format(DOCKER_CI_PATH, DO_IMAGE_USER, ip,
-    os.path.dirname(DOCKER_CI_PATH)), shell=True)
-
-# Install Docker and Buildbot dependencies
-sudo('mkdir /mnt/docker; ln -s /mnt/docker /var/lib/docker')
-sudo('apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9')
-sudo('echo deb https://get.docker.io/ubuntu docker main >'
-    ' /etc/apt/sources.list.d/docker.list')
-sudo('echo -e "deb http://archive.ubuntu.com/ubuntu raring main universe\n'
-    'deb http://us.archive.ubuntu.com/ubuntu/ raring-security main universe\n"'
-    ' > /etc/apt/sources.list; apt-get update')
-sudo('DEBIAN_FRONTEND=noninteractive apt-get install -q -y wget python-dev'
-    ' python-pip supervisor git mercurial linux-image-extra-$(uname -r)'
-    ' aufs-tools make libfontconfig libevent-dev libsqlite3-dev libssl-dev')
-sudo('wget -O - https://go.googlecode.com/files/go1.2.linux-amd64.tar.gz | '
-    'tar -v -C /usr/local -xz; ln -s /usr/local/go/bin/go /usr/bin/go')
-sudo('GOPATH=/go go get -d github.com/dotcloud/docker')
-sudo('pip install -r {}/requirements.txt'.format(CFG_PATH))
-
-# Install docker and testing dependencies
-sudo('apt-get install -y -q lxc-docker')
-sudo('curl -s https://phantomjs.googlecode.com/files/'
-    'phantomjs-1.9.1-linux-x86_64.tar.bz2 | tar jx -C /usr/bin'
-    ' --strip-components=2 phantomjs-1.9.1-linux-x86_64/bin/phantomjs')
-
-# Build docker-ci containers
-sudo('cd {}; docker build -t docker .'.format(DOCKER_PATH))
-sudo('cd {}; docker build -t docker-ci .'.format(DOCKER_CI_PATH))
-sudo('cd {}/nightlyrelease; docker build -t dockerbuilder .'.format(
-    DOCKER_CI_PATH))
-sudo('cd {}/registry-coverage; docker build -t registry_coverage .'.format(
-    DOCKER_CI_PATH))
-
-# Download docker-ci testing container
-sudo('docker pull mzdaniel/test_docker')
-
-# Setup buildbot
-sudo('mkdir /data')
-sudo('{0}/setup.sh root {0} {1} {2} {3} {4} {5} {6} {7} {8} {9} {10}'
-    ' {11} {12}'.format(CFG_PATH, DOCKER_PATH, env['BUILDBOT_PWD'],
-    env['IRC_PWD'], env['IRC_CHANNEL'], env['SMTP_USER'],
-    env['SMTP_PWD'], env['EMAIL_RCP'], env['REGISTRY_USER'],
-    env['REGISTRY_PWD'], env['REGISTRY_BUCKET'], env['REGISTRY_ACCESS_KEY'],
-    env['REGISTRY_SECRET_KEY']))
-
-# Preventively reboot docker-ci daily
-sudo('ln -s /sbin/reboot /etc/cron.daily')
diff --git a/components/engine/hack/infrastructure/docker-ci/docker-coverage/coverage-docker.sh b/components/engine/hack/infrastructure/docker-ci/docker-coverage/coverage-docker.sh
deleted file mode 100755
index c29ede5b81..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/docker-coverage/coverage-docker.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-# Generate a random string of $1 characters
-function random {
-    cat /dev/urandom | tr -cd 'a-f0-9' | head -c $1
-}
-
-# Compute test paths
-BASE_PATH=`pwd`/test_docker_$(random 12)
-DOCKER_PATH=$BASE_PATH/go/src/github.com/dotcloud/docker
-export GOPATH=$BASE_PATH/go:$DOCKER_PATH/vendor
-
-# Fetch latest master
-mkdir -p $DOCKER_PATH
-cd $DOCKER_PATH
-git init .
-git fetch -q http://github.com/dotcloud/docker master
-git reset --hard FETCH_HEAD
-
-# Fetch go coverage
-cd $BASE_PATH/go
-GOPATH=$BASE_PATH/go go get github.com/axw/gocov/gocov
-sudo -E GOPATH=$GOPATH ./bin/gocov test -deps -exclude-goroot -v\
- -exclude github.com/gorilla/context,github.com/gorilla/mux,github.com/kr/pty,\
-code.google.com/p/go.net/websocket\
- github.com/dotcloud/docker | ./bin/gocov report; exit_status=$?
-
-# Cleanup testing directory
-rm -rf $BASE_PATH
-
-exit $exit_status
diff --git a/components/engine/hack/infrastructure/docker-ci/docker-test/Dockerfile b/components/engine/hack/infrastructure/docker-ci/docker-test/Dockerfile
deleted file mode 100644
index 0f3a63f5f1..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/docker-test/Dockerfile
+++ /dev/null
@@ -1,25 +0,0 @@
-# VERSION:        0.4
-# DOCKER-VERSION  0.6.6
-# AUTHOR:         Daniel Mizyrycki <daniel@docker.com>
-# DESCRIPTION:    Testing docker PRs and commits on top of master using
-# REFERENCES:     This code reuses the excellent implementation of
-#                 Docker in Docker made by Jerome Petazzoni.
-#                 https://github.com/jpetazzo/dind
-# COMMENTS:
-#   This Dockerfile adapts /Dockerfile to enable docker PRs and commits testing
-#   Optional arguments:
-#       [commit]  (default: 'HEAD')
-#       [repo]    (default: 'http://github.com/dotcloud/docker')
-#       [branch]  (default: 'master')
-# TO_BUILD:       docker build -t test_docker .
-# TO_RUN:         docker run -privileged test_docker hack/dind test_docker.sh [commit] [repo] [branch]
-
-from docker
-maintainer Daniel Mizyrycki <daniel@docker.com>
-
-# Setup go in PATH. Extracted from /Dockerfile
-env PATH /usr/local/go/bin:$PATH
-
-# Add test_docker.sh
-add test_docker.sh /usr/bin/test_docker.sh
-run chmod +x /usr/bin/test_docker.sh
diff --git a/components/engine/hack/infrastructure/docker-ci/docker-test/test_docker.sh b/components/engine/hack/infrastructure/docker-ci/docker-test/test_docker.sh
deleted file mode 100755
index 14816706ed..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/docker-test/test_docker.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-COMMIT=${1-HEAD}
-REPO=${2-http://github.com/dotcloud/docker}
-BRANCH=${3-master}
-
-# Compute test paths
-DOCKER_PATH=/go/src/github.com/dotcloud/docker
-
-# Timestamp
-echo
-date; echo
-
-# Fetch latest master
-cd /
-rm -rf /go
-git clone -q -b master http://github.com/dotcloud/docker $DOCKER_PATH
-cd $DOCKER_PATH
-
-# Merge commit
-git fetch -q "$REPO" "$BRANCH"
-git merge --no-edit $COMMIT || exit 255
-
-# Test commit
-./hack/make.sh test; exit_status=$?
-
-# Display load if test fails
-if [ $exit_status -ne 0 ] ; then
-    uptime; echo; free
-fi
-
-exit $exit_status
diff --git a/components/engine/hack/infrastructure/docker-ci/dockertest/docker b/components/engine/hack/infrastructure/docker-ci/dockertest/docker
new file mode 120000
index 0000000000..e3f094ee63
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/dockertest/docker
@@ -0,0 +1 @@
+project
\ No newline at end of file
diff --git a/components/engine/hack/infrastructure/docker-ci/dockertest/docker-registry b/components/engine/hack/infrastructure/docker-ci/dockertest/docker-registry
new file mode 120000
index 0000000000..e3f094ee63
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/dockertest/docker-registry
@@ -0,0 +1 @@
+project
\ No newline at end of file
diff --git a/components/engine/hack/infrastructure/docker-ci/dockertest/nightlyrelease b/components/engine/hack/infrastructure/docker-ci/dockertest/nightlyrelease
new file mode 100755
index 0000000000..475b088065
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/dockertest/nightlyrelease
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+if [ "$DEPLOYMENT" == "production" ]; then
+    AWS_S3_BUCKET='test.docker.io'
+else
+    AWS_S3_BUCKET='get-staging.docker.io'
+fi
+
+docker run -rm -privileged -v /run:/var/socket \
+    -e AWS_S3_BUCKET=$AWS_S3_BUCKET -e AWS_ACCESS_KEY=$AWS_ACCESS_KEY \
+    -e AWS_SECRET_KEY=$AWS_SECRET_KEY -e GPG_PASSPHRASE=$GPG_PASSPHRASE \
+    -e DOCKER_RELEASE=1 -e DEPLOYMENT=$DEPLOYMENT docker-ci/testbuilder docker
+
diff --git a/components/engine/hack/infrastructure/docker-ci/dockertest/project b/components/engine/hack/infrastructure/docker-ci/dockertest/project
new file mode 100755
index 0000000000..160f2d5d59
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/dockertest/project
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -x
+
+PROJECT_NAME=$(basename $0)
+
+docker run -rm -u sysadmin -e DEPLOYMENT=$DEPLOYMENT -v /run:/var/socket \
+    -v /home/docker-ci/coverage/$PROJECT_NAME:/data docker-ci/testbuilder $PROJECT_NAME $1 $2 $3
+
diff --git a/components/engine/hack/infrastructure/docker-ci/nginx/nginx.conf b/components/engine/hack/infrastructure/docker-ci/nginx/nginx.conf
new file mode 100644
index 0000000000..6649741134
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/nginx/nginx.conf
@@ -0,0 +1,12 @@
+server {
+    listen              80;
+    root /data/docker-ci;
+
+    location / {
+        proxy_pass http://localhost:8000/;
+    }
+
+    location /coverage {
+        root /data/docker-ci;
+    }
+}
diff --git a/components/engine/hack/infrastructure/docker-ci/nightlyrelease/Dockerfile b/components/engine/hack/infrastructure/docker-ci/nightlyrelease/Dockerfile
deleted file mode 100644
index 2100a9e8e9..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/nightlyrelease/Dockerfile
+++ /dev/null
@@ -1,30 +0,0 @@
-# VERSION:        1.6
-# DOCKER-VERSION  0.6.6
-# AUTHOR:         Daniel Mizyrycki <daniel@docker.com>
-# DESCRIPTION:    Build docker nightly release using Docker in Docker.
-# REFERENCES:     This code reuses the excellent implementation of docker in docker
-#                 made by Jerome Petazzoni.  https://github.com/jpetazzo/dind
-# COMMENTS:
-#   release_credentials.json is a base64 json encoded file containing:
-#       { "AWS_ACCESS_KEY": "Test_docker_AWS_S3_bucket_id",
-#         "AWS_SECRET_KEY": "Test_docker_AWS_S3_bucket_key",
-#         "GPG_PASSPHRASE": "Test_docker_GPG_passphrase_signature" }
-# TO_BUILD:       docker build -t dockerbuilder .
-# TO_RELEASE:     docker run -i -t -privileged -e AWS_S3_BUCKET="test.docker.io" dockerbuilder hack/dind dockerbuild.sh
-
-from docker
-maintainer Daniel Mizyrycki <daniel@docker.com>
-
-# Add docker dependencies and downloading packages
-run echo 'deb http://archive.ubuntu.com/ubuntu precise main universe' > /etc/apt/sources.list
-run apt-get update; apt-get install -y -q wget python2.7
-
-# Add production docker binary
-run wget -q -O /usr/bin/docker http://get.docker.io/builds/Linux/x86_64/docker-latest; chmod +x /usr/bin/docker
-
-# Add proto docker builder
-add ./dockerbuild.sh /usr/bin/dockerbuild.sh
-run chmod +x /usr/bin/dockerbuild.sh
-
-# Add release credentials
-add ./release_credentials.json /root/release_credentials.json
diff --git a/components/engine/hack/infrastructure/docker-ci/nightlyrelease/dockerbuild.sh b/components/engine/hack/infrastructure/docker-ci/nightlyrelease/dockerbuild.sh
deleted file mode 100644
index d5e58da7e1..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/nightlyrelease/dockerbuild.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-
-# Variables AWS_ACCESS_KEY, AWS_SECRET_KEY and PG_PASSPHRASE are decoded
-# from /root/release_credentials.json
-# Variable AWS_S3_BUCKET is passed to the environment from docker run -e
-
-# Turn debug off to load credentials from the environment
-set +x
-eval $(cat /root/release_credentials.json  | python -c '
-import sys,json,base64;
-d=json.loads(base64.b64decode(sys.stdin.read()));
-exec("""for k in d: print "export {0}=\\"{1}\\"".format(k,d[k])""")')
-
-# Fetch docker master branch
-set -x
-cd /
-rm -rf /go
-git clone -q -b master http://github.com/dotcloud/docker /go/src/github.com/dotcloud/docker
-cd /go/src/github.com/dotcloud/docker
-
-# Launch docker daemon using dind inside the container
-/usr/bin/docker version
-/usr/bin/docker -d &
-sleep 5
-
-# Build Docker release container
-docker build -t docker .
-
-# Test docker and if everything works well, release
-echo docker run -i -t -privileged -e AWS_S3_BUCKET=$AWS_S3_BUCKET -e AWS_ACCESS_KEY=XXXXX -e AWS_SECRET_KEY=XXXXX -e GPG_PASSPHRASE=XXXXX docker hack/release.sh
-set +x
-docker run -privileged -i -t -e AWS_S3_BUCKET=$AWS_S3_BUCKET -e AWS_ACCESS_KEY=$AWS_ACCESS_KEY -e AWS_SECRET_KEY=$AWS_SECRET_KEY -e GPG_PASSPHRASE=$GPG_PASSPHRASE docker hack/release.sh
-exit_status=$?
-
-# Display load if test fails
-set -x
-if [ $exit_status -ne 0 ] ; then
-    uptime; echo; free
-    exit 1
-fi
diff --git a/components/engine/hack/infrastructure/docker-ci/registry-coverage/Dockerfile b/components/engine/hack/infrastructure/docker-ci/registry-coverage/Dockerfile
deleted file mode 100644
index e544645b67..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/registry-coverage/Dockerfile
+++ /dev/null
@@ -1,18 +0,0 @@
-# VERSION:        0.1
-# DOCKER-VERSION  0.6.4
-# AUTHOR:         Daniel Mizyrycki <daniel@dotcloud.com>
-# DESCRIPTION:    Docker registry coverage
-# COMMENTS:       Add registry coverage into the docker-ci image
-# TO_BUILD:       docker build -t registry_coverage .
-# TO_RUN:         docker run registry_coverage
-
-from docker-ci
-maintainer Daniel Mizyrycki <daniel@dotcloud.com>
-
-# Add registry_coverager.sh and dependencies
-run pip install coverage flask pyyaml requests simplejson python-glanceclient \
-    blinker redis boto gevent rsa mock
-add registry_coverage.sh /usr/bin/registry_coverage.sh
-run chmod +x /usr/bin/registry_coverage.sh
-
-cmd "/usr/bin/registry_coverage.sh"
diff --git a/components/engine/hack/infrastructure/docker-ci/registry-coverage/registry_coverage.sh b/components/engine/hack/infrastructure/docker-ci/registry-coverage/registry_coverage.sh
deleted file mode 100755
index c67b17eba0..0000000000
--- a/components/engine/hack/infrastructure/docker-ci/registry-coverage/registry_coverage.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-# Setup the environment
-REGISTRY_PATH=/data/docker-registry
-export SETTINGS_FLAVOR=test
-export DOCKER_REGISTRY_CONFIG=config_test.yml
-export PYTHONPATH=$REGISTRY_PATH/test
-
-# Fetch latest docker-registry master
-rm -rf $REGISTRY_PATH
-git clone https://github.com/dotcloud/docker-registry -b master $REGISTRY_PATH
-cd $REGISTRY_PATH
-
-# Generate coverage
-coverage run -m unittest discover test || exit 1
-coverage report --include='./*' --omit='./test/*'
diff --git a/components/engine/hack/infrastructure/docker-ci/setup.sh b/components/engine/hack/infrastructure/docker-ci/setup.sh
new file mode 100755
index 0000000000..65a00f6dd0
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/setup.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# Set timezone
+echo "GMT" >/etc/timezone
+dpkg-reconfigure --frontend noninteractive tzdata
+
+# Set ssh superuser
+mkdir -p /data/buildbot /var/run/sshd /run
+useradd -m -d /home/sysadmin -s /bin/bash -G sudo,docker -p '*' sysadmin
+sed -Ei 's/(\%sudo.*) ALL/\1 NOPASSWD:ALL/' /etc/sudoers
+cd /home/sysadmin
+mkdir .ssh
+chmod 700 .ssh
+cat > .ssh/authorized_keys << 'EOF'
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7ALVhwQ68q1SjrKaAduOuOEAcWmb8kDZf5qA7T1fM8AP07EDC7nSKRJ8PXUBGTOQfxm89coJDuSJsTAZ+1PvglXhA0Mq6+knc6ZrZY+SuZlDIDAk4TOdVPoDZnmR1YW2McxHkhcGIOKeC8MMig5NeEjtgQwXzauUSPqeh8HMlLZRMooFYyyluIpn7NaCLzyWjwAQz2s3KyI7VE7hl+ncCrW86v+dciEdwqtzNoUMFb3iDpPxaiCl3rv+SB7co/5eUDTs1FZvUcYMXKQuf8R+2ZKzXOpwr0Zs8sKQXvXavCeWykwGgXLBjVkvrDcHuDD6UXCW63UKgmRECpLZaMBVIIRWLEEgTS5OSQTcxpMVe5zUW6sDvXHTcdPwWrcn1dE9F/0vLC0HJ4ADKelLX5zyTpmXGbuZuntIf1JO67D/K/P++uV1rmVIH+zgtOf23w5rX2zKb4BSTqP0sv61pmWV7MEVoEz6yXswcTjS92tb775v7XLU9vKAkt042ORFdE4/++hejhL/Lj52IRgjt1CJZHZsR9JywJZrz3kYuf8eU2J2FYh0Cpz5gmf0f+12Rt4HztnZxGPP4KuMa66e4+hpx1jynjMZ7D5QUnNYEmuvJByopn8HSluuY/kS5MMyZCZtJLEPGX4+yECX0Di/S0vCRl2NyqfCBqS+yXXT5SA1nFw== docker-test@docker.io
+EOF
+chmod 600 .ssh/authorized_keys
+chown -R sysadmin .ssh
+
+# Fix docker group id for use of host dockerd by sysadmin
+sed -Ei 's/(docker:x:)[^:]+/\1999/' /etc/group
+
+# Create buildbot configuration
+cd /data/buildbot; buildbot create-master master
+cp -a /data/buildbot/master/master.cfg.sample \
+    /data/buildbot/master/master.cfg
+cd /data/buildbot; \
+    buildslave create-slave slave localhost:9989 buildworker pass
+cp /docker-ci/buildbot/master.cfg /data/buildbot/master
+
+# Patch github webstatus to capture pull requests
+cp /docker-ci/buildbot/github.py /usr/local/lib/python2.7/dist-packages/buildbot/status/web/hooks
+chown -R sysadmin.sysadmin /data
+
+# Create nginx configuration
+rm /etc/nginx/sites-enabled/default
+cp /docker-ci/nginx/nginx.conf /etc/nginx/conf.d/buildbot.conf
+/bin/echo -e '\ndaemon off;\n' >> /etc/nginx/nginx.conf
+
+# Set supervisord buildbot, nginx and sshd processes
+/bin/echo -e "\
+[program:buildmaster]\n\
+command=twistd --nodaemon --no_save -y buildbot.tac\n\
+directory=/data/buildbot/master\n\
+user=sysadmin\n\n\
+[program:buildworker]\n\
+command=twistd --nodaemon --no_save -y buildbot.tac\n\
+directory=/data/buildbot/slave\n\
+user=sysadmin\n" > \
+    /etc/supervisor/conf.d/buildbot.conf
+/bin/echo -e "[program:nginx]\ncommand=/usr/sbin/nginx\n" > \
+    /etc/supervisor/conf.d/nginx.conf
+/bin/echo -e "[program:sshd]\ncommand=/usr/sbin/sshd -D\n" > \
+    /etc/supervisor/conf.d/sshd.conf
diff --git a/components/engine/hack/infrastructure/docker-ci/testbuilder/Dockerfile b/components/engine/hack/infrastructure/docker-ci/testbuilder/Dockerfile
new file mode 100644
index 0000000000..a008da6843
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/testbuilder/Dockerfile
@@ -0,0 +1,12 @@
+# TO_BUILD:      docker build -rm -no-cache -t docker-ci/testbuilder .
+# TO_RUN:        docker run -rm -u sysadmin \
+#                -v /run:/var/socket docker-ci/testbuilder docker-registry
+#
+
+FROM docker-ci/docker-ci
+ENV HOME /home/sysadmin
+
+RUN mkdir /testbuilder
+ADD . /testbuilder
+
+ENTRYPOINT ["/testbuilder/testbuilder.sh"]
diff --git a/components/engine/hack/infrastructure/docker-ci/testbuilder/docker-registry.sh b/components/engine/hack/infrastructure/docker-ci/testbuilder/docker-registry.sh
new file mode 100755
index 0000000000..72087462ad
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/testbuilder/docker-registry.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -x
+set -e
+PROJECT_PATH=$1
+
+# Build the docker project
+cd /data/$PROJECT_PATH
+sg docker -c "docker build -q -rm -t registry ."
+cd test; sg docker -c "docker build -q -rm -t docker-registry-test ."
+
+# Run the tests
+sg docker -c "docker run -rm -v /home/docker-ci/coverage/docker-registry:/data docker-registry-test"
diff --git a/components/engine/hack/infrastructure/docker-ci/testbuilder/docker.sh b/components/engine/hack/infrastructure/docker-ci/testbuilder/docker.sh
new file mode 100755
index 0000000000..b365dd7eaf
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/testbuilder/docker.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -x
+set -e
+PROJECT_PATH=$1
+
+# Build the docker project
+cd /data/$PROJECT_PATH
+sg docker -c "docker build -q -rm -t docker ."
+
+if [ "$DOCKER_RELEASE" == "1" ]; then
+    # Do nightly release
+    echo sg docker -c "docker run -rm -privileged -v /run:/var/socket -e AWS_S3_BUCKET=$AWS_S3_BUCKET -e AWS_ACCESS_KEY= -e AWS_SECRET_KEY= -e GPG_PASSPHRASE= docker hack/release.sh"
+    set +x
+    sg docker -c "docker run -rm -privileged -v /run:/var/socket -e AWS_S3_BUCKET=$AWS_S3_BUCKET -e AWS_ACCESS_KEY=$AWS_ACCESS_KEY -e AWS_SECRET_KEY=$AWS_SECRET_KEY -e GPG_PASSPHRASE=$GPG_PASSPHRASE docker hack/release.sh"
+else
+    # Run the tests
+    sg docker -c "docker run -rm -privileged -v /home/docker-ci/coverage/docker:/data docker ./hack/infrastructure/docker-ci/docker-coverage/gocoverage.sh"
+fi
diff --git a/components/engine/hack/infrastructure/docker-ci/testbuilder/testbuilder.sh b/components/engine/hack/infrastructure/docker-ci/testbuilder/testbuilder.sh
new file mode 100755
index 0000000000..70701343c2
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/testbuilder/testbuilder.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Download,  build and run a docker project tests
+# Environment variables: DEPLOYMENT
+
+cat $0
+set -e
+set -x
+
+PROJECT=$1
+COMMIT=${2-HEAD}
+REPO=${3-https://github.com/dotcloud/$PROJECT}
+BRANCH=${4-master}
+REPO_PROJ="https://github.com/docker-test/$PROJECT"
+if [ "$DEPLOYMENT" == "production" ]; then
+    REPO_PROJ="https://github.com/dotcloud/$PROJECT"
+fi
+set +x
+
+# Generate a random string of $1 characters
+function random {
+    cat /dev/urandom | tr -cd 'a-f0-9' | head -c $1
+}
+
+PROJECT_PATH="$PROJECT-tmp-$(random 12)"
+
+# Set docker-test git user
+set -x
+git config --global user.email "docker-test@docker.io"
+git config --global user.name "docker-test"
+
+# Fetch project
+git clone -q $REPO_PROJ -b master /data/$PROJECT_PATH
+cd /data/$PROJECT_PATH
+echo "Git commit: $(git rev-parse HEAD)"
+git fetch -q $REPO $BRANCH
+git merge --no-edit $COMMIT
+
+# Build the project dockertest
+/testbuilder/$PROJECT.sh $PROJECT_PATH
+rm -rf /data/$PROJECT_PATH
diff --git a/components/engine/hack/infrastructure/docker-ci/tool/backup.py b/components/engine/hack/infrastructure/docker-ci/tool/backup.py
new file mode 100755
index 0000000000..2db633e526
--- /dev/null
+++ b/components/engine/hack/infrastructure/docker-ci/tool/backup.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python
+
+import os,sys,json
+from datetime import datetime
+from filecmp import cmp
+from subprocess import check_call
+from boto.s3.key import Key
+from boto.s3.connection import S3Connection
+
+def ENV(x):
+    '''Promote an environment variable for global use returning its value'''
+    retval = os.environ.get(x, '')
+    globals()[x] = retval
+    return retval
+
+ROOT_PATH = '/data/backup/docker-ci'
+TODAY = str(datetime.today())[:10]
+BACKUP_FILE = '{}/docker-ci_{}.tgz'.format(ROOT_PATH, TODAY)
+BACKUP_LINK = '{}/docker-ci.tgz'.format(ROOT_PATH)
+ENV('BACKUP_BUCKET')
+ENV('BACKUP_AWS_ID')
+ENV('BACKUP_AWS_SECRET')
+
+'''Create full master buildbot backup, avoiding duplicates'''
+# Ensure backup path exist
+if not os.path.exists(ROOT_PATH):
+    os.makedirs(ROOT_PATH)
+# Make actual backups
+check_call('/bin/tar czf {} -C /data --exclude=backup --exclude=buildbot/slave'
+    ' . 1>/dev/null 2>&1'.format(BACKUP_FILE),shell=True)
+# remove previous dump if it is the same as the latest
+if (os.path.exists(BACKUP_LINK) and cmp(BACKUP_FILE, BACKUP_LINK) and
+ os.path._resolve_link(BACKUP_LINK) != BACKUP_FILE):
+    os.unlink(os.path._resolve_link(BACKUP_LINK))
+# Recreate backup link pointing to latest backup
+try:
+    os.unlink(BACKUP_LINK)
+except:
+    pass
+os.symlink(BACKUP_FILE, BACKUP_LINK)
+
+# Make backup on S3
+bucket = S3Connection(BACKUP_AWS_ID,BACKUP_AWS_SECRET).get_bucket(BACKUP_BUCKET)
+k = Key(bucket)
+k.key = BACKUP_FILE
+k.set_contents_from_filename(BACKUP_FILE)
+bucket.copy_key(os.path.basename(BACKUP_LINK),BACKUP_BUCKET,BACKUP_FILE[1:])

From d3c56b4c4af84743fd5ea42a7252b7f1aa6c1ef2 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 17 Feb 2014 11:17:05 -0800
Subject: [PATCH 120/403] Make crosbymichael and creack netlink maintainers
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 a75c6907b48f730fe79c6c9ebfe22eeea6389f4a Component: engine

---
 components/engine/pkg/netlink/MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 components/engine/pkg/netlink/MAINTAINERS

diff --git a/components/engine/pkg/netlink/MAINTAINERS b/components/engine/pkg/netlink/MAINTAINERS
new file mode 100644
index 0000000000..e53d933d47
--- /dev/null
+++ b/components/engine/pkg/netlink/MAINTAINERS
@@ -0,0 +1,2 @@
+Michael Crosby <michael@crosbymichael.com> (@crosbymichael)
+Guillaume Charmes <guillaume@dotcloud.com> (@creack)

From 3192f2a68b973da91ee925697b015ddf4d326258 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Mon, 17 Feb 2014 11:35:26 -0800
Subject: [PATCH 121/403] Fix DOCKER_HOST=tcp:// panic

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 513d86488046bfd898f5f1fdab39bfb302607535
Component: engine
---
 components/engine/docker/docker.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index b4d7879397..a552b8318a 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -58,6 +58,9 @@ func main() {
 			// If we do not have a host, default to unix socket
 			defaultHost = fmt.Sprintf("unix://%s", api.DEFAULTUNIXSOCKET)
 		}
+		if _, err := api.ValidateHost(defaultHost); err != nil {
+			log.Fatal(err)
+		}
 		flHosts.Set(defaultHost)
 	}
 

From e821f31734dd13ef8a965d75fb276c28101e04ba Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Mon, 17 Feb 2014 13:41:52 +0100
Subject: [PATCH 122/403] archive: Handle aufs plink hardlinks in ApplyLayer

Files in the .wh..wh.plnk directory are ignored, but other files
inside the tarfile can be hardlinks to these files. This is not
something that normally happens, as on aufs unmount such files are
supposed to be dropped via the "auplink" too, yet images on the index
(such as shipyard/shipyard, e.g. layer
f73c835af6d58b6fc827b400569f79a8f28e54f5bb732be063e1aacefbc374d0)
contains such files.

We handle these by extracting these files to a temporary directory
and resolve such hardlinks via the temporary files.

This fixes https://github.com/dotcloud/docker/issues/3884

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 6889cd9f9cfa3a6439b7702d73f27ab3fac3d3ef
Component: engine
---
 components/engine/archive/archive.go |  2 +-
 components/engine/archive/diff.go    | 42 +++++++++++++++++++++++++++-
 2 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index 8212621bb9..c0551d9fa3 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -186,7 +186,7 @@ func addTarFile(path, name string, tw *tar.Writer) error {
 	return nil
 }
 
-func createTarFile(path, extractDir string, hdr *tar.Header, reader *tar.Reader) error {
+func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader) error {
 	switch hdr.Typeflag {
 	case tar.TypeDir:
 		// Create directory unless it exists as a directory already.
diff --git a/components/engine/archive/diff.go b/components/engine/archive/diff.go
index de93fc69b2..6a778390bb 100644
--- a/components/engine/archive/diff.go
+++ b/components/engine/archive/diff.go
@@ -2,7 +2,9 @@ package archive
 
 import (
 	"code.google.com/p/go/src/pkg/archive/tar"
+	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -42,6 +44,9 @@ func ApplyLayer(dest string, layer ArchiveReader) error {
 
 	var dirs []*tar.Header
 
+	aufsTempdir := ""
+	aufsHardlinks := make(map[string]*tar.Header)
+
 	// Iterate through the files in the archive.
 	for {
 		hdr, err := tr.Next()
@@ -72,6 +77,22 @@ func ApplyLayer(dest string, layer ArchiveReader) error {
 
 		// Skip AUFS metadata dirs
 		if strings.HasPrefix(hdr.Name, ".wh..wh.") {
+			// Regular files inside /.wh..wh.plnk can be used as hardlink targets
+			// We don't want this directory, but we need the files in them so that
+			// such hardlinks can be resolved.
+			if strings.HasPrefix(hdr.Name, ".wh..wh.plnk") && hdr.Typeflag == tar.TypeReg {
+				basename := filepath.Base(hdr.Name)
+				aufsHardlinks[basename] = hdr
+				if aufsTempdir == "" {
+					if aufsTempdir, err = ioutil.TempDir("", "dockerplnk"); err != nil {
+						return err
+					}
+					defer os.RemoveAll(aufsTempdir)
+				}
+				if err := createTarFile(filepath.Join(aufsTempdir, basename), dest, hdr, tr); err != nil {
+					return err
+				}
+			}
 			continue
 		}
 
@@ -96,7 +117,26 @@ func ApplyLayer(dest string, layer ArchiveReader) error {
 				}
 			}
 
-			if err := createTarFile(path, dest, hdr, tr); err != nil {
+			srcData := io.Reader(tr)
+			srcHdr := hdr
+
+			// Hard links into /.wh..wh.plnk don't work, as we don't extract that directory, so
+			// we manually retarget these into the temporary files we extracted them into
+			if hdr.Typeflag == tar.TypeLink && strings.HasPrefix(filepath.Clean(hdr.Linkname), ".wh..wh.plnk") {
+				linkBasename := filepath.Base(hdr.Linkname)
+				srcHdr = aufsHardlinks[linkBasename]
+				if srcHdr == nil {
+					return fmt.Errorf("Invalid aufs hardlink")
+				}
+				tmpFile, err := os.Open(filepath.Join(aufsTempdir, linkBasename))
+				if err != nil {
+					return err
+				}
+				defer tmpFile.Close()
+				srcData = tmpFile
+			}
+
+			if err := createTarFile(path, dest, srcHdr, srcData); err != nil {
 				return err
 			}
 

From 7cfa188a7564ba2faceb1a39546a7efb45161aa2 Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Mon, 17 Feb 2014 23:09:09 +0200
Subject: [PATCH 123/403] update warning about local dns resolvers

This changes the local DNS resolver warning to explain what the
warning is about and why the default external DNS server is used.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 85b8025a35c29e0832fd13adc55177758ecbb309
Component: engine
---
 components/engine/server.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/server.go b/components/engine/server.go
index 46ab33b467..0ed96fee31 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1647,7 +1647,7 @@ func (srv *Server) ContainerCreate(job *engine.Job) engine.Status {
 		return job.Error(err)
 	}
 	if !config.NetworkDisabled && len(config.Dns) == 0 && len(srv.runtime.config.Dns) == 0 && utils.CheckLocalDns(resolvConf) {
-		job.Errorf("WARNING: Docker detected local DNS server on resolv.conf. Using default external servers: %v\n", defaultDns)
+		job.Errorf("WARNING: Local (127.0.0.1) DNS resolver found in resolv.conf and containers can't use it. Using default external servers : %v\n", defaultDns)
 		config.Dns = defaultDns
 	}
 

From 5f4d37b73db36fa8c970b73ff7f2558d2acfe87c Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 17 Feb 2014 13:31:13 -0800
Subject: [PATCH 124/403] Remove verbose logging for non errors
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 055f1a1f8181d51d3386b4270f810efd59d51d30 Component: engine

---
 components/engine/pkg/proxy/tcp_proxy.go | 10 +++-------
 components/engine/pkg/proxy/udp_proxy.go | 14 ++++----------
 2 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/components/engine/pkg/proxy/tcp_proxy.go b/components/engine/pkg/proxy/tcp_proxy.go
index b84483eff9..1aa6d9fd70 100644
--- a/components/engine/pkg/proxy/tcp_proxy.go
+++ b/components/engine/pkg/proxy/tcp_proxy.go
@@ -30,7 +30,7 @@ func NewTCPProxy(frontendAddr, backendAddr *net.TCPAddr) (*TCPProxy, error) {
 func (proxy *TCPProxy) clientLoop(client *net.TCPConn, quit chan bool) {
 	backend, err := net.DialTCP("tcp", nil, proxy.backendAddr)
 	if err != nil {
-		log.Printf("Can't forward traffic to backend tcp/%v: %v\n", proxy.backendAddr, err.Error())
+		log.Printf("Can't forward traffic to backend tcp/%v: %s\n", proxy.backendAddr, err)
 		client.Close()
 		return
 	}
@@ -49,7 +49,6 @@ func (proxy *TCPProxy) clientLoop(client *net.TCPConn, quit chan bool) {
 		event <- written
 	}
 
-	log.Printf("Forwarding traffic between tcp/%v and tcp/%v", client.RemoteAddr(), backend.RemoteAddr())
 	go broker(client, backend)
 	go broker(backend, client)
 
@@ -65,23 +64,20 @@ func (proxy *TCPProxy) clientLoop(client *net.TCPConn, quit chan bool) {
 			for ; i < 2; i++ {
 				transferred += <-event
 			}
-			goto done
+			return
 		}
 	}
 	client.Close()
 	backend.Close()
-done:
-	log.Printf("%v bytes transferred between tcp/%v and tcp/%v", transferred, client.RemoteAddr(), backend.RemoteAddr())
 }
 
 func (proxy *TCPProxy) Run() {
 	quit := make(chan bool)
 	defer close(quit)
-	log.Printf("Starting proxy on tcp/%v for tcp/%v", proxy.frontendAddr, proxy.backendAddr)
 	for {
 		client, err := proxy.listener.Accept()
 		if err != nil {
-			log.Printf("Stopping proxy on tcp/%v for tcp/%v (%v)", proxy.frontendAddr, proxy.backendAddr, err.Error())
+			log.Printf("Stopping proxy on tcp/%v for tcp/%v (%s)", proxy.frontendAddr, proxy.backendAddr, err)
 			return
 		}
 		go proxy.clientLoop(client.(*net.TCPConn), quit)
diff --git a/components/engine/pkg/proxy/udp_proxy.go b/components/engine/pkg/proxy/udp_proxy.go
index 9395516464..14f2306a5a 100644
--- a/components/engine/pkg/proxy/udp_proxy.go
+++ b/components/engine/pkg/proxy/udp_proxy.go
@@ -66,7 +66,6 @@ func (proxy *UDPProxy) replyLoop(proxyConn *net.UDPConn, clientAddr *net.UDPAddr
 		proxy.connTrackLock.Lock()
 		delete(proxy.connTrackTable, *clientKey)
 		proxy.connTrackLock.Unlock()
-		log.Printf("Done proxying between udp/%v and udp/%v", clientAddr.String(), proxy.backendAddr.String())
 		proxyConn.Close()
 	}()
 
@@ -92,24 +91,20 @@ func (proxy *UDPProxy) replyLoop(proxyConn *net.UDPConn, clientAddr *net.UDPAddr
 				return
 			}
 			i += written
-			log.Printf("Forwarded %v/%v bytes to udp/%v", i, read, clientAddr.String())
 		}
 	}
 }
 
 func (proxy *UDPProxy) Run() {
 	readBuf := make([]byte, UDPBufSize)
-	log.Printf("Starting proxy on udp/%v for udp/%v", proxy.frontendAddr, proxy.backendAddr)
 	for {
 		read, from, err := proxy.listener.ReadFromUDP(readBuf)
 		if err != nil {
 			// NOTE: Apparently ReadFrom doesn't return
 			// ECONNREFUSED like Read do (see comment in
 			// UDPProxy.replyLoop)
-			if isClosedError(err) {
-				log.Printf("Stopping proxy on udp/%v for udp/%v (socket was closed)", proxy.frontendAddr, proxy.backendAddr)
-			} else {
-				log.Printf("Stopping proxy on udp/%v for udp/%v (%v)", proxy.frontendAddr, proxy.backendAddr, err.Error())
+			if !isClosedError(err) {
+				log.Printf("Stopping proxy on udp/%v for udp/%v (%s)", proxy.frontendAddr, proxy.backendAddr, err)
 			}
 			break
 		}
@@ -120,7 +115,7 @@ func (proxy *UDPProxy) Run() {
 		if !hit {
 			proxyConn, err = net.DialUDP("udp", nil, proxy.backendAddr)
 			if err != nil {
-				log.Printf("Can't proxy a datagram to udp/%s: %v\n", proxy.backendAddr.String(), err)
+				log.Printf("Can't proxy a datagram to udp/%s: %s\n", proxy.backendAddr, err)
 				continue
 			}
 			proxy.connTrackTable[*fromKey] = proxyConn
@@ -130,11 +125,10 @@ func (proxy *UDPProxy) Run() {
 		for i := 0; i != read; {
 			written, err := proxyConn.Write(readBuf[i:read])
 			if err != nil {
-				log.Printf("Can't proxy a datagram to udp/%s: %v\n", proxy.backendAddr.String(), err)
+				log.Printf("Can't proxy a datagram to udp/%s: %s\n", proxy.backendAddr, err)
 				break
 			}
 			i += written
-			log.Printf("Forwarded %v/%v bytes to udp/%v", i, read, proxy.backendAddr.String())
 		}
 	}
 }

From 7dcf535f27fc2a7e2d316ce001c8ba9930ae5ffe Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 17 Feb 2014 15:10:51 -0800
Subject: [PATCH 125/403] Move job register into servapi
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 e743021193e589b1358d0eef0521e9d8878dd66d Component: engine

---
 components/engine/api/api.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index 8d7b1de685..bd4283e301 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -52,7 +52,6 @@ type HttpApiFunc func(eng *engine.Engine, version float64, w http.ResponseWriter
 
 func init() {
 	engine.Register("serveapi", ServeApi)
-	engine.Register("acceptconnections", AcceptConnections)
 }
 
 func hijackServer(w http.ResponseWriter) (io.ReadCloser, io.Writer, error) {
@@ -1211,6 +1210,10 @@ func ServeApi(job *engine.Job) engine.Status {
 	)
 	activationLock = make(chan struct{})
 
+	if err := job.Eng.Register("acceptconnections", AcceptConnections); err != nil {
+		return job.Error(err)
+	}
+
 	for _, protoAddr := range protoAddrs {
 		protoAddrParts := strings.SplitN(protoAddr, "://", 2)
 		go func() {

From 78488bf1e626adbed1aa96ecca423f3c372fa0bd Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 17 Feb 2014 15:25:00 -0800
Subject: [PATCH 126/403] Revert "Merge pull request #4151 from
 crosbymichael/improve-404-client-message"

This reverts commit 6dd1bb9eb08dc144bc172b0052df7c3904896e56, reversing
changes made to 23aec9d7fcaa72db026c042046102b381e2e9d27.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: d55cc64c4eb66c4ee536514e35e2e2094aa3d911
Component: engine
---
 components/engine/api/client.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index 605970c0fd..3dd867f771 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -2080,9 +2080,7 @@ func (cli *DockerCli) call(method, path string, data interface{}, passAuthInfo b
 		return nil, -1, err
 	}
 
-	if resp.StatusCode == 404 {
-		return nil, resp.StatusCode, fmt.Errorf("Error: request for %s returned 404 Not Found for the api version", req.URL)
-	} else if resp.StatusCode < 200 || resp.StatusCode >= 400 {
+	if resp.StatusCode < 200 || resp.StatusCode >= 400 {
 		body, err := ioutil.ReadAll(resp.Body)
 		if err != nil {
 			return nil, -1, err

From cf7d93d809bb7e2bdba513a1e1d214417dcf2439 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 17 Feb 2014 15:28:30 -0800
Subject: [PATCH 127/403] Improve error message only if no body is returned
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 e23190b6b3ddd16b3a5f951a33e05fd75ebb8970 Component: engine

---
 components/engine/api/client.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index 3dd867f771..81e337b023 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -2086,7 +2086,7 @@ func (cli *DockerCli) call(method, path string, data interface{}, passAuthInfo b
 			return nil, -1, err
 		}
 		if len(body) == 0 {
-			return nil, resp.StatusCode, fmt.Errorf("Error :%s", http.StatusText(resp.StatusCode))
+			return nil, resp.StatusCode, fmt.Errorf("Error: request returned %s for api route and version %s, check if the server supports the requested api version", http.StatusText(resp.StatusCode), req.URL)
 		}
 		return nil, resp.StatusCode, fmt.Errorf("Error: %s", bytes.TrimSpace(body))
 	}

From c39069efb079fc24fe29ecdabd17de2b75717d2a Mon Sep 17 00:00:00 2001
From: Vincent Batts <vbatts@redhat.com>
Date: Mon, 17 Feb 2014 16:54:36 -0500
Subject: [PATCH 128/403] execdriver flag for docker daemon

  like the storage-driver flag, this implements a flag for choosing the
  execdriver to be used, defaulting to lxc.

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Upstream-commit: 5f84d7f3146db1ac15974f1e28f77834de3e63ff
Component: engine
---
 components/engine/config.go                          |  2 ++
 components/engine/docker/docker.go                   |  2 ++
 .../docs/sources/reference/commandline/cli.rst       |  1 +
 components/engine/runtime.go                         | 12 +++++++++++-
 4 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/components/engine/config.go b/components/engine/config.go
index dc6e8b554f..19aad9ed4a 100644
--- a/components/engine/config.go
+++ b/components/engine/config.go
@@ -25,6 +25,7 @@ type DaemonConfig struct {
 	BridgeIP                    string
 	InterContainerCommunication bool
 	GraphDriver                 string
+	ExecDriver                  string
 	Mtu                         int
 	DisableNetwork              bool
 }
@@ -43,6 +44,7 @@ func DaemonConfigFromJob(job *engine.Job) *DaemonConfig {
 		DefaultIp:                   net.ParseIP(job.Getenv("DefaultIp")),
 		InterContainerCommunication: job.GetenvBool("InterContainerCommunication"),
 		GraphDriver:                 job.Getenv("GraphDriver"),
+		ExecDriver:                  job.Getenv("ExecDriver"),
 	}
 	if dns := job.GetenvList("Dns"); dns != nil {
 		config.Dns = dns
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 02c99b9316..51aaf334d1 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -39,6 +39,7 @@ func main() {
 		flDefaultIp          = flag.String([]string{"#ip", "-ip"}, "0.0.0.0", "Default IP address to use when binding container ports")
 		flInterContainerComm = flag.Bool([]string{"#icc", "-icc"}, true, "Enable inter-container communication")
 		flGraphDriver        = flag.String([]string{"s", "-storage-driver"}, "", "Force the docker runtime to use a specific storage driver")
+		flExecDriver         = flag.String([]string{"e", "-exec-driver"}, "", "Force the docker runtime to use a specific exec driver")
 		flHosts              = opts.NewListOpts(api.ValidateHost)
 		flMtu                = flag.Int([]string{"#mtu", "-mtu"}, 0, "Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if not default route is available")
 	)
@@ -98,6 +99,7 @@ func main() {
 			job.Setenv("DefaultIp", *flDefaultIp)
 			job.SetenvBool("InterContainerCommunication", *flInterContainerComm)
 			job.Setenv("GraphDriver", *flGraphDriver)
+			job.Setenv("ExecDriver", *flExecDriver)
 			job.SetenvInt("Mtu", *flMtu)
 			if err := job.Run(); err != nil {
 				log.Fatal(err)
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 7ba0123065..e0ec2b99cc 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -79,6 +79,7 @@ Commands
       -p, --pidfile="/var/run/docker.pid": Path to use for daemon PID file
       -r, --restart=true: Restart previously running containers
       -s, --storage-driver="": Force the docker runtime to use a specific storage driver
+      -e, --exec-driver="": Force the docker runtime to use a specific exec driver
       -v, --version=false: Print version information and quit
       -mtu, --mtu=0: Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if not default route is available
 
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index eed28f92ab..8e12a43402 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -7,6 +7,7 @@ import (
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/execdriver"
+	"github.com/dotcloud/docker/execdriver/chroot"
 	"github.com/dotcloud/docker/execdriver/lxc"
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/graphdriver/aufs"
@@ -703,7 +704,16 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 
 	sysInfo := sysinfo.New(false)
 
-	ed, err := lxc.NewDriver(config.Root, sysInfo.AppArmor)
+	var ed execdriver.Driver
+	utils.Debugf("execDriver: provided %s", config.ExecDriver)
+	if config.ExecDriver == "chroot" && false {
+		// chroot is presently a noop driver https://github.com/dotcloud/docker/pull/4189#issuecomment-35330655
+		ed, err = chroot.NewDriver()
+		utils.Debugf("execDriver: using chroot")
+	} else {
+		ed, err = lxc.NewDriver(config.Root, sysInfo.AppArmor)
+		utils.Debugf("execDriver: using lxc")
+	}
 	if err != nil {
 		return nil, err
 	}

From bf1c684667d674f839e920afad4428edcc63e947 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Mon, 17 Feb 2014 17:08:17 -0800
Subject: [PATCH 129/403] Fix remote tar ADD behavior

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 98ce0cdb4f80550462675ee3bbb927451bb76585
Component: engine
---
 components/engine/buildfile.go | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/components/engine/buildfile.go b/components/engine/buildfile.go
index 3ee63ea3fb..c7181b9146 100644
--- a/components/engine/buildfile.go
+++ b/components/engine/buildfile.go
@@ -355,7 +355,7 @@ func (b *buildFile) checkPathForAddition(orig string) error {
 	return nil
 }
 
-func (b *buildFile) addContext(container *Container, orig, dest string) error {
+func (b *buildFile) addContext(container *Container, orig, dest string, remote bool) error {
 	var (
 		origPath = path.Join(b.contextPath, orig)
 		destPath = path.Join(container.BasefsPath(), dest)
@@ -388,11 +388,14 @@ func (b *buildFile) addContext(container *Container, orig, dest string) error {
 		tarDest = filepath.Dir(destPath)
 	}
 
-	// try to successfully untar the orig
-	if err := archive.UntarPath(origPath, tarDest); err == nil {
-		return nil
+	// If we are adding a remote file, do not try to untar it
+	if !remote {
+		// try to successfully untar the orig
+		if err := archive.UntarPath(origPath, tarDest); err == nil {
+			return nil
+		}
+		utils.Debugf("Couldn't untar %s to %s: %s", origPath, destPath, err)
 	}
-	utils.Debugf("Couldn't untar %s to %s: %s", origPath, destPath, err)
 
 	// If that fails, just copy it as a regular file
 	// but do not use all the magic path handling for the tar path
@@ -428,14 +431,15 @@ func (b *buildFile) CmdAdd(args string) error {
 	b.config.Cmd = []string{"/bin/sh", "-c", fmt.Sprintf("#(nop) ADD %s in %s", orig, dest)}
 	b.config.Image = b.image
 
-	// FIXME: do we really need this?
 	var (
 		origPath   = orig
 		destPath   = dest
 		remoteHash string
+		isRemote   bool
 	)
 
 	if utils.IsURL(orig) {
+		isRemote = true
 		resp, err := utils.Download(orig)
 		if err != nil {
 			return err
@@ -545,7 +549,7 @@ func (b *buildFile) CmdAdd(args string) error {
 	}
 	defer container.Unmount()
 
-	if err := b.addContext(container, origPath, destPath); err != nil {
+	if err := b.addContext(container, origPath, destPath, isRemote); err != nil {
 		return err
 	}
 

From 5f957db92e780ba4af224a287ce863140bf7e5ab Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Fri, 14 Feb 2014 21:02:54 +1000
Subject: [PATCH 130/403] rejig the helloflask example as more advanced, and
 move it to the end

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 3036b5a196fdbb744f94299c82dc44078361bdae
Component: engine
---
 .../engine/docs/sources/examples/index.rst    |   2 +-
 .../docs/sources/examples/python_web_app.rst  | 113 +++++++++---------
 2 files changed, 59 insertions(+), 56 deletions(-)

diff --git a/components/engine/docs/sources/examples/index.rst b/components/engine/docs/sources/examples/index.rst
index cd08107e7a..cf9ed9340a 100644
--- a/components/engine/docs/sources/examples/index.rst
+++ b/components/engine/docs/sources/examples/index.rst
@@ -16,7 +16,6 @@ to more substantial services like those which you might find in production.
    :maxdepth: 1
 
    hello_world
-   python_web_app
    nodejs_web_app
    running_redis_service
    running_ssh_service
@@ -26,3 +25,4 @@ to more substantial services like those which you might find in production.
    running_riak_service
    using_supervisord
    cfengine_process_management
+   python_web_app
diff --git a/components/engine/docs/sources/examples/python_web_app.rst b/components/engine/docs/sources/examples/python_web_app.rst
index f31b31b7d2..b44c0e1ee5 100644
--- a/components/engine/docs/sources/examples/python_web_app.rst
+++ b/components/engine/docs/sources/examples/python_web_app.rst
@@ -9,85 +9,86 @@ Python Web App
 
 .. include:: example_header.inc
 
-The goal of this example is to show you how you can author your own
-Docker images using a parent image, making changes to it, and then
-saving the results as a new image. We will do that by making a simple
-hello Flask web application image.
+While using Dockerfiles is the prefered way to create maintainable
+and repeatable images, its useful to know how you can try things out
+and then commit your live changes to an image.
+
+The goal of this example is to show you how you can modify your own
+Docker images  by making changes to a running 
+container, and then saving the results as a new image. We will do 
+that by making a simple 'hello world' Flask web application image.
 
 **Steps:**
 
 .. code-block:: bash
 
-    sudo docker pull shykes/pybuilder
+    $ sudo docker pull shykes/pybuilder
+
+Download the ``shykes/pybuilder`` Docker image from the ``http://index.docker.io``
+registry. Note that this container was built with a very old version of docker 
+(May 2013), but can still be used now.
 
-We are downloading the ``shykes/pybuilder`` Docker image
 
 .. code-block:: bash
 
-    URL=http://github.com/shykes/helloflask/archive/master.tar.gz
+    $ sudo docker run -i -t -name pybuilder_run shykes/pybuilder bash
 
-We set a ``URL`` variable that points to a tarball of a simple helloflask web app
+    $$ URL=http://github.com/shykes/helloflask/archive/master.tar.gz
+    $$ /usr/local/bin/buildapp $URL
+    [lots of output later]
+    $$ exit
+
+
+We then start a new container running interactively  using the
+image. 
+First, we set a ``URL`` variable that points to a tarball of a simple 
+helloflask web app, and then we run a command contained in the image called
+``buildapp``, passing it the ``$URL`` variable. The container is
+given a name ``pybuilder_run`` which we will use in the next steps.
+
+While this example is simple, you could run any number of interactive commands,
+try things out, and then exit when you're done.
 
 .. code-block:: bash
 
-    BUILD_JOB=$(sudo docker run -d -t shykes/pybuilder:latest /usr/local/bin/buildapp $URL)
-
-Inside of the ``shykes/pybuilder`` image there is a command called
-``buildapp``, we are running that command and passing the ``$URL`` variable
-from step 2 to it, and running the whole thing inside of a new
-container. The ``BUILD_JOB`` environment variable will be set with the new container ID.
-
-.. code-block:: bash
-
-    sudo docker attach -sig-proxy=false $BUILD_JOB
-    [...]
-
-While this container is running, we can attach to the new container to
-see what is going on. The flag ``--sig-proxy`` set as ``false`` allows you to connect and
-disconnect (Ctrl-C) to it without stopping the container.
-
-.. code-block:: bash
-
-    sudo docker ps -a
-
-List all Docker containers. If this container has already finished
-running, it will still be listed here.
-
-.. code-block:: bash
-
-    BUILD_IMG=$(sudo docker commit $BUILD_JOB _/builds/github.com/shykes/helloflask/master)
+    $ sudo docker commit pybuilder_run /builds/github.com/shykes/helloflask/master
+    c8b2e8228f11b8b3e492cbf9a49923ae66496230056d61e07880dc74c5f495f9
 
 Save the changes we just made in the container to a new image called
-``_/builds/github.com/hykes/helloflask/master`` and save the image ID in
-the ``BUILD_IMG`` variable name.
+``/builds/github.com/hykes/helloflask/master``. You now have 3 different
+ways to refer to the container, name, short-id ``c8b2e8228f11``, or 
+long-id ``c8b2e8228f11b8b3e492cbf9a49923ae66496230056d61e07880dc74c5f495f9``.
 
 .. code-block:: bash
 
-    WEB_WORKER=$(sudo docker run -d -p 5000 $BUILD_IMG /usr/local/bin/runapp)
+    $ WEB_WORKER=$(sudo docker run -d -p 5000 /builds/github.com/hykes/helloflask/master /usr/local/bin/runapp)
+
+Use the new image to create a new container with
+network port 5000, and return the container ID and store in the
+``WEB_WORKER`` variable (rather than naming a container/image, you can use the ID's).
 
 - **"docker run -d "** run a command in a new container. We pass "-d"
   so it runs as a daemon.
 - **"-p 5000"** the web app is going to listen on this port, so it
   must be mapped from the container to the host system.
-- **"$BUILD_IMG"** is the image we want to run the command inside of.
 - **/usr/local/bin/runapp** is the command which starts the web app.
 
-Use the new image we just created and create a new container with
-network port 5000, and return the container ID and store in the
-``WEB_WORKER`` variable.
 
 .. code-block:: bash
 
-    sudo docker logs $WEB_WORKER
+    $ sudo docker logs -f $WEB_WORKER
      * Running on http://0.0.0.0:5000/
 
 View the logs for the new container using the ``WEB_WORKER`` variable, and
 if everything worked as planned you should see the line ``Running on
 http://0.0.0.0:5000/`` in the log output.
 
+To exit the view without stopping the container, hit Ctrl-C, or open another 
+terminal and continue with the example while watching the result in the logs.
+
 .. code-block:: bash
 
-    WEB_PORT=$(sudo docker port $WEB_WORKER 5000 | awk -F: '{ print $2 }')
+    $ WEB_PORT=$(sudo docker port $WEB_WORKER 5000 | awk -F: '{ print $2 }')
 
 Look up the public-facing port which is NAT-ed. Find the private port
 used by the container and store it inside of the ``WEB_PORT`` variable.
@@ -95,23 +96,25 @@ used by the container and store it inside of the ``WEB_PORT`` variable.
 .. code-block:: bash
 
     # install curl if necessary, then ...
-    curl http://127.0.0.1:$WEB_PORT
-      Hello world!
+    $ curl http://127.0.0.1:$WEB_PORT
+    Hello world!
 
 Access the web app using the ``curl`` binary. If everything worked as planned you
 should see the line ``Hello world!`` inside of your console.
 
-**Video:**
+.. code-block:: bash
 
-See the example in action
+    $ sudo docker ps --all
 
-.. raw:: html
+List ``--all`` the Docker containers. If this container had already finished
+running, it will still be listed here with a status of 'Exit 0'.
 
-   <iframe width="720" height="400" frameborder="0"
-           sandbox="allow-same-origin allow-scripts" 
-   srcdoc="<body><script type=&quot;text/javascript&quot; 
-           src=&quot;https://asciinema.org/a/2573.js&quot; 
-           id=&quot;asciicast-2573&quot; async></script></body>">
-   </iframe>
+.. code-block:: bash
+
+    $ sudo docker stop $WEB_WORKER
+    $ sudo docker rm $WEB_WORKER pybuilder_run
+    $ sudo docker rmi /builds/github.com/shykes/helloflask/master shykes/pybuilder:latest
+
+And now stop the running web worker, and delete the containers, so that we can 
+then delete the images that we used.
 
-Continue to :ref:`running_ssh_service`.

From 244da2b52047f75e467631b38cf94d3296aa93c3 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Fri, 14 Feb 2014 21:27:57 +1000
Subject: [PATCH 131/403] swap busybox for ubuntu, its quicker..

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: f535a58959809dbb613bf529019f26cc6ae0c6f9
Component: engine
---
 .../docs/sources/examples/hello_world.rst     | 30 +++++++++----------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/components/engine/docs/sources/examples/hello_world.rst b/components/engine/docs/sources/examples/hello_world.rst
index fd5d6421c3..c8ecb0f6c2 100644
--- a/components/engine/docs/sources/examples/hello_world.rst
+++ b/components/engine/docs/sources/examples/hello_world.rst
@@ -4,9 +4,6 @@
 
 .. _examples:
 
-Hello World
------------
-
 .. _running_examples:
 
 Check your Docker install
@@ -18,7 +15,7 @@ your Docker install, run the following command:
 .. code-block:: bash
 
     # Check that you have a working install
-    docker info
+    $ sudo docker info
 
 If you get ``docker: command not found`` or something like
 ``/var/lib/docker/repositories: permission denied`` you may have an incomplete
@@ -30,27 +27,28 @@ Please refer to :ref:`installation_list` for installation instructions.
 .. _hello_world:
 
 Hello World
-===========
+-----------
 
 .. include:: example_header.inc
 
 This is the most basic example available for using Docker.
 
-Download the base image which is named ``ubuntu``:
+Download the small base image named ``busybox``:
 
 .. code-block:: bash
 
-    # Download an ubuntu image
-    sudo docker pull ubuntu
+    # Download an busybox image
+    $ sudo docker pull busybox
 
-Alternatively to the ``ubuntu`` image, you can select ``busybox``, a bare
-minimal Linux system. The images are retrieved from the Docker
-repository.
+The ``busybox`` image is a minimal Linux system. You can do the same
+with any number of other images, such as ``debian``, ``ubuntu`` or ``centos``.
+The images can be found and retrieved using the `Docker index`_.
 
+.. _Docker index: http://index.docker.io
 
 .. code-block:: bash
 
-    sudo docker run ubuntu /bin/echo hello world
+    $ sudo docker run busybox /bin/echo hello world
 
 This command will run a simple ``echo`` command, that will echo ``hello world`` back to the console over standard out.
 
@@ -58,7 +56,7 @@ This command will run a simple ``echo`` command, that will echo ``hello world``
 
 - **"sudo"** execute the following commands as user *root* 
 - **"docker run"** run a command in a new container 
-- **"ubuntu"** is the image we want to run the command inside of.
+- **"busybox"** is the image we are running the command in.
 - **"/bin/echo"** is the command we want to run in the container
 - **"hello world"** is the input for the echo command
 
@@ -82,7 +80,7 @@ See the example in action
 .. _hello_world_daemon:
 
 Hello World Daemon
-==================
+------------------
 
 .. include:: example_header.inc
 
@@ -172,14 +170,14 @@ See the example in action
            id=&quot;asciicast-2562&quot; async></script></body>">
    </iframe>
 
-The next example in the series is a :ref:`python_web_app` example, or
+The next example in the series is a :ref:`nodejs_web_app` example, or
 you could skip to any of the other examples:
 
 
-* :ref:`python_web_app`
 * :ref:`nodejs_web_app`
 * :ref:`running_redis_service`
 * :ref:`running_ssh_service`
 * :ref:`running_couchdb_service`
 * :ref:`postgresql_service`
 * :ref:`mongodb_image`
+* :ref:`python_web_app`

From 32cc7c320166636568232a77c71e162166cace98 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Fri, 14 Feb 2014 22:41:59 +1000
Subject: [PATCH 132/403] update a new movie: http://asciinema.org/a/7658

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: b05602a0fe6d9b9731cee0008fbac27250f361bd
Component: engine
---
 .../docs/sources/examples/hello_world.rst     |  8 +-
 .../docs/sources/examples/python_web_app.rst  | 80 ++++++++++++-------
 2 files changed, 56 insertions(+), 32 deletions(-)

diff --git a/components/engine/docs/sources/examples/hello_world.rst b/components/engine/docs/sources/examples/hello_world.rst
index c8ecb0f6c2..63362e7d7b 100644
--- a/components/engine/docs/sources/examples/hello_world.rst
+++ b/components/engine/docs/sources/examples/hello_world.rst
@@ -2,8 +2,6 @@
 :description: A simple hello world example with Docker
 :keywords: docker, example, hello world
 
-.. _examples:
-
 .. _running_examples:
 
 Check your Docker install
@@ -37,7 +35,7 @@ Download the small base image named ``busybox``:
 
 .. code-block:: bash
 
-    # Download an busybox image
+    # Download a busybox image
     $ sudo docker pull busybox
 
 The ``busybox`` image is a minimal Linux system. You can do the same
@@ -71,8 +69,8 @@ See the example in action
    <iframe width="560" height="400" frameborder="0"
            sandbox="allow-same-origin allow-scripts" 
    srcdoc="<body><script type=&quot;text/javascript&quot; 
-           src=&quot;https://asciinema.org/a/2603.js&quot; 
-           id=&quot;asciicast-2603&quot; async></script></body>">
+           src=&quot;https://asciinema.org/a/7658.js&quot; 
+           id=&quot;asciicast-7658&quot; async></script></body>">
    </iframe>
 
 ----
diff --git a/components/engine/docs/sources/examples/python_web_app.rst b/components/engine/docs/sources/examples/python_web_app.rst
index b44c0e1ee5..6992d0f7f8 100644
--- a/components/engine/docs/sources/examples/python_web_app.rst
+++ b/components/engine/docs/sources/examples/python_web_app.rst
@@ -9,7 +9,7 @@ Python Web App
 
 .. include:: example_header.inc
 
-While using Dockerfiles is the prefered way to create maintainable
+While using Dockerfiles is the preffered way to create maintainable
 and repeatable images, its useful to know how you can try things out
 and then commit your live changes to an image.
 
@@ -18,29 +18,29 @@ Docker images  by making changes to a running
 container, and then saving the results as a new image. We will do 
 that by making a simple 'hello world' Flask web application image.
 
-**Steps:**
+Download the initial image
+--------------------------
+
+Download the ``shykes/pybuilder`` Docker image from the ``http://index.docker.io``
+registry. 
+
+This image contains a ``buildapp`` script to download the web app and then ``pip install`` 
+any required modules, and a ``runapp`` script that finds the ``app.py`` and runs it.
+
+.. _`shykes/pybuilder`: https://github.com/shykes/pybuilder
 
 .. code-block:: bash
 
     $ sudo docker pull shykes/pybuilder
 
-Download the ``shykes/pybuilder`` Docker image from the ``http://index.docker.io``
-registry. Note that this container was built with a very old version of docker 
-(May 2013), but can still be used now.
+.. note:: This container was built with a very old version of docker 
+    (May 2013 - see `shykes/pybuilder`_ ), when the ``Dockerfile`` format was different, 
+    but the image can still be used now.
 
+Interactively make some modifications
+-------------------------------------
 
-.. code-block:: bash
-
-    $ sudo docker run -i -t -name pybuilder_run shykes/pybuilder bash
-
-    $$ URL=http://github.com/shykes/helloflask/archive/master.tar.gz
-    $$ /usr/local/bin/buildapp $URL
-    [lots of output later]
-    $$ exit
-
-
-We then start a new container running interactively  using the
-image. 
+We then start a new container running interactively  using the image. 
 First, we set a ``URL`` variable that points to a tarball of a simple 
 helloflask web app, and then we run a command contained in the image called
 ``buildapp``, passing it the ``$URL`` variable. The container is
@@ -51,8 +51,15 @@ try things out, and then exit when you're done.
 
 .. code-block:: bash
 
-    $ sudo docker commit pybuilder_run /builds/github.com/shykes/helloflask/master
-    c8b2e8228f11b8b3e492cbf9a49923ae66496230056d61e07880dc74c5f495f9
+    $ sudo docker run -i -t -name pybuilder_run shykes/pybuilder bash
+
+    $$ URL=http://github.com/shykes/helloflask/archive/master.tar.gz
+    $$ /usr/local/bin/buildapp $URL
+    [...]
+    $$ exit
+
+Commit the container to create a new image
+------------------------------------------
 
 Save the changes we just made in the container to a new image called
 ``/builds/github.com/hykes/helloflask/master``. You now have 3 different
@@ -61,12 +68,22 @@ long-id ``c8b2e8228f11b8b3e492cbf9a49923ae66496230056d61e07880dc74c5f495f9``.
 
 .. code-block:: bash
 
-    $ WEB_WORKER=$(sudo docker run -d -p 5000 /builds/github.com/hykes/helloflask/master /usr/local/bin/runapp)
+    $ sudo docker commit pybuilder_run /builds/github.com/shykes/helloflask/master
+    c8b2e8228f11b8b3e492cbf9a49923ae66496230056d61e07880dc74c5f495f9
+
+
+Run the new image to start the web worker
+-----------------------------------------
 
 Use the new image to create a new container with
 network port 5000, and return the container ID and store in the
 ``WEB_WORKER`` variable (rather than naming a container/image, you can use the ID's).
 
+.. code-block:: bash
+
+    $ WEB_WORKER=$(sudo docker run -d -p 5000 /builds/github.com/hykes/helloflask/master /usr/local/bin/runapp)
+
+
 - **"docker run -d "** run a command in a new container. We pass "-d"
   so it runs as a daemon.
 - **"-p 5000"** the web app is going to listen on this port, so it
@@ -74,10 +91,8 @@ network port 5000, and return the container ID and store in the
 - **/usr/local/bin/runapp** is the command which starts the web app.
 
 
-.. code-block:: bash
-
-    $ sudo docker logs -f $WEB_WORKER
-     * Running on http://0.0.0.0:5000/
+View the container logs
+-----------------------
 
 View the logs for the new container using the ``WEB_WORKER`` variable, and
 if everything worked as planned you should see the line ``Running on
@@ -88,19 +103,30 @@ terminal and continue with the example while watching the result in the logs.
 
 .. code-block:: bash
 
-    $ WEB_PORT=$(sudo docker port $WEB_WORKER 5000 | awk -F: '{ print $2 }')
+    $ sudo docker logs -f $WEB_WORKER
+     * Running on http://0.0.0.0:5000/
+
+
+See the webapp output
+---------------------
 
 Look up the public-facing port which is NAT-ed. Find the private port
 used by the container and store it inside of the ``WEB_PORT`` variable.
 
+Access the web app using the ``curl`` binary. If everything worked as planned you
+should see the line ``Hello world!`` inside of your console.
+
 .. code-block:: bash
 
+    $ WEB_PORT=$(sudo docker port $WEB_WORKER 5000 | awk -F: '{ print $2 }')
+
     # install curl if necessary, then ...
     $ curl http://127.0.0.1:$WEB_PORT
     Hello world!
 
-Access the web app using the ``curl`` binary. If everything worked as planned you
-should see the line ``Hello world!`` inside of your console.
+
+Clean up example containers and images
+--------------------------------------
 
 .. code-block:: bash
 

From ca7b056023a7c43b57c178cb27cae4dafca389c1 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Tue, 18 Feb 2014 13:23:18 +1000
Subject: [PATCH 133/403] suggested improvements

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 29f7e1bfcbe6654d962a55eb5006e248284b9e0c
Component: engine
---
 .../docs/sources/examples/python_web_app.rst  | 21 +++++++++----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/components/engine/docs/sources/examples/python_web_app.rst b/components/engine/docs/sources/examples/python_web_app.rst
index 6992d0f7f8..5b8e3f6b4b 100644
--- a/components/engine/docs/sources/examples/python_web_app.rst
+++ b/components/engine/docs/sources/examples/python_web_app.rst
@@ -9,7 +9,7 @@ Python Web App
 
 .. include:: example_header.inc
 
-While using Dockerfiles is the preffered way to create maintainable
+While using Dockerfiles is the preferred way to create maintainable
 and repeatable images, its useful to know how you can try things out
 and then commit your live changes to an image.
 
@@ -62,8 +62,8 @@ Commit the container to create a new image
 ------------------------------------------
 
 Save the changes we just made in the container to a new image called
-``/builds/github.com/hykes/helloflask/master``. You now have 3 different
-ways to refer to the container, name, short-id ``c8b2e8228f11``, or 
+``/builds/github.com/shykes/helloflask/master``. You now have 3 different
+ways to refer to the container: name ``pybuilder_run``, short-id ``c8b2e8228f11``, or 
 long-id ``c8b2e8228f11b8b3e492cbf9a49923ae66496230056d61e07880dc74c5f495f9``.
 
 .. code-block:: bash
@@ -76,12 +76,11 @@ Run the new image to start the web worker
 -----------------------------------------
 
 Use the new image to create a new container with
-network port 5000, and return the container ID and store in the
-``WEB_WORKER`` variable (rather than naming a container/image, you can use the ID's).
+network port 5000 mapped to a local port
 
 .. code-block:: bash
 
-    $ WEB_WORKER=$(sudo docker run -d -p 5000 /builds/github.com/hykes/helloflask/master /usr/local/bin/runapp)
+    $ sudo docker run -d -p 5000 --name web_worker /builds/github.com/shykes/helloflask/master /usr/local/bin/runapp
 
 
 - **"docker run -d "** run a command in a new container. We pass "-d"
@@ -94,7 +93,7 @@ network port 5000, and return the container ID and store in the
 View the container logs
 -----------------------
 
-View the logs for the new container using the ``WEB_WORKER`` variable, and
+View the logs for the new ``web_worker`` container and
 if everything worked as planned you should see the line ``Running on
 http://0.0.0.0:5000/`` in the log output.
 
@@ -103,7 +102,7 @@ terminal and continue with the example while watching the result in the logs.
 
 .. code-block:: bash
 
-    $ sudo docker logs -f $WEB_WORKER
+    $ sudo docker logs -f web_worker
      * Running on http://0.0.0.0:5000/
 
 
@@ -118,7 +117,7 @@ should see the line ``Hello world!`` inside of your console.
 
 .. code-block:: bash
 
-    $ WEB_PORT=$(sudo docker port $WEB_WORKER 5000 | awk -F: '{ print $2 }')
+    $ WEB_PORT=$(sudo docker port web_worker 5000 | awk -F: '{ print $2 }')
 
     # install curl if necessary, then ...
     $ curl http://127.0.0.1:$WEB_PORT
@@ -137,8 +136,8 @@ running, it will still be listed here with a status of 'Exit 0'.
 
 .. code-block:: bash
 
-    $ sudo docker stop $WEB_WORKER
-    $ sudo docker rm $WEB_WORKER pybuilder_run
+    $ sudo docker stop web_worker
+    $ sudo docker rm web_worker pybuilder_run
     $ sudo docker rmi /builds/github.com/shykes/helloflask/master shykes/pybuilder:latest
 
 And now stop the running web worker, and delete the containers, so that we can 

From 92abc1e6512fe6038ef3205a884a443b7a752d55 Mon Sep 17 00:00:00 2001
From: Yasunori Mahata <nori@mahata.net>
Date: Mon, 17 Feb 2014 19:43:56 -0800
Subject: [PATCH 134/403] Fix typo in 'Using Supervisor with Docker' example

Docker-DCO-1.1-Signed-off-by: Yasunori Mahata <mahata777@gmail.com> (github: mahata)
Upstream-commit: 68de32888b6bad84cd37ccd165b0e7bb013574af
Component: engine
---
 components/engine/docs/sources/examples/using_supervisord.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/examples/using_supervisord.rst b/components/engine/docs/sources/examples/using_supervisord.rst
index eed063292d..750b6c2334 100644
--- a/components/engine/docs/sources/examples/using_supervisord.rst
+++ b/components/engine/docs/sources/examples/using_supervisord.rst
@@ -112,7 +112,7 @@ Once we've got a built image we can launch a container from it.
 
 .. code-block:: bash
 
-    sudo docker run -p 22 -p 80 -t -i <yourname>/supervisor
+    sudo docker run -p 22 -p 80 -t -i <yourname>/supervisord
     2013-11-25 18:53:22,312 CRIT Supervisor running as root (no user in config file)
     2013-11-25 18:53:22,312 WARN Included extra file "/etc/supervisor/conf.d/supervisord.conf" during parsing
     2013-11-25 18:53:22,342 INFO supervisord started with pid 1

From f829291e78f9d587d834be1c91607ab8ef25dac5 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 18 Feb 2014 09:53:30 +0100
Subject: [PATCH 135/403] archive: Fix the storing of setuid bits, etc

In commit 3dfc910d7774d57c533b067fbe59d6b24dd803cd we changed from
syscall.Chmod() to os.Chmod(), but these take a different form of the
Mode argument. The sycall one takes the raw linux form, wheras
os.Chmod takes the os.FileMode form, and they differ for the higher
bits (setuid, setgid, etc). The raw tar header uses a form which
is compatible with the syscalls, but not the go calls.

We fix this by using hdr.FileInfo() which properly converts the mode
to what go expects.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 5ba24629610c27f08b54ff4c1f000ad6d787c156
Component: engine
---
 components/engine/archive/archive.go | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index c0551d9fa3..16c01993b7 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -187,19 +187,24 @@ func addTarFile(path, name string, tw *tar.Writer) error {
 }
 
 func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader) error {
+	// hdr.Mode is in linux format, which we can use for sycalls,
+	// but for os.Foo() calls we need the mode converted to os.FileMode,
+	// so use hdrInfo.Mode() (they differ for e.g. setuid bits)
+	hdrInfo := hdr.FileInfo()
+
 	switch hdr.Typeflag {
 	case tar.TypeDir:
 		// Create directory unless it exists as a directory already.
 		// In that case we just want to merge the two
 		if fi, err := os.Lstat(path); !(err == nil && fi.IsDir()) {
-			if err := os.Mkdir(path, os.FileMode(hdr.Mode)); err != nil {
+			if err := os.Mkdir(path, hdrInfo.Mode()); err != nil {
 				return err
 			}
 		}
 
 	case tar.TypeReg, tar.TypeRegA:
 		// Source is regular file
-		file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, os.FileMode(hdr.Mode))
+		file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, hdrInfo.Mode())
 		if err != nil {
 			return err
 		}
@@ -249,7 +254,7 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader) e
 	// There is no LChmod, so ignore mode for symlink. Also, this
 	// must happen after chown, as that can modify the file mode
 	if hdr.Typeflag != tar.TypeSymlink {
-		if err := os.Chmod(path, os.FileMode(hdr.Mode&07777)); err != nil {
+		if err := os.Chmod(path, hdrInfo.Mode()); err != nil {
 			return err
 		}
 	}

From 3700ea5ec4b8a9e34816af9a64cb786d96eb736c Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Wed, 18 Dec 2013 21:12:49 +1000
Subject: [PATCH 136/403] my attempt to disentagle repository and registry
 (Issue #1439)

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: 940c381dd5898df4dd863a2d76a122b6610f2940
Component: engine
---
 components/engine/api/client.go               |  4 +--
 .../sources/reference/commandline/cli.rst     |  2 +-
 .../engine/docs/sources/terms/index.rst       |  2 ++
 .../engine/docs/sources/terms/registry.rst    | 16 +++++++++
 .../engine/docs/sources/terms/repository.rst  | 27 ++++++++++++++
 .../sources/use/workingwithrepository.rst     | 35 +++++++++++--------
 6 files changed, 69 insertions(+), 17 deletions(-)
 create mode 100644 components/engine/docs/sources/terms/registry.rst
 create mode 100644 components/engine/docs/sources/terms/repository.rst

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index 81e337b023..eb345ae40b 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -1668,7 +1668,7 @@ func (cli *DockerCli) CmdSearch(args ...string) error {
 type ports []int
 
 func (cli *DockerCli) CmdTag(args ...string) error {
-	cmd := cli.Subcmd("tag", "[OPTIONS] IMAGE REPOSITORY[:TAG]", "Tag an image into a repository")
+	cmd := cli.Subcmd("tag", "[OPTIONS] IMAGE [REGISTRYHOST/][USERNAME/]NAME[:TAG]", "Tag an image into a repository")
 	force := cmd.Bool([]string{"f", "#force", "-force"}, false, "Force")
 	if err := cmd.Parse(args); err != nil {
 		return nil
@@ -1681,7 +1681,7 @@ func (cli *DockerCli) CmdTag(args ...string) error {
 	var repository, tag string
 
 	if cmd.NArg() == 3 {
-		fmt.Fprintf(cli.err, "[DEPRECATED] The format 'IMAGE [REPOSITORY [TAG]]' as been deprecated. Please use IMAGE [REPOSITORY[:TAG]]\n")
+		fmt.Fprintf(cli.err, "[DEPRECATED] The format 'IMAGE [REPOSITORY [TAG]]' as been deprecated. Please use IMAGE [REGISTRYHOST/][USERNAME/]NAME[:TAG]]\n")
 		repository, tag = cmd.Arg(1), cmd.Arg(2)
 	} else {
 		repository, tag = utils.ParseRepositoryTag(cmd.Arg(1))
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 7ba0123065..927f6d3b2d 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -1301,7 +1301,7 @@ The main process inside the container will receive SIGTERM, and after a grace pe
 
 ::
 
-    Usage: docker tag [OPTIONS] IMAGE REPOSITORY[:TAG]
+    Usage: docker tag [OPTIONS] IMAGE [REGISTRYHOST/][USERNAME/]NAME[:TAG]
 
     Tag an image into a repository
 
diff --git a/components/engine/docs/sources/terms/index.rst b/components/engine/docs/sources/terms/index.rst
index 882d83f0d4..40851082b5 100644
--- a/components/engine/docs/sources/terms/index.rst
+++ b/components/engine/docs/sources/terms/index.rst
@@ -18,5 +18,7 @@ Contents:
    layer
    image
    container
+   registry
+   repository
 
 
diff --git a/components/engine/docs/sources/terms/registry.rst b/components/engine/docs/sources/terms/registry.rst
new file mode 100644
index 0000000000..90c3ee721c
--- /dev/null
+++ b/components/engine/docs/sources/terms/registry.rst
@@ -0,0 +1,16 @@
+:title: Registry
+:description: Definition of an Registry
+:keywords: containers, lxc, concepts, explanation, image, repository, container
+
+.. _registry_def:
+
+Registry
+==========
+
+A Registry is a hosted service containing :ref:`repositories<repository_def>` 
+of :ref:`images<image_def>` which responds to the Registry API.
+
+The default registry can be accessed using a browser at http://images.docker.io
+or using the ``sudo docker search`` command.
+
+For more information see :ref:`Working with Repositories<working_with_the_repository>`
diff --git a/components/engine/docs/sources/terms/repository.rst b/components/engine/docs/sources/terms/repository.rst
new file mode 100644
index 0000000000..cceaeec23a
--- /dev/null
+++ b/components/engine/docs/sources/terms/repository.rst
@@ -0,0 +1,27 @@
+:title: Repository
+:description: Definition of an Repository
+:keywords: containers, lxc, concepts, explanation, image, repository, container
+
+.. _repository_def:
+
+Repository
+==========
+
+A repository is a tagged set of images either on your local docker server, or
+shared, by pushing it to a :ref:`Registry<registry_def>` server.
+
+Images can be labeld into a repository using ``sudo docker build -t LABEL``, 
+``sudo docker commit CONTAINERID LABEL`` or ``sudo docker tag IMAGEID LABEL``.
+
+The label can be made up of 3 parts:
+
+[registry_hostname[:port]/][user_name/]( repository_name[:version_tag] | image_id )
+[REGISTRYHOST/][USERNAME/]NAME[:TAG]
+
+TAG defaults to ``latest``, USERNAME and REGISTRYHOST default to an empty string.
+When REGISTRYHOST is an empty string, then ``docker push`` will push to ``index.docker.io:80``.
+
+If you create a new repository which you want to share, you will need to set the 
+first part, as the 'default' blank REPOSITORY prefix is reserved for official Docker images.
+
+For more information see :ref:`Working with Repositories<working_with_the_repository>`
diff --git a/components/engine/docs/sources/use/workingwithrepository.rst b/components/engine/docs/sources/use/workingwithrepository.rst
index 38062556cb..36f9c590c0 100644
--- a/components/engine/docs/sources/use/workingwithrepository.rst
+++ b/components/engine/docs/sources/use/workingwithrepository.rst
@@ -7,9 +7,9 @@
 Share Images via Repositories
 =============================
 
-A *repository* is a hosted collection of tagged :ref:`images
-<image_def>` that together create the file system for a container. The
-repository's name is a tag that indicates the provenance of the
+A *repository* is a shareable collection of tagged :ref:`images<image_def>` 
+that together create the file systems for containers. The
+repository's name is a label that indicates the provenance of the
 repository, i.e. who created it and where the original copy is
 located.
 
@@ -19,7 +19,7 @@ tag. The implicit registry is located at ``index.docker.io``, the home
 of "top-level" repositories and the Central Index. This registry may
 also include public "user" repositories.
 
-So Docker is not only a tool for creating and managing your own
+Docker is not only a tool for creating and managing your own
 :ref:`containers <container_def>` -- **Docker is also a tool for
 sharing**. The Docker project provides a Central Registry to host
 public repositories, namespaced by user, and a Central Index which
@@ -28,6 +28,12 @@ repositories. You can host your own Registry too! Docker acts as a
 client for these services via ``docker search, pull, login`` and
 ``push``.
 
+Local Repositories
+------------------
+
+Docker images which have been created and labled on your local docker server
+need to be pushed to a Public or Private registry to be shared.
+
 .. _using_public_repositories:
 
 Public Repositories
@@ -136,13 +142,13 @@ name for the image.
 
 .. _image_push:
 
-Pushing an image to its repository
-----------------------------------
+Pushing a repository to its registry
+------------------------------------
 
-In order to push an image to its repository you need to have committed
-your container to a named image (see above)
+In order to push an repository to its registry you need to have named an image, 
+or committed your container to a named image (see above)
 
-Now you can commit this image to the repository designated by its name
+Now you can push this repository to the registry designated by its name
 or tag.
 
 .. code-block:: bash
@@ -187,14 +193,15 @@ manage it by committing code to your GitHub repository.
 You can create multiple Trusted Builds per repository and configure them to
 point to specific ``Dockerfile``'s or Git branches.
 
-Private Repositories
---------------------
+Private Registry
+----------------
 
-Right now (version 0.6), private repositories are only possible by
-hosting `your own registry
+Private registries and private shared repositories are 
+only possible by hosting `your own registry
 <https://github.com/dotcloud/docker-registry>`_.  To push or pull to a
 repository on your own registry, you must prefix the tag with the
-address of the registry's host, like this:
+address of the registry's host (a ``.`` or ``:`` is used to identify a host), 
+like this:
 
 .. code-block:: bash
 

From 90a166ff8b1f5b7f6834430f0f30282789fb2eaf Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Wed, 18 Dec 2013 21:36:02 +1000
Subject: [PATCH 137/403] try out @metalivedev's suggestion, including FQIN

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: a049e93a4c164de25ce1fc1113f2929aa0aa0b5b
Component: engine
---
 .../engine/docs/sources/terms/repository.rst  | 23 +++++++++++--------
 .../sources/use/workingwithrepository.rst     | 10 ++++----
 2 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/components/engine/docs/sources/terms/repository.rst b/components/engine/docs/sources/terms/repository.rst
index cceaeec23a..e4fe4b8fd1 100644
--- a/components/engine/docs/sources/terms/repository.rst
+++ b/components/engine/docs/sources/terms/repository.rst
@@ -7,21 +7,24 @@
 Repository
 ==========
 
-A repository is a tagged set of images either on your local docker server, or
+A repository is a set of images either on your local Docker server, or
 shared, by pushing it to a :ref:`Registry<registry_def>` server.
 
-Images can be labeld into a repository using ``sudo docker build -t LABEL``, 
-``sudo docker commit CONTAINERID LABEL`` or ``sudo docker tag IMAGEID LABEL``.
+Images can be associated with a repository (or multiple) by giving them an image name 
+using one of three different commands:
 
-The label can be made up of 3 parts:
+1. At build time (e.g. ``sudo docker build -t IMAGENAME``),
+2. When committing a container (e.g. ``sudo docker commit CONTAINERID IMAGENAME``) or
+3. When tagging an image id with an image name (e.g. ``sudo docker tag IMAGEID IMAGENAME``).
 
-[registry_hostname[:port]/][user_name/]( repository_name[:version_tag] | image_id )
-[REGISTRYHOST/][USERNAME/]NAME[:TAG]
+A `Fully Qualified Image Name` (FQIN) can be made up of 3 parts:
 
-TAG defaults to ``latest``, USERNAME and REGISTRYHOST default to an empty string.
-When REGISTRYHOST is an empty string, then ``docker push`` will push to ``index.docker.io:80``.
+``[registry_hostname[:port]/][user_name/](repository_name[:version_tag])``
 
-If you create a new repository which you want to share, you will need to set the 
-first part, as the 'default' blank REPOSITORY prefix is reserved for official Docker images.
+``version_tag`` defaults to ``latest``, ``username`` and ``registry_hostname`` default to an empty string.
+When ``registry_hostname`` is an empty string, then ``docker push`` will push to ``index.docker.io:80``.
+
+If you create a new repository which you want to share, you will need to set at least the 
+``user_name``, as the 'default' blank ``user_name`` prefix is reserved for official Docker images.
 
 For more information see :ref:`Working with Repositories<working_with_the_repository>`
diff --git a/components/engine/docs/sources/use/workingwithrepository.rst b/components/engine/docs/sources/use/workingwithrepository.rst
index 36f9c590c0..cbde932cde 100644
--- a/components/engine/docs/sources/use/workingwithrepository.rst
+++ b/components/engine/docs/sources/use/workingwithrepository.rst
@@ -31,7 +31,7 @@ client for these services via ``docker search, pull, login`` and
 Local Repositories
 ------------------
 
-Docker images which have been created and labled on your local docker server
+Docker images which have been created and labeled on your local Docker server
 need to be pushed to a Public or Private registry to be shared.
 
 .. _using_public_repositories:
@@ -64,8 +64,8 @@ Find Public Images on the Central Index
 ---------------------------------------
 
 You can search the Central Index `online <https://index.docker.io>`_
-or by the CLI. Searching can find images by name, user name or
-description:
+or using the command line interface. Searching can find images by name, user
+name or description:
 
 .. code-block:: bash
 
@@ -162,7 +162,7 @@ Trusted Builds
 --------------
 
 Trusted Builds automate the building and updating of images from GitHub, directly 
-on docker.io servers. It works by adding a commit hook to your selected repository,
+on ``docker.io`` servers. It works by adding a commit hook to your selected repository,
 triggering a build and update when you push a commit.
 
 To setup a trusted build
@@ -186,7 +186,7 @@ If you want to see the status of your Trusted Builds you can go to your
 `Trusted Builds page <https://index.docker.io/builds/>`_ on the Docker index,
 and it will show you the status of your builds, and the build history.
 
-Once you've created a Trusted Build you can deactive or delete it. You cannot
+Once you've created a Trusted Build you can deactivate or delete it. You cannot
 however push to a Trusted Build with the ``docker push`` command. You can only
 manage it by committing code to your GitHub repository.
 

From e8870b2f18badaf5ed78296ca78513df7cc58528 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20K=C3=BChnle?= <kuehnle@online.de>
Date: Fri, 14 Feb 2014 14:23:10 +0100
Subject: [PATCH 138/403] Env Clarification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clarified that the env variables here are an example output of env. The user should not set them to the example values.

Docker-DCO-1.1-Signed-off-by: Matthias Kühnle <git.nivoc@neverbox.com> (github: float64)
Upstream-commit: a7f1b74dd812fbc86beefea6fcd3ba4c4abaa7e2
Component: engine
---
 .../engine/docs/sources/examples/running_redis_service.rst | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/components/engine/docs/sources/examples/running_redis_service.rst b/components/engine/docs/sources/examples/running_redis_service.rst
index 9687f0cfa8..a07250c35a 100644
--- a/components/engine/docs/sources/examples/running_redis_service.rst
+++ b/components/engine/docs/sources/examples/running_redis_service.rst
@@ -68,13 +68,14 @@ Once inside our freshly created container we need to install Redis to get the
     service redis-server stop
 
 Now we can test the connection. Firstly, let's look at the available environmental 
-variables in our web application container. We can use these to get the IP and port 
+variables in our web application container that docker has setup for us. We can use these to get the IP and port 
 of our ``redis`` container.
 
 .. code-block:: bash
 
-    env
-    . . .
+    env | grep DB_
+    
+    # Should return something similar to this with your values 
     DB_NAME=/violet_wolf/db
     DB_PORT_6379_TCP_PORT=6379
     DB_PORT=tcp://172.17.0.33:6379

From efed40e022e5d427b01d2142dddd67f75f74507d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20K=C3=BChnle?= <kuehnle@online.de>
Date: Fri, 14 Feb 2014 14:29:09 +0100
Subject: [PATCH 139/403] Fixed misspelling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Docker-DCO-1.1-Signed-off-by: Matthias Kühnle <git.nivoc@neverbox.com> (github: float64)
Upstream-commit: 8a3cb0c65e7940e928e31d6e64cce5d81d9975a6
Component: engine
---
 .../engine/docs/sources/examples/running_redis_service.rst      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/examples/running_redis_service.rst b/components/engine/docs/sources/examples/running_redis_service.rst
index a07250c35a..c679547b7d 100644
--- a/components/engine/docs/sources/examples/running_redis_service.rst
+++ b/components/engine/docs/sources/examples/running_redis_service.rst
@@ -68,7 +68,7 @@ Once inside our freshly created container we need to install Redis to get the
     service redis-server stop
 
 Now we can test the connection. Firstly, let's look at the available environmental 
-variables in our web application container that docker has setup for us. We can use these to get the IP and port 
+variables in our web application container that Docker has setup for us. We can use these to get the IP and port 
 of our ``redis`` container.
 
 .. code-block:: bash

From e867f9248c7211bbc16e0c3235b7cd6a6db5a073 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20K=C3=BChnle?= <git.nivoc@neverbox.com>
Date: Tue, 18 Feb 2014 12:36:14 +0100
Subject: [PATCH 140/403] Reworded description of the environment variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removed the "test now..." b/c the code example is only about inspection
of env-variables.
Test follows in the next section.

Docker-DCO-1.1-Signed-off-by: Matthias Kühnle <git.nivoc@neverbox.com> (github: float64)
Upstream-commit: d73d3b03e4216bf6cf44b393108dd520acac9670
Component: engine
---
 .../engine/docs/sources/examples/running_redis_service.rst   | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/components/engine/docs/sources/examples/running_redis_service.rst b/components/engine/docs/sources/examples/running_redis_service.rst
index c679547b7d..3b2f65c128 100644
--- a/components/engine/docs/sources/examples/running_redis_service.rst
+++ b/components/engine/docs/sources/examples/running_redis_service.rst
@@ -67,9 +67,8 @@ Once inside our freshly created container we need to install Redis to get the
     apt-get -y install redis-server
     service redis-server stop
 
-Now we can test the connection. Firstly, let's look at the available environmental 
-variables in our web application container that Docker has setup for us. We can use these to get the IP and port 
-of our ``redis`` container.
+Docker sets some environment variables in our web application container. 
+Let's inspect them with the ``env`` command.
 
 .. code-block:: bash
 

From 983d3e7de300208ebb76b16dbe85cc9bdf6cd934 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20K=C3=BChnle?= <kuehnle@online.de>
Date: Tue, 18 Feb 2014 12:47:44 +0100
Subject: [PATCH 141/403] Updated environment description
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

.. to make it even more clear that this env variables are there because of the --link option.

Docker-DCO-1.1-Signed-off-by: Matthias Kühnle <git.nivoc@neverbox.com> (github: float64)
Upstream-commit: c1dfc63845cdf08d7609e1890f45d01f10326bda
Component: engine
---
 .../engine/docs/sources/examples/running_redis_service.rst     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/examples/running_redis_service.rst b/components/engine/docs/sources/examples/running_redis_service.rst
index 3b2f65c128..7cbc58b58a 100644
--- a/components/engine/docs/sources/examples/running_redis_service.rst
+++ b/components/engine/docs/sources/examples/running_redis_service.rst
@@ -67,7 +67,8 @@ Once inside our freshly created container we need to install Redis to get the
     apt-get -y install redis-server
     service redis-server stop
 
-Docker sets some environment variables in our web application container. 
+Since we used the ``--link redis:db`` option before. Docker has created some 
+environment variables in our web application container. 
 Let's inspect them with the ``env`` command.
 
 .. code-block:: bash

From d71035c5b7420916748c56c0d7a50bcbfb08fecf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20K=C3=BChnle?= <kuehnle@online.de>
Date: Tue, 18 Feb 2014 16:00:21 +0100
Subject: [PATCH 142/403] Reword - one sentence :-)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Docker-DCO-1.1-Signed-off-by: Matthias Kühnle <git.nivoc@neverbox.com> (github: float64)
Upstream-commit: 311cb5ca45c15c32408d54194470536e73ae016d
Component: engine
---
 .../engine/docs/sources/examples/running_redis_service.rst   | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/components/engine/docs/sources/examples/running_redis_service.rst b/components/engine/docs/sources/examples/running_redis_service.rst
index 7cbc58b58a..c9424867a4 100644
--- a/components/engine/docs/sources/examples/running_redis_service.rst
+++ b/components/engine/docs/sources/examples/running_redis_service.rst
@@ -67,9 +67,8 @@ Once inside our freshly created container we need to install Redis to get the
     apt-get -y install redis-server
     service redis-server stop
 
-Since we used the ``--link redis:db`` option before. Docker has created some 
-environment variables in our web application container. 
-Let's inspect them with the ``env`` command.
+As we've used the ``--link redis:db`` option, Docker has created some environment 
+variables in our web application container.
 
 .. code-block:: bash
 

From b0d22755b4ad2d71e611f40537cd0f0b55aef1cf Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 18 Feb 2014 11:23:37 -0700
Subject: [PATCH 143/403] Fix dyntest problems finding dockerinit

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 6ccb30a0e5d1146dddaec340643d3950e6f992ef
Component: engine
---
 components/engine/hack/make/dyntest             | 2 +-
 components/engine/hack/make/dyntest-integration | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/engine/hack/make/dyntest b/components/engine/hack/make/dyntest
index eb5c2b73ed..555517fd05 100644
--- a/components/engine/hack/make/dyntest
+++ b/components/engine/hack/make/dyntest
@@ -12,6 +12,6 @@ fi
 
 (
 	export TEST_DOCKERINIT_PATH="$INIT"
-	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/utils.INITSHA1 \"$DOCKER_INITSHA1\""
+	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\""
 	source "$(dirname "$BASH_SOURCE")/test"
 )
diff --git a/components/engine/hack/make/dyntest-integration b/components/engine/hack/make/dyntest-integration
index 0887c45be0..b3a2d7be63 100644
--- a/components/engine/hack/make/dyntest-integration
+++ b/components/engine/hack/make/dyntest-integration
@@ -12,6 +12,6 @@ fi
 
 (
 	export TEST_DOCKERINIT_PATH="$INIT"
-	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/utils.INITSHA1 \"$DOCKER_INITSHA1\""
+	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\""
 	source "$(dirname "$BASH_SOURCE")/test-integration"
 )

From 27672a2f55b8893768ca30c07894b1f3bf795438 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 18 Feb 2014 11:24:33 -0700
Subject: [PATCH 144/403] Add "Conflicts" to our lxc-docker package to make it
 more clear that we can't/shouldn't be installed alongside either "docker" or
 "docker.io"

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 6d1c0a91f89887bd0d73b161b1ffe8b9cc10365e
Component: engine
---
 components/engine/hack/make/ubuntu | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/engine/hack/make/ubuntu b/components/engine/hack/make/ubuntu
index 1d309d2b5c..23af0ff7e0 100644
--- a/components/engine/hack/make/ubuntu
+++ b/components/engine/hack/make/ubuntu
@@ -119,6 +119,8 @@ EOF
 		    --deb-recommends xz-utils \
 		    --description "$PACKAGE_DESCRIPTION" \
 		    --maintainer "$PACKAGE_MAINTAINER" \
+		    --conflicts docker \
+		    --conflicts docker.io \
 		    --conflicts lxc-docker-virtual-package \
 		    --provides lxc-docker \
 		    --provides lxc-docker-virtual-package \

From 24eab2e4178a18a68640278e5005bad272b335d3 Mon Sep 17 00:00:00 2001
From: Brian Goff <cpuguy83@gmail.com>
Date: Tue, 18 Feb 2014 15:08:09 -0500
Subject: [PATCH 145/403] Add extra info regarding docker run funcationality

Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
Upstream-commit: 349adf4d4df63cd35ecfd74aa21de01629964ea5
Component: engine
---
 components/engine/docs/sources/reference/commandline/cli.rst | 3 +++
 components/engine/docs/sources/use/basics.rst                | 1 +
 2 files changed, 4 insertions(+)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 927f6d3b2d..8ef0ab8b72 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -917,6 +917,8 @@ Running ``docker ps`` showing 2 linked containers.
 
 The last container is marked as a ``Ghost`` container. It is a container that was running when the docker daemon was restarted (upgraded, or ``-H`` settings changed). The container is still running, but as this docker daemon process is not able to manage it, you can't attach to it. To bring them out of ``Ghost`` Status, you need to use ``docker kill`` or ``docker restart``.
 
+``docker ps`` will show only running containers by default.  To see all containers: ``docker ps -a``
+
 .. _cli_pull:
 
 ``pull``
@@ -1085,6 +1087,7 @@ The ``docker run`` command first ``creates`` a writeable container layer over
 the specified image, and then ``starts`` it using the specified command. That
 is, ``docker run`` is equivalent to the API ``/containers/create`` then
 ``/containers/(id)/start``.
+Once the container is stopped it still exists and can be started back up.  See ``docker ps -a`` to view a list of all containers.
 
 The ``docker run`` command can be used in combination with ``docker commit`` to
 :ref:`change the command that a container runs <cli_commit_examples>`.
diff --git a/components/engine/docs/sources/use/basics.rst b/components/engine/docs/sources/use/basics.rst
index d62f778b9d..75907efa39 100644
--- a/components/engine/docs/sources/use/basics.rst
+++ b/components/engine/docs/sources/use/basics.rst
@@ -50,6 +50,7 @@ Running an interactive shell
   # allocate a tty, attach stdin and stdout
   # To detach the tty without exiting the shell,
   # use the escape sequence Ctrl-p + Ctrl-q
+  # note: This will continue to exist in a stopped state once exited (see "docker ps -a")
   sudo docker run -i -t ubuntu /bin/bash
 
 .. _bind_docker:

From f51c1fe9adfafb8f55151713a9f3690a49cecfa2 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 18 Feb 2014 11:56:52 -0800
Subject: [PATCH 146/403] Bump to version 0.8.1 Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: a1598d1e1c157388f3b07415729de28f4d205e49 Component: engine

---
 components/engine/CHANGELOG.md | 45 ++++++++++++++++++++++++++++++++++
 components/engine/VERSION      |  2 +-
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/components/engine/CHANGELOG.md b/components/engine/CHANGELOG.md
index e016472406..a6a93dc97d 100644
--- a/components/engine/CHANGELOG.md
+++ b/components/engine/CHANGELOG.md
@@ -1,5 +1,50 @@
 # Changelog
 
+## 0.8.1 (2014-02-18)
+
+#### Builder
+
+- Avoid extra mount/unmount during build. This removes an unneeded mount/unmount operation which was causing problems with devicemapper
+- Fix regression with ADD of tar files. This stops Docker from decompressing tarballs added via ADD from the local file system
+- Add error to `docker build --rm`. This adds a missing error check to ensure failures to remove containers are detected and reported
+
+#### Documentation
+
+* Update issue filing instructions
+* Warn against the use of symlinks for Docker's storage folder
+* Replace the Firefox example with an IceWeasel example
+* Rewrite the PostgresSQL example using a Dockerfile and add more details to it
+* Improve the OS X documentation
+
+#### Remote API
+
+- Fix broken images API for version less than 1.7
+- Use the right encoding for all API endpoints which return JSON
+- Move remote api client to api/
+- Queue calls to the API using generic socket wait 
+
+#### Runtime
+
+- Fix the use of custom settings for bridges and custom bridges
+- Refactor the devicemapper code to avoid many mount/unmount race conditions and failures
+- Remove two panics which could make Docker crash in some situations
+- Don't ping registry from the CLI client
+- Enable skip_block_zeroing for devicemapper. This stops devicemapper from always zeroing entire blocks
+- Fix --run in `docker commit`. This makes docker commit store `--run` in the image configuration
+- Remove directory when removing devicemapper device. This cleans up leftover mount directories
+- Drop NET_ADMIN capability for non-privileged containers. Unprivileged containers can't change their network configuration
+- Ensure `docker cp` stream is closed properly
+- Avoid extra mount/unmount during container registration. This removes an unneeded mount/unmount operation which was causing problems with devicemapper
+- Stop allowing tcp:// as a default tcp bin address which binds to 127.0.0.1:4243 and remove the default port
++ Mount-bind the PTY as container console. This allows tmux and screen to run in a container
+- Clean up archive closing. This fixes and improves archive handling
+- Fix engine tests on systems where temp directories are symlinked
+- Add test methods for save and load
+- Avoid temporarily unmounting the container when restarting it. This fixes a race for devicemapper during restart
+- Support submodules when building from a GitHub repository
+- Quote volume path to allow spaces
+- Fix remote tar ADD behavior. This fixes a regression which was causing Docker to extract tarballs
+
 ## 0.8.0 (2014-02-04)
 
 #### Notable features since 0.7.0
diff --git a/components/engine/VERSION b/components/engine/VERSION
index f8d71478f5..6f4eebdf6f 100644
--- a/components/engine/VERSION
+++ b/components/engine/VERSION
@@ -1 +1 @@
-0.8.0-dev
+0.8.1

From c8dd504e3a38f79c8f09417d70fddeb2987e62bf Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 18 Feb 2014 16:01:04 -0800
Subject: [PATCH 147/403] Change version to v0.8.1
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 97ed268a8281231cdab88b166e2fe3faf7ccb296 Component: engine

---
 components/engine/VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/VERSION b/components/engine/VERSION
index 6f4eebdf6f..d182dc9160 100644
--- a/components/engine/VERSION
+++ b/components/engine/VERSION
@@ -1 +1 @@
-0.8.1
+0.8.1-dev

From ee616cd9b4a66c14ae7207f7bdbea35a08493615 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Wed, 19 Feb 2014 11:35:58 +1000
Subject: [PATCH 148/403] we moved the repo

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: e2da84ee63b759173d4919481eeb0c3ddf58cfb5
Component: engine
---
 components/engine/docs/sources/installation/mac.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/components/engine/docs/sources/installation/mac.rst b/components/engine/docs/sources/installation/mac.rst
index efb999ee1f..75e788b597 100644
--- a/components/engine/docs/sources/installation/mac.rst
+++ b/components/engine/docs/sources/installation/mac.rst
@@ -39,7 +39,7 @@ boot2docker
 ``docker`` daemon. It also takes care of the installation for the OS image
 that is used for the job.
 
-.. _GitHub page: https://github.com/steeve/boot2docker
+.. _GitHub page: https://github.com/boot2docker/boot2docker
 
 Open up a new terminal window, if you have not already.
 
@@ -51,7 +51,7 @@ Run the following commands to get boot2docker:
     cd ~/bin
 
     # Get the file
-    curl https://raw.github.com/steeve/boot2docker/master/boot2docker > boot2docker
+    curl https://raw.github.com/boot2docker/boot2docker/master/boot2docker > boot2docker
 
     # Mark it executable
     chmod +x boot2docker
@@ -153,7 +153,7 @@ boot2docker:
 
 See the GitHub page for `boot2docker`_.
 
-.. _boot2docker: https://github.com/steeve/boot2docker
+.. _boot2docker: https://github.com/boot2docker/boot2docker
 
 If SSH complains about keys:
 ----------------------------

From 2894395a0944902537125eea7d3d9871fb72682c Mon Sep 17 00:00:00 2001
From: Brian Goff <cpuguy83@gmail.com>
Date: Tue, 18 Feb 2014 21:45:48 -0500
Subject: [PATCH 149/403] Add basics for controlling a container's lifecycle

Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
Upstream-commit: 6dc2f5513648c42b2e71e55c4a4ea6cd3073ce55
Component: engine
---
 components/engine/docs/sources/use/basics.rst | 32 +++++++++++++++++--
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/components/engine/docs/sources/use/basics.rst b/components/engine/docs/sources/use/basics.rst
index 75907efa39..24c22bba39 100644
--- a/components/engine/docs/sources/use/basics.rst
+++ b/components/engine/docs/sources/use/basics.rst
@@ -122,12 +122,38 @@ Starting a long-running worker process
   sudo docker kill $JOB
 
 
-Listing all running containers
-------------------------------
+Listing containers
+------------------
 
 .. code-block:: bash
 
-  sudo docker ps
+  sudo docker ps # Lists only running containers
+  sudo docker ps -a # Lists all containers
+
+
+Controlling containers
+----------------------
+.. code-block:: bash
+
+  # Start a new container
+  JOB=$(sudo docker run -d ubuntu /bin/sh -c "while true; do echo Hello world; sleep 1; done")
+
+  # Stop the container
+  docker stop $JOB
+
+  # Start the container
+  docker start $JOB
+
+  # Restart the container
+  docker restart $JOB
+
+  # SIGKILL a container
+  docker kill $JOB
+
+  # Remove a container
+  docker stop $JOB # Container must be stopped to remove it
+  docker rm $JOB
+
 
 Bind a service on a TCP port
 ------------------------------

From 83c5ea4b475e71aa053aa41a7b0d749d6f797e76 Mon Sep 17 00:00:00 2001
From: Andy Rothfusz <github@developersupport.net>
Date: Tue, 18 Feb 2014 19:21:12 -0800
Subject: [PATCH 150/403] Update the documentation docs with new branch
 information. Docker-DCO-1.1-Signed-off-by: Andy Rothfusz
 <github@developersupport.net> (github: metalivedev) Upstream-commit:
 05c692d64ec9cabe6c16385300405406ebe63f40 Component: engine

---
 components/engine/docs/README.md | 63 +++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 13 deletions(-)

diff --git a/components/engine/docs/README.md b/components/engine/docs/README.md
index 3fdbad2ead..71b3a09995 100644
--- a/components/engine/docs/README.md
+++ b/components/engine/docs/README.md
@@ -19,10 +19,24 @@ post-commit hooks. The "release" branch maps to the "latest"
 documentation and the "master" branch maps to the "master"
 documentation. 
 
-**Warning**: The "master" documentation may include features not yet
-part of any official docker release. "Master" docs should be used only
-for understanding bleeding-edge development and "latest" should be
-used for the latest official release.
+## Branches
+
+**There are two branches related to editing docs**: ``master`` and a
+``doc*`` branch (currently ``doc0.8.1``). You should normally edit
+docs on the ``master`` branch. That way your fixes will automatically
+get included in later releases, and docs maintainers can easily
+cherry-pick your changes to bring over to the current docs branch. In
+the rare case where your change is not forward-compatible, then you
+could base your change on the appropriate ``doc*`` branch.
+
+Now that we have a ``doc*`` branch, we can keep the ``latest`` docs
+up to date with any bugs found between ``docker`` code releases.
+
+**Warning**: When *reading* the docs, the ``master`` documentation may
+include features not yet part of any official docker
+release. ``Master`` docs should be used only for understanding
+bleeding-edge development and ``latest`` (which points to the ``doc*``
+branch``) should be used for the latest official release.
 
 If you need to manually trigger a build of an existing branch, then
 you can do that through the [readthedocs
@@ -39,7 +53,7 @@ Getting Started
 To edit and test the docs, you'll need to install the Sphinx tool and
 its dependencies. There are two main ways to install this tool:
 
-###Native Installation
+### Native Installation
 
 Install dependencies from `requirements.txt` file in your `docker/docs`
 directory:
@@ -48,7 +62,7 @@ directory:
 
 * Mac OS X: `[sudo] pip-2.7 install -r docs/requirements.txt`
 
-###Alternative Installation: Docker Container
+### Alternative Installation: Docker Container
 
 If you're running ``docker`` on your development machine then you may
 find it easier and cleaner to use the docs Dockerfile. This installs Sphinx
@@ -59,11 +73,16 @@ docs inside the container, even starting a simple HTTP server on port
 In the ``docker`` source directory, run:
     ```make docs```
 
-This is the equivalent to ``make clean server`` since each container starts clean.
+This is the equivalent to ``make clean server`` since each container
+starts clean.
 
-Usage
------
-* Follow the contribution guidelines (``../CONTRIBUTING.md``)
+# Contributing
+
+## Normal Case:
+
+* Follow the contribution guidelines ([see
+  ``../CONTRIBUTING.md``](../CONTRIBUTING)).
+* Remember to sign your work!
 * Work in your own fork of the code, we accept pull requests.
 * Change the ``.rst`` files with your favorite editor -- try to keep the
   lines short and respect RST and Sphinx conventions. 
@@ -75,6 +94,20 @@ Usage
 
 ``make clean docs`` must complete without any warnings or errors.
 
+## Special Case for RST Newbies:
+
+If you want to write a new doc or make substantial changes to an
+existing doc, but **you don't know RST syntax**, we will accept pull
+requests in Markdown and plain text formats. We really want to
+encourage people to share their knowledge and don't want the markup
+syntax to be the obstacle. So when you make the Pull Request, please
+note in your comment that you need RST markup assistance, and we'll
+make the changes for you, and then we will make a pull request to your
+pull request so that you can get all the changes and learn about the
+markup. You still need to follow the
+[``CONTRIBUTING``](../CONTRIBUTING) guidelines, so please sign your
+commits.
+
 Working using GitHub's file editor
 ----------------------------------
 
@@ -93,8 +126,11 @@ exists.
 
 Notes
 -----
-* For the template the css is compiled from less. When changes are needed they can be compiled using
-lessc ``lessc main.less`` or watched using watch-lessc ``watch-lessc -i main.less -o main.css``
+
+* For the template the css is compiled from less. When changes are
+  needed they can be compiled using
+
+  lessc ``lessc main.less`` or watched using watch-lessc ``watch-lessc -i main.less -o main.css``
 
 Guides on using sphinx
 ----------------------
@@ -106,7 +142,8 @@ Guides on using sphinx
     Hello world
     ===========
 
-    This is.. (etc.)
+    This is a reference to :ref:`hello_world` and will work even if we
+    move the target to another file or change the title of the section. 
   ```
 
   The ``_hello_world:`` will make it possible to link to this position

From 569ad8a8f45b92f553999b710c02780e5dc16915 Mon Sep 17 00:00:00 2001
From: Thomas Schroeter <thomas@cliqz.com>
Date: Wed, 19 Feb 2014 10:50:11 +0000
Subject: [PATCH 151/403] Correct port range in OS X installation doc

Docker-DCO-1.1-Signed-off-by: Thomas Schroeter <thschroeter@gmail.com> (github: thschroeter)
Upstream-commit: 8a289a8a54480b968a6924536e084d749e567cf0
Component: engine
---
 components/engine/docs/sources/installation/mac.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/installation/mac.rst b/components/engine/docs/sources/installation/mac.rst
index 75e788b597..5139324d0b 100644
--- a/components/engine/docs/sources/installation/mac.rst
+++ b/components/engine/docs/sources/installation/mac.rst
@@ -126,7 +126,7 @@ with our containers as if they were running locally:
 .. code-block:: bash
 
    # vm must be powered off
-   for i in {4900..49900}; do
+   for i in {49000..49900}; do
     VBoxManage modifyvm "boot2docker-vm" --natpf1 "tcp-port$i,tcp,,$i,,$i";
     VBoxManage modifyvm "boot2docker-vm" --natpf1 "udp-port$i,udp,,$i,,$i";
    done

From 33370133022b9ca05e6c2c813d129b4e3cdb537d Mon Sep 17 00:00:00 2001
From: Fabio Falci <fabiofalci@gmail.com>
Date: Mon, 10 Feb 2014 23:21:20 +0000
Subject: [PATCH 152/403] Package coverage when running integration tests

If coverpkg is missing on `go test` command, only the current package
will be covered. That's the case of unit tests. For integration tests
we need to explicitly declare each package.

Docker-DCO-1.1-Signed-off-by: Fabio Falci <fabiofalci@gmail.com> (github: fabiofalci)
Upstream-commit: b3d5e9527a050a0c7252f0125a8a26a6fc5175f1
Component: engine
---
 components/engine/hack/make.sh               | 15 +++++++++++++--
 components/engine/hack/make/test             | 13 +------------
 components/engine/hack/make/test-integration |  3 ++-
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index c0092b106f..59bd716022 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -16,7 +16,7 @@ set -e
 #   in the Dockerfile at the root of the source. In other words:
 #   DO NOT CALL THIS SCRIPT DIRECTLY.
 # - The right way to call this script is to invoke "make" from
-#   your checkout of the Docker repository. 
+#   your checkout of the Docker repository.
 #   the Makefile will do a "docker build -t docker ." and then
 #   "docker run hack/make.sh" in the resulting container image.
 #
@@ -101,13 +101,14 @@ fi
 #
 go_test_dir() {
 	dir=$1
+	coverpkg=$2
 	testcover=()
 	if [ "$HAVE_GO_TEST_COVER" ]; then
 		# if our current go install has -cover, we want to use it :)
 		mkdir -p "$DEST/coverprofiles"
 		coverprofile="docker${dir#.}"
 		coverprofile="$DEST/coverprofiles/${coverprofile//\//-}"
-		testcover=( -cover -coverprofile "$coverprofile" )
+		testcover=( -cover -coverprofile "$coverprofile" $coverpkg )
 	fi
 	(
 		set -x
@@ -116,6 +117,16 @@ go_test_dir() {
 	)
 }
 
+# This helper function walks the current directory looking for directories
+# holding certain files ($1 parameter), and prints their paths on standard
+# output, one per line.
+find_dirs() {
+	find -not \( \
+		\( -wholename './vendor' -o -wholename './integration' -o -wholename './contrib' -o -wholename './pkg/mflag/example' \) \
+		-prune \
+	\) -name "$1" -print0 | xargs -0n1 dirname | sort -u
+}
+
 bundle() {
 	bundlescript=$1
 	bundle=$(basename $bundlescript)
diff --git a/components/engine/hack/make/test b/components/engine/hack/make/test
index 760c5a5fc6..68b4c52202 100644
--- a/components/engine/hack/make/test
+++ b/components/engine/hack/make/test
@@ -19,7 +19,7 @@ bundle_test() {
 		date
 
 		TESTS_FAILED=()
-		for test_dir in $(find_test_dirs); do
+		for test_dir in $(find_dirs '*_test.go'); do
 			echo
 
 			if ! LDFLAGS="$LDFLAGS $LDFLAGS_STATIC" go_test_dir "$test_dir"; then
@@ -48,15 +48,4 @@ bundle_test() {
 	} 2>&1 | tee $DEST/test.log
 }
 
-
-# This helper function walks the current directory looking for directories
-# holding Go test files, and prints their paths on standard output, one per
-# line.
-find_test_dirs() {
-	find -not \( \
-		\( -wholename './vendor' -o -wholename './integration' \) \
-		-prune \
-	\) -name '*_test.go' -print0 | xargs -0n1 dirname | sort -u
-}
-
 bundle_test
diff --git a/components/engine/hack/make/test-integration b/components/engine/hack/make/test-integration
index f1ab0b99c3..93d63ad595 100644
--- a/components/engine/hack/make/test-integration
+++ b/components/engine/hack/make/test-integration
@@ -5,7 +5,8 @@ DEST=$1
 set -e
 
 bundle_test_integration() {
-	LDFLAGS="$LDFLAGS $LDFLAGS_STATIC" go_test_dir ./integration
+	LDFLAGS="$LDFLAGS $LDFLAGS_STATIC" go_test_dir ./integration \
+		"-coverpkg $(find_dirs '*.go' | sed 's,^\.,github.com/dotcloud/docker,g' | paste -d, -s)"
 }
 
 bundle_test_integration 2>&1 | tee $DEST/test.log

From 98d4bbe0f67907e4757ba43a771ddaa73c138df9 Mon Sep 17 00:00:00 2001
From: Andy Rothfusz <github@developersupport.net>
Date: Tue, 18 Feb 2014 19:25:43 -0800
Subject: [PATCH 153/403] update links Docker-DCO-1.1-Signed-off-by: Andy
 Rothfusz <github@developersupport.net> (github: metalivedev) Upstream-commit:
 196702fbf9905426e590c0dbcb6101e72c62aac6 Component: engine

---
 components/engine/docs/README.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/components/engine/docs/README.md b/components/engine/docs/README.md
index 71b3a09995..9379d86870 100644
--- a/components/engine/docs/README.md
+++ b/components/engine/docs/README.md
@@ -81,8 +81,8 @@ starts clean.
 ## Normal Case:
 
 * Follow the contribution guidelines ([see
-  ``../CONTRIBUTING.md``](../CONTRIBUTING)).
-* Remember to sign your work!
+  ``../CONTRIBUTING.md``](../CONTRIBUTING.md)).
+* [Remember to sign your work!](../CONTRIBUTING.md#sign-your-work)
 * Work in your own fork of the code, we accept pull requests.
 * Change the ``.rst`` files with your favorite editor -- try to keep the
   lines short and respect RST and Sphinx conventions. 
@@ -115,6 +115,7 @@ Alternatively, for small changes and typos you might want to use
 GitHub's built in file editor. It allows you to preview your changes
 right online (though there can be some differences between GitHub
 markdown and Sphinx RST). Just be careful not to create many commits.
+And you must still [sign your work!](../CONTRIBUTING.md#sign-your-work)
 
 Images
 ------

From 785171a902869769f2872bf09d1370cee1402c79 Mon Sep 17 00:00:00 2001
From: Dan Williams <me@deedubs.com>
Date: Wed, 19 Feb 2014 08:53:31 -0500
Subject: [PATCH 154/403] FIX: Linux mint troubleshooting tip

Package is called 'cgroup-lite' not 'cgroups-lite'. Verified on Linux Mint 16.

Ref http://packages.ubuntu.com/search?keywords=cgroup-lite

Docker-DCO-1.1-Signed-off-by: Dan Williams <me@deedubs.com> (github: deedubs)
Upstream-commit: 6073b450e83a67a27ffe8c11ebda36791a7923b4
Component: engine
---
 components/engine/docs/sources/installation/ubuntulinux.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/engine/docs/sources/installation/ubuntulinux.rst b/components/engine/docs/sources/installation/ubuntulinux.rst
index f37be90d7d..dc8832a982 100644
--- a/components/engine/docs/sources/installation/ubuntulinux.rst
+++ b/components/engine/docs/sources/installation/ubuntulinux.rst
@@ -220,12 +220,12 @@ To install the latest version of docker, use the standard ``apt-get`` method:
 Troubleshooting
 ^^^^^^^^^^^^^^^
 
-On Linux Mint, the ``cgroups-lite`` package is not installed by default.
+On Linux Mint, the ``cgroup-lite`` package is not installed by default.
 Before Docker will work correctly, you will need to install this via:
 
 .. code-block:: bash
 
-    sudo apt-get update && sudo apt-get install cgroups-lite
+    sudo apt-get update && sudo apt-get install cgroup-lite
 
 .. _ufw:
 

From 0802cd5e0ff11039ec9279caa767f6a92d2c4fa4 Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Thu, 20 Feb 2014 01:11:04 +0200
Subject: [PATCH 155/403] don't skip cert check for an example & use HTTPS

This changes two URLs from http to https and it fixes a Dockerfile to
stop skipping certificate validation. It also adds the ca-certificates
package to that Dockerfile example.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 73a277eb2fd66b815b11e9d2caff2c31c18a0854
Component: engine
---
 components/engine/contrib/mkimage-arch.sh                     | 2 +-
 .../docs/sources/examples/cfengine_process_management.rst     | 4 ++--
 .../engine/docs/sources/reference/api/docker_remote_api.rst   | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/components/engine/contrib/mkimage-arch.sh b/components/engine/contrib/mkimage-arch.sh
index d178a1df3d..73a4173b11 100755
--- a/components/engine/contrib/mkimage-arch.sh
+++ b/components/engine/contrib/mkimage-arch.sh
@@ -39,7 +39,7 @@ arch-chroot $ROOTFS /bin/sh -c "haveged -w 1024; pacman-key --init; pkill havege
 arch-chroot $ROOTFS /bin/sh -c "ln -s /usr/share/zoneinfo/UTC /etc/localtime"
 echo 'en_US.UTF-8 UTF-8' > $ROOTFS/etc/locale.gen
 arch-chroot $ROOTFS locale-gen
-arch-chroot $ROOTFS /bin/sh -c 'echo "Server = http://mirrors.kernel.org/archlinux/\$repo/os/\$arch" > /etc/pacman.d/mirrorlist'
+arch-chroot $ROOTFS /bin/sh -c 'echo "Server = https://mirrors.kernel.org/archlinux/\$repo/os/\$arch" > /etc/pacman.d/mirrorlist'
 
 # udev doesn't work in containers, rebuild /dev
 DEV=$ROOTFS/dev
diff --git a/components/engine/docs/sources/examples/cfengine_process_management.rst b/components/engine/docs/sources/examples/cfengine_process_management.rst
index 9d7681f556..7ca2c35498 100644
--- a/components/engine/docs/sources/examples/cfengine_process_management.rst
+++ b/components/engine/docs/sources/examples/cfengine_process_management.rst
@@ -55,7 +55,7 @@ The first two steps can be done as part of a Dockerfile, as follows.
     FROM ubuntu
     MAINTAINER Eystein Måløy Stenberg <eytein.stenberg@gmail.com>
 
-    RUN apt-get -y install wget lsb-release unzip
+    RUN apt-get -y install wget lsb-release unzip ca-certificates
 
     # install latest CFEngine
     RUN wget -qO- http://cfengine.com/pub/gpg.key | apt-key add -
@@ -64,7 +64,7 @@ The first two steps can be done as part of a Dockerfile, as follows.
     RUN apt-get install cfengine-community
 
     # install cfe-docker process management policy
-    RUN wget --no-check-certificate https://github.com/estenberg/cfe-docker/archive/master.zip -P /tmp/ && unzip /tmp/master.zip -d /tmp/
+    RUN wget https://github.com/estenberg/cfe-docker/archive/master.zip -P /tmp/ && unzip /tmp/master.zip -d /tmp/
     RUN cp /tmp/cfe-docker-master/cfengine/bin/* /var/cfengine/bin/
     RUN cp /tmp/cfe-docker-master/cfengine/inputs/* /var/cfengine/inputs/
     RUN rm -rf /tmp/cfe-docker-master /tmp/master.zip
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api.rst b/components/engine/docs/sources/reference/api/docker_remote_api.rst
index f7cd7faf4f..69bbf71ec9 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api.rst
@@ -2,7 +2,7 @@
 :description: API Documentation for Docker
 :keywords: API, Docker, rcli, REST, documentation
 
-.. COMMENT use http://pythonhosted.org/sphinxcontrib-httpdomain/ to
+.. COMMENT use https://pythonhosted.org/sphinxcontrib-httpdomain/ to
 .. document the REST API.
 
 =================

From 852e62316ce21cedfea1fd54a61a5407e09dc6b2 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Wed, 19 Feb 2014 16:53:15 -0700
Subject: [PATCH 156/403] Add back the Ubuntu "Memory and Swap Accounting"
 section that was lost when the "Kernel" page was culled

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 42b97be441f5272ead365c3400b91fb756565b1a
Component: engine
---
 .../docs/sources/installation/ubuntulinux.rst | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/components/engine/docs/sources/installation/ubuntulinux.rst b/components/engine/docs/sources/installation/ubuntulinux.rst
index f37be90d7d..55ea036522 100644
--- a/components/engine/docs/sources/installation/ubuntulinux.rst
+++ b/components/engine/docs/sources/installation/ubuntulinux.rst
@@ -217,6 +217,26 @@ To install the latest version of docker, use the standard ``apt-get`` method:
    # install the latest
    sudo apt-get install lxc-docker
 
+Memory and Swap Accounting
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If want to enable memory and swap accounting, you must add the following
+command-line parameters to your kernel::
+
+    cgroup_enable=memory swapaccount=1
+
+On systems using GRUB (which is the default for Ubuntu), you can add those
+parameters by editing ``/etc/default/grub`` and extending
+``GRUB_CMDLINE_LINUX``. Look for the following line::
+
+    GRUB_CMDLINE_LINUX=""
+
+And replace it by the following one::
+
+    GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1"
+
+Then run ``update-grub``, and reboot.
+
 Troubleshooting
 ^^^^^^^^^^^^^^^
 

From c8d7265499475d995b4d0b18064cbc2ba9d8e1b7 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Thu, 20 Feb 2014 13:49:15 +1000
Subject: [PATCH 157/403] lets talk about the other way to make base images

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 9f1c69ca7b1b2afd96b4d154431395ee48ada97d
Component: engine
---
 .../docs/sources/articles/baseimages.rst      | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/components/engine/docs/sources/articles/baseimages.rst b/components/engine/docs/sources/articles/baseimages.rst
index 6fd1823f8d..61c8f7d9c5 100644
--- a/components/engine/docs/sources/articles/baseimages.rst
+++ b/components/engine/docs/sources/articles/baseimages.rst
@@ -13,8 +13,8 @@ The specific process will depend heavily on the Linux distribution you
 want to package. We have some examples below, and you are encouraged
 to submit pull requests to contribute new ones.
 
-Getting Started
-...............
+Create a full image using tar
+.............................
 
 In general, you'll want to start with a working machine that is
 running the distribution you'd like to package as a base image, though
@@ -44,3 +44,22 @@ Docker GitHub Repo:
   <https://github.com/dotcloud/docker/blob/master/contrib/mkimage-yum.sh>`_
 * `Debian / Ubuntu
   <https://github.com/dotcloud/docker/blob/master/contrib/mkimage-debootstrap.sh>`_
+
+
+Creating a simple base image using ``scratch``
+..............................................
+
+There is a special repository in the Docker registry called ``scratch``, which 
+was created using an empty tar file::
+
+    $ tar cv --files-from /dev/null | docker import - scratch
+
+which you can ``docker pull``. You can then use that image to base your new 
+minimal containers ``FROM``::
+
+    FROM scratch
+    ADD true-asm /true
+    CMD ["/true"]
+
+The Dockerfile above is from extremely minimal image - 
+`tianon/true <https://github.com/tianon/dockerfiles/tree/master/true>`_.

From 3d478c1043434edf347e8758f9ed4085bc70e6eb Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Fri, 14 Feb 2014 14:24:37 +0100
Subject: [PATCH 158/403] Archive: Add Add Lgetxattr and Lsetxattr
 implementations

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: d19e998e7a99d24122da3e98d9886e3b7b4b3501
Component: engine
---
 components/engine/archive/stat_linux.go       | 53 +++++++++++++++++++
 components/engine/archive/stat_unsupported.go |  8 +++
 2 files changed, 61 insertions(+)

diff --git a/components/engine/archive/stat_linux.go b/components/engine/archive/stat_linux.go
index f87a99c55a..2910ce5bab 100644
--- a/components/engine/archive/stat_linux.go
+++ b/components/engine/archive/stat_linux.go
@@ -37,3 +37,56 @@ func UtimesNano(path string, ts []syscall.Timespec) error {
 	}
 	return nil
 }
+
+// Returns a nil slice and nil error if the xattr is not set
+func Lgetxattr(path string, attr string) ([]byte, error) {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return nil, err
+	}
+	attrBytes, err := syscall.BytePtrFromString(attr)
+	if err != nil {
+		return nil, err
+	}
+
+	dest := make([]byte, 128)
+	destBytes := unsafe.Pointer(&dest[0])
+	sz, _, errno := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0)
+	if errno == syscall.ENODATA {
+		return nil, nil
+	}
+	if errno == syscall.ERANGE {
+		dest = make([]byte, sz)
+		destBytes := unsafe.Pointer(&dest[0])
+		sz, _, errno = syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0)
+	}
+	if errno != 0 {
+		return nil, errno
+	}
+
+	return dest[:sz], nil
+}
+
+var _zero uintptr
+
+func Lsetxattr(path string, attr string, data []byte, flags int) error {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return err
+	}
+	attrBytes, err := syscall.BytePtrFromString(attr)
+	if err != nil {
+		return err
+	}
+	var dataBytes unsafe.Pointer
+	if len(data) > 0 {
+		dataBytes = unsafe.Pointer(&data[0])
+	} else {
+		dataBytes = unsafe.Pointer(&_zero)
+	}
+	_, _, errno := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(dataBytes), uintptr(len(data)), uintptr(flags), 0)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
diff --git a/components/engine/archive/stat_unsupported.go b/components/engine/archive/stat_unsupported.go
index 50ca461867..99f1fbc7da 100644
--- a/components/engine/archive/stat_unsupported.go
+++ b/components/engine/archive/stat_unsupported.go
@@ -19,3 +19,11 @@ func LUtimesNano(path string, ts []syscall.Timespec) error {
 func UtimesNano(path string, ts []syscall.Timespec) error {
 	return ErrNotImplemented
 }
+
+func Lgetxattr(path string, attr string) ([]byte, error) {
+	return nil, ErrNotImplemented
+}
+
+func Lsetxattr(path string, attr string, data []byte, flags int) error {
+	return ErrNotImplemented
+}

From 91e61d40222f63f379b04c537eda52b5969cb4b9 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Wed, 15 Jan 2014 15:05:30 +0100
Subject: [PATCH 159/403] archive: extract xattrs from tarfiles

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: c8428d77fdde41786aa5c0c4e64e0e762f873676
Component: engine
---
 components/engine/archive/archive.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index 16c01993b7..206580fa08 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -251,6 +251,12 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader) e
 		return err
 	}
 
+	for key, value := range hdr.Xattrs {
+		if err := Lsetxattr(path, key, []byte(value), 0); err != nil {
+			return err
+		}
+	}
+
 	// There is no LChmod, so ignore mode for symlink. Also, this
 	// must happen after chown, as that can modify the file mode
 	if hdr.Typeflag != tar.TypeSymlink {

From 8cd94e7ac60018eddc04becd4352220a23ae315b Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Fri, 17 Jan 2014 10:51:59 +0100
Subject: [PATCH 160/403] archive: Detect file changes to capability bits

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 87ca750cdc3114a340af1c5bc9394cc5f6242677
Component: engine
---
 components/engine/archive/changes.go | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/components/engine/archive/changes.go b/components/engine/archive/changes.go
index b46b13bbe7..a9eba8196f 100644
--- a/components/engine/archive/changes.go
+++ b/components/engine/archive/changes.go
@@ -1,6 +1,7 @@
 package archive
 
 import (
+	"bytes"
 	"code.google.com/p/go/src/pkg/archive/tar"
 	"fmt"
 	"github.com/dotcloud/docker/utils"
@@ -126,10 +127,11 @@ func Changes(layers []string, rw string) ([]Change, error) {
 }
 
 type FileInfo struct {
-	parent   *FileInfo
-	name     string
-	stat     syscall.Stat_t
-	children map[string]*FileInfo
+	parent     *FileInfo
+	name       string
+	stat       syscall.Stat_t
+	children   map[string]*FileInfo
+	capability []byte
 }
 
 func (root *FileInfo) LookUp(path string) *FileInfo {
@@ -200,7 +202,8 @@ func (info *FileInfo) addChanges(oldInfo *FileInfo, changes *[]Change) {
 				oldStat.Rdev != newStat.Rdev ||
 				// Don't look at size for dirs, its not a good measure of change
 				(oldStat.Size != newStat.Size && oldStat.Mode&syscall.S_IFDIR != syscall.S_IFDIR) ||
-				!sameFsTimeSpec(getLastModification(oldStat), getLastModification(newStat)) {
+				!sameFsTimeSpec(getLastModification(oldStat), getLastModification(newStat)) ||
+				bytes.Compare(oldChild.capability, newChild.capability) != 0 {
 				change := Change{
 					Path: newChild.path(),
 					Kind: ChangeModify,
@@ -275,6 +278,8 @@ func collectFileInfo(sourceDir string) (*FileInfo, error) {
 			return err
 		}
 
+		info.capability, _ = Lgetxattr(path, "security.capability")
+
 		parent.children[info.name] = info
 
 		return nil

From 7d5d3a982f55254efd748ba036046f092e0ceea8 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Mon, 20 Jan 2014 12:26:08 +0100
Subject: [PATCH 161/403] archive: Handle capabilities in tar files

If a file has a security.capability set, we push this to the tar file.
This is important to handle in e.g. layer files or when copying files
to containers, as some distros (e.g. Fedora) use capability bits as
a more finegrained version of setuid bits, and thus if the capabilites
are stripped (and setuid is not set) the binaries will fail to work.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 3b9953903b12eaca76655311bd44533768f6f3da
Component: engine
---
 components/engine/archive/archive.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index 206580fa08..8bb0a8ed1c 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -165,6 +165,13 @@ func addTarFile(path, name string, tw *tar.Writer) error {
 			hdr.Devmajor = int64(major(uint64(stat.Rdev)))
 			hdr.Devminor = int64(minor(uint64(stat.Rdev)))
 		}
+
+	}
+
+	capability, _ := Lgetxattr(path, "security.capability")
+	if capability != nil {
+		hdr.Xattrs = make(map[string]string)
+		hdr.Xattrs["security.capability"] = string(capability)
 	}
 
 	if err := tw.WriteHeader(hdr); err != nil {

From e100a3787851aed5b9ee7aa5d3fd56e40d6c263b Mon Sep 17 00:00:00 2001
From: James Turnbull <james@lovedthanlost.net>
Date: Thu, 20 Feb 2014 08:51:39 -0500
Subject: [PATCH 162/403] Site ver for Webmaster tools

Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Upstream-commit: ef826621585a62d9b563e8ab2fd72f731b14817c
Component: engine
---
 components/engine/docs/theme/docker/layout.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/docs/theme/docker/layout.html b/components/engine/docs/theme/docker/layout.html
index a966556044..7d78fb9c3c 100755
--- a/components/engine/docs/theme/docker/layout.html
+++ b/components/engine/docs/theme/docker/layout.html
@@ -3,6 +3,7 @@
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
     <meta name="google-site-verification" content="UxV66EKuPe87dgnH1sbrldrx6VsoWMrx5NjwkgUFxXI" />
+    <meta name="google-site-verification" content="XzwpAUE5-gjq6j2F0dDqiBYxCZpHd8uVYe5Fnyt3V8Q" />
     <title>{{ meta['title'] if meta and meta['title'] else title }} - Docker Documentation</title>
     <meta name="description" content="{{ meta['description'] if meta }}" />
     <meta name="keywords" content="{{ meta['keywords'] if meta }}" />

From 6ec2f023129d7a00849e56c8bd79d0b6b51d7aa0 Mon Sep 17 00:00:00 2001
From: Adrian Mouat <adrian.mouat@gmail.com>
Date: Thu, 20 Feb 2014 16:55:07 +0100
Subject: [PATCH 163/403] Fix misspelling

Docker-DCO-1.1-Signed-off-by: Adrian Mouat <adrian@adrianmouat.com> (github: amouat)
Upstream-commit: 88d24df6687d64bf0e19c23973da32eed32fda28
Component: engine
---
 components/engine/docs/sources/use/working_with_volumes.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/use/working_with_volumes.rst b/components/engine/docs/sources/use/working_with_volumes.rst
index 40e282c986..8ddd4196c7 100644
--- a/components/engine/docs/sources/use/working_with_volumes.rst
+++ b/components/engine/docs/sources/use/working_with_volumes.rst
@@ -80,7 +80,7 @@ similar to :ref:`ambassador_pattern_linking <ambassador_pattern_linking>`.
 
 If you remove containers that mount volumes, including the initial DATA container, 
 or the middleman, the volumes will not be deleted until there are no containers still
-referencing those volumes. This allows you to upgrade, or effectivly migrate data volumes
+referencing those volumes. This allows you to upgrade, or effectively migrate data volumes
 between containers.
 
 Mount a Host Directory as a Container Volume:

From 1124129b254733cd73a2428081152145c6aaa373 Mon Sep 17 00:00:00 2001
From: Nolan Darilek <nolan@thewordnerd.info>
Date: Thu, 20 Feb 2014 11:18:27 -0600
Subject: [PATCH 164/403] Don't call applyVolumesFrom on containers with
 volumes already configured (closes #2973)

Docker-DCO-1.1-Signed-off-by: Nolan Darilek <nolan@thewordnerd.info> (github: ndarilek)
Upstream-commit: 937ea1d3805771b0e5763f336f9d64e5996c2c95
Component: engine
---
 components/engine/volumes.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/components/engine/volumes.go b/components/engine/volumes.go
index a53ef722e7..9f76e3698b 100644
--- a/components/engine/volumes.go
+++ b/components/engine/volumes.go
@@ -23,11 +23,11 @@ func prepareVolumesForContainer(container *Container) error {
 	if container.Volumes == nil || len(container.Volumes) == 0 {
 		container.Volumes = make(map[string]string)
 		container.VolumesRW = make(map[string]bool)
+		if err := applyVolumesFrom(container); err != nil {
+			return err
+		}
 	}
 
-	if err := applyVolumesFrom(container); err != nil {
-		return err
-	}
 	if err := createVolumes(container); err != nil {
 		return err
 	}

From c7ecc00d6b0a7c89973a8e6070c6421da3bfdacb Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Thu, 20 Feb 2014 19:43:00 +0200
Subject: [PATCH 165/403] docs: explain DNS warnings & how to fix them

This explains how to fix the DNS warnings on Ubuntu and why they're
shown.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: cae554b32e8c3341767e0efe7b9a8977a499d826
Component: engine
---
 .../docs/sources/installation/ubuntulinux.rst | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/components/engine/docs/sources/installation/ubuntulinux.rst b/components/engine/docs/sources/installation/ubuntulinux.rst
index f37be90d7d..0fd24e9996 100644
--- a/components/engine/docs/sources/installation/ubuntulinux.rst
+++ b/components/engine/docs/sources/installation/ubuntulinux.rst
@@ -261,6 +261,64 @@ incoming connections on the Docker port (default 4243):
 
 .. _installmirrors:
 
+Docker and local DNS server warnings
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Systems which are running Ubuntu or an Ubuntu derivative on the desktop will
+use `127.0.0.1` as the default nameserver in `/etc/resolv.conf`. NetworkManager
+sets up dnsmasq to use the real DNS servers of the connection and sets up
+`nameserver 127.0.0.1` in `/etc/resolv.conf`.
+
+When starting containers on these desktop machines, users will see a warning:
+
+.. code-block:: bash
+
+  WARNING: Local (127.0.0.1) DNS resolver found in resolv.conf and containers can't use it. Using default external servers : [8.8.8.8 8.8.4.4]
+
+This warning is shown because the containers can't use the local DNS nameserver
+and Docker will default to using an external nameserver.
+
+This can be worked around by specifying a DNS server to be used by the Docker
+daemon for the containers:
+
+.. code-block:: bash
+
+   sudo nano /etc/default/docker
+   ---
+   # Add:
+   DOCKER_OPTS="-dns 8.8.8.8"
+   # 8.8.8.8 could be replaced with a local DNS server, such as 192.168.1.1
+   # multiple DNS servers can be specified: -dns 8.8.8.8 -dns 192.168.1.1
+
+The Docker daemon has to be restarted:
+
+.. code-block:: bash
+
+    sudo restart docker
+
+.. warning:: If you're doing this on a laptop which connects to various networks, make sure to choose a public DNS server.
+
+An alternative solution involves disabling dnsmasq in NetworkManager by
+following these steps:
+
+.. code-block:: bash
+
+    sudo nano /etc/NetworkManager/NetworkManager.conf
+    ----
+    # Change:
+    dns=dnsmasq
+    # to
+    #dns=dnsmasq
+
+NetworkManager and Docker need to be restarted afterwards:
+
+.. code-block:: bash
+
+    sudo restart network-manager
+    sudo restart docker
+
+.. warning:: This might make DNS resolution slower on some networks.
+
 Mirrors
 ^^^^^^^
 

From 87c3fb28d226f0fbc0f472eb36a2496130daa035 Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Thu, 20 Feb 2014 17:16:45 +0200
Subject: [PATCH 166/403] forbid chained onbuild, from & maintainer triggers

This changes the way onbuild works:
- forbids the chaining of onbuild instructions
- forbids the use of `onbuild from`
- forbids the use of `onbuild maintainer`

It also makes docker throw errors when encountering such triggers when
executing the triggers during `FROM`.

Three tests have been added:
- ensure that chained onbuild (`onbuild onbuild`) is forbidden
- ensure that `onbuild from` is forbidden
- ensure that `onbuild maintainer` is forbidden

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: b829e96cde4f798bc21f05a763b2f6a623dfe1eb
Component: engine
---
 components/engine/buildfile.go                | 16 +++++++
 .../engine/docs/sources/reference/builder.rst |  2 +
 .../engine/integration/buildfile_test.go      | 42 +++++++++++++++++++
 3 files changed, 60 insertions(+)

diff --git a/components/engine/buildfile.go b/components/engine/buildfile.go
index c7181b9146..b30a220ddc 100644
--- a/components/engine/buildfile.go
+++ b/components/engine/buildfile.go
@@ -117,6 +117,14 @@ func (b *buildFile) CmdFrom(name string) error {
 		fmt.Fprintf(b.errStream, "# Executing %d build triggers\n", nTriggers)
 	}
 	for n, step := range b.config.OnBuild {
+		splitStep := strings.Split(step, " ")
+		stepInstruction := strings.ToUpper(strings.Trim(splitStep[0], " "))
+		switch stepInstruction {
+		case "ONBUILD":
+			return fmt.Errorf("Source image contains forbidden chained `ONBUILD ONBUILD` trigger: %s", step)
+		case "MAINTAINER", "FROM":
+			return fmt.Errorf("Source image contains forbidden %s trigger: %s", stepInstruction, step)
+		}
 		if err := b.BuildStep(fmt.Sprintf("onbuild-%d", n), step); err != nil {
 			return err
 		}
@@ -128,6 +136,14 @@ func (b *buildFile) CmdFrom(name string) error {
 // The ONBUILD command declares a build instruction to be executed in any future build
 // using the current image as a base.
 func (b *buildFile) CmdOnbuild(trigger string) error {
+	splitTrigger := strings.Split(trigger, " ")
+	triggerInstruction := strings.ToUpper(strings.Trim(splitTrigger[0], " "))
+	switch triggerInstruction {
+	case "ONBUILD":
+		return fmt.Errorf("Chaining ONBUILD via `ONBUILD ONBUILD` isn't allowed")
+	case "MAINTAINER", "FROM":
+		return fmt.Errorf("%s isn't allowed as an ONBUILD trigger", triggerInstruction)
+	}
 	b.config.OnBuild = append(b.config.OnBuild, trigger)
 	return b.commit("", b.config.Cmd, fmt.Sprintf("ONBUILD %s", trigger))
 }
diff --git a/components/engine/docs/sources/reference/builder.rst b/components/engine/docs/sources/reference/builder.rst
index 4b6a151006..6fabd6629d 100644
--- a/components/engine/docs/sources/reference/builder.rst
+++ b/components/engine/docs/sources/reference/builder.rst
@@ -466,6 +466,8 @@ For example you might add something like this:
     ONBUILD RUN /usr/local/bin/python-build --dir /app/src
     [...]
 
+.. warning:: Chaining ONBUILD instructions using `ONBUILD ONBUILD` isn't allowed.
+.. warning:: ONBUILD may not trigger FROM or MAINTAINER instructions.
 
 .. _dockerfile_examples:
 
diff --git a/components/engine/integration/buildfile_test.go b/components/engine/integration/buildfile_test.go
index 805932b57a..efab9707ec 100644
--- a/components/engine/integration/buildfile_test.go
+++ b/components/engine/integration/buildfile_test.go
@@ -924,3 +924,45 @@ func TestBuildOnBuildTrigger(t *testing.T) {
 	}
 	// FIXME: test that the 'foobar' file was created in the final build.
 }
+
+func TestBuildOnBuildForbiddenChainedTrigger(t *testing.T) {
+	_, err := buildImage(testContextTemplate{`
+	from {IMAGE}
+	onbuild onbuild run echo test
+	`,
+		nil, nil,
+	},
+		t, nil, true,
+	)
+	if err == nil {
+		t.Fatal("Error should not be nil")
+	}
+}
+
+func TestBuildOnBuildForbiddenFromTrigger(t *testing.T) {
+	_, err := buildImage(testContextTemplate{`
+	from {IMAGE}
+	onbuild from {IMAGE}
+	`,
+		nil, nil,
+	},
+		t, nil, true,
+	)
+	if err == nil {
+		t.Fatal("Error should not be nil")
+	}
+}
+
+func TestBuildOnBuildForbiddenMaintainerTrigger(t *testing.T) {
+	_, err := buildImage(testContextTemplate{`
+	from {IMAGE}
+	onbuild maintainer test
+	`,
+		nil, nil,
+	},
+		t, nil, true,
+	)
+	if err == nil {
+		t.Fatal("Error should not be nil")
+	}
+}

From 733cdcbf96a61ac28c654bbd1fffbbc14bd30623 Mon Sep 17 00:00:00 2001
From: Jake Moshenko <jake@devtable.com>
Date: Thu, 20 Feb 2014 17:57:58 -0500
Subject: [PATCH 167/403] Fix registry auth by storing the string passed on the
 command line, and allowing for credential selection by normalizing on
 hostname. Also, remove remote ping calls from CmdPush and CmdPull.

Docker-DCO-1.1-Signed-off-by: Jake Moshenko <jake@devtable.com> (github: jakedt)
Upstream-commit: 90b0cce07b4f68d8099903f7e1470f79541f45d0
Component: engine
---
 components/engine/api/client.go             | 26 ++++-----
 components/engine/auth/auth.go              | 59 +++++++++------------
 components/engine/auth/auth_test.go         |  7 +++
 components/engine/registry/registry.go      |  9 ++--
 components/engine/registry/registry_test.go |  2 +-
 components/engine/server.go                 | 14 ++++-
 6 files changed, 60 insertions(+), 57 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index eb345ae40b..f421c6366c 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -977,13 +977,13 @@ func (cli *DockerCli) CmdPush(args ...string) error {
 
 	cli.LoadConfigFile()
 
-	// Resolve the Repository name from fqn to endpoint + name
-	endpoint, _, err := registry.ResolveRepositoryName(name)
+	// Resolve the Repository name from fqn to hostname + name
+	hostname, _, err := registry.ResolveRepositoryName(name)
 	if err != nil {
 		return err
 	}
 	// Resolve the Auth config relevant for this server
-	authConfig := cli.configFile.ResolveAuthConfig(endpoint)
+	authConfig := cli.configFile.ResolveAuthConfig(hostname)
 	// If we're not using a custom registry, we know the restrictions
 	// applied to repository names and can warn the user in advance.
 	// Custom repositories can have different rules, and we must also
@@ -1014,10 +1014,10 @@ func (cli *DockerCli) CmdPush(args ...string) error {
 	if err := push(authConfig); err != nil {
 		if strings.Contains(err.Error(), "Status 401") {
 			fmt.Fprintln(cli.out, "\nPlease login prior to push:")
-			if err := cli.CmdLogin(endpoint); err != nil {
+			if err := cli.CmdLogin(hostname); err != nil {
 				return err
 			}
-			authConfig := cli.configFile.ResolveAuthConfig(endpoint)
+			authConfig := cli.configFile.ResolveAuthConfig(hostname)
 			return push(authConfig)
 		}
 		return err
@@ -1042,8 +1042,8 @@ func (cli *DockerCli) CmdPull(args ...string) error {
 		*tag = parsedTag
 	}
 
-	// Resolve the Repository name from fqn to endpoint + name
-	endpoint, _, err := registry.ResolveRepositoryName(remote)
+	// Resolve the Repository name from fqn to hostname + name
+	hostname, _, err := registry.ResolveRepositoryName(remote)
 	if err != nil {
 		return err
 	}
@@ -1051,7 +1051,7 @@ func (cli *DockerCli) CmdPull(args ...string) error {
 	cli.LoadConfigFile()
 
 	// Resolve the Auth config relevant for this server
-	authConfig := cli.configFile.ResolveAuthConfig(endpoint)
+	authConfig := cli.configFile.ResolveAuthConfig(hostname)
 	v := url.Values{}
 	v.Set("fromImage", remote)
 	v.Set("tag", *tag)
@@ -1073,10 +1073,10 @@ func (cli *DockerCli) CmdPull(args ...string) error {
 	if err := pull(authConfig); err != nil {
 		if strings.Contains(err.Error(), "Status 401") {
 			fmt.Fprintln(cli.out, "\nPlease login prior to pull:")
-			if err := cli.CmdLogin(endpoint); err != nil {
+			if err := cli.CmdLogin(hostname); err != nil {
 				return err
 			}
-			authConfig := cli.configFile.ResolveAuthConfig(endpoint)
+			authConfig := cli.configFile.ResolveAuthConfig(hostname)
 			return pull(authConfig)
 		}
 		return err
@@ -1753,8 +1753,8 @@ func (cli *DockerCli) CmdRun(args ...string) error {
 		v.Set("fromImage", repos)
 		v.Set("tag", tag)
 
-		// Resolve the Repository name from fqn to endpoint + name
-		endpoint, _, err := registry.ResolveRepositoryName(repos)
+		// Resolve the Repository name from fqn to hostname + name
+		hostname, _, err := registry.ResolveRepositoryName(repos)
 		if err != nil {
 			return err
 		}
@@ -1763,7 +1763,7 @@ func (cli *DockerCli) CmdRun(args ...string) error {
 		cli.LoadConfigFile()
 
 		// Resolve the Auth config relevant for this server
-		authConfig := cli.configFile.ResolveAuthConfig(endpoint)
+		authConfig := cli.configFile.ResolveAuthConfig(hostname)
 		buf, err := json.Marshal(authConfig)
 		if err != nil {
 			return err
diff --git a/components/engine/auth/auth.go b/components/engine/auth/auth.go
index cbca81f3e3..4417dd0f7a 100644
--- a/components/engine/auth/auth.go
+++ b/components/engine/auth/auth.go
@@ -252,50 +252,39 @@ func Login(authConfig *AuthConfig, factory *utils.HTTPRequestFactory) (string, e
 }
 
 // this method matches a auth configuration to a server address or a url
-func (config *ConfigFile) ResolveAuthConfig(registry string) AuthConfig {
-	if registry == IndexServerAddress() || len(registry) == 0 {
+func (config *ConfigFile) ResolveAuthConfig(hostname string) AuthConfig {
+	if hostname == IndexServerAddress() || len(hostname) == 0 {
 		// default to the index server
 		return config.Configs[IndexServerAddress()]
 	}
-	// if it's not the index server there are three cases:
-	//
-	// 1. a full config url -> it should be used as is
-	// 2. a full url, but with the wrong protocol
-	// 3. a hostname, with an optional port
-	//
-	// as there is only one auth entry which is fully qualified we need to start
-	// parsing and matching
 
-	swapProtocol := func(url string) string {
-		if strings.HasPrefix(url, "http:") {
-			return strings.Replace(url, "http:", "https:", 1)
-		}
-		if strings.HasPrefix(url, "https:") {
-			return strings.Replace(url, "https:", "http:", 1)
-		}
-		return url
+	// First try the happy case
+	if c, found := config.Configs[hostname]; found {
+		return c
 	}
 
-	resolveIgnoringProtocol := func(url string) AuthConfig {
-		if c, found := config.Configs[url]; found {
-			return c
+	convertToHostname := func(url string) string {
+		stripped := url
+		if strings.HasPrefix(url, "http://") {
+			stripped = strings.Replace(url, "http://", "", 1)
+		} else if strings.HasPrefix(url, "https://") {
+			stripped = strings.Replace(url, "https://", "", 1)
 		}
-		registrySwappedProtocol := swapProtocol(url)
-		// now try to match with the different protocol
-		if c, found := config.Configs[registrySwappedProtocol]; found {
-			return c
-		}
-		return AuthConfig{}
+
+		nameParts := strings.SplitN(stripped, "/", 2)
+
+		return nameParts[0]
 	}
 
-	// match both protocols as it could also be a server name like httpfoo
-	if strings.HasPrefix(registry, "http:") || strings.HasPrefix(registry, "https:") {
-		return resolveIgnoringProtocol(registry)
+	// Maybe they have a legacy config file, we will iterate the keys converting
+	// them to the new format and testing
+	normalizedHostename := convertToHostname(hostname)
+	for registry, config := range config.Configs {
+		if registryHostname := convertToHostname(registry); registryHostname == normalizedHostename {
+			return config
+		}
 	}
 
-	url := "https://" + registry
-	if !strings.Contains(registry, "/") {
-		url = url + "/v1/"
-	}
-	return resolveIgnoringProtocol(url)
+	// When all else fails, return an empty auth config
+	return AuthConfig{}
 }
diff --git a/components/engine/auth/auth_test.go b/components/engine/auth/auth_test.go
index 5f2d3b85fd..2335072609 100644
--- a/components/engine/auth/auth_test.go
+++ b/components/engine/auth/auth_test.go
@@ -108,6 +108,7 @@ func TestResolveAuthConfigFullURL(t *testing.T) {
 	}
 	configFile.Configs["https://registry.example.com/v1/"] = registryAuth
 	configFile.Configs["http://localhost:8000/v1/"] = localAuth
+	configFile.Configs["registry.com"] = registryAuth
 
 	validRegistries := map[string][]string{
 		"https://registry.example.com/v1/": {
@@ -122,6 +123,12 @@ func TestResolveAuthConfigFullURL(t *testing.T) {
 			"localhost:8000",
 			"localhost:8000/v1/",
 		},
+		"registry.com": {
+			"https://registry.com/v1/",
+			"http://registry.com/v1/",
+			"registry.com",
+			"registry.com/v1/",
+		},
 	}
 
 	for configKey, registries := range validRegistries {
diff --git a/components/engine/registry/registry.go b/components/engine/registry/registry.go
index df94302305..37e107fad4 100644
--- a/components/engine/registry/registry.go
+++ b/components/engine/registry/registry.go
@@ -91,7 +91,7 @@ func validateRepositoryName(repositoryName string) error {
 	return nil
 }
 
-// Resolves a repository name to a endpoint + name
+// Resolves a repository name to a hostname + name
 func ResolveRepositoryName(reposName string) (string, string, error) {
 	if strings.Contains(reposName, "://") {
 		// It cannot contain a scheme!
@@ -117,11 +117,8 @@ func ResolveRepositoryName(reposName string) (string, string, error) {
 	if err := validateRepositoryName(reposName); err != nil {
 		return "", "", err
 	}
-	endpoint, err := ExpandAndVerifyRegistryUrl(hostname)
-	if err != nil {
-		return "", "", err
-	}
-	return endpoint, reposName, err
+
+	return hostname, reposName, nil
 }
 
 // this method expands the registry name as used in the prefix of a repo
diff --git a/components/engine/registry/registry_test.go b/components/engine/registry/registry_test.go
index 16bc431e55..5e398f9933 100644
--- a/components/engine/registry/registry_test.go
+++ b/components/engine/registry/registry_test.go
@@ -145,7 +145,7 @@ func TestResolveRepositoryName(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	assertEqual(t, ep, "http://"+u+"/v1/", "Expected endpoint to be "+u)
+	assertEqual(t, ep, u, "Expected endpoint to be "+u)
 	assertEqual(t, repo, "private/moonbase", "Expected endpoint to be private/moonbase")
 }
 
diff --git a/components/engine/server.go b/components/engine/server.go
index 0ed96fee31..7555830c0a 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1336,7 +1336,12 @@ func (srv *Server) ImagePull(job *engine.Job) engine.Status {
 	defer srv.poolRemove("pull", localName+":"+tag)
 
 	// Resolve the Repository name from fqn to endpoint + name
-	endpoint, remoteName, err := registry.ResolveRepositoryName(localName)
+	hostname, remoteName, err := registry.ResolveRepositoryName(localName)
+	if err != nil {
+		return job.Error(err)
+	}
+
+	endpoint, err := registry.ExpandAndVerifyRegistryUrl(hostname)
 	if err != nil {
 		return job.Error(err)
 	}
@@ -1538,7 +1543,12 @@ func (srv *Server) ImagePush(job *engine.Job) engine.Status {
 	defer srv.poolRemove("push", localName)
 
 	// Resolve the Repository name from fqn to endpoint + name
-	endpoint, remoteName, err := registry.ResolveRepositoryName(localName)
+	hostname, remoteName, err := registry.ResolveRepositoryName(localName)
+	if err != nil {
+		return job.Error(err)
+	}
+
+	endpoint, err := registry.ExpandAndVerifyRegistryUrl(hostname)
 	if err != nil {
 		return job.Error(err)
 	}

From 5a22c079a1d1aa08b3836969e5d519a55a2340c5 Mon Sep 17 00:00:00 2001
From: jakedt <jake@devtable.com>
Date: Thu, 20 Feb 2014 19:22:13 -0500
Subject: [PATCH 168/403] Fix build command auth by adding the auth config and
 registry objects to the build job environment.

Docker-DCO-1.1-Signed-off-by: Jake Moshenko <jake@devtable.com> (github: jakedt)
Upstream-commit: 7dcbae485cd46ad4b8af1ea758dd1d2c69f11fbe
Component: engine
---
 components/engine/api/api.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index 8d9bae978f..fe965ddafa 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -912,6 +912,8 @@ func postBuild(eng *engine.Engine, version float64, w http.ResponseWriter, r *ht
 	job.Setenv("q", r.FormValue("q"))
 	job.Setenv("nocache", r.FormValue("nocache"))
 	job.Setenv("rm", r.FormValue("rm"))
+	job.SetenvJson("authConfig", authConfig)
+	job.SetenvJson("configFile", configFile)
 
 	if err := job.Run(); err != nil {
 		if !job.Stdout.Used() {

From 2524fdc1ab56c235b5a8f9d80ddc8d62fdade808 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Fri, 21 Feb 2014 13:51:08 +1000
Subject: [PATCH 169/403] reinforce that docker build --rm is a good default to
 use

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: e59485e148f5d1ab0cf5ec18ca3bb7c684e8cf7b
Component: engine
---
 .../engine/docs/sources/reference/commandline/cli.rst | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 8ef0ab8b72..41cdfe7cbb 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -197,6 +197,8 @@ is given as ``URL``, then no context is set.  When a Git repository is set as
 ``URL``, then the repository is used as the context. Git repositories are
 cloned with their submodules (`git clone --recursive`).
 
+.. note:: ``docker build --rm`` does not affect the image cache which is used to accelerate builds, it only removes the duplicate writeable container layers.
+
 .. _cli_build_examples:
 
 .. seealso:: :ref:`dockerbuilder`.
@@ -206,7 +208,7 @@ Examples:
 
 .. code-block:: bash
 
-    $ sudo docker build .
+    $ sudo docker build --rm .
     Uploading context 10240 bytes
     Step 1 : FROM busybox
     Pulling repository busybox
@@ -229,6 +231,9 @@ Examples:
      ---> Running in 02071fceb21b
      ---> f52f38b7823e
     Successfully built f52f38b7823e
+    Removing intermediate container 9c9e81692ae9
+    Removing intermediate container 02071fceb21b
+
 
 This example specifies that the ``PATH`` is ``.``, and so all the files in
 the local directory get tar'd and sent to the Docker daemon.  The ``PATH``
@@ -243,6 +248,10 @@ The transfer of context from the local machine to the Docker daemon is
 what the ``docker`` client means when you see the "Uploading context"
 message.
 
+The ``--rm`` option tells Docker to remove the intermediate containers and 
+layers that were used to create each image layer. Doing so has no impact on
+the image build cache.
+
 
 .. code-block:: bash
 

From ecb0d90e1959185115c9cd6328d59435db0c8c9c Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Thu, 20 Feb 2014 23:42:31 -0700
Subject: [PATCH 170/403] Add newlines to the JSON stream functions

This makes the JSON streams a _lot_ easier to parse in less well-baked JSON parsers, and no less so in better ones.

Line-based JSON streams are very, very common, where simply chunk-based is not very common at all.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 060da572d20dfeee4fe02ce6b975a6cb33e50dbe
Component: engine
---
 components/engine/utils/streamformatter.go | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/components/engine/utils/streamformatter.go b/components/engine/utils/streamformatter.go
index 9345c3cb16..8876fa5cb7 100644
--- a/components/engine/utils/streamformatter.go
+++ b/components/engine/utils/streamformatter.go
@@ -14,6 +14,10 @@ func NewStreamFormatter(json bool) *StreamFormatter {
 	return &StreamFormatter{json, false}
 }
 
+const streamNewline = "\r\n"
+
+var streamNewlineBytes = []byte(streamNewline)
+
 func (sf *StreamFormatter) FormatStream(str string) []byte {
 	sf.used = true
 	if sf.json {
@@ -21,7 +25,7 @@ func (sf *StreamFormatter) FormatStream(str string) []byte {
 		if err != nil {
 			return sf.FormatError(err)
 		}
-		return b
+		return append(b, streamNewlineBytes...)
 	}
 	return []byte(str + "\r")
 }
@@ -34,9 +38,9 @@ func (sf *StreamFormatter) FormatStatus(id, format string, a ...interface{}) []b
 		if err != nil {
 			return sf.FormatError(err)
 		}
-		return b
+		return append(b, streamNewlineBytes...)
 	}
-	return []byte(str + "\r\n")
+	return []byte(str + streamNewline)
 }
 
 func (sf *StreamFormatter) FormatError(err error) []byte {
@@ -47,11 +51,11 @@ func (sf *StreamFormatter) FormatError(err error) []byte {
 			jsonError = &JSONError{Message: err.Error()}
 		}
 		if b, err := json.Marshal(&JSONMessage{Error: jsonError, ErrorMessage: err.Error()}); err == nil {
-			return b
+			return append(b, streamNewlineBytes...)
 		}
-		return []byte("{\"error\":\"format error\"}")
+		return []byte("{\"error\":\"format error\"}" + streamNewline)
 	}
-	return []byte("Error: " + err.Error() + "\r\n")
+	return []byte("Error: " + err.Error() + streamNewline)
 }
 
 func (sf *StreamFormatter) FormatProgress(id, action string, progress *JSONProgress) []byte {

From 611dddcc478506d48abd381ea33558b9361a0ce9 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Fri, 21 Feb 2014 17:42:02 +1000
Subject: [PATCH 171/403] small update to API docs to go with #4276

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: f83e553452db74b73e9de7fa770646e72e7af88f
Component: engine
---
 .../docs/sources/reference/api/docker_remote_api_v1.9.rst  | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
index 47cdb46b28..a7372d5dc8 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
@@ -993,12 +993,12 @@ Search images
 2.3 Misc
 --------
 
-Build an image from Dockerfile via stdin
-****************************************
+Build an image from Dockerfile
+******************************
 
 .. http:post:: /build
 
-   Build an image from Dockerfile via stdin
+   Build an image from Dockerfile using a POST body.
 
    **Example request**:
 
@@ -1032,6 +1032,7 @@ Build an image from Dockerfile via stdin
    :query t: repository name (and optionally a tag) to be applied to the resulting image in case of success
    :query q: suppress verbose build output
    :query nocache: do not use the cache when building the image
+   :query rm: Remove intermediate containers after a successful build
    :reqheader Content-type: should be set to ``"application/tar"``.
    :reqheader X-Registry-Config: base64-encoded ConfigFile object
    :statuscode 200: no error

From 9b049ad74b2a9602b9ceb2a0b46d75cb8184978d Mon Sep 17 00:00:00 2001
From: Darren Shepherd <darren.s.shepherd@gmail.com>
Date: Fri, 21 Feb 2014 03:02:06 -0700
Subject: [PATCH 172/403] Add MTU to lxc conf to make host and container MTU
 match

If you are using jumbo frames the host side of the veth was being set to
1500.  Docker would set the MTU of the container side of the veth to 9001.
This would lead to a situation in which the two sides of the veth had
different MTU sizes causing issues in network traffic.

Docker-DCO-1.1-Signed-off-by: Darren Shepherd <darren.s.shepherd@gmail.com> (github: ibuildthecloud)
Upstream-commit: 0db53bd2ecba097c6ace1a1088e11458e139390a
Component: engine
---
 components/engine/execdriver/lxc/lxc_template.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/execdriver/lxc/lxc_template.go b/components/engine/execdriver/lxc/lxc_template.go
index 639780f5d8..1181396a18 100644
--- a/components/engine/execdriver/lxc/lxc_template.go
+++ b/components/engine/execdriver/lxc/lxc_template.go
@@ -12,6 +12,7 @@ const LxcTemplate = `
 lxc.network.type = veth
 lxc.network.link = {{.Network.Bridge}}
 lxc.network.name = eth0
+lxc.network.mtu = {{.Network.Mtu}}
 {{else}}
 # network is disabled (-n=false)
 lxc.network.type = empty

From 1ddffb74450914ec32a16191ed75e14ef3f3bc52 Mon Sep 17 00:00:00 2001
From: Danny Berger <dpb587@gmail.com>
Date: Fri, 21 Feb 2014 10:51:51 -0500
Subject: [PATCH 173/403] Fix cli argument usage typo for docker --mtu

Docker-DCO-1.1-Signed-off-by: Danny Berger <dpb587@gmail.com> (github: dpb587)
Upstream-commit: 8c4160fe61151f38f471e93e7bf98dcbf5406a9e
Component: engine
---
 components/engine/docker/docker.go                           | 2 +-
 components/engine/docs/sources/reference/commandline/cli.rst | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 02c99b9316..9e93b71767 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -40,7 +40,7 @@ func main() {
 		flInterContainerComm = flag.Bool([]string{"#icc", "-icc"}, true, "Enable inter-container communication")
 		flGraphDriver        = flag.String([]string{"s", "-storage-driver"}, "", "Force the docker runtime to use a specific storage driver")
 		flHosts              = opts.NewListOpts(api.ValidateHost)
-		flMtu                = flag.Int([]string{"#mtu", "-mtu"}, 0, "Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if not default route is available")
+		flMtu                = flag.Int([]string{"#mtu", "-mtu"}, 0, "Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if no default route is available")
 	)
 	flag.Var(&flDns, []string{"#dns", "-dns"}, "Force docker to use specific DNS servers")
 	flag.Var(&flHosts, []string{"H", "-host"}, "tcp://host:port, unix://path/to/socket, fd://* or fd://socketfd to use in daemon mode. Multiple sockets can be specified")
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 41cdfe7cbb..d5267cd2d0 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -80,7 +80,7 @@ Commands
       -r, --restart=true: Restart previously running containers
       -s, --storage-driver="": Force the docker runtime to use a specific storage driver
       -v, --version=false: Print version information and quit
-      -mtu, --mtu=0: Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if not default route is available
+      -mtu, --mtu=0: Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if no default route is available
 
 The Docker daemon is the persistent process that manages containers.  Docker uses the same binary for both the 
 daemon and client.  To run the daemon you provide the ``-d`` flag.

From 1377718158903c7807629a8c96b730eacd961e65 Mon Sep 17 00:00:00 2001
From: Manuel Woelker <github@manuel.woelker.org>
Date: Fri, 21 Feb 2014 19:25:49 +0100
Subject: [PATCH 174/403] docs: document some JSON parameters
 /containers/create and /containers/(id)/start in remote api (fixes #2948)

Docker-DCO-1.1-Signed-off-by: Manuel Woelker <github@manuel.woelker.org> (github: manuel-woelker)
Upstream-commit: c3faab3955a6cfb5b36249889269dd8d272e9e8b
Component: engine
---
 .../reference/api/docker_remote_api_v1.8.rst    | 17 +++++++++++++++--
 .../reference/api/docker_remote_api_v1.9.rst    | 17 +++++++++++++++--
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.8.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.8.rst
index 5033f34210..b752f2f8a4 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.8.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.8.rst
@@ -118,6 +118,7 @@ Create a container
                 "User":"",
                 "Memory":0,
                 "MemorySwap":0,
+                "CpuShares":0,
                 "AttachStdin":false,
                 "AttachStdout":true,
                 "AttachStderr":true,
@@ -153,7 +154,15 @@ Create a container
                 "Warnings":[]
            }
 
-        :jsonparam config: the container's configuration
+        :jsonparam Hostname: Container host name
+        :jsonparam User: Username or UID
+        :jsonparam Memory: Memory Limit in bytes
+        :jsonparam CpuShares: CPU shares (relative weight)
+        :jsonparam AttachStdin: 1/True/true or 0/False/false, attach to standard input. Default false
+        :jsonparam AttachStdout: 1/True/true or 0/False/false, attach to standard output. Default false
+        :jsonparam AttachStderr: 1/True/true or 0/False/false, attach to standard error. Default false
+        :jsonparam Tty: 1/True/true or 0/False/false, allocate a pseudo-tty. Default false
+        :jsonparam OpenStdin: 1/True/true or 0/False/false, keep stdin open even if not attached. Default false
         :query name: Assign the specified name to the container. Must match ``/?[a-zA-Z0-9_-]+``.
         :statuscode 201: no error
         :statuscode 404: no such container
@@ -394,7 +403,11 @@ Start a container
            HTTP/1.1 204 No Content
            Content-Type: text/plain
 
-        :jsonparam hostConfig: the container's host configuration (optional)
+        :jsonparam Binds: Create a bind mount to a directory or file with [host-path]:[container-path]:[rw|ro]. If a directory "container-path" is missing, then docker creates a new volume.
+        :jsonparam LxcConf: Map of custom lxc options
+        :jsonparam PortBindings: Expose ports from the container, optionally publishing them via the HostPort flag
+        :jsonparam PublishAllPorts: 1/True/true or 0/False/false, publish all exposed ports to the host interfaces. Default false
+        :jsonparam Privileged: 1/True/true or 0/False/false, give extended privileges to this container. Default false
         :statuscode 204: no error
         :statuscode 404: no such container
         :statuscode 500: server error
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
index 47cdb46b28..3ea4761530 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.9.rst
@@ -118,6 +118,7 @@ Create a container
                 "User":"",
                 "Memory":0,
                 "MemorySwap":0,
+                "CpuShares":0,
                 "AttachStdin":false,
                 "AttachStdout":true,
                 "AttachStderr":true,
@@ -153,7 +154,15 @@ Create a container
                 "Warnings":[]
            }
 
-        :jsonparam config: the container's configuration
+        :jsonparam Hostname: Container host name
+        :jsonparam User: Username or UID
+        :jsonparam Memory: Memory Limit in bytes
+        :jsonparam CpuShares: CPU shares (relative weight)
+        :jsonparam AttachStdin: 1/True/true or 0/False/false, attach to standard input. Default false
+        :jsonparam AttachStdout: 1/True/true or 0/False/false, attach to standard output. Default false
+        :jsonparam AttachStderr: 1/True/true or 0/False/false, attach to standard error. Default false
+        :jsonparam Tty: 1/True/true or 0/False/false, allocate a pseudo-tty. Default false
+        :jsonparam OpenStdin: 1/True/true or 0/False/false, keep stdin open even if not attached. Default false
         :query name: Assign the specified name to the container. Must match ``/?[a-zA-Z0-9_-]+``.
         :statuscode 201: no error
         :statuscode 404: no such container
@@ -394,7 +403,11 @@ Start a container
            HTTP/1.1 204 No Content
            Content-Type: text/plain
 
-        :jsonparam hostConfig: the container's host configuration (optional)
+        :jsonparam Binds: Create a bind mount to a directory or file with [host-path]:[container-path]:[rw|ro]. If a directory "container-path" is missing, then docker creates a new volume.
+        :jsonparam LxcConf: Map of custom lxc options
+        :jsonparam PortBindings: Expose ports from the container, optionally publishing them via the HostPort flag
+        :jsonparam PublishAllPorts: 1/True/true or 0/False/false, publish all exposed ports to the host interfaces. Default false
+        :jsonparam Privileged: 1/True/true or 0/False/false, give extended privileges to this container. Default false
         :statuscode 204: no error
         :statuscode 404: no such container
         :statuscode 500: server error

From 56684e6d5fd1e1ccc45b72d197afc7bcfcda9fca Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Fri, 21 Feb 2014 11:26:04 -0700
Subject: [PATCH 175/403] Add simple "grep" to hide the harmless "warning: no
 packages being tested depend on ..." in "go test -coverpkg ..." output

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 41b1f93bf72e4c012a159a013697090efdcc183b
Component: engine
---
 components/engine/hack/make/test-integration | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/components/engine/hack/make/test-integration b/components/engine/hack/make/test-integration
index 93d63ad595..fa8b8be719 100644
--- a/components/engine/hack/make/test-integration
+++ b/components/engine/hack/make/test-integration
@@ -9,4 +9,8 @@ bundle_test_integration() {
 		"-coverpkg $(find_dirs '*.go' | sed 's,^\.,github.com/dotcloud/docker,g' | paste -d, -s)"
 }
 
-bundle_test_integration 2>&1 | tee $DEST/test.log
+# this "grep" hides some really irritating warnings that "go test -coverpkg"
+# spews when it is given packages that aren't used
+bundle_test_integration 2>&1 \
+	| grep -v '^warning: no packages being tested depend on ' \
+	| tee $DEST/test.log

From 773b1a3574130ad52890d26d8953ad474bf642bc Mon Sep 17 00:00:00 2001
From: Danny Berger <dpb587@gmail.com>
Date: Fri, 21 Feb 2014 13:43:03 -0500
Subject: [PATCH 176/403] Drop -mtu from docs in favor of --mtu only

Docker-DCO-1.1-Signed-off-by: Danny Berger <dpb587@gmail.com> (github: dpb587)
Upstream-commit: afb565e97c79b87d4563e8e728513ca5b50514c7
Component: engine
---
 components/engine/docs/sources/reference/commandline/cli.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index d5267cd2d0..67794a41c5 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -80,7 +80,7 @@ Commands
       -r, --restart=true: Restart previously running containers
       -s, --storage-driver="": Force the docker runtime to use a specific storage driver
       -v, --version=false: Print version information and quit
-      -mtu, --mtu=0: Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if no default route is available
+      --mtu=0: Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if no default route is available
 
 The Docker daemon is the persistent process that manages containers.  Docker uses the same binary for both the 
 daemon and client.  To run the daemon you provide the ``-d`` flag.

From 9de10592bc44924ac2e9571871969eb669794299 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 11:47:53 -0800
Subject: [PATCH 177/403] Move console into execdriver
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 8c783c1c1336d8f2d1b08b9cbd8e2298d066750c Component: engine

---
 components/engine/container.go          |  93 +++-------------
 components/engine/execdriver/console.go | 137 ++++++++++++++++++++++++
 components/engine/utils/utils.go        |   2 +-
 components/engine/utils/utils_test.go   |   2 +-
 4 files changed, 155 insertions(+), 79 deletions(-)
 create mode 100644 components/engine/execdriver/console.go

diff --git a/components/engine/container.go b/components/engine/container.go
index 9c7fc8ffd7..f38876ed24 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -10,10 +10,8 @@ import (
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/links"
 	"github.com/dotcloud/docker/nat"
-	"github.com/dotcloud/docker/pkg/term"
 	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
-	"github.com/kr/pty"
 	"io"
 	"io/ioutil"
 	"log"
@@ -57,11 +55,11 @@ type Container struct {
 	Driver         string
 
 	command   *execdriver.Command
+	console   execdriver.Console
 	stdout    *utils.WriteBroadcaster
 	stderr    *utils.WriteBroadcaster
 	stdin     io.ReadCloser
 	stdinPipe io.WriteCloser
-	ptyMaster io.Closer
 
 	runtime *Runtime
 
@@ -213,56 +211,6 @@ func (container *Container) generateEnvConfig(env []string) error {
 	return nil
 }
 
-func (container *Container) setupPty() error {
-	ptyMaster, ptySlave, err := pty.Open()
-	if err != nil {
-		return err
-	}
-	container.ptyMaster = ptyMaster
-	container.command.Stdout = ptySlave
-	container.command.Stderr = ptySlave
-	container.command.Console = ptySlave.Name()
-
-	// Copy the PTYs to our broadcasters
-	go func() {
-		defer container.stdout.CloseWriters()
-		utils.Debugf("startPty: begin of stdout pipe")
-		io.Copy(container.stdout, ptyMaster)
-		utils.Debugf("startPty: end of stdout pipe")
-	}()
-
-	// stdin
-	if container.Config.OpenStdin {
-		container.command.Stdin = ptySlave
-		container.command.SysProcAttr.Setctty = true
-		go func() {
-			defer container.stdin.Close()
-			utils.Debugf("startPty: begin of stdin pipe")
-			io.Copy(ptyMaster, container.stdin)
-			utils.Debugf("startPty: end of stdin pipe")
-		}()
-	}
-	return nil
-}
-
-func (container *Container) setupStd() error {
-	container.command.Stdout = container.stdout
-	container.command.Stderr = container.stderr
-	if container.Config.OpenStdin {
-		stdin, err := container.command.StdinPipe()
-		if err != nil {
-			return err
-		}
-		go func() {
-			defer stdin.Close()
-			utils.Debugf("start: begin of stdin pipe")
-			io.Copy(stdin, container.stdin)
-			utils.Debugf("start: end of stdin pipe")
-		}()
-	}
-	return nil
-}
-
 func (container *Container) Attach(stdin io.ReadCloser, stdinCloser io.Closer, stdout io.Writer, stderr io.Writer) chan error {
 	var cStdout, cStderr io.ReadCloser
 
@@ -593,14 +541,13 @@ func (container *Container) Start() (err error) {
 	}
 	container.waitLock = make(chan struct{})
 
-	// Setuping pipes and/or Pty
-	var setup func() error
-	if container.Config.Tty {
-		setup = container.setupPty
-	} else {
-		setup = container.setupStd
+	container.console, err = execdriver.NewConsole(
+		container.stdin, container.stdout, container.stderr,
+		container.Config.OpenStdin, container.Config.Tty)
+	if err != nil {
+		return err
 	}
-	if err := setup(); err != nil {
+	if err := container.console.AttachTo(container.command); err != nil {
 		return err
 	}
 
@@ -887,22 +834,20 @@ func (container *Container) cleanup() {
 			link.Disable()
 		}
 	}
-
 	if container.Config.OpenStdin {
 		if err := container.stdin.Close(); err != nil {
 			utils.Errorf("%s: Error close stdin: %s", container.ID, err)
 		}
 	}
-	if err := container.stdout.CloseWriters(); err != nil {
+	if err := container.stdout.Close(); err != nil {
 		utils.Errorf("%s: Error close stdout: %s", container.ID, err)
 	}
-	if err := container.stderr.CloseWriters(); err != nil {
+	if err := container.stderr.Close(); err != nil {
 		utils.Errorf("%s: Error close stderr: %s", container.ID, err)
 	}
-
-	if container.ptyMaster != nil {
-		if err := container.ptyMaster.Close(); err != nil {
-			utils.Errorf("%s: Error closing Pty master: %s", container.ID, err)
+	if container.console != nil {
+		if err := container.console.Close(); err != nil {
+			utils.Errorf("%s: Error closing console: %s", container.ID, err)
 		}
 	}
 
@@ -994,11 +939,7 @@ func (container *Container) Wait() int {
 }
 
 func (container *Container) Resize(h, w int) error {
-	pty, ok := container.ptyMaster.(*os.File)
-	if !ok {
-		return fmt.Errorf("ptyMaster does not have Fd() method")
-	}
-	return term.SetWinsize(pty.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+	return container.console.Resize(h, w)
 }
 
 func (container *Container) ExportRw() (archive.Archive, error) {
@@ -1202,11 +1143,9 @@ func (container *Container) Exposes(p nat.Port) bool {
 }
 
 func (container *Container) GetPtyMaster() (*os.File, error) {
-	if container.ptyMaster == nil {
+	ttyConsole, ok := container.console.(*execdriver.TtyConsole)
+	if !ok {
 		return nil, ErrNoTTY
 	}
-	if pty, ok := container.ptyMaster.(*os.File); ok {
-		return pty, nil
-	}
-	return nil, ErrNotATTY
+	return ttyConsole.Master, nil
 }
diff --git a/components/engine/execdriver/console.go b/components/engine/execdriver/console.go
new file mode 100644
index 0000000000..01b45afb60
--- /dev/null
+++ b/components/engine/execdriver/console.go
@@ -0,0 +1,137 @@
+package execdriver
+
+import (
+	"github.com/dotcloud/docker/pkg/term"
+	"github.com/kr/pty"
+	"io"
+	"os"
+)
+
+type Console interface {
+	io.Closer
+	Resize(height, width int) error
+	AttachTo(command *Command) error
+}
+
+type pipes struct {
+	Stdin          io.ReadCloser
+	Stdout, Stderr io.WriteCloser
+}
+
+func (p *pipes) Close() error {
+	if p.Stderr != nil {
+		p.Stdin.Close()
+	}
+	if p.Stdout != nil {
+		p.Stdout.Close()
+	}
+	if p.Stderr != nil {
+		p.Stderr.Close()
+	}
+	return nil
+}
+
+func NewConsole(stdin io.ReadCloser, stdout, stderr io.WriteCloser, useStdin, tty bool) (Console, error) {
+	p := &pipes{
+		Stdout: stdout,
+		Stderr: stderr,
+	}
+	if useStdin {
+		p.Stdin = stdin
+	}
+	if tty {
+		return NewTtyConsole(p)
+	}
+	return NewStdConsole(p)
+}
+
+type TtyConsole struct {
+	Master *os.File
+	Slave  *os.File
+	pipes  *pipes
+}
+
+func NewTtyConsole(p *pipes) (*TtyConsole, error) {
+	ptyMaster, ptySlave, err := pty.Open()
+	if err != nil {
+		return nil, err
+	}
+	tty := &TtyConsole{
+		Master: ptyMaster,
+		Slave:  ptySlave,
+		pipes:  p,
+	}
+	return tty, nil
+}
+
+func (t *TtyConsole) Resize(h, w int) error {
+	return term.SetWinsize(t.Master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+
+}
+
+func (t *TtyConsole) AttachTo(command *Command) error {
+	command.Stdout = t.Slave
+	command.Stderr = t.Slave
+
+	command.Console = t.Slave.Name()
+
+	go func() {
+		defer t.pipes.Stdout.Close()
+		io.Copy(t.pipes.Stdout, t.Master)
+	}()
+
+	if t.pipes.Stdin != nil {
+		command.Stdin = t.Slave
+		command.SysProcAttr.Setctty = true
+
+		go func() {
+			defer t.pipes.Stdin.Close()
+			io.Copy(t.Master, t.pipes.Stdin)
+		}()
+	}
+	return nil
+}
+
+func (t *TtyConsole) Close() error {
+	err := t.Slave.Close()
+	if merr := t.Master.Close(); err == nil {
+		err = merr
+	}
+	return err
+}
+
+type StdConsole struct {
+	pipes *pipes
+}
+
+func NewStdConsole(p *pipes) (*StdConsole, error) {
+	return &StdConsole{p}, nil
+}
+
+func (s *StdConsole) AttachTo(command *Command) error {
+	command.Stdout = s.pipes.Stdout
+	command.Stderr = s.pipes.Stderr
+
+	if s.pipes.Stdin != nil {
+		stdin, err := command.StdinPipe()
+		if err != nil {
+			return err
+		}
+
+		go func() {
+			defer stdin.Close()
+			io.Copy(stdin, s.pipes.Stdin)
+		}()
+	}
+	return nil
+}
+
+func (s *StdConsole) Resize(h, w int) error {
+	// we do not need to reside a non tty
+	return nil
+}
+
+func (s *StdConsole) Close() error {
+	// nothing to close here
+	return nil
+}
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 1aba80ff41..3a87f76f5f 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -388,7 +388,7 @@ func (w *WriteBroadcaster) Write(p []byte) (n int, err error) {
 	return len(p), nil
 }
 
-func (w *WriteBroadcaster) CloseWriters() error {
+func (w *WriteBroadcaster) Close() error {
 	w.Lock()
 	defer w.Unlock()
 	for sw := range w.writers {
diff --git a/components/engine/utils/utils_test.go b/components/engine/utils/utils_test.go
index 7e63a45cf7..f8b3920548 100644
--- a/components/engine/utils/utils_test.go
+++ b/components/engine/utils/utils_test.go
@@ -110,7 +110,7 @@ func TestWriteBroadcaster(t *testing.T) {
 		t.Errorf("Buffer contains %v", bufferC.String())
 	}
 
-	writer.CloseWriters()
+	writer.Close()
 }
 
 type devNullCloser int

From a808fdbf65a64c8aba7f9e56b4df6c9818247e0b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 12:32:14 -0800
Subject: [PATCH 178/403] Change Console to Terminal

Move creation and attach to driver
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 1e742876988546efb876f67f83de6737ee5e9cf6
Component: engine
---
 components/engine/container.go                |  27 ++--
 components/engine/execdriver/chroot/driver.go |   2 +-
 components/engine/execdriver/console.go       | 137 ------------------
 components/engine/execdriver/driver.go        |   6 +-
 components/engine/execdriver/lxc/driver.go    |   7 +-
 components/engine/execdriver/term.go          | 137 ++++++++++++++++++
 components/engine/runtime.go                  |   4 +-
 7 files changed, 159 insertions(+), 161 deletions(-)
 delete mode 100644 components/engine/execdriver/console.go
 create mode 100644 components/engine/execdriver/term.go

diff --git a/components/engine/container.go b/components/engine/container.go
index f38876ed24..025479f240 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -55,7 +55,6 @@ type Container struct {
 	Driver         string
 
 	command   *execdriver.Command
-	console   execdriver.Console
 	stdout    *utils.WriteBroadcaster
 	stderr    *utils.WriteBroadcaster
 	stdin     io.ReadCloser
@@ -531,6 +530,9 @@ func (container *Container) Start() (err error) {
 	}
 
 	populateCommand(container)
+	if err := execdriver.NewTerminal(container.command); err != nil {
+		return err
+	}
 
 	// Setup logging of stdout and stderr to disk
 	if err := container.runtime.LogToDisk(container.stdout, container.logPath("json"), "stdout"); err != nil {
@@ -541,16 +543,6 @@ func (container *Container) Start() (err error) {
 	}
 	container.waitLock = make(chan struct{})
 
-	container.console, err = execdriver.NewConsole(
-		container.stdin, container.stdout, container.stderr,
-		container.Config.OpenStdin, container.Config.Tty)
-	if err != nil {
-		return err
-	}
-	if err := container.console.AttachTo(container.command); err != nil {
-		return err
-	}
-
 	callbackLock := make(chan struct{})
 	callback := func(command *execdriver.Command) {
 		container.State.SetRunning(command.Pid())
@@ -790,7 +782,8 @@ func (container *Container) monitor(callback execdriver.StartCallback) error {
 		populateCommand(container)
 		err = container.runtime.RestoreCommand(container)
 	} else {
-		exitCode, err = container.runtime.Run(container, callback)
+		pipes := execdriver.NewPipes(container.stdin, container.stdout, container.stderr, container.Config.OpenStdin)
+		exitCode, err = container.runtime.Run(container, pipes, callback)
 	}
 
 	if err != nil {
@@ -845,9 +838,9 @@ func (container *Container) cleanup() {
 	if err := container.stderr.Close(); err != nil {
 		utils.Errorf("%s: Error close stderr: %s", container.ID, err)
 	}
-	if container.console != nil {
-		if err := container.console.Close(); err != nil {
-			utils.Errorf("%s: Error closing console: %s", container.ID, err)
+	if container.command.Terminal != nil {
+		if err := container.command.Terminal.Close(); err != nil {
+			utils.Errorf("%s: Error closing terminal: %s", container.ID, err)
 		}
 	}
 
@@ -939,7 +932,7 @@ func (container *Container) Wait() int {
 }
 
 func (container *Container) Resize(h, w int) error {
-	return container.console.Resize(h, w)
+	return container.command.Terminal.Resize(h, w)
 }
 
 func (container *Container) ExportRw() (archive.Archive, error) {
@@ -1143,7 +1136,7 @@ func (container *Container) Exposes(p nat.Port) bool {
 }
 
 func (container *Container) GetPtyMaster() (*os.File, error) {
-	ttyConsole, ok := container.console.(*execdriver.TtyConsole)
+	ttyConsole, ok := container.command.Terminal.(*execdriver.TtyConsole)
 	if !ok {
 		return nil, ErrNoTTY
 	}
diff --git a/components/engine/execdriver/chroot/driver.go b/components/engine/execdriver/chroot/driver.go
index 396df87bad..dfec680d84 100644
--- a/components/engine/execdriver/chroot/driver.go
+++ b/components/engine/execdriver/chroot/driver.go
@@ -37,7 +37,7 @@ func NewDriver() (*driver, error) {
 	return &driver{}, nil
 }
 
-func (d *driver) Run(c *execdriver.Command, startCallback execdriver.StartCallback) (int, error) {
+func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
 	params := []string{
 		"chroot",
 		c.Rootfs,
diff --git a/components/engine/execdriver/console.go b/components/engine/execdriver/console.go
deleted file mode 100644
index 01b45afb60..0000000000
--- a/components/engine/execdriver/console.go
+++ /dev/null
@@ -1,137 +0,0 @@
-package execdriver
-
-import (
-	"github.com/dotcloud/docker/pkg/term"
-	"github.com/kr/pty"
-	"io"
-	"os"
-)
-
-type Console interface {
-	io.Closer
-	Resize(height, width int) error
-	AttachTo(command *Command) error
-}
-
-type pipes struct {
-	Stdin          io.ReadCloser
-	Stdout, Stderr io.WriteCloser
-}
-
-func (p *pipes) Close() error {
-	if p.Stderr != nil {
-		p.Stdin.Close()
-	}
-	if p.Stdout != nil {
-		p.Stdout.Close()
-	}
-	if p.Stderr != nil {
-		p.Stderr.Close()
-	}
-	return nil
-}
-
-func NewConsole(stdin io.ReadCloser, stdout, stderr io.WriteCloser, useStdin, tty bool) (Console, error) {
-	p := &pipes{
-		Stdout: stdout,
-		Stderr: stderr,
-	}
-	if useStdin {
-		p.Stdin = stdin
-	}
-	if tty {
-		return NewTtyConsole(p)
-	}
-	return NewStdConsole(p)
-}
-
-type TtyConsole struct {
-	Master *os.File
-	Slave  *os.File
-	pipes  *pipes
-}
-
-func NewTtyConsole(p *pipes) (*TtyConsole, error) {
-	ptyMaster, ptySlave, err := pty.Open()
-	if err != nil {
-		return nil, err
-	}
-	tty := &TtyConsole{
-		Master: ptyMaster,
-		Slave:  ptySlave,
-		pipes:  p,
-	}
-	return tty, nil
-}
-
-func (t *TtyConsole) Resize(h, w int) error {
-	return term.SetWinsize(t.Master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
-
-}
-
-func (t *TtyConsole) AttachTo(command *Command) error {
-	command.Stdout = t.Slave
-	command.Stderr = t.Slave
-
-	command.Console = t.Slave.Name()
-
-	go func() {
-		defer t.pipes.Stdout.Close()
-		io.Copy(t.pipes.Stdout, t.Master)
-	}()
-
-	if t.pipes.Stdin != nil {
-		command.Stdin = t.Slave
-		command.SysProcAttr.Setctty = true
-
-		go func() {
-			defer t.pipes.Stdin.Close()
-			io.Copy(t.Master, t.pipes.Stdin)
-		}()
-	}
-	return nil
-}
-
-func (t *TtyConsole) Close() error {
-	err := t.Slave.Close()
-	if merr := t.Master.Close(); err == nil {
-		err = merr
-	}
-	return err
-}
-
-type StdConsole struct {
-	pipes *pipes
-}
-
-func NewStdConsole(p *pipes) (*StdConsole, error) {
-	return &StdConsole{p}, nil
-}
-
-func (s *StdConsole) AttachTo(command *Command) error {
-	command.Stdout = s.pipes.Stdout
-	command.Stderr = s.pipes.Stderr
-
-	if s.pipes.Stdin != nil {
-		stdin, err := command.StdinPipe()
-		if err != nil {
-			return err
-		}
-
-		go func() {
-			defer stdin.Close()
-			io.Copy(stdin, s.pipes.Stdin)
-		}()
-	}
-	return nil
-}
-
-func (s *StdConsole) Resize(h, w int) error {
-	// we do not need to reside a non tty
-	return nil
-}
-
-func (s *StdConsole) Close() error {
-	// nothing to close here
-	return nil
-}
diff --git a/components/engine/execdriver/driver.go b/components/engine/execdriver/driver.go
index 32b39771b6..c9f62f500e 100644
--- a/components/engine/execdriver/driver.go
+++ b/components/engine/execdriver/driver.go
@@ -58,7 +58,7 @@ type Info interface {
 }
 
 type Driver interface {
-	Run(c *Command, startCallback StartCallback) (int, error) // Run executes the process and blocks until the process exits and returns the exit code
+	Run(c *Command, pipes *Pipes, startCallback StartCallback) (int, error) // Run executes the process and blocks until the process exits and returns the exit code
 	Kill(c *Command, sig int) error
 	Restore(c *Command) error                     // Wait and try to re-attach on an out of process command
 	Name() string                                 // Driver name
@@ -82,7 +82,6 @@ type Resources struct {
 }
 
 // Process wrapps an os/exec.Cmd to add more metadata
-// TODO: Rename to Command
 type Command struct {
 	exec.Cmd `json:"-"`
 
@@ -100,7 +99,8 @@ type Command struct {
 	Config     []string   `json:"config"`  //  generic values that specific drivers can consume
 	Resources  *Resources `json:"resources"`
 
-	Console string `json:"-"`
+	Terminal Term   `json:"-"`
+	Console  string `json:"-"`
 }
 
 // Return the pid of the process
diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index ee4d02a6b6..da3bc1ec7c 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -76,7 +76,12 @@ func (d *driver) Name() string {
 	return fmt.Sprintf("%s-%s", DriverName, version)
 }
 
-func (d *driver) Run(c *execdriver.Command, startCallback execdriver.StartCallback) (int, error) {
+func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
+	if c.Terminal != nil {
+		if err := c.Terminal.Attach(pipes); err != nil {
+			return -1, err
+		}
+	}
 	configPath, err := d.generateLXCConfig(c)
 	if err != nil {
 		return -1, err
diff --git a/components/engine/execdriver/term.go b/components/engine/execdriver/term.go
new file mode 100644
index 0000000000..e7ec46653c
--- /dev/null
+++ b/components/engine/execdriver/term.go
@@ -0,0 +1,137 @@
+package execdriver
+
+import (
+	"github.com/dotcloud/docker/pkg/term"
+	"github.com/kr/pty"
+	"io"
+	"os"
+)
+
+type Term interface {
+	io.Closer
+	Resize(height, width int) error
+	Attach(pipes *Pipes) error
+}
+
+type Pipes struct {
+	Stdin          io.ReadCloser
+	Stdout, Stderr io.WriteCloser
+}
+
+func NewPipes(stdin io.ReadCloser, stdout, stderr io.WriteCloser, useStdin bool) *Pipes {
+	p := &Pipes{
+		Stdout: stdout,
+		Stderr: stderr,
+	}
+	if useStdin {
+		p.Stdin = stdin
+	}
+	return p
+}
+
+func NewTerminal(command *Command) error {
+	var (
+		term Term
+		err  error
+	)
+	if command.Tty {
+		term, err = NewTtyConsole(command)
+	} else {
+		term, err = NewStdConsole(command)
+	}
+	if err != nil {
+		return err
+	}
+	command.Terminal = term
+	return nil
+}
+
+type TtyConsole struct {
+	command *Command
+	Master  *os.File
+	Slave   *os.File
+}
+
+func NewTtyConsole(command *Command) (*TtyConsole, error) {
+	ptyMaster, ptySlave, err := pty.Open()
+	if err != nil {
+		return nil, err
+	}
+	tty := &TtyConsole{
+		Master:  ptyMaster,
+		Slave:   ptySlave,
+		command: command,
+	}
+	return tty, nil
+}
+
+func (t *TtyConsole) Resize(h, w int) error {
+	return term.SetWinsize(t.Master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+}
+
+func (t *TtyConsole) Attach(pipes *Pipes) error {
+	t.command.Stdout = t.Slave
+	t.command.Stderr = t.Slave
+
+	t.command.Console = t.Slave.Name()
+
+	go func() {
+		defer pipes.Stdout.Close()
+		io.Copy(pipes.Stdout, t.Master)
+	}()
+
+	if pipes.Stdin != nil {
+		t.command.Stdin = t.Slave
+		t.command.SysProcAttr.Setctty = true
+
+		go func() {
+			defer pipes.Stdin.Close()
+			io.Copy(t.Master, pipes.Stdin)
+		}()
+	}
+	return nil
+}
+
+func (t *TtyConsole) Close() error {
+	err := t.Slave.Close()
+	if merr := t.Master.Close(); err == nil {
+		err = merr
+	}
+	return err
+}
+
+type StdConsole struct {
+	command *Command
+}
+
+func NewStdConsole(command *Command) (*StdConsole, error) {
+	return &StdConsole{command}, nil
+}
+
+func (s *StdConsole) Attach(pipes *Pipes) error {
+	s.command.Stdout = pipes.Stdout
+	s.command.Stderr = pipes.Stderr
+
+	if pipes.Stdin != nil {
+		stdin, err := s.command.StdinPipe()
+		if err != nil {
+			return err
+		}
+
+		go func() {
+			defer stdin.Close()
+			io.Copy(stdin, pipes.Stdin)
+		}()
+	}
+	return nil
+}
+
+func (s *StdConsole) Resize(h, w int) error {
+	// we do not need to reside a non tty
+	return nil
+}
+
+func (s *StdConsole) Close() error {
+	// nothing to close here
+	return nil
+}
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index eed28f92ab..a38109cca0 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -812,8 +812,8 @@ func (runtime *Runtime) Diff(container *Container) (archive.Archive, error) {
 	}), nil
 }
 
-func (runtime *Runtime) Run(c *Container, startCallback execdriver.StartCallback) (int, error) {
-	return runtime.execDriver.Run(c.command, startCallback)
+func (runtime *Runtime) Run(c *Container, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
+	return runtime.execDriver.Run(c.command, pipes, startCallback)
 }
 
 func (runtime *Runtime) Kill(c *Container, sig int) error {

From b0992a0e9909521c8229a94c4d78c8b414a326cc Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 12:42:37 -0800
Subject: [PATCH 179/403] Move term creation into driver
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 592c2f6f9a472bda227a03c819f73b8edc7c3320 Component: engine

---
 components/engine/container.go             |  3 --
 components/engine/execdriver/lxc/driver.go |  6 +--
 components/engine/execdriver/term.go       | 61 +++++++++++-----------
 3 files changed, 33 insertions(+), 37 deletions(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index 025479f240..733a31d5a2 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -530,9 +530,6 @@ func (container *Container) Start() (err error) {
 	}
 
 	populateCommand(container)
-	if err := execdriver.NewTerminal(container.command); err != nil {
-		return err
-	}
 
 	// Setup logging of stdout and stderr to disk
 	if err := container.runtime.LogToDisk(container.stdout, container.logPath("json"), "stdout"); err != nil {
diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index da3bc1ec7c..c18b2e6ab4 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -77,10 +77,8 @@ func (d *driver) Name() string {
 }
 
 func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
-	if c.Terminal != nil {
-		if err := c.Terminal.Attach(pipes); err != nil {
-			return -1, err
-		}
+	if err := execdriver.SetTerminal(c, pipes); err != nil {
+		return -1, err
 	}
 	configPath, err := d.generateLXCConfig(c)
 	if err != nil {
diff --git a/components/engine/execdriver/term.go b/components/engine/execdriver/term.go
index e7ec46653c..ab399e8337 100644
--- a/components/engine/execdriver/term.go
+++ b/components/engine/execdriver/term.go
@@ -10,7 +10,6 @@ import (
 type Term interface {
 	io.Closer
 	Resize(height, width int) error
-	Attach(pipes *Pipes) error
 }
 
 type Pipes struct {
@@ -29,15 +28,15 @@ func NewPipes(stdin io.ReadCloser, stdout, stderr io.WriteCloser, useStdin bool)
 	return p
 }
 
-func NewTerminal(command *Command) error {
+func SetTerminal(command *Command, pipes *Pipes) error {
 	var (
 		term Term
 		err  error
 	)
 	if command.Tty {
-		term, err = NewTtyConsole(command)
+		term, err = NewTtyConsole(command, pipes)
 	} else {
-		term, err = NewStdConsole(command)
+		term, err = NewStdConsole(command, pipes)
 	}
 	if err != nil {
 		return err
@@ -47,20 +46,22 @@ func NewTerminal(command *Command) error {
 }
 
 type TtyConsole struct {
-	command *Command
-	Master  *os.File
-	Slave   *os.File
+	Master *os.File
+	Slave  *os.File
 }
 
-func NewTtyConsole(command *Command) (*TtyConsole, error) {
+func NewTtyConsole(command *Command, pipes *Pipes) (*TtyConsole, error) {
 	ptyMaster, ptySlave, err := pty.Open()
 	if err != nil {
 		return nil, err
 	}
 	tty := &TtyConsole{
-		Master:  ptyMaster,
-		Slave:   ptySlave,
-		command: command,
+		Master: ptyMaster,
+		Slave:  ptySlave,
+	}
+	if err := tty.attach(command, pipes); err != nil {
+		tty.Close()
+		return nil, err
 	}
 	return tty, nil
 }
@@ -69,11 +70,10 @@ func (t *TtyConsole) Resize(h, w int) error {
 	return term.SetWinsize(t.Master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
 }
 
-func (t *TtyConsole) Attach(pipes *Pipes) error {
-	t.command.Stdout = t.Slave
-	t.command.Stderr = t.Slave
-
-	t.command.Console = t.Slave.Name()
+func (t *TtyConsole) attach(command *Command, pipes *Pipes) error {
+	command.Stdout = t.Slave
+	command.Stderr = t.Slave
+	command.Console = t.Slave.Name()
 
 	go func() {
 		defer pipes.Stdout.Close()
@@ -81,8 +81,8 @@ func (t *TtyConsole) Attach(pipes *Pipes) error {
 	}()
 
 	if pipes.Stdin != nil {
-		t.command.Stdin = t.Slave
-		t.command.SysProcAttr.Setctty = true
+		command.Stdin = t.Slave
+		command.SysProcAttr.Setctty = true
 
 		go func() {
 			defer pipes.Stdin.Close()
@@ -93,27 +93,28 @@ func (t *TtyConsole) Attach(pipes *Pipes) error {
 }
 
 func (t *TtyConsole) Close() error {
-	err := t.Slave.Close()
-	if merr := t.Master.Close(); err == nil {
-		err = merr
-	}
-	return err
+	t.Slave.Close()
+	return t.Master.Close()
 }
 
 type StdConsole struct {
-	command *Command
 }
 
-func NewStdConsole(command *Command) (*StdConsole, error) {
-	return &StdConsole{command}, nil
+func NewStdConsole(command *Command, pipes *Pipes) (*StdConsole, error) {
+	std := &StdConsole{}
+
+	if err := std.attach(command, pipes); err != nil {
+		return nil, err
+	}
+	return std, nil
 }
 
-func (s *StdConsole) Attach(pipes *Pipes) error {
-	s.command.Stdout = pipes.Stdout
-	s.command.Stderr = pipes.Stderr
+func (s *StdConsole) attach(command *Command, pipes *Pipes) error {
+	command.Stdout = pipes.Stdout
+	command.Stderr = pipes.Stderr
 
 	if pipes.Stdin != nil {
-		stdin, err := s.command.StdinPipe()
+		stdin, err := command.StdinPipe()
 		if err != nil {
 			return err
 		}

From a3562ba47c04923c3e1a77c1d5bf0e64c08de52f Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 12:52:18 -0800
Subject: [PATCH 180/403] Add CloseWriters back and do an interface cast
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 8e2284aaa2364a8e47a8058e65d60813f9cd5089 Component: engine

---
 components/engine/container.go        |  4 ++--
 components/engine/execdriver/term.go  | 10 +++++++---
 components/engine/utils/utils.go      |  2 +-
 components/engine/utils/utils_test.go |  2 +-
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index 733a31d5a2..218ae1e4a8 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -829,10 +829,10 @@ func (container *Container) cleanup() {
 			utils.Errorf("%s: Error close stdin: %s", container.ID, err)
 		}
 	}
-	if err := container.stdout.Close(); err != nil {
+	if err := container.stdout.CloseWriters(); err != nil {
 		utils.Errorf("%s: Error close stdout: %s", container.ID, err)
 	}
-	if err := container.stderr.Close(); err != nil {
+	if err := container.stderr.CloseWriters(); err != nil {
 		utils.Errorf("%s: Error close stderr: %s", container.ID, err)
 	}
 	if container.command.Terminal != nil {
diff --git a/components/engine/execdriver/term.go b/components/engine/execdriver/term.go
index ab399e8337..ec3c368012 100644
--- a/components/engine/execdriver/term.go
+++ b/components/engine/execdriver/term.go
@@ -14,10 +14,10 @@ type Term interface {
 
 type Pipes struct {
 	Stdin          io.ReadCloser
-	Stdout, Stderr io.WriteCloser
+	Stdout, Stderr io.Writer
 }
 
-func NewPipes(stdin io.ReadCloser, stdout, stderr io.WriteCloser, useStdin bool) *Pipes {
+func NewPipes(stdin io.ReadCloser, stdout, stderr io.Writer, useStdin bool) *Pipes {
 	p := &Pipes{
 		Stdout: stdout,
 		Stderr: stderr,
@@ -76,7 +76,11 @@ func (t *TtyConsole) attach(command *Command, pipes *Pipes) error {
 	command.Console = t.Slave.Name()
 
 	go func() {
-		defer pipes.Stdout.Close()
+		if wb, ok := pipes.Stdout.(interface {
+			CloseWriters() error
+		}); ok {
+			defer wb.CloseWriters()
+		}
 		io.Copy(pipes.Stdout, t.Master)
 	}()
 
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 3a87f76f5f..1aba80ff41 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -388,7 +388,7 @@ func (w *WriteBroadcaster) Write(p []byte) (n int, err error) {
 	return len(p), nil
 }
 
-func (w *WriteBroadcaster) Close() error {
+func (w *WriteBroadcaster) CloseWriters() error {
 	w.Lock()
 	defer w.Unlock()
 	for sw := range w.writers {
diff --git a/components/engine/utils/utils_test.go b/components/engine/utils/utils_test.go
index f8b3920548..7e63a45cf7 100644
--- a/components/engine/utils/utils_test.go
+++ b/components/engine/utils/utils_test.go
@@ -110,7 +110,7 @@ func TestWriteBroadcaster(t *testing.T) {
 		t.Errorf("Buffer contains %v", bufferC.String())
 	}
 
-	writer.Close()
+	writer.CloseWriters()
 }
 
 type devNullCloser int

From 28cc135001feb3e5bfb593e39308fdd224622de9 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 13:27:15 -0800
Subject: [PATCH 181/403] Move current tty and pipe impl to lxc driver
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 aac702727ea02b3974a2848748b0713ac583fc84 Component: engine

---
 components/engine/container.go                |  4 +-
 components/engine/execdriver/driver.go        | 18 ++++-
 components/engine/execdriver/lxc/driver.go    |  2 +-
 .../engine/execdriver/{ => lxc}/term.go       | 68 +++++++------------
 components/engine/execdriver/pipes.go         | 23 +++++++
 5 files changed, 68 insertions(+), 47 deletions(-)
 rename components/engine/execdriver/{ => lxc}/term.go (58%)
 create mode 100644 components/engine/execdriver/pipes.go

diff --git a/components/engine/container.go b/components/engine/container.go
index 218ae1e4a8..ca53bb57c7 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -1133,9 +1133,9 @@ func (container *Container) Exposes(p nat.Port) bool {
 }
 
 func (container *Container) GetPtyMaster() (*os.File, error) {
-	ttyConsole, ok := container.command.Terminal.(*execdriver.TtyConsole)
+	ttyConsole, ok := container.command.Terminal.(execdriver.TtyTerminal)
 	if !ok {
 		return nil, ErrNoTTY
 	}
-	return ttyConsole.Master, nil
+	return ttyConsole.Master(), nil
 }
diff --git a/components/engine/execdriver/driver.go b/components/engine/execdriver/driver.go
index c9f62f500e..a6d865caf3 100644
--- a/components/engine/execdriver/driver.go
+++ b/components/engine/execdriver/driver.go
@@ -2,6 +2,8 @@ package execdriver
 
 import (
 	"errors"
+	"io"
+	"os"
 	"os/exec"
 )
 
@@ -57,6 +59,18 @@ type Info interface {
 	IsRunning() bool
 }
 
+// Terminal in an interface for drivers to implement
+// if they want to support Close and Resize calls from
+// the core
+type Terminal interface {
+	io.Closer
+	Resize(height, width int) error
+}
+
+type TtyTerminal interface {
+	Master() *os.File
+}
+
 type Driver interface {
 	Run(c *Command, pipes *Pipes, startCallback StartCallback) (int, error) // Run executes the process and blocks until the process exits and returns the exit code
 	Kill(c *Command, sig int) error
@@ -99,8 +113,8 @@ type Command struct {
 	Config     []string   `json:"config"`  //  generic values that specific drivers can consume
 	Resources  *Resources `json:"resources"`
 
-	Terminal Term   `json:"-"`
-	Console  string `json:"-"`
+	Terminal Terminal `json:"-"` // standard or tty terminal
+	Console  string   `json:"-"` // dev/console path
 }
 
 // Return the pid of the process
diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index c18b2e6ab4..5be7ad2219 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -77,7 +77,7 @@ func (d *driver) Name() string {
 }
 
 func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
-	if err := execdriver.SetTerminal(c, pipes); err != nil {
+	if err := SetTerminal(c, pipes); err != nil {
 		return -1, err
 	}
 	configPath, err := d.generateLXCConfig(c)
diff --git a/components/engine/execdriver/term.go b/components/engine/execdriver/lxc/term.go
similarity index 58%
rename from components/engine/execdriver/term.go
rename to components/engine/execdriver/lxc/term.go
index ec3c368012..d772f60972 100644
--- a/components/engine/execdriver/term.go
+++ b/components/engine/execdriver/lxc/term.go
@@ -1,36 +1,16 @@
-package execdriver
+package lxc
 
 import (
+	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/pkg/term"
 	"github.com/kr/pty"
 	"io"
 	"os"
 )
 
-type Term interface {
-	io.Closer
-	Resize(height, width int) error
-}
-
-type Pipes struct {
-	Stdin          io.ReadCloser
-	Stdout, Stderr io.Writer
-}
-
-func NewPipes(stdin io.ReadCloser, stdout, stderr io.Writer, useStdin bool) *Pipes {
-	p := &Pipes{
-		Stdout: stdout,
-		Stderr: stderr,
-	}
-	if useStdin {
-		p.Stdin = stdin
-	}
-	return p
-}
-
-func SetTerminal(command *Command, pipes *Pipes) error {
+func SetTerminal(command *execdriver.Command, pipes *execdriver.Pipes) error {
 	var (
-		term Term
+		term execdriver.Terminal
 		err  error
 	)
 	if command.Tty {
@@ -46,18 +26,18 @@ func SetTerminal(command *Command, pipes *Pipes) error {
 }
 
 type TtyConsole struct {
-	Master *os.File
-	Slave  *os.File
+	master *os.File
+	slave  *os.File
 }
 
-func NewTtyConsole(command *Command, pipes *Pipes) (*TtyConsole, error) {
+func NewTtyConsole(command *execdriver.Command, pipes *execdriver.Pipes) (*TtyConsole, error) {
 	ptyMaster, ptySlave, err := pty.Open()
 	if err != nil {
 		return nil, err
 	}
 	tty := &TtyConsole{
-		Master: ptyMaster,
-		Slave:  ptySlave,
+		master: ptyMaster,
+		slave:  ptySlave,
 	}
 	if err := tty.attach(command, pipes); err != nil {
 		tty.Close()
@@ -66,14 +46,18 @@ func NewTtyConsole(command *Command, pipes *Pipes) (*TtyConsole, error) {
 	return tty, nil
 }
 
-func (t *TtyConsole) Resize(h, w int) error {
-	return term.SetWinsize(t.Master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+func (t *TtyConsole) Master() *os.File {
+	return t.master
 }
 
-func (t *TtyConsole) attach(command *Command, pipes *Pipes) error {
-	command.Stdout = t.Slave
-	command.Stderr = t.Slave
-	command.Console = t.Slave.Name()
+func (t *TtyConsole) Resize(h, w int) error {
+	return term.SetWinsize(t.master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+}
+
+func (t *TtyConsole) attach(command *execdriver.Command, pipes *execdriver.Pipes) error {
+	command.Stdout = t.slave
+	command.Stderr = t.slave
+	command.Console = t.slave.Name()
 
 	go func() {
 		if wb, ok := pipes.Stdout.(interface {
@@ -81,30 +65,30 @@ func (t *TtyConsole) attach(command *Command, pipes *Pipes) error {
 		}); ok {
 			defer wb.CloseWriters()
 		}
-		io.Copy(pipes.Stdout, t.Master)
+		io.Copy(pipes.Stdout, t.master)
 	}()
 
 	if pipes.Stdin != nil {
-		command.Stdin = t.Slave
+		command.Stdin = t.slave
 		command.SysProcAttr.Setctty = true
 
 		go func() {
 			defer pipes.Stdin.Close()
-			io.Copy(t.Master, pipes.Stdin)
+			io.Copy(t.master, pipes.Stdin)
 		}()
 	}
 	return nil
 }
 
 func (t *TtyConsole) Close() error {
-	t.Slave.Close()
-	return t.Master.Close()
+	t.slave.Close()
+	return t.master.Close()
 }
 
 type StdConsole struct {
 }
 
-func NewStdConsole(command *Command, pipes *Pipes) (*StdConsole, error) {
+func NewStdConsole(command *execdriver.Command, pipes *execdriver.Pipes) (*StdConsole, error) {
 	std := &StdConsole{}
 
 	if err := std.attach(command, pipes); err != nil {
@@ -113,7 +97,7 @@ func NewStdConsole(command *Command, pipes *Pipes) (*StdConsole, error) {
 	return std, nil
 }
 
-func (s *StdConsole) attach(command *Command, pipes *Pipes) error {
+func (s *StdConsole) attach(command *execdriver.Command, pipes *execdriver.Pipes) error {
 	command.Stdout = pipes.Stdout
 	command.Stderr = pipes.Stderr
 
diff --git a/components/engine/execdriver/pipes.go b/components/engine/execdriver/pipes.go
new file mode 100644
index 0000000000..158219f0c5
--- /dev/null
+++ b/components/engine/execdriver/pipes.go
@@ -0,0 +1,23 @@
+package execdriver
+
+import (
+	"io"
+)
+
+// Pipes is a wrapper around a containers output for
+// stdin, stdout, stderr
+type Pipes struct {
+	Stdin          io.ReadCloser
+	Stdout, Stderr io.Writer
+}
+
+func NewPipes(stdin io.ReadCloser, stdout, stderr io.Writer, useStdin bool) *Pipes {
+	p := &Pipes{
+		Stdout: stdout,
+		Stderr: stderr,
+	}
+	if useStdin {
+		p.Stdin = stdin
+	}
+	return p
+}

From a326ecddb84f4c120f26bc682685199c720dbd23 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 18 Feb 2014 16:56:11 -0800
Subject: [PATCH 182/403] Initial commit of libcontainer
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 e8abaf217b887fcd6a157b4f905156bd245f8f0a Component: engine

---
 .../engine/pkg/libcontainer/MAINTAINERS       |   2 +
 components/engine/pkg/libcontainer/README.md  |  63 +++++
 .../libcontainer/capabilities/capabilities.go |  49 ++++
 .../engine/pkg/libcontainer/cli/main.go       | 171 +++++++++++
 .../engine/pkg/libcontainer/container.go      |  27 ++
 .../engine/pkg/libcontainer/container.json    |  38 +++
 components/engine/pkg/libcontainer/errors.go  |   9 +
 .../libcontainer/namespaces/calls_linux.go    | 164 +++++++++++
 .../pkg/libcontainer/namespaces/exec.go       | 266 ++++++++++++++++++
 .../libcontainer/namespaces/linux_x86_64.go   |   7 +
 .../pkg/libcontainer/namespaces/mount.go      | 207 ++++++++++++++
 .../pkg/libcontainer/namespaces/namespaces.go |  70 +++++
 .../pkg/libcontainer/namespaces/ns_linux.go   |  35 +++
 .../pkg/libcontainer/namespaces/utils.go      | 108 +++++++
 .../pkg/libcontainer/network/network.go       | 104 +++++++
 .../engine/pkg/libcontainer/network/veth.go   |  85 ++++++
 .../engine/pkg/libcontainer/privileged.json   |  22 ++
 components/engine/pkg/libcontainer/types.go   |  49 ++++
 .../engine/pkg/libcontainer/ubuntu.json       |  22 ++
 .../engine/pkg/libcontainer/utils/utils.go    |  33 +++
 20 files changed, 1531 insertions(+)
 create mode 100644 components/engine/pkg/libcontainer/MAINTAINERS
 create mode 100644 components/engine/pkg/libcontainer/README.md
 create mode 100644 components/engine/pkg/libcontainer/capabilities/capabilities.go
 create mode 100644 components/engine/pkg/libcontainer/cli/main.go
 create mode 100644 components/engine/pkg/libcontainer/container.go
 create mode 100644 components/engine/pkg/libcontainer/container.json
 create mode 100644 components/engine/pkg/libcontainer/errors.go
 create mode 100644 components/engine/pkg/libcontainer/namespaces/calls_linux.go
 create mode 100644 components/engine/pkg/libcontainer/namespaces/exec.go
 create mode 100644 components/engine/pkg/libcontainer/namespaces/linux_x86_64.go
 create mode 100644 components/engine/pkg/libcontainer/namespaces/mount.go
 create mode 100644 components/engine/pkg/libcontainer/namespaces/namespaces.go
 create mode 100644 components/engine/pkg/libcontainer/namespaces/ns_linux.go
 create mode 100644 components/engine/pkg/libcontainer/namespaces/utils.go
 create mode 100644 components/engine/pkg/libcontainer/network/network.go
 create mode 100644 components/engine/pkg/libcontainer/network/veth.go
 create mode 100644 components/engine/pkg/libcontainer/privileged.json
 create mode 100644 components/engine/pkg/libcontainer/types.go
 create mode 100644 components/engine/pkg/libcontainer/ubuntu.json
 create mode 100644 components/engine/pkg/libcontainer/utils/utils.go

diff --git a/components/engine/pkg/libcontainer/MAINTAINERS b/components/engine/pkg/libcontainer/MAINTAINERS
new file mode 100644
index 0000000000..e53d933d47
--- /dev/null
+++ b/components/engine/pkg/libcontainer/MAINTAINERS
@@ -0,0 +1,2 @@
+Michael Crosby <michael@crosbymichael.com> (@crosbymichael)
+Guillaume Charmes <guillaume@dotcloud.com> (@creack)
diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
new file mode 100644
index 0000000000..91d747863c
--- /dev/null
+++ b/components/engine/pkg/libcontainer/README.md
@@ -0,0 +1,63 @@
+## libcontainer - reference implementation for containers
+
+#### playground
+
+
+Use the cli package to test out functionality
+
+First setup a container configuration.  You will need a root fs, better go the path to a
+stopped docker container and use that.
+
+
+```json
+{
+    "id": "koye",
+    "namespace_pid": 12265,
+    "command": {
+        "args": [
+            "/bin/bash"
+        ],
+        "environment": [
+            "HOME=/",
+            "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
+            "container=docker",
+            "TERM=xterm"
+        ]
+    },
+    "rootfs": "/root/development/gocode/src/github.com/docker/libcontainer/namespaces/ubuntu",
+    "network": null,
+    "user": "",
+    "working_dir": "",
+    "namespaces": [
+        "NEWNET",
+        "NEWIPC",
+        "NEWNS",
+        "NEWPID",
+        "NEWUTS"
+    ],
+    "capabilities": [
+        "SETPCAP",
+        "SYS_MODULE",
+        "SYS_RAWIO",
+        "SYS_PACCT",
+        "SYS_ADMIN",
+        "SYS_NICE",
+        "SYS_RESOURCE",
+        "SYS_TIME",
+        "SYS_TTY_CONFIG",
+        "MKNOD",
+        "AUDIT_WRITE",
+        "AUDIT_CONTROL",
+        "MAC_OVERRIDE",
+        "MAC_ADMIN"
+    ]
+}
+```
+
+After you have a json file and a rootfs path to use just run:
+`./cli exec container.json`
+
+
+If you want to attach to an existing namespace just use the same json
+file with the container still running and do:
+`./cli execin container.json`
diff --git a/components/engine/pkg/libcontainer/capabilities/capabilities.go b/components/engine/pkg/libcontainer/capabilities/capabilities.go
new file mode 100644
index 0000000000..3301e10f7f
--- /dev/null
+++ b/components/engine/pkg/libcontainer/capabilities/capabilities.go
@@ -0,0 +1,49 @@
+package capabilities
+
+import (
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/syndtr/gocapability/capability"
+	"os"
+)
+
+var capMap = map[libcontainer.Capability]capability.Cap{
+	libcontainer.CAP_SETPCAP:        capability.CAP_SETPCAP,
+	libcontainer.CAP_SYS_MODULE:     capability.CAP_SYS_MODULE,
+	libcontainer.CAP_SYS_RAWIO:      capability.CAP_SYS_RAWIO,
+	libcontainer.CAP_SYS_PACCT:      capability.CAP_SYS_PACCT,
+	libcontainer.CAP_SYS_ADMIN:      capability.CAP_SYS_ADMIN,
+	libcontainer.CAP_SYS_NICE:       capability.CAP_SYS_NICE,
+	libcontainer.CAP_SYS_RESOURCE:   capability.CAP_SYS_RESOURCE,
+	libcontainer.CAP_SYS_TIME:       capability.CAP_SYS_TIME,
+	libcontainer.CAP_SYS_TTY_CONFIG: capability.CAP_SYS_TTY_CONFIG,
+	libcontainer.CAP_MKNOD:          capability.CAP_MKNOD,
+	libcontainer.CAP_AUDIT_WRITE:    capability.CAP_AUDIT_WRITE,
+	libcontainer.CAP_AUDIT_CONTROL:  capability.CAP_AUDIT_CONTROL,
+	libcontainer.CAP_MAC_OVERRIDE:   capability.CAP_MAC_OVERRIDE,
+	libcontainer.CAP_MAC_ADMIN:      capability.CAP_MAC_ADMIN,
+}
+
+// DropCapabilities drops capabilities for the current process based
+// on the container's configuration.
+func DropCapabilities(container *libcontainer.Container) error {
+	if drop := getCapabilities(container); len(drop) > 0 {
+		c, err := capability.NewPid(os.Getpid())
+		if err != nil {
+			return err
+		}
+		c.Unset(capability.CAPS|capability.BOUNDS, drop...)
+
+		if err := c.Apply(capability.CAPS | capability.BOUNDS); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func getCapabilities(container *libcontainer.Container) []capability.Cap {
+	drop := []capability.Cap{}
+	for _, c := range container.Capabilities {
+		drop = append(drop, capMap[c])
+	}
+	return drop
+}
diff --git a/components/engine/pkg/libcontainer/cli/main.go b/components/engine/pkg/libcontainer/cli/main.go
new file mode 100644
index 0000000000..490135ef5a
--- /dev/null
+++ b/components/engine/pkg/libcontainer/cli/main.go
@@ -0,0 +1,171 @@
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/namespaces"
+	"github.com/dotcloud/docker/pkg/libcontainer/network"
+	"github.com/dotcloud/docker/pkg/libcontainer/utils"
+	"os"
+)
+
+var (
+	displayPid bool
+	newCommand string
+	usrNet     bool
+)
+
+func init() {
+	flag.BoolVar(&displayPid, "pid", false, "display the pid before waiting")
+	flag.StringVar(&newCommand, "cmd", "/bin/bash", "command to run in the existing namespace")
+	flag.BoolVar(&usrNet, "net", false, "user a net namespace")
+	flag.Parse()
+}
+
+func exec(container *libcontainer.Container) error {
+	var (
+		netFile *os.File
+		err     error
+	)
+	container.NetNsFd = 0
+
+	if usrNet {
+		netFile, err = os.Open("/root/nsroot/test")
+		if err != nil {
+			return err
+		}
+		container.NetNsFd = netFile.Fd()
+	}
+
+	pid, err := namespaces.Exec(container)
+	if err != nil {
+		return fmt.Errorf("error exec container %s", err)
+	}
+
+	if displayPid {
+		fmt.Println(pid)
+	}
+
+	exitcode, err := utils.WaitOnPid(pid)
+	if err != nil {
+		return fmt.Errorf("error waiting on child %s", err)
+	}
+	fmt.Println(exitcode)
+	if usrNet {
+		netFile.Close()
+		if err := network.DeleteNetworkNamespace("/root/nsroot/test"); err != nil {
+			return err
+		}
+	}
+	os.Exit(exitcode)
+	return nil
+}
+
+func execIn(container *libcontainer.Container) error {
+	f, err := os.Open("/root/nsroot/test")
+	if err != nil {
+		return err
+	}
+	container.NetNsFd = f.Fd()
+	pid, err := namespaces.ExecIn(container, &libcontainer.Command{
+		Env: container.Command.Env,
+		Args: []string{
+			newCommand,
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("error exexin container %s", err)
+	}
+	exitcode, err := utils.WaitOnPid(pid)
+	if err != nil {
+		return fmt.Errorf("error waiting on child %s", err)
+	}
+	os.Exit(exitcode)
+	return nil
+}
+
+func createNet(config *libcontainer.Network) error {
+	root := "/root/nsroot"
+	if err := network.SetupNamespaceMountDir(root); err != nil {
+		return err
+	}
+
+	nspath := root + "/test"
+	if err := network.CreateNetworkNamespace(nspath); err != nil {
+		return nil
+	}
+	if err := network.CreateVethPair("veth0", config.TempVethName); err != nil {
+		return err
+	}
+	if err := network.SetInterfaceMaster("veth0", config.Bridge); err != nil {
+		return err
+	}
+	if err := network.InterfaceUp("veth0"); err != nil {
+		return err
+	}
+
+	f, err := os.Open(nspath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	if err := network.SetInterfaceInNamespaceFd("veth1", int(f.Fd())); err != nil {
+		return err
+	}
+
+	/*
+		if err := network.SetupVethInsideNamespace(f.Fd(), config); err != nil {
+			return err
+		}
+	*/
+	return nil
+}
+
+func printErr(err error) {
+	fmt.Fprintln(os.Stderr, err)
+	os.Exit(1)
+}
+
+func main() {
+	var (
+		err    error
+		cliCmd = flag.Arg(0)
+		config = flag.Arg(1)
+	)
+	f, err := os.Open(config)
+	if err != nil {
+		printErr(err)
+	}
+
+	dec := json.NewDecoder(f)
+	var container *libcontainer.Container
+
+	if err := dec.Decode(&container); err != nil {
+		printErr(err)
+	}
+	f.Close()
+
+	switch cliCmd {
+	case "exec":
+		err = exec(container)
+	case "execin":
+		err = execIn(container)
+	case "net":
+		err = createNet(&libcontainer.Network{
+			TempVethName: "veth1",
+			IP:           "172.17.0.100/16",
+			Gateway:      "172.17.42.1",
+			Mtu:          1500,
+			Bridge:       "docker0",
+		})
+	default:
+		err = fmt.Errorf("command not supported: %s", cliCmd)
+	}
+
+	if err != nil {
+		printErr(err)
+	}
+}
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
new file mode 100644
index 0000000000..b77890fb5c
--- /dev/null
+++ b/components/engine/pkg/libcontainer/container.go
@@ -0,0 +1,27 @@
+package libcontainer
+
+type Container struct {
+	ID           string       `json:"id,omitempty"`
+	NsPid        int          `json:"namespace_pid,omitempty"`
+	Command      *Command     `json:"command,omitempty"`
+	RootFs       string       `json:"rootfs,omitempty"`
+	ReadonlyFs   bool         `json:"readonly_fs,omitempty"`
+	NetNsFd      uintptr      `json:"network_namespace_fd,omitempty"`
+	User         string       `json:"user,omitempty"`
+	WorkingDir   string       `json:"working_dir,omitempty"`
+	Namespaces   Namespaces   `json:"namespaces,omitempty"`
+	Capabilities Capabilities `json:"capabilities,omitempty"`
+}
+
+type Command struct {
+	Args []string `json:"args,omitempty"`
+	Env  []string `json:"environment,omitempty"`
+}
+
+type Network struct {
+	TempVethName string `json:"temp_veth,omitempty"`
+	IP           string `json:"ip,omitempty"`
+	Gateway      string `json:"gateway,omitempty"`
+	Bridge       string `json:"bridge,omitempty"`
+	Mtu          int    `json:"mtu,omitempty"`
+}
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
new file mode 100644
index 0000000000..ed8eb1bd78
--- /dev/null
+++ b/components/engine/pkg/libcontainer/container.json
@@ -0,0 +1,38 @@
+{
+    "id": "koye",
+    "namespace_pid": 3117,
+    "command": {
+        "args": [
+            "/bin/bash"
+        ],
+        "environment": [
+            "HOME=/",
+            "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
+            "container=docker",
+            "TERM=xterm"
+        ]
+    },
+    "rootfs": "/root/main/mycontainer",
+    "namespaces": [
+        "NEWIPC",
+        "NEWNS",
+        "NEWPID",
+        "NEWUTS"
+    ],
+    "capabilities": [
+        "SETPCAP",
+        "SYS_MODULE",
+        "SYS_RAWIO",
+        "SYS_PACCT",
+        "SYS_ADMIN",
+        "SYS_NICE",
+        "SYS_RESOURCE",
+        "SYS_TIME",
+        "SYS_TTY_CONFIG",
+        "MKNOD",
+        "AUDIT_WRITE",
+        "AUDIT_CONTROL",
+        "MAC_OVERRIDE",
+        "MAC_ADMIN"
+    ]
+}
diff --git a/components/engine/pkg/libcontainer/errors.go b/components/engine/pkg/libcontainer/errors.go
new file mode 100644
index 0000000000..c6964ee8e6
--- /dev/null
+++ b/components/engine/pkg/libcontainer/errors.go
@@ -0,0 +1,9 @@
+package libcontainer
+
+import (
+	"errors"
+)
+
+var (
+	ErrInvalidPid = errors.New("no ns pid found")
+)
diff --git a/components/engine/pkg/libcontainer/namespaces/calls_linux.go b/components/engine/pkg/libcontainer/namespaces/calls_linux.go
new file mode 100644
index 0000000000..793e940b6e
--- /dev/null
+++ b/components/engine/pkg/libcontainer/namespaces/calls_linux.go
@@ -0,0 +1,164 @@
+package namespaces
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+	"unsafe"
+)
+
+const (
+	TIOCGPTN   = 0x80045430
+	TIOCSPTLCK = 0x40045431
+)
+
+func chroot(dir string) error {
+	return syscall.Chroot(dir)
+}
+
+func chdir(dir string) error {
+	return syscall.Chdir(dir)
+}
+
+func exec(cmd string, args []string, env []string) error {
+	return syscall.Exec(cmd, args, env)
+}
+
+func fork() (int, error) {
+	syscall.ForkLock.Lock()
+	pid, _, err := syscall.Syscall(syscall.SYS_FORK, 0, 0, 0)
+	syscall.ForkLock.Unlock()
+	if err != 0 {
+		return -1, err
+	}
+	return int(pid), nil
+}
+
+func vfork() (int, error) {
+	syscall.ForkLock.Lock()
+	pid, _, err := syscall.Syscall(syscall.SYS_VFORK, 0, 0, 0)
+	syscall.ForkLock.Unlock()
+	if err != 0 {
+		return -1, err
+	}
+	return int(pid), nil
+}
+
+func mount(source, target, fstype string, flags uintptr, data string) error {
+	return syscall.Mount(source, target, fstype, flags, data)
+}
+
+func unmount(target string, flags int) error {
+	return syscall.Unmount(target, flags)
+}
+
+func pivotroot(newroot, putold string) error {
+	return syscall.PivotRoot(newroot, putold)
+}
+
+func unshare(flags int) error {
+	return syscall.Unshare(flags)
+}
+
+func clone(flags uintptr) (int, error) {
+	syscall.ForkLock.Lock()
+	pid, _, err := syscall.RawSyscall(syscall.SYS_CLONE, flags, 0, 0)
+	syscall.ForkLock.Unlock()
+	if err != 0 {
+		return -1, err
+	}
+	return int(pid), nil
+}
+
+func setns(fd uintptr, flags uintptr) error {
+	_, _, err := syscall.RawSyscall(SYS_SETNS, fd, flags, 0)
+	if err != 0 {
+		return err
+	}
+	return nil
+}
+
+func usetCloseOnExec(fd uintptr) error {
+	if _, _, err := syscall.Syscall(syscall.SYS_FCNTL, fd, syscall.F_SETFD, 0); err != 0 {
+		return err
+	}
+	return nil
+}
+
+func setgroups(gids []int) error {
+	return syscall.Setgroups(gids)
+}
+
+func setresgid(rgid, egid, sgid int) error {
+	return syscall.Setresgid(rgid, egid, sgid)
+}
+
+func setresuid(ruid, euid, suid int) error {
+	return syscall.Setresuid(ruid, euid, suid)
+}
+
+func sethostname(name string) error {
+	return syscall.Sethostname([]byte(name))
+}
+
+func setsid() (int, error) {
+	return syscall.Setsid()
+}
+
+func ioctl(fd uintptr, flag, data uintptr) error {
+	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, fd, flag, data); err != 0 {
+		return err
+	}
+	return nil
+}
+
+func openpmtx() (*os.File, error) {
+	return os.OpenFile("/dev/ptmx", syscall.O_RDONLY|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
+}
+
+func unlockpt(f *os.File) error {
+	var u int
+	return ioctl(f.Fd(), TIOCSPTLCK, uintptr(unsafe.Pointer(&u)))
+}
+
+func ptsname(f *os.File) (string, error) {
+	var n int
+	if err := ioctl(f.Fd(), TIOCGPTN, uintptr(unsafe.Pointer(&n))); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("/dev/pts/%d", n), nil
+}
+
+func closefd(fd uintptr) error {
+	return syscall.Close(int(fd))
+}
+
+func dup2(fd1, fd2 uintptr) error {
+	return syscall.Dup2(int(fd1), int(fd2))
+}
+
+func mknod(path string, mode uint32, dev int) error {
+	return syscall.Mknod(path, mode, dev)
+}
+
+func parentDeathSignal() error {
+	if _, _, err := syscall.RawSyscall6(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0, 0, 0, 0); err != 0 {
+		return err
+	}
+	return nil
+}
+
+func setctty() error {
+	if _, _, err := syscall.RawSyscall(syscall.SYS_IOCTL, 0, uintptr(syscall.TIOCSCTTY), 0); err != 0 {
+		return err
+	}
+	return nil
+}
+
+func mkfifo(name string, mode uint32) error {
+	return syscall.Mkfifo(name, mode)
+}
+
+func umask(mask int) int {
+	return syscall.Umask(mask)
+}
diff --git a/components/engine/pkg/libcontainer/namespaces/exec.go b/components/engine/pkg/libcontainer/namespaces/exec.go
new file mode 100644
index 0000000000..893b302887
--- /dev/null
+++ b/components/engine/pkg/libcontainer/namespaces/exec.go
@@ -0,0 +1,266 @@
+/*
+   Higher level convience functions for setting up a container
+*/
+
+package namespaces
+
+import (
+	"errors"
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
+	"github.com/dotcloud/docker/pkg/libcontainer/utils"
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+var (
+	ErrExistingNetworkNamespace = errors.New("specified both CLONE_NEWNET and an existing network namespace")
+)
+
+// Exec will spawn new namespaces with the specified Container configuration
+// in the RootFs path and return the pid of the new containerized process.
+//
+// If an existing network namespace is specified the container
+// will join that namespace.  If an existing network namespace is not specified but CLONE_NEWNET is,
+// the container will be spawned with a new network namespace with no configuration.  Omiting an
+// existing network namespace and the CLONE_NEWNET option in the container configuration will allow
+// the container to the the host's networking options and configuration.
+func Exec(container *libcontainer.Container) (pid int, err error) {
+	// a user cannot pass CLONE_NEWNET and an existing net namespace fd to join
+	if container.NetNsFd > 0 && container.Namespaces.Contains(libcontainer.CLONE_NEWNET) {
+		return -1, ErrExistingNetworkNamespace
+	}
+
+	rootfs, err := resolveRootfs(container)
+	if err != nil {
+		return -1, err
+	}
+
+	master, console, err := createMasterAndConsole()
+	if err != nil {
+		return -1, err
+	}
+
+	logger, err := os.OpenFile("/root/logs", os.O_RDWR|os.O_CREATE|os.O_APPEND, 0755)
+	if err != nil {
+		return -1, err
+	}
+	log.SetOutput(logger)
+
+	// we need CLONE_VFORK so we can wait on the child
+	flag := getNamespaceFlags(container.Namespaces) | CLONE_VFORK
+
+	if pid, err = clone(uintptr(flag | SIGCHLD)); err != nil {
+		return -1, fmt.Errorf("error cloning process: %s", err)
+	}
+
+	if pid == 0 {
+		// welcome to your new namespace ;)
+		//
+		// any errors encoutered inside the namespace we should write
+		// out to a log or a pipe to our parent and exit(1)
+		// because writing to stderr will not work after we close
+		if err := closeMasterAndStd(master); err != nil {
+			writeError("close master and std %s", err)
+		}
+		slave, err := openTerminal(console, syscall.O_RDWR)
+		if err != nil {
+			writeError("open terminal %s", err)
+		}
+		if err := dupSlave(slave); err != nil {
+			writeError("dup2 slave %s", err)
+		}
+
+		if container.NetNsFd > 0 {
+			if err := JoinExistingNamespace(container.NetNsFd, libcontainer.CLONE_NEWNET); err != nil {
+				writeError("join existing net namespace %s", err)
+			}
+		}
+
+		if _, err := setsid(); err != nil {
+			writeError("setsid %s", err)
+		}
+		if err := setctty(); err != nil {
+			writeError("setctty %s", err)
+		}
+		if err := parentDeathSignal(); err != nil {
+			writeError("parent deth signal %s", err)
+		}
+		if err := SetupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
+			writeError("setup mount namespace %s", err)
+		}
+		if err := sethostname(container.ID); err != nil {
+			writeError("sethostname %s", err)
+		}
+		if err := capabilities.DropCapabilities(container); err != nil {
+			writeError("drop capabilities %s", err)
+		}
+		if err := setupUser(container); err != nil {
+			writeError("setup user %s", err)
+		}
+		if container.WorkingDir != "" {
+			if err := chdir(container.WorkingDir); err != nil {
+				writeError("chdir to %s %s", container.WorkingDir, err)
+			}
+		}
+		if err := exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+			writeError("exec %s", err)
+		}
+		panic("unreachable")
+	}
+
+	go func() {
+		if _, err := io.Copy(os.Stdout, master); err != nil {
+			log.Println(err)
+		}
+	}()
+	go func() {
+		if _, err := io.Copy(master, os.Stdin); err != nil {
+			log.Println(err)
+		}
+	}()
+	return pid, nil
+}
+
+// ExecIn will spawn a new command inside an existing container's namespaces.  The existing container's
+// pid and namespace configuration is needed along with the specific capabilities that should
+// be dropped once inside the namespace.
+func ExecIn(container *libcontainer.Container, cmd *libcontainer.Command) (int, error) {
+	if container.NsPid <= 0 {
+		return -1, libcontainer.ErrInvalidPid
+	}
+
+	fds, err := getNsFds(container)
+	if err != nil {
+		return -1, err
+	}
+
+	if container.NetNsFd > 0 {
+		fds = append(fds, container.NetNsFd)
+	}
+
+	pid, err := fork()
+	if err != nil {
+		for _, fd := range fds {
+			syscall.Close(int(fd))
+		}
+		return -1, err
+	}
+
+	if pid == 0 {
+		for _, fd := range fds {
+			if fd > 0 {
+				if err := JoinExistingNamespace(fd, ""); err != nil {
+					for _, fd := range fds {
+						syscall.Close(int(fd))
+					}
+					writeError("join existing namespace for %d %s", fd, err)
+				}
+			}
+			syscall.Close(int(fd))
+		}
+
+		if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
+			container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
+			// important:
+			//
+			// we need to fork and unshare so that re can remount proc and sys within
+			// the namespace so the CLONE_NEWPID namespace will take effect
+			// if we don't fork we would end up unmounting proc and sys for the entire
+			// namespace
+			child, err := fork()
+			if err != nil {
+				writeError("fork child %s", err)
+			}
+
+			if child == 0 {
+				if err := unshare(CLONE_NEWNS); err != nil {
+					writeError("unshare newns %s", err)
+				}
+				if err := remountProc(); err != nil {
+					writeError("remount proc %s", err)
+				}
+				if err := remountSys(); err != nil {
+					writeError("remount sys %s", err)
+				}
+				if err := capabilities.DropCapabilities(container); err != nil {
+					writeError("drop caps %s", err)
+				}
+				if err := exec(cmd.Args[0], cmd.Args[0:], cmd.Env); err != nil {
+					writeError("exec %s", err)
+				}
+				panic("unreachable")
+			}
+			exit, err := utils.WaitOnPid(child)
+			if err != nil {
+				writeError("wait on child %s", err)
+			}
+			os.Exit(exit)
+		}
+		if err := exec(cmd.Args[0], cmd.Args[0:], cmd.Env); err != nil {
+			writeError("exec %s", err)
+		}
+		panic("unreachable")
+	}
+	return pid, err
+}
+
+func resolveRootfs(container *libcontainer.Container) (string, error) {
+	rootfs, err := filepath.Abs(container.RootFs)
+	if err != nil {
+		return "", err
+	}
+	return filepath.EvalSymlinks(rootfs)
+}
+
+func createMasterAndConsole() (*os.File, string, error) {
+	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, "", err
+	}
+
+	console, err := ptsname(master)
+	if err != nil {
+		return nil, "", err
+	}
+
+	if err := unlockpt(master); err != nil {
+		return nil, "", err
+	}
+	return master, console, nil
+}
+
+func closeMasterAndStd(master *os.File) error {
+	closefd(master.Fd())
+	closefd(0)
+	closefd(1)
+	closefd(2)
+
+	return nil
+}
+
+func dupSlave(slave *os.File) error {
+	// we close Stdin,etc so our pty slave should have fd 0
+	if slave.Fd() != 0 {
+		return fmt.Errorf("slave fd not 0 %d", slave.Fd())
+	}
+	if err := dup2(slave.Fd(), 1); err != nil {
+		return err
+	}
+	if err := dup2(slave.Fd(), 2); err != nil {
+		return err
+	}
+	return nil
+}
+
+func openTerminal(name string, flag int) (*os.File, error) {
+	r, e := syscall.Open(name, flag, 0)
+	if e != nil {
+		return nil, &os.PathError{"open", name, e}
+	}
+	return os.NewFile(uintptr(r), name), nil
+}
diff --git a/components/engine/pkg/libcontainer/namespaces/linux_x86_64.go b/components/engine/pkg/libcontainer/namespaces/linux_x86_64.go
new file mode 100644
index 0000000000..ac9a014763
--- /dev/null
+++ b/components/engine/pkg/libcontainer/namespaces/linux_x86_64.go
@@ -0,0 +1,7 @@
+// +build linux,x86_64
+package namespaces
+
+// Via http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b21fddd087678a70ad64afc0f632e0f1071b092
+const (
+	SYS_SETNS = 308
+)
diff --git a/components/engine/pkg/libcontainer/namespaces/mount.go b/components/engine/pkg/libcontainer/namespaces/mount.go
new file mode 100644
index 0000000000..6d867c91ec
--- /dev/null
+++ b/components/engine/pkg/libcontainer/namespaces/mount.go
@@ -0,0 +1,207 @@
+package namespaces
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+var (
+	// default mount point options
+	defaults = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
+)
+
+func SetupNewMountNamespace(rootfs, console string, readonly bool) error {
+	if err := mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
+		return fmt.Errorf("mounting / as slave %s", err)
+	}
+
+	if err := mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {
+		return fmt.Errorf("mouting %s as bind %s", rootfs, err)
+	}
+
+	if readonly {
+		if err := mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, ""); err != nil {
+			return fmt.Errorf("mounting %s as readonly %s", rootfs, err)
+		}
+	}
+
+	if err := mountSystem(rootfs); err != nil {
+		return fmt.Errorf("mount system %s", err)
+	}
+
+	if err := copyDevNodes(rootfs); err != nil {
+		return fmt.Errorf("copy dev nodes %s", err)
+	}
+
+	ptmx := filepath.Join(rootfs, "dev/ptmx")
+	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err := os.Symlink(filepath.Join(rootfs, "pts/ptmx"), ptmx); err != nil {
+		return fmt.Errorf("symlink dev ptmx %s", err)
+	}
+
+	if err := setupDev(rootfs); err != nil {
+		return err
+	}
+
+	if err := setupConsole(rootfs, console); err != nil {
+		return err
+	}
+
+	if err := chdir(rootfs); err != nil {
+		return fmt.Errorf("chdir into %s %s", rootfs, err)
+	}
+
+	if err := mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
+		return fmt.Errorf("mount move %s into / %s", rootfs, err)
+	}
+
+	if err := chroot("."); err != nil {
+		return fmt.Errorf("chroot . %s", err)
+	}
+
+	if err := chdir("/"); err != nil {
+		return fmt.Errorf("chdir / %s", err)
+	}
+
+	umask(0022)
+
+	return nil
+}
+
+func copyDevNodes(rootfs string) error {
+	umask(0000)
+
+	for _, node := range []string{
+		"null",
+		"zero",
+		"full",
+		"random",
+		"urandom",
+		"tty",
+	} {
+		stat, err := os.Stat(filepath.Join("/dev", node))
+		if err != nil {
+			return err
+		}
+
+		var (
+			dest = filepath.Join(rootfs, "dev", node)
+			st   = stat.Sys().(*syscall.Stat_t)
+		)
+
+		log.Printf("copy %s to %s %d\n", node, dest, st.Rdev)
+		if err := mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) {
+			return fmt.Errorf("copy %s %s", node, err)
+		}
+	}
+	return nil
+}
+
+func setupDev(rootfs string) error {
+	for _, link := range []struct {
+		from string
+		to   string
+	}{
+		{"/proc/kcore", "/dev/core"},
+		{"/proc/self/fd", "/dev/fd"},
+		{"/proc/self/fd/0", "/dev/stdin"},
+		{"/proc/self/fd/1", "/dev/stdout"},
+		{"/proc/self/fd/2", "/dev/stderr"},
+	} {
+		dest := filepath.Join(rootfs, link.to)
+		if err := os.Remove(dest); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("remove %s %s", dest, err)
+		}
+		if err := os.Symlink(link.from, dest); err != nil {
+			return fmt.Errorf("symlink %s %s", dest, err)
+		}
+	}
+	return nil
+}
+
+func setupConsole(rootfs, console string) error {
+	umask(0000)
+
+	stat, err := os.Stat(console)
+	if err != nil {
+		return fmt.Errorf("stat console %s %s", console, err)
+	}
+	st := stat.Sys().(*syscall.Stat_t)
+
+	dest := filepath.Join(rootfs, "dev/console")
+	if err := os.Remove(dest); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove %s %s", dest, err)
+	}
+
+	if err := os.Chmod(console, 0600); err != nil {
+		return err
+	}
+	if err := os.Chown(console, 0, 0); err != nil {
+		return err
+	}
+
+	if err := mknod(dest, (st.Mode&^07777)|0600, int(st.Rdev)); err != nil {
+		return fmt.Errorf("mknod %s %s", dest, err)
+	}
+
+	if err := mount(console, dest, "bind", syscall.MS_BIND, ""); err != nil {
+		return fmt.Errorf("bind %s to %s %s", console, dest, err)
+	}
+	return nil
+}
+
+// mountSystem sets up linux specific system mounts like sys, proc, shm, and devpts
+// inside the mount namespace
+func mountSystem(rootfs string) error {
+	mounts := []struct {
+		source string
+		path   string
+		device string
+		flags  int
+		data   string
+	}{
+		{source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaults},
+		{source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaults},
+		{source: "tmpfs", path: filepath.Join(rootfs, "dev"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME, data: "mode=755"},
+		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaults, data: "mode=1777"},
+		{source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: "newinstance,ptmxmode=0666,mode=620,gid=5"},
+		{source: "tmpfs", path: filepath.Join(rootfs, "run"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_STRICTATIME, data: "mode=755"},
+	}
+	for _, m := range mounts {
+		if err := os.MkdirAll(m.path, 0755); err != nil && !os.IsExist(err) {
+			return fmt.Errorf("mkdirall %s %s", m.path, err)
+		}
+		if err := mount(m.source, m.path, m.device, uintptr(m.flags), m.data); err != nil {
+			return fmt.Errorf("mounting %s into %s %s", m.source, m.path, err)
+		}
+	}
+	return nil
+}
+
+func remountProc() error {
+	if err := unmount("/proc", syscall.MNT_DETACH); err != nil {
+		return err
+	}
+	if err := mount("proc", "/proc", "proc", uintptr(defaults), ""); err != nil {
+		return err
+	}
+	return nil
+}
+
+func remountSys() error {
+	if err := unmount("/sys", syscall.MNT_DETACH); err != nil {
+		if err != syscall.EINVAL {
+			return err
+		}
+	} else {
+		if err := mount("sysfs", "/sys", "sysfs", uintptr(defaults), ""); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/components/engine/pkg/libcontainer/namespaces/namespaces.go b/components/engine/pkg/libcontainer/namespaces/namespaces.go
new file mode 100644
index 0000000000..2a50847015
--- /dev/null
+++ b/components/engine/pkg/libcontainer/namespaces/namespaces.go
@@ -0,0 +1,70 @@
+/*
+   TODO
+   pivot root
+   cgroups
+   more mount stuff that I probably am forgetting
+   apparmor
+*/
+
+package namespaces
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/utils"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// CreateNewNamespace creates a new namespace and binds it's fd to the specified path
+func CreateNewNamespace(namespace libcontainer.Namespace, bindTo string) error {
+	var (
+		flag   = namespaceMap[namespace]
+		name   = namespaceFileMap[namespace]
+		nspath = filepath.Join("/proc/self/ns", name)
+	)
+	// TODO: perform validation on name and flag
+
+	pid, err := fork()
+	if err != nil {
+		return err
+	}
+
+	if pid == 0 {
+		if err := unshare(flag); err != nil {
+			writeError("unshare %s", err)
+		}
+		if err := mount(nspath, bindTo, "none", syscall.MS_BIND, ""); err != nil {
+			writeError("bind mount %s", err)
+		}
+		os.Exit(0)
+	}
+	exit, err := utils.WaitOnPid(pid)
+	if err != nil {
+		return err
+	}
+	if exit != 0 {
+		return fmt.Errorf("exit status %d", exit)
+	}
+	return err
+}
+
+// JoinExistingNamespace uses the fd of an existing linux namespace and
+// has the current process join that namespace or the spacespace specified by ns
+func JoinExistingNamespace(fd uintptr, ns libcontainer.Namespace) error {
+	flag := namespaceMap[ns]
+	if err := setns(fd, uintptr(flag)); err != nil {
+		return err
+	}
+	return nil
+}
+
+// getNamespaceFlags parses the container's Namespaces options to set the correct
+// flags on clone, unshare, and setns
+func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
+	for _, ns := range namespaces {
+		flag |= namespaceMap[ns]
+	}
+	return
+}
diff --git a/components/engine/pkg/libcontainer/namespaces/ns_linux.go b/components/engine/pkg/libcontainer/namespaces/ns_linux.go
new file mode 100644
index 0000000000..b0e5119130
--- /dev/null
+++ b/components/engine/pkg/libcontainer/namespaces/ns_linux.go
@@ -0,0 +1,35 @@
+package namespaces
+
+import (
+	"github.com/dotcloud/docker/pkg/libcontainer"
+)
+
+const (
+	SIGCHLD       = 0x14
+	CLONE_VFORK   = 0x00004000
+	CLONE_NEWNS   = 0x00020000
+	CLONE_NEWUTS  = 0x04000000
+	CLONE_NEWIPC  = 0x08000000
+	CLONE_NEWUSER = 0x10000000
+	CLONE_NEWPID  = 0x20000000
+	CLONE_NEWNET  = 0x40000000
+)
+
+var namespaceMap = map[libcontainer.Namespace]int{
+	"": 0,
+	libcontainer.CLONE_NEWNS:   CLONE_NEWNS,
+	libcontainer.CLONE_NEWUTS:  CLONE_NEWUTS,
+	libcontainer.CLONE_NEWIPC:  CLONE_NEWIPC,
+	libcontainer.CLONE_NEWUSER: CLONE_NEWUSER,
+	libcontainer.CLONE_NEWPID:  CLONE_NEWPID,
+	libcontainer.CLONE_NEWNET:  CLONE_NEWNET,
+}
+
+var namespaceFileMap = map[libcontainer.Namespace]string{
+	libcontainer.CLONE_NEWNS:   "mnt",
+	libcontainer.CLONE_NEWUTS:  "uts",
+	libcontainer.CLONE_NEWIPC:  "ipc",
+	libcontainer.CLONE_NEWUSER: "user",
+	libcontainer.CLONE_NEWPID:  "pid",
+	libcontainer.CLONE_NEWNET:  "net",
+}
diff --git a/components/engine/pkg/libcontainer/namespaces/utils.go b/components/engine/pkg/libcontainer/namespaces/utils.go
new file mode 100644
index 0000000000..438d896484
--- /dev/null
+++ b/components/engine/pkg/libcontainer/namespaces/utils.go
@@ -0,0 +1,108 @@
+package namespaces
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+func addEnvIfNotSet(container *libcontainer.Container, key, value string) {
+	jv := fmt.Sprintf("%s=%s", key, value)
+	if len(container.Command.Env) == 0 {
+		container.Command.Env = []string{jv}
+		return
+	}
+
+	for _, v := range container.Command.Env {
+		parts := strings.Split(v, "=")
+		if parts[0] == key {
+			return
+		}
+	}
+	container.Command.Env = append(container.Command.Env, jv)
+}
+
+// print and error to stderr and exit(1)
+func writeError(format string, v ...interface{}) {
+	fmt.Fprintf(os.Stderr, format, v...)
+	os.Exit(1)
+}
+
+// getNsFds inspects the container's namespace configuration and opens the fds to
+// each of the namespaces.
+func getNsFds(container *libcontainer.Container) ([]uintptr, error) {
+	var (
+		namespaces = []string{}
+		fds        = []uintptr{}
+	)
+
+	for _, ns := range container.Namespaces {
+		namespaces = append(namespaces, namespaceFileMap[ns])
+	}
+
+	for _, ns := range namespaces {
+		fd, err := getNsFd(container.NsPid, ns)
+		if err != nil {
+			for _, fd = range fds {
+				syscall.Close(int(fd))
+			}
+			return nil, err
+		}
+		fds = append(fds, fd)
+	}
+	return fds, nil
+}
+
+// getNsFd returns the fd for a specific pid and namespace option
+func getNsFd(pid int, ns string) (uintptr, error) {
+	nspath := filepath.Join("/proc", strconv.Itoa(pid), "ns", ns)
+	// OpenFile adds closOnExec
+	f, err := os.OpenFile(nspath, os.O_RDONLY, 0666)
+	if err != nil {
+		return 0, err
+	}
+	return f.Fd(), nil
+}
+
+// setupEnvironment adds additional environment variables to the container's
+// Command such as USER, LOGNAME, container, and TERM
+func setupEnvironment(container *libcontainer.Container) {
+	addEnvIfNotSet(container, "container", "docker")
+	// TODO: check if pty
+	addEnvIfNotSet(container, "TERM", "xterm")
+	// TODO: get username from container
+	addEnvIfNotSet(container, "USER", "root")
+	addEnvIfNotSet(container, "LOGNAME", "root")
+}
+
+func setupUser(container *libcontainer.Container) error {
+	// TODO: honor user passed on container
+	if err := setgroups(nil); err != nil {
+		return err
+	}
+	if err := setresgid(0, 0, 0); err != nil {
+		return err
+	}
+	if err := setresuid(0, 0, 0); err != nil {
+		return err
+	}
+	return nil
+}
+
+func getMasterAndConsole(container *libcontainer.Container) (string, *os.File, error) {
+	master, err := openpmtx()
+	if err != nil {
+		return "", nil, err
+	}
+
+	console, err := ptsname(master)
+	if err != nil {
+		master.Close()
+		return "", nil, err
+	}
+	return console, master, nil
+}
diff --git a/components/engine/pkg/libcontainer/network/network.go b/components/engine/pkg/libcontainer/network/network.go
new file mode 100644
index 0000000000..31c5d32492
--- /dev/null
+++ b/components/engine/pkg/libcontainer/network/network.go
@@ -0,0 +1,104 @@
+package network
+
+import (
+	"errors"
+	"github.com/dotcloud/docker/pkg/netlink"
+	"net"
+)
+
+var (
+	ErrNoDefaultRoute = errors.New("no default network route found")
+)
+
+func InterfaceUp(name string) error {
+	iface, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	return netlink.NetworkLinkUp(iface)
+}
+
+func InterfaceDown(name string) error {
+	iface, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	return netlink.NetworkLinkDown(iface)
+}
+
+func ChangeInterfaceName(old, newName string) error {
+	iface, err := net.InterfaceByName(old)
+	if err != nil {
+		return err
+	}
+	return netlink.NetworkChangeName(iface, newName)
+}
+
+func CreateVethPair(name1, name2 string) error {
+	return netlink.NetworkCreateVethPair(name1, name2)
+}
+
+func SetInterfaceInNamespacePid(name string, nsPid int) error {
+	iface, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	return netlink.NetworkSetNsPid(iface, nsPid)
+}
+
+func SetInterfaceInNamespaceFd(name string, fd int) error {
+	iface, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	return netlink.NetworkSetNsFd(iface, fd)
+}
+
+func SetInterfaceMaster(name, master string) error {
+	iface, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	masterIface, err := net.InterfaceByName(master)
+	if err != nil {
+		return err
+	}
+	return netlink.NetworkSetMaster(iface, masterIface)
+}
+
+func SetDefaultGateway(ip string) error {
+	return netlink.AddDefaultGw(net.ParseIP(ip))
+}
+
+func SetInterfaceIp(name string, rawIp string) error {
+	iface, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	ip, ipNet, err := net.ParseCIDR(rawIp)
+	if err != nil {
+		return err
+	}
+	return netlink.NetworkLinkAddIp(iface, ip, ipNet)
+}
+
+func SetMtu(name string, mtu int) error {
+	iface, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	return netlink.NetworkSetMTU(iface, mtu)
+}
+
+func GetDefaultMtu() (int, error) {
+	routes, err := netlink.NetworkGetRoutes()
+	if err != nil {
+		return -1, err
+	}
+	for _, r := range routes {
+		if r.Default {
+			return r.Iface.MTU, nil
+		}
+	}
+	return -1, ErrNoDefaultRoute
+}
diff --git a/components/engine/pkg/libcontainer/network/veth.go b/components/engine/pkg/libcontainer/network/veth.go
new file mode 100644
index 0000000000..dc207b3394
--- /dev/null
+++ b/components/engine/pkg/libcontainer/network/veth.go
@@ -0,0 +1,85 @@
+package network
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/namespaces"
+	"os"
+	"syscall"
+)
+
+// SetupVeth sets up an existing network namespace with the specified
+// network configuration.
+func SetupVeth(config *libcontainer.Network) error {
+	if err := InterfaceDown(config.TempVethName); err != nil {
+		return fmt.Errorf("interface down %s %s", config.TempVethName, err)
+	}
+	if err := ChangeInterfaceName(config.TempVethName, "eth0"); err != nil {
+		return fmt.Errorf("change %s to eth0 %s", config.TempVethName, err)
+	}
+	if err := SetInterfaceIp("eth0", config.IP); err != nil {
+		return fmt.Errorf("set eth0 ip %s", err)
+	}
+
+	if err := SetMtu("eth0", config.Mtu); err != nil {
+		return fmt.Errorf("set eth0 mtu to %d %s", config.Mtu, err)
+	}
+	if err := InterfaceUp("eth0"); err != nil {
+		return fmt.Errorf("eth0 up %s", err)
+	}
+
+	if err := SetMtu("lo", config.Mtu); err != nil {
+		return fmt.Errorf("set lo mtu to %d %s", config.Mtu, err)
+	}
+	if err := InterfaceUp("lo"); err != nil {
+		return fmt.Errorf("lo up %s", err)
+	}
+
+	if config.Gateway != "" {
+		if err := SetDefaultGateway(config.Gateway); err != nil {
+			return fmt.Errorf("set gateway to %s %s", config.Gateway, err)
+		}
+	}
+	return nil
+}
+
+// SetupNamespaceMountDir prepares a new root for use as a mount
+// source for bind mounting namespace fd to an outside path
+func SetupNamespaceMountDir(root string) error {
+	if err := os.MkdirAll(root, 0666); err != nil {
+		return err
+	}
+	// make sure mounts are not unmounted by other mnt namespaces
+	if err := syscall.Mount("", root, "none", syscall.MS_SHARED|syscall.MS_REC, ""); err != nil && err != syscall.EINVAL {
+		return err
+	}
+	if err := syscall.Mount(root, root, "none", syscall.MS_BIND, ""); err != nil {
+		return err
+	}
+	return nil
+}
+
+// CreateNetworkNamespace creates a new network namespace and binds it's fd
+// at the binding path
+func CreateNetworkNamespace(bindingPath string) error {
+	f, err := os.OpenFile(bindingPath, os.O_RDONLY|os.O_CREATE|os.O_EXCL, 0)
+	if err != nil {
+		return err
+	}
+	f.Close()
+
+	if err := namespaces.CreateNewNamespace(libcontainer.CLONE_NEWNET, bindingPath); err != nil {
+		return err
+	}
+	return nil
+}
+
+// DeleteNetworkNamespace unmounts the binding path and removes the
+// file so that no references to the fd are present and the network
+// namespace is automatically cleaned up
+func DeleteNetworkNamespace(bindingPath string) error {
+	if err := syscall.Unmount(bindingPath, 0); err != nil {
+		return err
+	}
+	return os.Remove(bindingPath)
+}
diff --git a/components/engine/pkg/libcontainer/privileged.json b/components/engine/pkg/libcontainer/privileged.json
new file mode 100644
index 0000000000..be877ad335
--- /dev/null
+++ b/components/engine/pkg/libcontainer/privileged.json
@@ -0,0 +1,22 @@
+{
+    "id": "koye",
+    "namespace_pid": 3745,
+    "command": {
+        "args": [
+            "/usr/lib/systemd/systemd"
+        ],
+        "environment": [
+            "HOME=/",
+            "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
+            "container=docker",
+            "TERM="
+        ]
+    },
+    "rootfs": "/root/main/mycontainer",
+    "namespaces": [
+        "NEWIPC",
+        "NEWNS",
+        "NEWPID",
+        "NEWUTS"
+    ]
+}
diff --git a/components/engine/pkg/libcontainer/types.go b/components/engine/pkg/libcontainer/types.go
new file mode 100644
index 0000000000..db1c3b9738
--- /dev/null
+++ b/components/engine/pkg/libcontainer/types.go
@@ -0,0 +1,49 @@
+package libcontainer
+
+type Namespace string
+type Namespaces []Namespace
+
+func (n Namespaces) Contains(ns Namespace) bool {
+	for _, nns := range n {
+		if nns == ns {
+			return true
+		}
+	}
+	return false
+}
+
+type Capability string
+type Capabilities []Capability
+
+func (c Capabilities) Contains(capp Capability) bool {
+	for _, cc := range c {
+		if cc == capp {
+			return true
+		}
+	}
+	return false
+}
+
+const (
+	CAP_SETPCAP        Capability = "SETPCAP"
+	CAP_SYS_MODULE     Capability = "SYS_MODULE"
+	CAP_SYS_RAWIO      Capability = "SYS_RAWIO"
+	CAP_SYS_PACCT      Capability = "SYS_PACCT"
+	CAP_SYS_ADMIN      Capability = "SYS_ADMIN"
+	CAP_SYS_NICE       Capability = "SYS_NICE"
+	CAP_SYS_RESOURCE   Capability = "SYS_RESOURCE"
+	CAP_SYS_TIME       Capability = "SYS_TIME"
+	CAP_SYS_TTY_CONFIG Capability = "SYS_TTY_CONFIG"
+	CAP_MKNOD          Capability = "MKNOD"
+	CAP_AUDIT_WRITE    Capability = "AUDIT_WRITE"
+	CAP_AUDIT_CONTROL  Capability = "AUDIT_CONTROL"
+	CAP_MAC_OVERRIDE   Capability = "MAC_OVERRIDE"
+	CAP_MAC_ADMIN      Capability = "MAC_ADMIN"
+
+	CLONE_NEWNS   Namespace = "NEWNS"   // mount
+	CLONE_NEWUTS  Namespace = "NEWUTS"  // utsname
+	CLONE_NEWIPC  Namespace = "NEWIPC"  // ipc
+	CLONE_NEWUSER Namespace = "NEWUSER" // user
+	CLONE_NEWPID  Namespace = "NEWPID"  // pid
+	CLONE_NEWNET  Namespace = "NEWNET"  // network
+)
diff --git a/components/engine/pkg/libcontainer/ubuntu.json b/components/engine/pkg/libcontainer/ubuntu.json
new file mode 100644
index 0000000000..0a450ae066
--- /dev/null
+++ b/components/engine/pkg/libcontainer/ubuntu.json
@@ -0,0 +1,22 @@
+{
+    "id": "koye",
+    "namespace_pid": 3745,
+    "command": {
+        "args": [
+            "/sbin/init"
+        ],
+        "environment": [
+            "HOME=/",
+            "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
+            "container=docker",
+            "TERM=xterm"
+        ]
+    },
+    "rootfs": "/var/lib/docker/btrfs/subvolumes/7c0f15df1ad2e2fe04d7a6e079aec17406e9465a6a37dd16cb0dd754fc0167b3",
+    "namespaces": [
+        "NEWIPC",
+        "NEWNS",
+        "NEWPID",
+        "NEWUTS"
+    ]
+}
diff --git a/components/engine/pkg/libcontainer/utils/utils.go b/components/engine/pkg/libcontainer/utils/utils.go
new file mode 100644
index 0000000000..7289fecf2e
--- /dev/null
+++ b/components/engine/pkg/libcontainer/utils/utils.go
@@ -0,0 +1,33 @@
+package utils
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"io"
+	"os"
+	"syscall"
+)
+
+func WaitOnPid(pid int) (exitcode int, err error) {
+	child, err := os.FindProcess(pid)
+	if err != nil {
+		return -1, err
+	}
+	state, err := child.Wait()
+	if err != nil {
+		return -1, err
+	}
+	return getExitCode(state), nil
+}
+
+func getExitCode(state *os.ProcessState) int {
+	return state.Sys().(syscall.WaitStatus).ExitStatus()
+}
+
+func GenerateRandomName(size int) (string, error) {
+	id := make([]byte, size)
+	if _, err := io.ReadFull(rand.Reader, id); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(id), nil
+}

From d60eb0a2ddaac37967f25c57d7c3f8d48361af08 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 18 Feb 2014 17:52:06 -0800
Subject: [PATCH 183/403] Make separate nsinit pkg for a dockerinit like init
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 68b049aed4663eb5f6f53241390f7602c1b40c12 Component: engine

---
 .../engine/pkg/libcontainer/container.go      |   2 +
 .../libcontainer/namespaces/calls_linux.go    |  80 +++---
 .../pkg/libcontainer/namespaces/exec.go       | 270 ++++++------------
 .../pkg/libcontainer/namespaces/mount.go      |  36 +--
 .../pkg/libcontainer/namespaces/namespaces.go |  40 +--
 .../libcontainer/namespaces/nsinit/init.go    | 140 +++++++++
 .../pkg/libcontainer/namespaces/utils.go      |  24 +-
 7 files changed, 285 insertions(+), 307 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/namespaces/nsinit/init.go

diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index b77890fb5c..dd5e728e68 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -11,6 +11,8 @@ type Container struct {
 	WorkingDir   string       `json:"working_dir,omitempty"`
 	Namespaces   Namespaces   `json:"namespaces,omitempty"`
 	Capabilities Capabilities `json:"capabilities,omitempty"`
+	Master       uintptr      `json:"master"`
+	Console      string       `json:"console"`
 }
 
 type Command struct {
diff --git a/components/engine/pkg/libcontainer/namespaces/calls_linux.go b/components/engine/pkg/libcontainer/namespaces/calls_linux.go
index 793e940b6e..f006d56da6 100644
--- a/components/engine/pkg/libcontainer/namespaces/calls_linux.go
+++ b/components/engine/pkg/libcontainer/namespaces/calls_linux.go
@@ -12,19 +12,19 @@ const (
 	TIOCSPTLCK = 0x40045431
 )
 
-func chroot(dir string) error {
+func Chroot(dir string) error {
 	return syscall.Chroot(dir)
 }
 
-func chdir(dir string) error {
+func Chdir(dir string) error {
 	return syscall.Chdir(dir)
 }
 
-func exec(cmd string, args []string, env []string) error {
+func Exec(cmd string, args []string, env []string) error {
 	return syscall.Exec(cmd, args, env)
 }
 
-func fork() (int, error) {
+func Fork() (int, error) {
 	syscall.ForkLock.Lock()
 	pid, _, err := syscall.Syscall(syscall.SYS_FORK, 0, 0, 0)
 	syscall.ForkLock.Unlock()
@@ -34,33 +34,23 @@ func fork() (int, error) {
 	return int(pid), nil
 }
 
-func vfork() (int, error) {
-	syscall.ForkLock.Lock()
-	pid, _, err := syscall.Syscall(syscall.SYS_VFORK, 0, 0, 0)
-	syscall.ForkLock.Unlock()
-	if err != 0 {
-		return -1, err
-	}
-	return int(pid), nil
-}
-
-func mount(source, target, fstype string, flags uintptr, data string) error {
+func Mount(source, target, fstype string, flags uintptr, data string) error {
 	return syscall.Mount(source, target, fstype, flags, data)
 }
 
-func unmount(target string, flags int) error {
+func Unmount(target string, flags int) error {
 	return syscall.Unmount(target, flags)
 }
 
-func pivotroot(newroot, putold string) error {
+func Pivotroot(newroot, putold string) error {
 	return syscall.PivotRoot(newroot, putold)
 }
 
-func unshare(flags int) error {
+func Unshare(flags int) error {
 	return syscall.Unshare(flags)
 }
 
-func clone(flags uintptr) (int, error) {
+func Clone(flags uintptr) (int, error) {
 	syscall.ForkLock.Lock()
 	pid, _, err := syscall.RawSyscall(syscall.SYS_CLONE, flags, 0, 0)
 	syscall.ForkLock.Unlock()
@@ -70,7 +60,7 @@ func clone(flags uintptr) (int, error) {
 	return int(pid), nil
 }
 
-func setns(fd uintptr, flags uintptr) error {
+func Setns(fd uintptr, flags uintptr) error {
 	_, _, err := syscall.RawSyscall(SYS_SETNS, fd, flags, 0)
 	if err != 0 {
 		return err
@@ -78,87 +68,87 @@ func setns(fd uintptr, flags uintptr) error {
 	return nil
 }
 
-func usetCloseOnExec(fd uintptr) error {
+func UsetCloseOnExec(fd uintptr) error {
 	if _, _, err := syscall.Syscall(syscall.SYS_FCNTL, fd, syscall.F_SETFD, 0); err != 0 {
 		return err
 	}
 	return nil
 }
 
-func setgroups(gids []int) error {
+func Setgroups(gids []int) error {
 	return syscall.Setgroups(gids)
 }
 
-func setresgid(rgid, egid, sgid int) error {
+func Setresgid(rgid, egid, sgid int) error {
 	return syscall.Setresgid(rgid, egid, sgid)
 }
 
-func setresuid(ruid, euid, suid int) error {
+func Setresuid(ruid, euid, suid int) error {
 	return syscall.Setresuid(ruid, euid, suid)
 }
 
-func sethostname(name string) error {
+func Sethostname(name string) error {
 	return syscall.Sethostname([]byte(name))
 }
 
-func setsid() (int, error) {
+func Setsid() (int, error) {
 	return syscall.Setsid()
 }
 
-func ioctl(fd uintptr, flag, data uintptr) error {
+func Unlockpt(f *os.File) error {
+	var u int
+	return Ioctl(f.Fd(), TIOCSPTLCK, uintptr(unsafe.Pointer(&u)))
+}
+
+func Ioctl(fd uintptr, flag, data uintptr) error {
 	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, fd, flag, data); err != 0 {
 		return err
 	}
 	return nil
 }
 
-func openpmtx() (*os.File, error) {
-	return os.OpenFile("/dev/ptmx", syscall.O_RDONLY|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
-}
-
-func unlockpt(f *os.File) error {
-	var u int
-	return ioctl(f.Fd(), TIOCSPTLCK, uintptr(unsafe.Pointer(&u)))
-}
-
-func ptsname(f *os.File) (string, error) {
+func Ptsname(f *os.File) (string, error) {
 	var n int
-	if err := ioctl(f.Fd(), TIOCGPTN, uintptr(unsafe.Pointer(&n))); err != nil {
+	if err := Ioctl(f.Fd(), TIOCGPTN, uintptr(unsafe.Pointer(&n))); err != nil {
 		return "", err
 	}
 	return fmt.Sprintf("/dev/pts/%d", n), nil
 }
 
-func closefd(fd uintptr) error {
+func Openpmtx() (*os.File, error) {
+	return os.OpenFile("/dev/ptmx", syscall.O_RDONLY|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
+}
+
+func Closefd(fd uintptr) error {
 	return syscall.Close(int(fd))
 }
 
-func dup2(fd1, fd2 uintptr) error {
+func Dup2(fd1, fd2 uintptr) error {
 	return syscall.Dup2(int(fd1), int(fd2))
 }
 
-func mknod(path string, mode uint32, dev int) error {
+func Mknod(path string, mode uint32, dev int) error {
 	return syscall.Mknod(path, mode, dev)
 }
 
-func parentDeathSignal() error {
+func ParentDeathSignal() error {
 	if _, _, err := syscall.RawSyscall6(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0, 0, 0, 0); err != 0 {
 		return err
 	}
 	return nil
 }
 
-func setctty() error {
+func Setctty() error {
 	if _, _, err := syscall.RawSyscall(syscall.SYS_IOCTL, 0, uintptr(syscall.TIOCSCTTY), 0); err != 0 {
 		return err
 	}
 	return nil
 }
 
-func mkfifo(name string, mode uint32) error {
+func Mkfifo(name string, mode uint32) error {
 	return syscall.Mkfifo(name, mode)
 }
 
-func umask(mask int) int {
+func Umask(mask int) int {
 	return syscall.Umask(mask)
 }
diff --git a/components/engine/pkg/libcontainer/namespaces/exec.go b/components/engine/pkg/libcontainer/namespaces/exec.go
index 893b302887..0077a0b16c 100644
--- a/components/engine/pkg/libcontainer/namespaces/exec.go
+++ b/components/engine/pkg/libcontainer/namespaces/exec.go
@@ -8,12 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
-	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 	"io"
 	"log"
 	"os"
-	"path/filepath"
+	"os/exec"
 	"syscall"
 )
 
@@ -29,89 +27,31 @@ var (
 // the container will be spawned with a new network namespace with no configuration.  Omiting an
 // existing network namespace and the CLONE_NEWNET option in the container configuration will allow
 // the container to the the host's networking options and configuration.
-func Exec(container *libcontainer.Container) (pid int, err error) {
+func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 	// a user cannot pass CLONE_NEWNET and an existing net namespace fd to join
 	if container.NetNsFd > 0 && container.Namespaces.Contains(libcontainer.CLONE_NEWNET) {
 		return -1, ErrExistingNetworkNamespace
 	}
 
-	rootfs, err := resolveRootfs(container)
-	if err != nil {
-		return -1, err
-	}
-
 	master, console, err := createMasterAndConsole()
 	if err != nil {
 		return -1, err
 	}
-
-	logger, err := os.OpenFile("/root/logs", os.O_RDWR|os.O_CREATE|os.O_APPEND, 0755)
-	if err != nil {
-		return -1, err
-	}
-	log.SetOutput(logger)
+	container.Console = console
+	container.Master = master.Fd()
 
 	// we need CLONE_VFORK so we can wait on the child
-	flag := getNamespaceFlags(container.Namespaces) | CLONE_VFORK
+	flag := uintptr(getNamespaceFlags(container.Namespaces) | CLONE_VFORK)
 
-	if pid, err = clone(uintptr(flag | SIGCHLD)); err != nil {
-		return -1, fmt.Errorf("error cloning process: %s", err)
-	}
-
-	if pid == 0 {
-		// welcome to your new namespace ;)
-		//
-		// any errors encoutered inside the namespace we should write
-		// out to a log or a pipe to our parent and exit(1)
-		// because writing to stderr will not work after we close
-		if err := closeMasterAndStd(master); err != nil {
-			writeError("close master and std %s", err)
-		}
-		slave, err := openTerminal(console, syscall.O_RDWR)
-		if err != nil {
-			writeError("open terminal %s", err)
-		}
-		if err := dupSlave(slave); err != nil {
-			writeError("dup2 slave %s", err)
-		}
-
-		if container.NetNsFd > 0 {
-			if err := JoinExistingNamespace(container.NetNsFd, libcontainer.CLONE_NEWNET); err != nil {
-				writeError("join existing net namespace %s", err)
-			}
-		}
-
-		if _, err := setsid(); err != nil {
-			writeError("setsid %s", err)
-		}
-		if err := setctty(); err != nil {
-			writeError("setctty %s", err)
-		}
-		if err := parentDeathSignal(); err != nil {
-			writeError("parent deth signal %s", err)
-		}
-		if err := SetupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
-			writeError("setup mount namespace %s", err)
-		}
-		if err := sethostname(container.ID); err != nil {
-			writeError("sethostname %s", err)
-		}
-		if err := capabilities.DropCapabilities(container); err != nil {
-			writeError("drop capabilities %s", err)
-		}
-		if err := setupUser(container); err != nil {
-			writeError("setup user %s", err)
-		}
-		if container.WorkingDir != "" {
-			if err := chdir(container.WorkingDir); err != nil {
-				writeError("chdir to %s %s", container.WorkingDir, err)
-			}
-		}
-		if err := exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
-			writeError("exec %s", err)
-		}
-		panic("unreachable")
+	command := exec.Command("/.nsinit")
+	command.SysProcAttr = &syscall.SysProcAttr{}
+	command.SysProcAttr.Cloneflags = flag
+	command.SysProcAttr.Setctty = true
+
+	if err := command.Start(); err != nil {
+		return -1, err
 	}
+	pid = command.Process.Pid
 
 	go func() {
 		if _, err := io.Copy(os.Stdout, master); err != nil {
@@ -130,91 +70,86 @@ func Exec(container *libcontainer.Container) (pid int, err error) {
 // pid and namespace configuration is needed along with the specific capabilities that should
 // be dropped once inside the namespace.
 func ExecIn(container *libcontainer.Container, cmd *libcontainer.Command) (int, error) {
-	if container.NsPid <= 0 {
-		return -1, libcontainer.ErrInvalidPid
-	}
-
-	fds, err := getNsFds(container)
-	if err != nil {
-		return -1, err
-	}
-
-	if container.NetNsFd > 0 {
-		fds = append(fds, container.NetNsFd)
-	}
-
-	pid, err := fork()
-	if err != nil {
-		for _, fd := range fds {
-			syscall.Close(int(fd))
+	return -1, fmt.Errorf("not implemented")
+	/*
+		if container.NsPid <= 0 {
+			return -1, libcontainer.ErrInvalidPid
 		}
-		return -1, err
-	}
 
-	if pid == 0 {
-		for _, fd := range fds {
-			if fd > 0 {
-				if err := JoinExistingNamespace(fd, ""); err != nil {
-					for _, fd := range fds {
-						syscall.Close(int(fd))
+		fds, err := getNsFds(container)
+		if err != nil {
+			return -1, err
+		}
+
+		if container.NetNsFd > 0 {
+			fds = append(fds, container.NetNsFd)
+		}
+
+		pid, err := fork()
+		if err != nil {
+			for _, fd := range fds {
+				syscall.Close(int(fd))
+			}
+			return -1, err
+		}
+
+		if pid == 0 {
+			for _, fd := range fds {
+				if fd > 0 {
+					if err := JoinExistingNamespace(fd, ""); err != nil {
+						for _, fd := range fds {
+							syscall.Close(int(fd))
+						}
+						writeError("join existing namespace for %d %s", fd, err)
 					}
-					writeError("join existing namespace for %d %s", fd, err)
 				}
-			}
-			syscall.Close(int(fd))
-		}
-
-		if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
-			container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
-			// important:
-			//
-			// we need to fork and unshare so that re can remount proc and sys within
-			// the namespace so the CLONE_NEWPID namespace will take effect
-			// if we don't fork we would end up unmounting proc and sys for the entire
-			// namespace
-			child, err := fork()
-			if err != nil {
-				writeError("fork child %s", err)
+				syscall.Close(int(fd))
 			}
 
-			if child == 0 {
-				if err := unshare(CLONE_NEWNS); err != nil {
-					writeError("unshare newns %s", err)
+			if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
+				container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
+				// important:
+				//
+				// we need to fork and unshare so that re can remount proc and sys within
+				// the namespace so the CLONE_NEWPID namespace will take effect
+				// if we don't fork we would end up unmounting proc and sys for the entire
+				// namespace
+				child, err := fork()
+				if err != nil {
+					writeError("fork child %s", err)
 				}
-				if err := remountProc(); err != nil {
-					writeError("remount proc %s", err)
-				}
-				if err := remountSys(); err != nil {
-					writeError("remount sys %s", err)
-				}
-				if err := capabilities.DropCapabilities(container); err != nil {
-					writeError("drop caps %s", err)
-				}
-				if err := exec(cmd.Args[0], cmd.Args[0:], cmd.Env); err != nil {
-					writeError("exec %s", err)
-				}
-				panic("unreachable")
-			}
-			exit, err := utils.WaitOnPid(child)
-			if err != nil {
-				writeError("wait on child %s", err)
-			}
-			os.Exit(exit)
-		}
-		if err := exec(cmd.Args[0], cmd.Args[0:], cmd.Env); err != nil {
-			writeError("exec %s", err)
-		}
-		panic("unreachable")
-	}
-	return pid, err
-}
 
-func resolveRootfs(container *libcontainer.Container) (string, error) {
-	rootfs, err := filepath.Abs(container.RootFs)
-	if err != nil {
-		return "", err
-	}
-	return filepath.EvalSymlinks(rootfs)
+				if child == 0 {
+					if err := unshare(CLONE_NEWNS); err != nil {
+						writeError("unshare newns %s", err)
+					}
+					if err := remountProc(); err != nil {
+						writeError("remount proc %s", err)
+					}
+					if err := remountSys(); err != nil {
+						writeError("remount sys %s", err)
+					}
+					if err := capabilities.DropCapabilities(container); err != nil {
+						writeError("drop caps %s", err)
+					}
+					if err := exec(cmd.Args[0], cmd.Args[0:], cmd.Env); err != nil {
+						writeError("exec %s", err)
+					}
+					panic("unreachable")
+				}
+				exit, err := utils.WaitOnPid(child)
+				if err != nil {
+					writeError("wait on child %s", err)
+				}
+				os.Exit(exit)
+			}
+			if err := exec(cmd.Args[0], cmd.Args[0:], cmd.Env); err != nil {
+				writeError("exec %s", err)
+			}
+			panic("unreachable")
+		}
+		return pid, err
+	*/
 }
 
 func createMasterAndConsole() (*os.File, string, error) {
@@ -223,44 +158,13 @@ func createMasterAndConsole() (*os.File, string, error) {
 		return nil, "", err
 	}
 
-	console, err := ptsname(master)
+	console, err := Ptsname(master)
 	if err != nil {
 		return nil, "", err
 	}
 
-	if err := unlockpt(master); err != nil {
+	if err := Unlockpt(master); err != nil {
 		return nil, "", err
 	}
 	return master, console, nil
 }
-
-func closeMasterAndStd(master *os.File) error {
-	closefd(master.Fd())
-	closefd(0)
-	closefd(1)
-	closefd(2)
-
-	return nil
-}
-
-func dupSlave(slave *os.File) error {
-	// we close Stdin,etc so our pty slave should have fd 0
-	if slave.Fd() != 0 {
-		return fmt.Errorf("slave fd not 0 %d", slave.Fd())
-	}
-	if err := dup2(slave.Fd(), 1); err != nil {
-		return err
-	}
-	if err := dup2(slave.Fd(), 2); err != nil {
-		return err
-	}
-	return nil
-}
-
-func openTerminal(name string, flag int) (*os.File, error) {
-	r, e := syscall.Open(name, flag, 0)
-	if e != nil {
-		return nil, &os.PathError{"open", name, e}
-	}
-	return os.NewFile(uintptr(r), name), nil
-}
diff --git a/components/engine/pkg/libcontainer/namespaces/mount.go b/components/engine/pkg/libcontainer/namespaces/mount.go
index 6d867c91ec..8e7c54b046 100644
--- a/components/engine/pkg/libcontainer/namespaces/mount.go
+++ b/components/engine/pkg/libcontainer/namespaces/mount.go
@@ -14,16 +14,16 @@ var (
 )
 
 func SetupNewMountNamespace(rootfs, console string, readonly bool) error {
-	if err := mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
+	if err := Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
 
-	if err := mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {
+	if err := Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mouting %s as bind %s", rootfs, err)
 	}
 
 	if readonly {
-		if err := mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, ""); err != nil {
+		if err := Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, ""); err != nil {
 			return fmt.Errorf("mounting %s as readonly %s", rootfs, err)
 		}
 	}
@@ -52,29 +52,29 @@ func SetupNewMountNamespace(rootfs, console string, readonly bool) error {
 		return err
 	}
 
-	if err := chdir(rootfs); err != nil {
+	if err := Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
 
-	if err := mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
+	if err := Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
 		return fmt.Errorf("mount move %s into / %s", rootfs, err)
 	}
 
-	if err := chroot("."); err != nil {
+	if err := Chroot("."); err != nil {
 		return fmt.Errorf("chroot . %s", err)
 	}
 
-	if err := chdir("/"); err != nil {
+	if err := Chdir("/"); err != nil {
 		return fmt.Errorf("chdir / %s", err)
 	}
 
-	umask(0022)
+	Umask(0022)
 
 	return nil
 }
 
 func copyDevNodes(rootfs string) error {
-	umask(0000)
+	Umask(0000)
 
 	for _, node := range []string{
 		"null",
@@ -95,7 +95,7 @@ func copyDevNodes(rootfs string) error {
 		)
 
 		log.Printf("copy %s to %s %d\n", node, dest, st.Rdev)
-		if err := mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) {
+		if err := Mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) {
 			return fmt.Errorf("copy %s %s", node, err)
 		}
 	}
@@ -125,7 +125,7 @@ func setupDev(rootfs string) error {
 }
 
 func setupConsole(rootfs, console string) error {
-	umask(0000)
+	Umask(0000)
 
 	stat, err := os.Stat(console)
 	if err != nil {
@@ -145,11 +145,11 @@ func setupConsole(rootfs, console string) error {
 		return err
 	}
 
-	if err := mknod(dest, (st.Mode&^07777)|0600, int(st.Rdev)); err != nil {
+	if err := Mknod(dest, (st.Mode&^07777)|0600, int(st.Rdev)); err != nil {
 		return fmt.Errorf("mknod %s %s", dest, err)
 	}
 
-	if err := mount(console, dest, "bind", syscall.MS_BIND, ""); err != nil {
+	if err := Mount(console, dest, "bind", syscall.MS_BIND, ""); err != nil {
 		return fmt.Errorf("bind %s to %s %s", console, dest, err)
 	}
 	return nil
@@ -176,7 +176,7 @@ func mountSystem(rootfs string) error {
 		if err := os.MkdirAll(m.path, 0755); err != nil && !os.IsExist(err) {
 			return fmt.Errorf("mkdirall %s %s", m.path, err)
 		}
-		if err := mount(m.source, m.path, m.device, uintptr(m.flags), m.data); err != nil {
+		if err := Mount(m.source, m.path, m.device, uintptr(m.flags), m.data); err != nil {
 			return fmt.Errorf("mounting %s into %s %s", m.source, m.path, err)
 		}
 	}
@@ -184,22 +184,22 @@ func mountSystem(rootfs string) error {
 }
 
 func remountProc() error {
-	if err := unmount("/proc", syscall.MNT_DETACH); err != nil {
+	if err := Unmount("/proc", syscall.MNT_DETACH); err != nil {
 		return err
 	}
-	if err := mount("proc", "/proc", "proc", uintptr(defaults), ""); err != nil {
+	if err := Mount("proc", "/proc", "proc", uintptr(defaults), ""); err != nil {
 		return err
 	}
 	return nil
 }
 
 func remountSys() error {
-	if err := unmount("/sys", syscall.MNT_DETACH); err != nil {
+	if err := Unmount("/sys", syscall.MNT_DETACH); err != nil {
 		if err != syscall.EINVAL {
 			return err
 		}
 	} else {
-		if err := mount("sysfs", "/sys", "sysfs", uintptr(defaults), ""); err != nil {
+		if err := Mount("sysfs", "/sys", "sysfs", uintptr(defaults), ""); err != nil {
 			return err
 		}
 	}
diff --git a/components/engine/pkg/libcontainer/namespaces/namespaces.go b/components/engine/pkg/libcontainer/namespaces/namespaces.go
index 2a50847015..05ef0ac7a9 100644
--- a/components/engine/pkg/libcontainer/namespaces/namespaces.go
+++ b/components/engine/pkg/libcontainer/namespaces/namespaces.go
@@ -9,52 +9,14 @@
 package namespaces
 
 import (
-	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"github.com/dotcloud/docker/pkg/libcontainer/utils"
-	"os"
-	"path/filepath"
-	"syscall"
 )
 
-// CreateNewNamespace creates a new namespace and binds it's fd to the specified path
-func CreateNewNamespace(namespace libcontainer.Namespace, bindTo string) error {
-	var (
-		flag   = namespaceMap[namespace]
-		name   = namespaceFileMap[namespace]
-		nspath = filepath.Join("/proc/self/ns", name)
-	)
-	// TODO: perform validation on name and flag
-
-	pid, err := fork()
-	if err != nil {
-		return err
-	}
-
-	if pid == 0 {
-		if err := unshare(flag); err != nil {
-			writeError("unshare %s", err)
-		}
-		if err := mount(nspath, bindTo, "none", syscall.MS_BIND, ""); err != nil {
-			writeError("bind mount %s", err)
-		}
-		os.Exit(0)
-	}
-	exit, err := utils.WaitOnPid(pid)
-	if err != nil {
-		return err
-	}
-	if exit != 0 {
-		return fmt.Errorf("exit status %d", exit)
-	}
-	return err
-}
-
 // JoinExistingNamespace uses the fd of an existing linux namespace and
 // has the current process join that namespace or the spacespace specified by ns
 func JoinExistingNamespace(fd uintptr, ns libcontainer.Namespace) error {
 	flag := namespaceMap[ns]
-	if err := setns(fd, uintptr(flag)); err != nil {
+	if err := Setns(fd, uintptr(flag)); err != nil {
 		return err
 	}
 	return nil
diff --git a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go b/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
new file mode 100644
index 0000000000..9a7563642c
--- /dev/null
+++ b/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
@@ -0,0 +1,140 @@
+package nsinit
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
+	"github.com/dotcloud/docker/pkg/libcontainer/namespaces"
+	"log"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// InitNamespace should be run inside an existing namespace to setup
+// common mounts, drop capabilities, and setup network interfaces
+func InitNamespace(container *libcontainer.Container) error {
+	rootfs, err := resolveRootfs(container)
+	if err != nil {
+		return err
+	}
+
+	// any errors encoutered inside the namespace we should write
+	// out to a log or a pipe to our parent and exit(1)
+	// because writing to stderr will not work after we close
+	if err := closeMasterAndStd(container.Master); err != nil {
+		log.Fatalf("close master and std %s", err)
+		return err
+	}
+
+	slave, err := openTerminal(container.Console, syscall.O_RDWR)
+	if err != nil {
+		log.Fatalf("open terminal %s", err)
+		return err
+	}
+	if err := dupSlave(slave); err != nil {
+		log.Fatalf("dup2 slave %s", err)
+		return err
+	}
+
+	/*
+		if container.NetNsFd > 0 {
+			if err := joinExistingNamespace(container.NetNsFd, libcontainer.CLONE_NEWNET); err != nil {
+				log.Fatalf("join existing net namespace %s", err)
+			}
+		}
+	*/
+
+	if _, err := namespaces.Setsid(); err != nil {
+		log.Fatalf("setsid %s", err)
+		return err
+	}
+	if err := namespaces.Setctty(); err != nil {
+		log.Fatalf("setctty %s", err)
+		return err
+	}
+	if err := namespaces.ParentDeathSignal(); err != nil {
+		log.Fatalf("parent deth signal %s", err)
+		return err
+	}
+	if err := namespaces.SetupNewMountNamespace(rootfs, container.Console, container.ReadonlyFs); err != nil {
+		log.Fatalf("setup mount namespace %s", err)
+		return err
+	}
+	if err := namespaces.Sethostname(container.ID); err != nil {
+		log.Fatalf("sethostname %s", err)
+		return err
+	}
+	if err := capabilities.DropCapabilities(container); err != nil {
+		log.Fatalf("drop capabilities %s", err)
+		return err
+	}
+	if err := setupUser(container); err != nil {
+		log.Fatalf("setup user %s", err)
+		return err
+	}
+	if container.WorkingDir != "" {
+		if err := namespaces.Chdir(container.WorkingDir); err != nil {
+			log.Fatalf("chdir to %s %s", container.WorkingDir, err)
+			return err
+		}
+	}
+	if err := namespaces.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+		log.Fatalf("exec %s", err)
+		return err
+	}
+	panic("unreachable")
+}
+
+func resolveRootfs(container *libcontainer.Container) (string, error) {
+	rootfs, err := filepath.Abs(container.RootFs)
+	if err != nil {
+		return "", err
+	}
+	return filepath.EvalSymlinks(rootfs)
+}
+
+func closeMasterAndStd(master uintptr) error {
+	namespaces.Closefd(master)
+	namespaces.Closefd(0)
+	namespaces.Closefd(1)
+	namespaces.Closefd(2)
+
+	return nil
+}
+
+func setupUser(container *libcontainer.Container) error {
+	// TODO: honor user passed on container
+	if err := namespaces.Setgroups(nil); err != nil {
+		return err
+	}
+	if err := namespaces.Setresgid(0, 0, 0); err != nil {
+		return err
+	}
+	if err := namespaces.Setresuid(0, 0, 0); err != nil {
+		return err
+	}
+	return nil
+}
+
+func dupSlave(slave *os.File) error {
+	// we close Stdin,etc so our pty slave should have fd 0
+	if slave.Fd() != 0 {
+		return fmt.Errorf("slave fd not 0 %d", slave.Fd())
+	}
+	if err := namespaces.Dup2(slave.Fd(), 1); err != nil {
+		return err
+	}
+	if err := namespaces.Dup2(slave.Fd(), 2); err != nil {
+		return err
+	}
+	return nil
+}
+
+func openTerminal(name string, flag int) (*os.File, error) {
+	r, e := syscall.Open(name, flag, 0)
+	if e != nil {
+		return nil, &os.PathError{"open", name, e}
+	}
+	return os.NewFile(uintptr(r), name), nil
+}
diff --git a/components/engine/pkg/libcontainer/namespaces/utils.go b/components/engine/pkg/libcontainer/namespaces/utils.go
index 438d896484..fd195c0ad1 100644
--- a/components/engine/pkg/libcontainer/namespaces/utils.go
+++ b/components/engine/pkg/libcontainer/namespaces/utils.go
@@ -26,12 +26,6 @@ func addEnvIfNotSet(container *libcontainer.Container, key, value string) {
 	container.Command.Env = append(container.Command.Env, jv)
 }
 
-// print and error to stderr and exit(1)
-func writeError(format string, v ...interface{}) {
-	fmt.Fprintf(os.Stderr, format, v...)
-	os.Exit(1)
-}
-
 // getNsFds inspects the container's namespace configuration and opens the fds to
 // each of the namespaces.
 func getNsFds(container *libcontainer.Container) ([]uintptr, error) {
@@ -79,27 +73,13 @@ func setupEnvironment(container *libcontainer.Container) {
 	addEnvIfNotSet(container, "LOGNAME", "root")
 }
 
-func setupUser(container *libcontainer.Container) error {
-	// TODO: honor user passed on container
-	if err := setgroups(nil); err != nil {
-		return err
-	}
-	if err := setresgid(0, 0, 0); err != nil {
-		return err
-	}
-	if err := setresuid(0, 0, 0); err != nil {
-		return err
-	}
-	return nil
-}
-
 func getMasterAndConsole(container *libcontainer.Container) (string, *os.File, error) {
-	master, err := openpmtx()
+	master, err := Openpmtx()
 	if err != nil {
 		return "", nil, err
 	}
 
-	console, err := ptsname(master)
+	console, err := Ptsname(master)
 	if err != nil {
 		master.Close()
 		return "", nil, err

From e746c16a002caa2a031c3f40445aa5cac12876cb Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 18 Feb 2014 18:15:41 -0800
Subject: [PATCH 184/403] WIP moving to nsini Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 72e65b654b75d5087e50cc6366e78bd2f8318bae Component: engine

---
 .../engine/pkg/libcontainer/cli/main.go       | 78 +++++++++++--------
 .../pkg/libcontainer/namespaces/exec.go       | 10 ++-
 .../engine/pkg/libcontainer/network/veth.go   | 16 ----
 3 files changed, 52 insertions(+), 52 deletions(-)

diff --git a/components/engine/pkg/libcontainer/cli/main.go b/components/engine/pkg/libcontainer/cli/main.go
index 490135ef5a..0430e29430 100644
--- a/components/engine/pkg/libcontainer/cli/main.go
+++ b/components/engine/pkg/libcontainer/cli/main.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/namespaces"
+	"github.com/dotcloud/docker/pkg/libcontainer/namespaces/nsinit"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 	"os"
@@ -15,15 +16,26 @@ var (
 	displayPid bool
 	newCommand string
 	usrNet     bool
+	masterFd   int
+	console    string
 )
 
 func init() {
 	flag.BoolVar(&displayPid, "pid", false, "display the pid before waiting")
 	flag.StringVar(&newCommand, "cmd", "/bin/bash", "command to run in the existing namespace")
 	flag.BoolVar(&usrNet, "net", false, "user a net namespace")
+	flag.IntVar(&masterFd, "master", 0, "master fd")
+	flag.StringVar(&console, "console", "", "console path")
 	flag.Parse()
 }
 
+func nsinitFunc(container *libcontainer.Container) error {
+	container.Master = uintptr(masterFd)
+	container.Console = console
+
+	return nsinit.InitNamespace(container)
+}
+
 func exec(container *libcontainer.Container) error {
 	var (
 		netFile *os.File
@@ -39,7 +51,7 @@ func exec(container *libcontainer.Container) error {
 		container.NetNsFd = netFile.Fd()
 	}
 
-	pid, err := namespaces.Exec(container)
+	pid, err := namespaces.ExecContainer(container)
 	if err != nil {
 		return fmt.Errorf("error exec container %s", err)
 	}
@@ -87,39 +99,39 @@ func execIn(container *libcontainer.Container) error {
 }
 
 func createNet(config *libcontainer.Network) error {
-	root := "/root/nsroot"
-	if err := network.SetupNamespaceMountDir(root); err != nil {
-		return err
-	}
-
-	nspath := root + "/test"
-	if err := network.CreateNetworkNamespace(nspath); err != nil {
-		return nil
-	}
-	if err := network.CreateVethPair("veth0", config.TempVethName); err != nil {
-		return err
-	}
-	if err := network.SetInterfaceMaster("veth0", config.Bridge); err != nil {
-		return err
-	}
-	if err := network.InterfaceUp("veth0"); err != nil {
-		return err
-	}
-
-	f, err := os.Open(nspath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	if err := network.SetInterfaceInNamespaceFd("veth1", int(f.Fd())); err != nil {
-		return err
-	}
-
 	/*
-		if err := network.SetupVethInsideNamespace(f.Fd(), config); err != nil {
+		root := "/root/nsroot"
+		if err := network.SetupNamespaceMountDir(root); err != nil {
 			return err
 		}
+
+		nspath := root + "/test"
+		if err := network.CreateNetworkNamespace(nspath); err != nil {
+			return nil
+		}
+		if err := network.CreateVethPair("veth0", config.TempVethName); err != nil {
+			return err
+		}
+		if err := network.SetInterfaceMaster("veth0", config.Bridge); err != nil {
+			return err
+		}
+		if err := network.InterfaceUp("veth0"); err != nil {
+			return err
+		}
+
+		f, err := os.Open(nspath)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+
+		if err := network.SetInterfaceInNamespaceFd("veth1", int(f.Fd())); err != nil {
+			return err
+		}
+
+			if err := network.SetupVethInsideNamespace(f.Fd(), config); err != nil {
+				return err
+			}
 	*/
 	return nil
 }
@@ -133,7 +145,7 @@ func main() {
 	var (
 		err    error
 		cliCmd = flag.Arg(0)
-		config = flag.Arg(1)
+		config = "/root/development/gocode/src/github.com/dotcloud/docker/pkg/libcontainer/container.json" //flag.Arg(1)
 	)
 	f, err := os.Open(config)
 	if err != nil {
@@ -149,6 +161,8 @@ func main() {
 	f.Close()
 
 	switch cliCmd {
+	case "init":
+		err = nsinitFunc(container)
 	case "exec":
 		err = exec(container)
 	case "execin":
diff --git a/components/engine/pkg/libcontainer/namespaces/exec.go b/components/engine/pkg/libcontainer/namespaces/exec.go
index 0077a0b16c..93b155ba24 100644
--- a/components/engine/pkg/libcontainer/namespaces/exec.go
+++ b/components/engine/pkg/libcontainer/namespaces/exec.go
@@ -12,6 +12,8 @@ import (
 	"log"
 	"os"
 	"os/exec"
+	"path/filepath"
+	"strconv"
 	"syscall"
 )
 
@@ -37,16 +39,15 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 	if err != nil {
 		return -1, err
 	}
-	container.Console = console
-	container.Master = master.Fd()
+	nsinit := filepath.Join(container.RootFs, ".nsinit")
 
 	// we need CLONE_VFORK so we can wait on the child
 	flag := uintptr(getNamespaceFlags(container.Namespaces) | CLONE_VFORK)
 
-	command := exec.Command("/.nsinit")
+	command := exec.Command(nsinit, "init", "-master", strconv.Itoa(int(master.Fd())), "-console", console)
 	command.SysProcAttr = &syscall.SysProcAttr{}
 	command.SysProcAttr.Cloneflags = flag
-	command.SysProcAttr.Setctty = true
+	//	command.SysProcAttr.Setctty = true
 
 	if err := command.Start(); err != nil {
 		return -1, err
@@ -63,6 +64,7 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 			log.Println(err)
 		}
 	}()
+	command.Wait()
 	return pid, nil
 }
 
diff --git a/components/engine/pkg/libcontainer/network/veth.go b/components/engine/pkg/libcontainer/network/veth.go
index dc207b3394..2ecce22c3e 100644
--- a/components/engine/pkg/libcontainer/network/veth.go
+++ b/components/engine/pkg/libcontainer/network/veth.go
@@ -3,7 +3,6 @@ package network
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"github.com/dotcloud/docker/pkg/libcontainer/namespaces"
 	"os"
 	"syscall"
 )
@@ -59,21 +58,6 @@ func SetupNamespaceMountDir(root string) error {
 	return nil
 }
 
-// CreateNetworkNamespace creates a new network namespace and binds it's fd
-// at the binding path
-func CreateNetworkNamespace(bindingPath string) error {
-	f, err := os.OpenFile(bindingPath, os.O_RDONLY|os.O_CREATE|os.O_EXCL, 0)
-	if err != nil {
-		return err
-	}
-	f.Close()
-
-	if err := namespaces.CreateNewNamespace(libcontainer.CLONE_NEWNET, bindingPath); err != nil {
-		return err
-	}
-	return nil
-}
-
 // DeleteNetworkNamespace unmounts the binding path and removes the
 // file so that no references to the fd are present and the network
 // namespace is automatically cleaned up

From 1da80198b4a225c47f859c8fd41bd51850750761 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 10:44:29 -0800
Subject: [PATCH 185/403] Use nsinit for setting up namespace
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 11429457691be3b009c6d9f4cc9fce9150d4e810 Component: engine

---
 components/engine/pkg/libcontainer/cli/main.go      |  1 +
 components/engine/pkg/libcontainer/container.go     |  1 +
 .../engine/pkg/libcontainer/namespaces/exec.go      |  4 ++--
 .../pkg/libcontainer/namespaces/nsinit/init.go      | 13 +++++++++++++
 4 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/components/engine/pkg/libcontainer/cli/main.go b/components/engine/pkg/libcontainer/cli/main.go
index 0430e29430..ac0ea29924 100644
--- a/components/engine/pkg/libcontainer/cli/main.go
+++ b/components/engine/pkg/libcontainer/cli/main.go
@@ -32,6 +32,7 @@ func init() {
 func nsinitFunc(container *libcontainer.Container) error {
 	container.Master = uintptr(masterFd)
 	container.Console = console
+	container.LogFile = "/root/logs"
 
 	return nsinit.InitNamespace(container)
 }
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index dd5e728e68..c9a3f2e902 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -13,6 +13,7 @@ type Container struct {
 	Capabilities Capabilities `json:"capabilities,omitempty"`
 	Master       uintptr      `json:"master"`
 	Console      string       `json:"console"`
+	LogFile      string       `json:"log_file"`
 }
 
 type Command struct {
diff --git a/components/engine/pkg/libcontainer/namespaces/exec.go b/components/engine/pkg/libcontainer/namespaces/exec.go
index 93b155ba24..7f4b4a609a 100644
--- a/components/engine/pkg/libcontainer/namespaces/exec.go
+++ b/components/engine/pkg/libcontainer/namespaces/exec.go
@@ -44,9 +44,10 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 	// we need CLONE_VFORK so we can wait on the child
 	flag := uintptr(getNamespaceFlags(container.Namespaces) | CLONE_VFORK)
 
-	command := exec.Command(nsinit, "init", "-master", strconv.Itoa(int(master.Fd())), "-console", console)
+	command := exec.Command(nsinit, "-master", strconv.Itoa(int(master.Fd())), "-console", console, "init")
 	command.SysProcAttr = &syscall.SysProcAttr{}
 	command.SysProcAttr.Cloneflags = flag
+	command.ExtraFiles = []*os.File{master}
 	//	command.SysProcAttr.Setctty = true
 
 	if err := command.Start(); err != nil {
@@ -64,7 +65,6 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 			log.Println(err)
 		}
 	}()
-	command.Wait()
 	return pid, nil
 }
 
diff --git a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go b/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
index 9a7563642c..ae6159b45a 100644
--- a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
@@ -14,6 +14,10 @@ import (
 // InitNamespace should be run inside an existing namespace to setup
 // common mounts, drop capabilities, and setup network interfaces
 func InitNamespace(container *libcontainer.Container) error {
+	if err := setLogFile(container); err != nil {
+		return err
+	}
+
 	rootfs, err := resolveRootfs(container)
 	if err != nil {
 		return err
@@ -138,3 +142,12 @@ func openTerminal(name string, flag int) (*os.File, error) {
 	}
 	return os.NewFile(uintptr(r), name), nil
 }
+
+func setLogFile(container *libcontainer.Container) error {
+	f, err := os.OpenFile(container.LogFile, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0655)
+	if err != nil {
+		return err
+	}
+	log.SetOutput(f)
+	return nil
+}

From 0ffa3c9f04a6679696dfe7655a14dc41c77736ec Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Tue, 18 Feb 2014 23:13:36 -0800
Subject: [PATCH 186/403] Improve general quality of libcontainer

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 93d41e53ae64fd77340c31d3bc5531864ed28779
Component: engine
---
 .../engine/pkg/libcontainer/cli/main.go       |  65 ++++++-----
 .../engine/pkg/libcontainer/container.json    |   2 +-
 .../pkg/libcontainer/namespaces/exec.go       | 101 ++----------------
 .../pkg/libcontainer/namespaces/mount.go      |  44 ++++----
 .../pkg/libcontainer/namespaces/namespaces.go |  32 ------
 .../pkg/libcontainer/namespaces/ns_linux.go   |   9 ++
 .../libcontainer/namespaces/nsinit/init.go    |  41 +++----
 .../pkg/libcontainer/namespaces/utils.go      |  14 ---
 .../namespaces => system}/calls_linux.go      |  37 +------
 components/engine/pkg/system/pty_linux.go     |  31 ++++++
 components/engine/pkg/system/setns_linux.go   |  13 +++
 .../engine/pkg/system/setns_linux_amd64.go    |   8 ++
 12 files changed, 159 insertions(+), 238 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/namespaces/namespaces.go
 rename components/engine/pkg/{libcontainer/namespaces => system}/calls_linux.go (74%)
 create mode 100644 components/engine/pkg/system/pty_linux.go
 create mode 100644 components/engine/pkg/system/setns_linux.go
 create mode 100644 components/engine/pkg/system/setns_linux_amd64.go

diff --git a/components/engine/pkg/libcontainer/cli/main.go b/components/engine/pkg/libcontainer/cli/main.go
index ac0ea29924..93bb0399f0 100644
--- a/components/engine/pkg/libcontainer/cli/main.go
+++ b/components/engine/pkg/libcontainer/cli/main.go
@@ -10,6 +10,9 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 	"os"
+	exec_ "os/exec"
+	"path"
+	"path/filepath"
 )
 
 var (
@@ -52,6 +55,18 @@ func exec(container *libcontainer.Container) error {
 		container.NetNsFd = netFile.Fd()
 	}
 
+	self, err := exec_.LookPath(os.Args[0])
+	if err != nil {
+		return err
+	}
+	if output, err := exec_.Command("cp", self, path.Join(container.RootFs, ".nsinit")).CombinedOutput(); err != nil {
+		return fmt.Errorf("Error exec cp: %s, (%s)", err, output)
+	} else {
+		println(self, container.RootFs)
+		fmt.Printf("-----> %s\n", output)
+	}
+	println("----")
+
 	pid, err := namespaces.ExecContainer(container)
 	if err != nil {
 		return fmt.Errorf("error exec container %s", err)
@@ -77,25 +92,25 @@ func exec(container *libcontainer.Container) error {
 }
 
 func execIn(container *libcontainer.Container) error {
-	f, err := os.Open("/root/nsroot/test")
-	if err != nil {
-		return err
-	}
-	container.NetNsFd = f.Fd()
-	pid, err := namespaces.ExecIn(container, &libcontainer.Command{
-		Env: container.Command.Env,
-		Args: []string{
-			newCommand,
-		},
-	})
-	if err != nil {
-		return fmt.Errorf("error exexin container %s", err)
-	}
-	exitcode, err := utils.WaitOnPid(pid)
-	if err != nil {
-		return fmt.Errorf("error waiting on child %s", err)
-	}
-	os.Exit(exitcode)
+	// f, err := os.Open("/root/nsroot/test")
+	// if err != nil {
+	// 	return err
+	// }
+	// container.NetNsFd = f.Fd()
+	// pid, err := namespaces.ExecIn(container, &libcontainer.Command{
+	// 	Env: container.Command.Env,
+	// 	Args: []string{
+	// 		newCommand,
+	// 	},
+	// })
+	// if err != nil {
+	// 	return fmt.Errorf("error exexin container %s", err)
+	// }
+	// exitcode, err := utils.WaitOnPid(pid)
+	// if err != nil {
+	// 	return fmt.Errorf("error waiting on child %s", err)
+	// }
+	// os.Exit(exitcode)
 	return nil
 }
 
@@ -143,11 +158,13 @@ func printErr(err error) {
 }
 
 func main() {
-	var (
-		err    error
-		cliCmd = flag.Arg(0)
-		config = "/root/development/gocode/src/github.com/dotcloud/docker/pkg/libcontainer/container.json" //flag.Arg(1)
-	)
+	cliCmd := flag.Arg(0)
+
+	config, err := filepath.Abs(flag.Arg(1))
+	if err != nil {
+		printErr(err)
+	}
+	println("cli:", cliCmd, "config:", config)
 	f, err := os.Open(config)
 	if err != nil {
 		printErr(err)
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index ed8eb1bd78..6e4fda54c8 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -12,7 +12,7 @@
             "TERM=xterm"
         ]
     },
-    "rootfs": "/root/main/mycontainer",
+    "rootfs": "/var/lib/docker/containers/ee76122136d691d63e09d24168a91ddb2ef9fdcf210b4de5c50aa76354892f4b/root",
     "namespaces": [
         "NEWIPC",
         "NEWNS",
diff --git a/components/engine/pkg/libcontainer/namespaces/exec.go b/components/engine/pkg/libcontainer/namespaces/exec.go
index 7f4b4a609a..ea3d2caa70 100644
--- a/components/engine/pkg/libcontainer/namespaces/exec.go
+++ b/components/engine/pkg/libcontainer/namespaces/exec.go
@@ -6,8 +6,8 @@ package namespaces
 
 import (
 	"errors"
-	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/system"
 	"io"
 	"log"
 	"os"
@@ -44,12 +44,15 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 	// we need CLONE_VFORK so we can wait on the child
 	flag := uintptr(getNamespaceFlags(container.Namespaces) | CLONE_VFORK)
 
-	command := exec.Command(nsinit, "-master", strconv.Itoa(int(master.Fd())), "-console", console, "init")
+	command := exec.Command(nsinit, "-master", strconv.Itoa(int(master.Fd())), "-console", console, "init", "container.json")
+	// command.Stdin = os.Stdin
+	// command.Stdout = os.Stdout
+	// command.Stderr = os.Stderr
 	command.SysProcAttr = &syscall.SysProcAttr{}
 	command.SysProcAttr.Cloneflags = flag
-	command.ExtraFiles = []*os.File{master}
-	//	command.SysProcAttr.Setctty = true
+	//command.ExtraFiles = []*os.File{master}
 
+	println("vvvvvvvvv")
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
@@ -68,104 +71,18 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 	return pid, nil
 }
 
-// ExecIn will spawn a new command inside an existing container's namespaces.  The existing container's
-// pid and namespace configuration is needed along with the specific capabilities that should
-// be dropped once inside the namespace.
-func ExecIn(container *libcontainer.Container, cmd *libcontainer.Command) (int, error) {
-	return -1, fmt.Errorf("not implemented")
-	/*
-		if container.NsPid <= 0 {
-			return -1, libcontainer.ErrInvalidPid
-		}
-
-		fds, err := getNsFds(container)
-		if err != nil {
-			return -1, err
-		}
-
-		if container.NetNsFd > 0 {
-			fds = append(fds, container.NetNsFd)
-		}
-
-		pid, err := fork()
-		if err != nil {
-			for _, fd := range fds {
-				syscall.Close(int(fd))
-			}
-			return -1, err
-		}
-
-		if pid == 0 {
-			for _, fd := range fds {
-				if fd > 0 {
-					if err := JoinExistingNamespace(fd, ""); err != nil {
-						for _, fd := range fds {
-							syscall.Close(int(fd))
-						}
-						writeError("join existing namespace for %d %s", fd, err)
-					}
-				}
-				syscall.Close(int(fd))
-			}
-
-			if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
-				container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
-				// important:
-				//
-				// we need to fork and unshare so that re can remount proc and sys within
-				// the namespace so the CLONE_NEWPID namespace will take effect
-				// if we don't fork we would end up unmounting proc and sys for the entire
-				// namespace
-				child, err := fork()
-				if err != nil {
-					writeError("fork child %s", err)
-				}
-
-				if child == 0 {
-					if err := unshare(CLONE_NEWNS); err != nil {
-						writeError("unshare newns %s", err)
-					}
-					if err := remountProc(); err != nil {
-						writeError("remount proc %s", err)
-					}
-					if err := remountSys(); err != nil {
-						writeError("remount sys %s", err)
-					}
-					if err := capabilities.DropCapabilities(container); err != nil {
-						writeError("drop caps %s", err)
-					}
-					if err := exec(cmd.Args[0], cmd.Args[0:], cmd.Env); err != nil {
-						writeError("exec %s", err)
-					}
-					panic("unreachable")
-				}
-				exit, err := utils.WaitOnPid(child)
-				if err != nil {
-					writeError("wait on child %s", err)
-				}
-				os.Exit(exit)
-			}
-			if err := exec(cmd.Args[0], cmd.Args[0:], cmd.Env); err != nil {
-				writeError("exec %s", err)
-			}
-			panic("unreachable")
-		}
-		return pid, err
-	*/
-}
-
 func createMasterAndConsole() (*os.File, string, error) {
 	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
 	if err != nil {
 		return nil, "", err
 	}
 
-	console, err := Ptsname(master)
+	console, err := system.Ptsname(master)
 	if err != nil {
 		return nil, "", err
 	}
 
-	if err := Unlockpt(master); err != nil {
+	if err := system.Unlockpt(master); err != nil {
 		return nil, "", err
 	}
 	return master, console, nil
diff --git a/components/engine/pkg/libcontainer/namespaces/mount.go b/components/engine/pkg/libcontainer/namespaces/mount.go
index 8e7c54b046..a9b981ecd9 100644
--- a/components/engine/pkg/libcontainer/namespaces/mount.go
+++ b/components/engine/pkg/libcontainer/namespaces/mount.go
@@ -2,6 +2,7 @@ package namespaces
 
 import (
 	"fmt"
+	"github.com/dotcloud/docker/pkg/system"
 	"log"
 	"os"
 	"path/filepath"
@@ -14,16 +15,16 @@ var (
 )
 
 func SetupNewMountNamespace(rootfs, console string, readonly bool) error {
-	if err := Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
+	if err := system.Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
 
-	if err := Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {
+	if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mouting %s as bind %s", rootfs, err)
 	}
 
 	if readonly {
-		if err := Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, ""); err != nil {
+		if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, ""); err != nil {
 			return fmt.Errorf("mounting %s as readonly %s", rootfs, err)
 		}
 	}
@@ -52,29 +53,30 @@ func SetupNewMountNamespace(rootfs, console string, readonly bool) error {
 		return err
 	}
 
-	if err := Chdir(rootfs); err != nil {
+	if err := system.Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
 
-	if err := Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
+	if err := system.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
 		return fmt.Errorf("mount move %s into / %s", rootfs, err)
 	}
 
-	if err := Chroot("."); err != nil {
+	if err := system.Chroot("."); err != nil {
 		return fmt.Errorf("chroot . %s", err)
 	}
 
-	if err := Chdir("/"); err != nil {
+	if err := system.Chdir("/"); err != nil {
 		return fmt.Errorf("chdir / %s", err)
 	}
 
-	Umask(0022)
+	system.Umask(0022)
 
 	return nil
 }
 
 func copyDevNodes(rootfs string) error {
-	Umask(0000)
+	oldMask := system.Umask(0000)
+	defer system.Umask(oldMask)
 
 	for _, node := range []string{
 		"null",
@@ -95,7 +97,7 @@ func copyDevNodes(rootfs string) error {
 		)
 
 		log.Printf("copy %s to %s %d\n", node, dest, st.Rdev)
-		if err := Mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) {
+		if err := system.Mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) {
 			return fmt.Errorf("copy %s %s", node, err)
 		}
 	}
@@ -125,7 +127,8 @@ func setupDev(rootfs string) error {
 }
 
 func setupConsole(rootfs, console string) error {
-	Umask(0000)
+	oldMask := system.Umask(0000)
+	defer system.Umask(oldMask)
 
 	stat, err := os.Stat(console)
 	if err != nil {
@@ -145,11 +148,11 @@ func setupConsole(rootfs, console string) error {
 		return err
 	}
 
-	if err := Mknod(dest, (st.Mode&^07777)|0600, int(st.Rdev)); err != nil {
+	if err := system.Mknod(dest, (st.Mode&^07777)|0600, int(st.Rdev)); err != nil {
 		return fmt.Errorf("mknod %s %s", dest, err)
 	}
 
-	if err := Mount(console, dest, "bind", syscall.MS_BIND, ""); err != nil {
+	if err := system.Mount(console, dest, "bind", syscall.MS_BIND, ""); err != nil {
 		return fmt.Errorf("bind %s to %s %s", console, dest, err)
 	}
 	return nil
@@ -158,7 +161,7 @@ func setupConsole(rootfs, console string) error {
 // mountSystem sets up linux specific system mounts like sys, proc, shm, and devpts
 // inside the mount namespace
 func mountSystem(rootfs string) error {
-	mounts := []struct {
+	for _, m := range []struct {
 		source string
 		path   string
 		device string
@@ -171,12 +174,11 @@ func mountSystem(rootfs string) error {
 		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaults, data: "mode=1777"},
 		{source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: "newinstance,ptmxmode=0666,mode=620,gid=5"},
 		{source: "tmpfs", path: filepath.Join(rootfs, "run"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_STRICTATIME, data: "mode=755"},
-	}
-	for _, m := range mounts {
+	} {
 		if err := os.MkdirAll(m.path, 0755); err != nil && !os.IsExist(err) {
 			return fmt.Errorf("mkdirall %s %s", m.path, err)
 		}
-		if err := Mount(m.source, m.path, m.device, uintptr(m.flags), m.data); err != nil {
+		if err := system.Mount(m.source, m.path, m.device, uintptr(m.flags), m.data); err != nil {
 			return fmt.Errorf("mounting %s into %s %s", m.source, m.path, err)
 		}
 	}
@@ -184,22 +186,22 @@ func mountSystem(rootfs string) error {
 }
 
 func remountProc() error {
-	if err := Unmount("/proc", syscall.MNT_DETACH); err != nil {
+	if err := system.Unmount("/proc", syscall.MNT_DETACH); err != nil {
 		return err
 	}
-	if err := Mount("proc", "/proc", "proc", uintptr(defaults), ""); err != nil {
+	if err := system.Mount("proc", "/proc", "proc", uintptr(defaults), ""); err != nil {
 		return err
 	}
 	return nil
 }
 
 func remountSys() error {
-	if err := Unmount("/sys", syscall.MNT_DETACH); err != nil {
+	if err := system.Unmount("/sys", syscall.MNT_DETACH); err != nil {
 		if err != syscall.EINVAL {
 			return err
 		}
 	} else {
-		if err := Mount("sysfs", "/sys", "sysfs", uintptr(defaults), ""); err != nil {
+		if err := system.Mount("sysfs", "/sys", "sysfs", uintptr(defaults), ""); err != nil {
 			return err
 		}
 	}
diff --git a/components/engine/pkg/libcontainer/namespaces/namespaces.go b/components/engine/pkg/libcontainer/namespaces/namespaces.go
deleted file mode 100644
index 05ef0ac7a9..0000000000
--- a/components/engine/pkg/libcontainer/namespaces/namespaces.go
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
-   TODO
-   pivot root
-   cgroups
-   more mount stuff that I probably am forgetting
-   apparmor
-*/
-
-package namespaces
-
-import (
-	"github.com/dotcloud/docker/pkg/libcontainer"
-)
-
-// JoinExistingNamespace uses the fd of an existing linux namespace and
-// has the current process join that namespace or the spacespace specified by ns
-func JoinExistingNamespace(fd uintptr, ns libcontainer.Namespace) error {
-	flag := namespaceMap[ns]
-	if err := Setns(fd, uintptr(flag)); err != nil {
-		return err
-	}
-	return nil
-}
-
-// getNamespaceFlags parses the container's Namespaces options to set the correct
-// flags on clone, unshare, and setns
-func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
-	for _, ns := range namespaces {
-		flag |= namespaceMap[ns]
-	}
-	return
-}
diff --git a/components/engine/pkg/libcontainer/namespaces/ns_linux.go b/components/engine/pkg/libcontainer/namespaces/ns_linux.go
index b0e5119130..f61279334d 100644
--- a/components/engine/pkg/libcontainer/namespaces/ns_linux.go
+++ b/components/engine/pkg/libcontainer/namespaces/ns_linux.go
@@ -33,3 +33,12 @@ var namespaceFileMap = map[libcontainer.Namespace]string{
 	libcontainer.CLONE_NEWPID:  "pid",
 	libcontainer.CLONE_NEWNET:  "net",
 }
+
+// getNamespaceFlags parses the container's Namespaces options to set the correct
+// flags on clone, unshare, and setns
+func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
+	for _, ns := range namespaces {
+		flag |= namespaceMap[ns]
+	}
+	return
+}
diff --git a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go b/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
index ae6159b45a..7f85ebacdb 100644
--- a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
@@ -5,6 +5,7 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
 	"github.com/dotcloud/docker/pkg/libcontainer/namespaces"
+	"github.com/dotcloud/docker/pkg/system"
 	"log"
 	"os"
 	"path/filepath"
@@ -14,10 +15,12 @@ import (
 // InitNamespace should be run inside an existing namespace to setup
 // common mounts, drop capabilities, and setup network interfaces
 func InitNamespace(container *libcontainer.Container) error {
+	println("|||||||||||||")
 	if err := setLogFile(container); err != nil {
 		return err
 	}
-
+	println(container.LogFile)
+	log.Printf("--------->")
 	rootfs, err := resolveRootfs(container)
 	if err != nil {
 		return err
@@ -26,7 +29,7 @@ func InitNamespace(container *libcontainer.Container) error {
 	// any errors encoutered inside the namespace we should write
 	// out to a log or a pipe to our parent and exit(1)
 	// because writing to stderr will not work after we close
-	if err := closeMasterAndStd(container.Master); err != nil {
+	if err := closeMasterAndStd(os.NewFile(container.Master, "/dev/ptmx")); err != nil {
 		log.Fatalf("close master and std %s", err)
 		return err
 	}
@@ -49,15 +52,15 @@ func InitNamespace(container *libcontainer.Container) error {
 		}
 	*/
 
-	if _, err := namespaces.Setsid(); err != nil {
+	if _, err := system.Setsid(); err != nil {
 		log.Fatalf("setsid %s", err)
 		return err
 	}
-	if err := namespaces.Setctty(); err != nil {
+	if err := system.Setctty(); err != nil {
 		log.Fatalf("setctty %s", err)
 		return err
 	}
-	if err := namespaces.ParentDeathSignal(); err != nil {
+	if err := system.ParentDeathSignal(); err != nil {
 		log.Fatalf("parent deth signal %s", err)
 		return err
 	}
@@ -65,7 +68,7 @@ func InitNamespace(container *libcontainer.Container) error {
 		log.Fatalf("setup mount namespace %s", err)
 		return err
 	}
-	if err := namespaces.Sethostname(container.ID); err != nil {
+	if err := system.Sethostname(container.ID); err != nil {
 		log.Fatalf("sethostname %s", err)
 		return err
 	}
@@ -78,12 +81,12 @@ func InitNamespace(container *libcontainer.Container) error {
 		return err
 	}
 	if container.WorkingDir != "" {
-		if err := namespaces.Chdir(container.WorkingDir); err != nil {
+		if err := system.Chdir(container.WorkingDir); err != nil {
 			log.Fatalf("chdir to %s %s", container.WorkingDir, err)
 			return err
 		}
 	}
-	if err := namespaces.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+	if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
 		log.Fatalf("exec %s", err)
 		return err
 	}
@@ -98,24 +101,23 @@ func resolveRootfs(container *libcontainer.Container) (string, error) {
 	return filepath.EvalSymlinks(rootfs)
 }
 
-func closeMasterAndStd(master uintptr) error {
-	namespaces.Closefd(master)
-	namespaces.Closefd(0)
-	namespaces.Closefd(1)
-	namespaces.Closefd(2)
-
+func closeMasterAndStd(master *os.File) error {
+	master.Close()
+	os.Stdin.Close()
+	os.Stdout.Close()
+	os.Stderr.Close()
 	return nil
 }
 
 func setupUser(container *libcontainer.Container) error {
 	// TODO: honor user passed on container
-	if err := namespaces.Setgroups(nil); err != nil {
+	if err := system.Setgroups(nil); err != nil {
 		return err
 	}
-	if err := namespaces.Setresgid(0, 0, 0); err != nil {
+	if err := system.Setresgid(0, 0, 0); err != nil {
 		return err
 	}
-	if err := namespaces.Setresuid(0, 0, 0); err != nil {
+	if err := system.Setresuid(0, 0, 0); err != nil {
 		return err
 	}
 	return nil
@@ -126,15 +128,16 @@ func dupSlave(slave *os.File) error {
 	if slave.Fd() != 0 {
 		return fmt.Errorf("slave fd not 0 %d", slave.Fd())
 	}
-	if err := namespaces.Dup2(slave.Fd(), 1); err != nil {
+	if err := system.Dup2(slave.Fd(), 1); err != nil {
 		return err
 	}
-	if err := namespaces.Dup2(slave.Fd(), 2); err != nil {
+	if err := system.Dup2(slave.Fd(), 2); err != nil {
 		return err
 	}
 	return nil
 }
 
+// openTerminal is a clone of os.OpenFile without the O_CLOEXEC addition.
 func openTerminal(name string, flag int) (*os.File, error) {
 	r, e := syscall.Open(name, flag, 0)
 	if e != nil {
diff --git a/components/engine/pkg/libcontainer/namespaces/utils.go b/components/engine/pkg/libcontainer/namespaces/utils.go
index fd195c0ad1..a5d677c7b3 100644
--- a/components/engine/pkg/libcontainer/namespaces/utils.go
+++ b/components/engine/pkg/libcontainer/namespaces/utils.go
@@ -72,17 +72,3 @@ func setupEnvironment(container *libcontainer.Container) {
 	addEnvIfNotSet(container, "USER", "root")
 	addEnvIfNotSet(container, "LOGNAME", "root")
 }
-
-func getMasterAndConsole(container *libcontainer.Container) (string, *os.File, error) {
-	master, err := Openpmtx()
-	if err != nil {
-		return "", nil, err
-	}
-
-	console, err := Ptsname(master)
-	if err != nil {
-		master.Close()
-		return "", nil, err
-	}
-	return console, master, nil
-}
diff --git a/components/engine/pkg/libcontainer/namespaces/calls_linux.go b/components/engine/pkg/system/calls_linux.go
similarity index 74%
rename from components/engine/pkg/libcontainer/namespaces/calls_linux.go
rename to components/engine/pkg/system/calls_linux.go
index f006d56da6..42afa349c2 100644
--- a/components/engine/pkg/libcontainer/namespaces/calls_linux.go
+++ b/components/engine/pkg/system/calls_linux.go
@@ -1,15 +1,7 @@
-package namespaces
+package system
 
 import (
-	"fmt"
-	"os"
 	"syscall"
-	"unsafe"
-)
-
-const (
-	TIOCGPTN   = 0x80045430
-	TIOCSPTLCK = 0x40045431
 )
 
 func Chroot(dir string) error {
@@ -60,14 +52,6 @@ func Clone(flags uintptr) (int, error) {
 	return int(pid), nil
 }
 
-func Setns(fd uintptr, flags uintptr) error {
-	_, _, err := syscall.RawSyscall(SYS_SETNS, fd, flags, 0)
-	if err != 0 {
-		return err
-	}
-	return nil
-}
-
 func UsetCloseOnExec(fd uintptr) error {
 	if _, _, err := syscall.Syscall(syscall.SYS_FCNTL, fd, syscall.F_SETFD, 0); err != 0 {
 		return err
@@ -95,11 +79,6 @@ func Setsid() (int, error) {
 	return syscall.Setsid()
 }
 
-func Unlockpt(f *os.File) error {
-	var u int
-	return Ioctl(f.Fd(), TIOCSPTLCK, uintptr(unsafe.Pointer(&u)))
-}
-
 func Ioctl(fd uintptr, flag, data uintptr) error {
 	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, fd, flag, data); err != 0 {
 		return err
@@ -107,18 +86,6 @@ func Ioctl(fd uintptr, flag, data uintptr) error {
 	return nil
 }
 
-func Ptsname(f *os.File) (string, error) {
-	var n int
-	if err := Ioctl(f.Fd(), TIOCGPTN, uintptr(unsafe.Pointer(&n))); err != nil {
-		return "", err
-	}
-	return fmt.Sprintf("/dev/pts/%d", n), nil
-}
-
-func Openpmtx() (*os.File, error) {
-	return os.OpenFile("/dev/ptmx", syscall.O_RDONLY|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
-}
-
 func Closefd(fd uintptr) error {
 	return syscall.Close(int(fd))
 }
@@ -132,7 +99,7 @@ func Mknod(path string, mode uint32, dev int) error {
 }
 
 func ParentDeathSignal() error {
-	if _, _, err := syscall.RawSyscall6(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0, 0, 0, 0); err != 0 {
+	if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0); err != 0 {
 		return err
 	}
 	return nil
diff --git a/components/engine/pkg/system/pty_linux.go b/components/engine/pkg/system/pty_linux.go
new file mode 100644
index 0000000000..b281b719fb
--- /dev/null
+++ b/components/engine/pkg/system/pty_linux.go
@@ -0,0 +1,31 @@
+package system
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+	"unsafe"
+)
+
+// Unlockpt unlocks the slave pseudoterminal device corresponding to the master pseudoterminal referred to by f.
+// Unlockpt should be called before opening the slave side of a pseudoterminal.
+func Unlockpt(f *os.File) error {
+	var u int
+	return Ioctl(f.Fd(), syscall.TIOCSPTLCK, uintptr(unsafe.Pointer(&u)))
+}
+
+// Ptsname retrieves the name of the first available pts for the given master.
+func Ptsname(f *os.File) (string, error) {
+	var n int
+
+	if err := Ioctl(f.Fd(), syscall.TIOCGPTN, uintptr(unsafe.Pointer(&n))); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("/dev/pts/%d", n), nil
+}
+
+// OpenPtmx opens /dev/ptmx, i.e. the PTY master.
+func OpenPtmx() (*os.File, error) {
+	// O_NOCTTY and O_CLOEXEC are not present in os package so we use the syscall's one for all.
+	return os.OpenFile("/dev/ptmx", syscall.O_RDONLY|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
+}
diff --git a/components/engine/pkg/system/setns_linux.go b/components/engine/pkg/system/setns_linux.go
new file mode 100644
index 0000000000..be6f3edb30
--- /dev/null
+++ b/components/engine/pkg/system/setns_linux.go
@@ -0,0 +1,13 @@
+package system
+
+import (
+	"syscall"
+)
+
+func Setns(fd uintptr, flags uintptr) error {
+	_, _, err := syscall.RawSyscall(SYS_SETNS, fd, flags, 0)
+	if err != 0 {
+		return err
+	}
+	return nil
+}
diff --git a/components/engine/pkg/system/setns_linux_amd64.go b/components/engine/pkg/system/setns_linux_amd64.go
new file mode 100644
index 0000000000..4e306253d9
--- /dev/null
+++ b/components/engine/pkg/system/setns_linux_amd64.go
@@ -0,0 +1,8 @@
+// +build linux,amd64
+
+package system
+
+// Via http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b21fddd087678a70ad64afc0f632e0f1071b092
+const (
+	SYS_SETNS = 308
+)

From 570aeb08e3a0c44385fef227495a2e00c46c26e1 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Wed, 19 Feb 2014 12:47:01 -0800
Subject: [PATCH 187/403] Fix ptmx issue on libcontainer

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 18f06b8d16c475568fd023e97eecc138ab052c2d
Component: engine
---
 components/engine/pkg/libcontainer/namespaces/exec.go  | 3 ++-
 components/engine/pkg/libcontainer/namespaces/mount.go | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/components/engine/pkg/libcontainer/namespaces/exec.go b/components/engine/pkg/libcontainer/namespaces/exec.go
index ea3d2caa70..77550d6089 100644
--- a/components/engine/pkg/libcontainer/namespaces/exec.go
+++ b/components/engine/pkg/libcontainer/namespaces/exec.go
@@ -50,7 +50,8 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 	// command.Stderr = os.Stderr
 	command.SysProcAttr = &syscall.SysProcAttr{}
 	command.SysProcAttr.Cloneflags = flag
-	//command.ExtraFiles = []*os.File{master}
+
+	command.ExtraFiles = []*os.File{master}
 
 	println("vvvvvvvvv")
 	if err := command.Start(); err != nil {
diff --git a/components/engine/pkg/libcontainer/namespaces/mount.go b/components/engine/pkg/libcontainer/namespaces/mount.go
index a9b981ecd9..5c0b8ead16 100644
--- a/components/engine/pkg/libcontainer/namespaces/mount.go
+++ b/components/engine/pkg/libcontainer/namespaces/mount.go
@@ -41,7 +41,7 @@ func SetupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
 		return err
 	}
-	if err := os.Symlink(filepath.Join(rootfs, "pts/ptmx"), ptmx); err != nil {
+	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
 		return fmt.Errorf("symlink dev ptmx %s", err)
 	}
 

From a92b2b9a1bb82e84885cf1d42e52a442ae7149a3 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 14:33:25 -0800
Subject: [PATCH 188/403] Use nsinit as app Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: e25065a6b1df09771598d77cc698e4fcf1159bd4 Component: engine

---
 .../engine/pkg/libcontainer/container.go      |  10 +-
 .../pkg/libcontainer/namespaces/exec.go       |  40 ++-----
 .../libcontainer/namespaces/linux_x86_64.go   |   7 --
 .../pkg/libcontainer/namespaces/ns_linux.go   |   2 +-
 .../libcontainer/namespaces/nsinit/init.go    | 112 ++++++++++--------
 .../namespaces/{ => nsinit}/mount.go          |   4 +-
 .../pkg/libcontainer/namespaces/utils.go      |  26 ----
 7 files changed, 82 insertions(+), 119 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/namespaces/linux_x86_64.go
 rename components/engine/pkg/libcontainer/namespaces/{ => nsinit}/mount.go (98%)

diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index c9a3f2e902..c2885447fd 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -2,18 +2,14 @@ package libcontainer
 
 type Container struct {
 	ID           string       `json:"id,omitempty"`
-	NsPid        int          `json:"namespace_pid,omitempty"`
 	Command      *Command     `json:"command,omitempty"`
-	RootFs       string       `json:"rootfs,omitempty"`
 	ReadonlyFs   bool         `json:"readonly_fs,omitempty"`
-	NetNsFd      uintptr      `json:"network_namespace_fd,omitempty"`
 	User         string       `json:"user,omitempty"`
 	WorkingDir   string       `json:"working_dir,omitempty"`
 	Namespaces   Namespaces   `json:"namespaces,omitempty"`
 	Capabilities Capabilities `json:"capabilities,omitempty"`
-	Master       uintptr      `json:"master"`
-	Console      string       `json:"console"`
-	LogFile      string       `json:"log_file"`
+	LogFile      string       `json:"log_file,omitempty"`
+	Network      *Network     `json:"network,omitempty"`
 }
 
 type Command struct {
@@ -22,9 +18,9 @@ type Command struct {
 }
 
 type Network struct {
-	TempVethName string `json:"temp_veth,omitempty"`
 	IP           string `json:"ip,omitempty"`
 	Gateway      string `json:"gateway,omitempty"`
 	Bridge       string `json:"bridge,omitempty"`
 	Mtu          int    `json:"mtu,omitempty"`
+	TempVethName string `json:"temp_veth,omitempty"`
 }
diff --git a/components/engine/pkg/libcontainer/namespaces/exec.go b/components/engine/pkg/libcontainer/namespaces/exec.go
index 77550d6089..8e5bf68aef 100644
--- a/components/engine/pkg/libcontainer/namespaces/exec.go
+++ b/components/engine/pkg/libcontainer/namespaces/exec.go
@@ -1,27 +1,17 @@
-/*
-   Higher level convience functions for setting up a container
-*/
-
 package namespaces
 
 import (
-	"errors"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/system"
+	"github.com/dotcloud/docker/pkg/term"
 	"io"
 	"log"
 	"os"
 	"os/exec"
-	"path/filepath"
-	"strconv"
 	"syscall"
 )
 
-var (
-	ErrExistingNetworkNamespace = errors.New("specified both CLONE_NEWNET and an existing network namespace")
-)
-
-// Exec will spawn new namespaces with the specified Container configuration
+// ExecContainer will spawn new namespaces with the specified Container configuration
 // in the RootFs path and return the pid of the new containerized process.
 //
 // If an existing network namespace is specified the container
@@ -30,30 +20,19 @@ var (
 // existing network namespace and the CLONE_NEWNET option in the container configuration will allow
 // the container to the the host's networking options and configuration.
 func ExecContainer(container *libcontainer.Container) (pid int, err error) {
-	// a user cannot pass CLONE_NEWNET and an existing net namespace fd to join
-	if container.NetNsFd > 0 && container.Namespaces.Contains(libcontainer.CLONE_NEWNET) {
-		return -1, ErrExistingNetworkNamespace
-	}
-
 	master, console, err := createMasterAndConsole()
 	if err != nil {
 		return -1, err
 	}
-	nsinit := filepath.Join(container.RootFs, ".nsinit")
 
 	// we need CLONE_VFORK so we can wait on the child
 	flag := uintptr(getNamespaceFlags(container.Namespaces) | CLONE_VFORK)
 
-	command := exec.Command(nsinit, "-master", strconv.Itoa(int(master.Fd())), "-console", console, "init", "container.json")
-	// command.Stdin = os.Stdin
-	// command.Stdout = os.Stdout
-	// command.Stderr = os.Stderr
-	command.SysProcAttr = &syscall.SysProcAttr{}
-	command.SysProcAttr.Cloneflags = flag
+	command := exec.Command("nsinit", console)
+	command.SysProcAttr = &syscall.SysProcAttr{
+		Cloneflags: flag,
+	}
 
-	command.ExtraFiles = []*os.File{master}
-
-	println("vvvvvvvvv")
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
@@ -64,11 +43,18 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 			log.Println(err)
 		}
 	}()
+
 	go func() {
 		if _, err := io.Copy(master, os.Stdin); err != nil {
 			log.Println(err)
 		}
 	}()
+
+	term.SetRawTerminal(os.Stdin.Fd())
+
+	if err := command.Wait(); err != nil {
+		return pid, err
+	}
 	return pid, nil
 }
 
diff --git a/components/engine/pkg/libcontainer/namespaces/linux_x86_64.go b/components/engine/pkg/libcontainer/namespaces/linux_x86_64.go
deleted file mode 100644
index ac9a014763..0000000000
--- a/components/engine/pkg/libcontainer/namespaces/linux_x86_64.go
+++ /dev/null
@@ -1,7 +0,0 @@
-// +build linux,x86_64
-package namespaces
-
-// Via http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b21fddd087678a70ad64afc0f632e0f1071b092
-const (
-	SYS_SETNS = 308
-)
diff --git a/components/engine/pkg/libcontainer/namespaces/ns_linux.go b/components/engine/pkg/libcontainer/namespaces/ns_linux.go
index f61279334d..2c73e08e58 100644
--- a/components/engine/pkg/libcontainer/namespaces/ns_linux.go
+++ b/components/engine/pkg/libcontainer/namespaces/ns_linux.go
@@ -40,5 +40,5 @@ func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
 	for _, ns := range namespaces {
 		flag |= namespaceMap[ns]
 	}
-	return
+	return flag
 }
diff --git a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go b/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
index 7f85ebacdb..523854e5d6 100644
--- a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
@@ -1,6 +1,7 @@
-package nsinit
+package main
 
 import (
+	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
@@ -12,103 +13,112 @@ import (
 	"syscall"
 )
 
-// InitNamespace should be run inside an existing namespace to setup
-// common mounts, drop capabilities, and setup network interfaces
-func InitNamespace(container *libcontainer.Container) error {
-	println("|||||||||||||")
-	if err := setLogFile(container); err != nil {
-		return err
-	}
-	println(container.LogFile)
-	log.Printf("--------->")
-	rootfs, err := resolveRootfs(container)
+func loadContainer() (*libcontainer.Container, error) {
+	f, err := os.Open("container.json")
 	if err != nil {
-		return err
+		return nil, err
+	}
+	defer f.Close()
+
+	var container *libcontainer.Container
+	if err := json.NewDecoder(f).Decode(&container); err != nil {
+		return nil, err
+	}
+	return container, nil
+}
+
+func main() {
+	container, err := loadContainer()
+	if err != nil {
+		log.Fatal(err)
 	}
 
-	// any errors encoutered inside the namespace we should write
-	// out to a log or a pipe to our parent and exit(1)
-	// because writing to stderr will not work after we close
-	if err := closeMasterAndStd(os.NewFile(container.Master, "/dev/ptmx")); err != nil {
-		log.Fatalf("close master and std %s", err)
-		return err
+	if os.Args[1] == "exec" {
+		_, err := namespaces.ExecContainer(container)
+		if err != nil {
+			log.Fatal(err)
+		}
+		os.Exit(0)
+	}
+	console := os.Args[1]
+
+	if err := setLogFile(container); err != nil {
+		log.Fatal(err)
 	}
 
-	slave, err := openTerminal(container.Console, syscall.O_RDWR)
+	rootfs, err := resolveRootfs()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// close pipes so that we can replace it with the pty
+	os.Stdin.Close()
+	os.Stdout.Close()
+	os.Stderr.Close()
+
+	slave, err := openTerminal(console, syscall.O_RDWR)
 	if err != nil {
 		log.Fatalf("open terminal %s", err)
-		return err
+	}
+	if slave.Fd() != 0 {
+		log.Fatalf("slave fd should be 0")
 	}
 	if err := dupSlave(slave); err != nil {
 		log.Fatalf("dup2 slave %s", err)
-		return err
 	}
 
-	/*
-		if container.NetNsFd > 0 {
-			if err := joinExistingNamespace(container.NetNsFd, libcontainer.CLONE_NEWNET); err != nil {
-				log.Fatalf("join existing net namespace %s", err)
-			}
-		}
-	*/
-
 	if _, err := system.Setsid(); err != nil {
 		log.Fatalf("setsid %s", err)
-		return err
 	}
 	if err := system.Setctty(); err != nil {
 		log.Fatalf("setctty %s", err)
-		return err
 	}
 	if err := system.ParentDeathSignal(); err != nil {
 		log.Fatalf("parent deth signal %s", err)
-		return err
 	}
-	if err := namespaces.SetupNewMountNamespace(rootfs, container.Console, container.ReadonlyFs); err != nil {
+
+	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		log.Fatalf("setup mount namespace %s", err)
-		return err
 	}
+
+	if container.Network != nil {
+		if err := setupNetworking(container); err != nil {
+			log.Fatalf("setup networking %s", err)
+		}
+	}
+
 	if err := system.Sethostname(container.ID); err != nil {
 		log.Fatalf("sethostname %s", err)
-		return err
 	}
 	if err := capabilities.DropCapabilities(container); err != nil {
 		log.Fatalf("drop capabilities %s", err)
-		return err
 	}
 	if err := setupUser(container); err != nil {
 		log.Fatalf("setup user %s", err)
-		return err
 	}
 	if container.WorkingDir != "" {
 		if err := system.Chdir(container.WorkingDir); err != nil {
 			log.Fatalf("chdir to %s %s", container.WorkingDir, err)
-			return err
 		}
 	}
 	if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
 		log.Fatalf("exec %s", err)
-		return err
 	}
 	panic("unreachable")
 }
 
-func resolveRootfs(container *libcontainer.Container) (string, error) {
-	rootfs, err := filepath.Abs(container.RootFs)
+func resolveRootfs() (string, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	rootfs, err := filepath.Abs(cwd)
 	if err != nil {
 		return "", err
 	}
 	return filepath.EvalSymlinks(rootfs)
 }
 
-func closeMasterAndStd(master *os.File) error {
-	master.Close()
-	os.Stdin.Close()
-	os.Stdout.Close()
-	os.Stderr.Close()
-	return nil
-}
-
 func setupUser(container *libcontainer.Container) error {
 	// TODO: honor user passed on container
 	if err := system.Setgroups(nil); err != nil {
@@ -154,3 +164,7 @@ func setLogFile(container *libcontainer.Container) error {
 	log.SetOutput(f)
 	return nil
 }
+
+func setupNetworking(conatiner *libcontainer.Container) error {
+	return nil
+}
diff --git a/components/engine/pkg/libcontainer/namespaces/mount.go b/components/engine/pkg/libcontainer/namespaces/nsinit/mount.go
similarity index 98%
rename from components/engine/pkg/libcontainer/namespaces/mount.go
rename to components/engine/pkg/libcontainer/namespaces/nsinit/mount.go
index 5c0b8ead16..f9ee969636 100644
--- a/components/engine/pkg/libcontainer/namespaces/mount.go
+++ b/components/engine/pkg/libcontainer/namespaces/nsinit/mount.go
@@ -1,4 +1,4 @@
-package namespaces
+package main
 
 import (
 	"fmt"
@@ -14,7 +14,7 @@ var (
 	defaults = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
 )
 
-func SetupNewMountNamespace(rootfs, console string, readonly bool) error {
+func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := system.Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
diff --git a/components/engine/pkg/libcontainer/namespaces/utils.go b/components/engine/pkg/libcontainer/namespaces/utils.go
index a5d677c7b3..edc3ab52cc 100644
--- a/components/engine/pkg/libcontainer/namespaces/utils.go
+++ b/components/engine/pkg/libcontainer/namespaces/utils.go
@@ -7,7 +7,6 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
-	"syscall"
 )
 
 func addEnvIfNotSet(container *libcontainer.Container, key, value string) {
@@ -26,31 +25,6 @@ func addEnvIfNotSet(container *libcontainer.Container, key, value string) {
 	container.Command.Env = append(container.Command.Env, jv)
 }
 
-// getNsFds inspects the container's namespace configuration and opens the fds to
-// each of the namespaces.
-func getNsFds(container *libcontainer.Container) ([]uintptr, error) {
-	var (
-		namespaces = []string{}
-		fds        = []uintptr{}
-	)
-
-	for _, ns := range container.Namespaces {
-		namespaces = append(namespaces, namespaceFileMap[ns])
-	}
-
-	for _, ns := range namespaces {
-		fd, err := getNsFd(container.NsPid, ns)
-		if err != nil {
-			for _, fd = range fds {
-				syscall.Close(int(fd))
-			}
-			return nil, err
-		}
-		fds = append(fds, fd)
-	}
-	return fds, nil
-}
-
 // getNsFd returns the fd for a specific pid and namespace option
 func getNsFd(pid int, ns string) (uintptr, error) {
 	nspath := filepath.Join("/proc", strconv.Itoa(pid), "ns", ns)

From 05ed3c19b6329a06dad19d5bc3b14fc9fb1b5c4b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 14:55:34 -0800
Subject: [PATCH 189/403] Simplify namespaces with only nsinit
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 7bc3c012507edcfc5e8ab8523b240ac2bb03fe19 Component: engine

---
 .../engine/pkg/libcontainer/cli/main.go       | 203 ------------------
 .../pkg/libcontainer/namespaces/utils.go      |  48 -----
 .../{namespaces => nsinit}/exec.go            |  26 ++-
 .../{namespaces => }/nsinit/init.go           |  13 +-
 .../{namespaces => }/nsinit/mount.go          |   0
 .../{namespaces => nsinit}/ns_linux.go        |  11 +-
 6 files changed, 23 insertions(+), 278 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/cli/main.go
 delete mode 100644 components/engine/pkg/libcontainer/namespaces/utils.go
 rename components/engine/pkg/libcontainer/{namespaces => nsinit}/exec.go (63%)
 rename components/engine/pkg/libcontainer/{namespaces => }/nsinit/init.go (93%)
 rename components/engine/pkg/libcontainer/{namespaces => }/nsinit/mount.go (100%)
 rename components/engine/pkg/libcontainer/{namespaces => nsinit}/ns_linux.go (74%)

diff --git a/components/engine/pkg/libcontainer/cli/main.go b/components/engine/pkg/libcontainer/cli/main.go
deleted file mode 100644
index 93bb0399f0..0000000000
--- a/components/engine/pkg/libcontainer/cli/main.go
+++ /dev/null
@@ -1,203 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"flag"
-	"fmt"
-	"github.com/dotcloud/docker/pkg/libcontainer"
-	"github.com/dotcloud/docker/pkg/libcontainer/namespaces"
-	"github.com/dotcloud/docker/pkg/libcontainer/namespaces/nsinit"
-	"github.com/dotcloud/docker/pkg/libcontainer/network"
-	"github.com/dotcloud/docker/pkg/libcontainer/utils"
-	"os"
-	exec_ "os/exec"
-	"path"
-	"path/filepath"
-)
-
-var (
-	displayPid bool
-	newCommand string
-	usrNet     bool
-	masterFd   int
-	console    string
-)
-
-func init() {
-	flag.BoolVar(&displayPid, "pid", false, "display the pid before waiting")
-	flag.StringVar(&newCommand, "cmd", "/bin/bash", "command to run in the existing namespace")
-	flag.BoolVar(&usrNet, "net", false, "user a net namespace")
-	flag.IntVar(&masterFd, "master", 0, "master fd")
-	flag.StringVar(&console, "console", "", "console path")
-	flag.Parse()
-}
-
-func nsinitFunc(container *libcontainer.Container) error {
-	container.Master = uintptr(masterFd)
-	container.Console = console
-	container.LogFile = "/root/logs"
-
-	return nsinit.InitNamespace(container)
-}
-
-func exec(container *libcontainer.Container) error {
-	var (
-		netFile *os.File
-		err     error
-	)
-	container.NetNsFd = 0
-
-	if usrNet {
-		netFile, err = os.Open("/root/nsroot/test")
-		if err != nil {
-			return err
-		}
-		container.NetNsFd = netFile.Fd()
-	}
-
-	self, err := exec_.LookPath(os.Args[0])
-	if err != nil {
-		return err
-	}
-	if output, err := exec_.Command("cp", self, path.Join(container.RootFs, ".nsinit")).CombinedOutput(); err != nil {
-		return fmt.Errorf("Error exec cp: %s, (%s)", err, output)
-	} else {
-		println(self, container.RootFs)
-		fmt.Printf("-----> %s\n", output)
-	}
-	println("----")
-
-	pid, err := namespaces.ExecContainer(container)
-	if err != nil {
-		return fmt.Errorf("error exec container %s", err)
-	}
-
-	if displayPid {
-		fmt.Println(pid)
-	}
-
-	exitcode, err := utils.WaitOnPid(pid)
-	if err != nil {
-		return fmt.Errorf("error waiting on child %s", err)
-	}
-	fmt.Println(exitcode)
-	if usrNet {
-		netFile.Close()
-		if err := network.DeleteNetworkNamespace("/root/nsroot/test"); err != nil {
-			return err
-		}
-	}
-	os.Exit(exitcode)
-	return nil
-}
-
-func execIn(container *libcontainer.Container) error {
-	// f, err := os.Open("/root/nsroot/test")
-	// if err != nil {
-	// 	return err
-	// }
-	// container.NetNsFd = f.Fd()
-	// pid, err := namespaces.ExecIn(container, &libcontainer.Command{
-	// 	Env: container.Command.Env,
-	// 	Args: []string{
-	// 		newCommand,
-	// 	},
-	// })
-	// if err != nil {
-	// 	return fmt.Errorf("error exexin container %s", err)
-	// }
-	// exitcode, err := utils.WaitOnPid(pid)
-	// if err != nil {
-	// 	return fmt.Errorf("error waiting on child %s", err)
-	// }
-	// os.Exit(exitcode)
-	return nil
-}
-
-func createNet(config *libcontainer.Network) error {
-	/*
-		root := "/root/nsroot"
-		if err := network.SetupNamespaceMountDir(root); err != nil {
-			return err
-		}
-
-		nspath := root + "/test"
-		if err := network.CreateNetworkNamespace(nspath); err != nil {
-			return nil
-		}
-		if err := network.CreateVethPair("veth0", config.TempVethName); err != nil {
-			return err
-		}
-		if err := network.SetInterfaceMaster("veth0", config.Bridge); err != nil {
-			return err
-		}
-		if err := network.InterfaceUp("veth0"); err != nil {
-			return err
-		}
-
-		f, err := os.Open(nspath)
-		if err != nil {
-			return err
-		}
-		defer f.Close()
-
-		if err := network.SetInterfaceInNamespaceFd("veth1", int(f.Fd())); err != nil {
-			return err
-		}
-
-			if err := network.SetupVethInsideNamespace(f.Fd(), config); err != nil {
-				return err
-			}
-	*/
-	return nil
-}
-
-func printErr(err error) {
-	fmt.Fprintln(os.Stderr, err)
-	os.Exit(1)
-}
-
-func main() {
-	cliCmd := flag.Arg(0)
-
-	config, err := filepath.Abs(flag.Arg(1))
-	if err != nil {
-		printErr(err)
-	}
-	println("cli:", cliCmd, "config:", config)
-	f, err := os.Open(config)
-	if err != nil {
-		printErr(err)
-	}
-
-	dec := json.NewDecoder(f)
-	var container *libcontainer.Container
-
-	if err := dec.Decode(&container); err != nil {
-		printErr(err)
-	}
-	f.Close()
-
-	switch cliCmd {
-	case "init":
-		err = nsinitFunc(container)
-	case "exec":
-		err = exec(container)
-	case "execin":
-		err = execIn(container)
-	case "net":
-		err = createNet(&libcontainer.Network{
-			TempVethName: "veth1",
-			IP:           "172.17.0.100/16",
-			Gateway:      "172.17.42.1",
-			Mtu:          1500,
-			Bridge:       "docker0",
-		})
-	default:
-		err = fmt.Errorf("command not supported: %s", cliCmd)
-	}
-
-	if err != nil {
-		printErr(err)
-	}
-}
diff --git a/components/engine/pkg/libcontainer/namespaces/utils.go b/components/engine/pkg/libcontainer/namespaces/utils.go
deleted file mode 100644
index edc3ab52cc..0000000000
--- a/components/engine/pkg/libcontainer/namespaces/utils.go
+++ /dev/null
@@ -1,48 +0,0 @@
-package namespaces
-
-import (
-	"fmt"
-	"github.com/dotcloud/docker/pkg/libcontainer"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-)
-
-func addEnvIfNotSet(container *libcontainer.Container, key, value string) {
-	jv := fmt.Sprintf("%s=%s", key, value)
-	if len(container.Command.Env) == 0 {
-		container.Command.Env = []string{jv}
-		return
-	}
-
-	for _, v := range container.Command.Env {
-		parts := strings.Split(v, "=")
-		if parts[0] == key {
-			return
-		}
-	}
-	container.Command.Env = append(container.Command.Env, jv)
-}
-
-// getNsFd returns the fd for a specific pid and namespace option
-func getNsFd(pid int, ns string) (uintptr, error) {
-	nspath := filepath.Join("/proc", strconv.Itoa(pid), "ns", ns)
-	// OpenFile adds closOnExec
-	f, err := os.OpenFile(nspath, os.O_RDONLY, 0666)
-	if err != nil {
-		return 0, err
-	}
-	return f.Fd(), nil
-}
-
-// setupEnvironment adds additional environment variables to the container's
-// Command such as USER, LOGNAME, container, and TERM
-func setupEnvironment(container *libcontainer.Container) {
-	addEnvIfNotSet(container, "container", "docker")
-	// TODO: check if pty
-	addEnvIfNotSet(container, "TERM", "xterm")
-	// TODO: get username from container
-	addEnvIfNotSet(container, "USER", "root")
-	addEnvIfNotSet(container, "LOGNAME", "root")
-}
diff --git a/components/engine/pkg/libcontainer/namespaces/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
similarity index 63%
rename from components/engine/pkg/libcontainer/namespaces/exec.go
rename to components/engine/pkg/libcontainer/nsinit/exec.go
index 8e5bf68aef..ef81b0ef87 100644
--- a/components/engine/pkg/libcontainer/namespaces/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -1,4 +1,4 @@
-package namespaces
+package main
 
 import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
@@ -11,15 +11,7 @@ import (
 	"syscall"
 )
 
-// ExecContainer will spawn new namespaces with the specified Container configuration
-// in the RootFs path and return the pid of the new containerized process.
-//
-// If an existing network namespace is specified the container
-// will join that namespace.  If an existing network namespace is not specified but CLONE_NEWNET is,
-// the container will be spawned with a new network namespace with no configuration.  Omiting an
-// existing network namespace and the CLONE_NEWNET option in the container configuration will allow
-// the container to the the host's networking options and configuration.
-func ExecContainer(container *libcontainer.Container) (pid int, err error) {
+func execCommand(container *libcontainer.Container) (pid int, err error) {
 	master, console, err := createMasterAndConsole()
 	if err != nil {
 		return -1, err
@@ -50,7 +42,19 @@ func ExecContainer(container *libcontainer.Container) (pid int, err error) {
 		}
 	}()
 
-	term.SetRawTerminal(os.Stdin.Fd())
+	ws, err := term.GetWinsize(os.Stdin.Fd())
+	if err != nil {
+		return -1, err
+	}
+	if err := term.SetWinsize(master.Fd(), ws); err != nil {
+		return -1, err
+	}
+	state, err := term.SetRawTerminal(os.Stdin.Fd())
+	if err != nil {
+		command.Process.Kill()
+		return -1, err
+	}
+	defer term.RestoreTerminal(os.Stdin.Fd(), state)
 
 	if err := command.Wait(); err != nil {
 		return pid, err
diff --git a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
similarity index 93%
rename from components/engine/pkg/libcontainer/namespaces/nsinit/init.go
rename to components/engine/pkg/libcontainer/nsinit/init.go
index 523854e5d6..b4b7de410c 100644
--- a/components/engine/pkg/libcontainer/namespaces/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
-	"github.com/dotcloud/docker/pkg/libcontainer/namespaces"
 	"github.com/dotcloud/docker/pkg/system"
 	"log"
 	"os"
@@ -34,7 +33,7 @@ func main() {
 	}
 
 	if os.Args[1] == "exec" {
-		_, err := namespaces.ExecContainer(container)
+		_, err := execCommand(container)
 		if err != nil {
 			log.Fatal(err)
 		}
@@ -157,11 +156,13 @@ func openTerminal(name string, flag int) (*os.File, error) {
 }
 
 func setLogFile(container *libcontainer.Container) error {
-	f, err := os.OpenFile(container.LogFile, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0655)
-	if err != nil {
-		return err
+	if container.LogFile != "" {
+		f, err := os.OpenFile(container.LogFile, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0655)
+		if err != nil {
+			return err
+		}
+		log.SetOutput(f)
 	}
-	log.SetOutput(f)
 	return nil
 }
 
diff --git a/components/engine/pkg/libcontainer/namespaces/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
similarity index 100%
rename from components/engine/pkg/libcontainer/namespaces/nsinit/mount.go
rename to components/engine/pkg/libcontainer/nsinit/mount.go
diff --git a/components/engine/pkg/libcontainer/namespaces/ns_linux.go b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
similarity index 74%
rename from components/engine/pkg/libcontainer/namespaces/ns_linux.go
rename to components/engine/pkg/libcontainer/nsinit/ns_linux.go
index 2c73e08e58..b54bc2b993 100644
--- a/components/engine/pkg/libcontainer/namespaces/ns_linux.go
+++ b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
@@ -1,4 +1,4 @@
-package namespaces
+package main
 
 import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
@@ -25,15 +25,6 @@ var namespaceMap = map[libcontainer.Namespace]int{
 	libcontainer.CLONE_NEWNET:  CLONE_NEWNET,
 }
 
-var namespaceFileMap = map[libcontainer.Namespace]string{
-	libcontainer.CLONE_NEWNS:   "mnt",
-	libcontainer.CLONE_NEWUTS:  "uts",
-	libcontainer.CLONE_NEWIPC:  "ipc",
-	libcontainer.CLONE_NEWUSER: "user",
-	libcontainer.CLONE_NEWPID:  "pid",
-	libcontainer.CLONE_NEWNET:  "net",
-}
-
 // getNamespaceFlags parses the container's Namespaces options to set the correct
 // flags on clone, unshare, and setns
 func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {

From 3f67fdb8edbda0a56c2350264383422ab3df8182 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 15:33:44 -0800
Subject: [PATCH 190/403] Implement init veth creation
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 34671f20103fb975fed31a03705e04bc65aed239 Component: engine

---
 .../engine/pkg/libcontainer/container.go      |  9 ++---
 .../engine/pkg/libcontainer/container.json    | 14 +++++--
 .../engine/pkg/libcontainer/network/veth.go   | 38 +++----------------
 .../engine/pkg/libcontainer/nsinit/exec.go    | 33 ++++++++++++++++
 .../engine/pkg/libcontainer/nsinit/init.go    | 14 +++++--
 .../engine/pkg/libcontainer/ubuntu.json       | 22 -----------
 6 files changed, 63 insertions(+), 67 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/ubuntu.json

diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index c2885447fd..3f3961d496 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -18,9 +18,8 @@ type Command struct {
 }
 
 type Network struct {
-	IP           string `json:"ip,omitempty"`
-	Gateway      string `json:"gateway,omitempty"`
-	Bridge       string `json:"bridge,omitempty"`
-	Mtu          int    `json:"mtu,omitempty"`
-	TempVethName string `json:"temp_veth,omitempty"`
+	IP      string `json:"ip,omitempty"`
+	Gateway string `json:"gateway,omitempty"`
+	Bridge  string `json:"bridge,omitempty"`
+	Mtu     int    `json:"mtu,omitempty"`
 }
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index 6e4fda54c8..8731170c2a 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -1,6 +1,6 @@
 {
     "id": "koye",
-    "namespace_pid": 3117,
+    "log_file": "/root/logs",
     "command": {
         "args": [
             "/bin/bash"
@@ -12,12 +12,12 @@
             "TERM=xterm"
         ]
     },
-    "rootfs": "/var/lib/docker/containers/ee76122136d691d63e09d24168a91ddb2ef9fdcf210b4de5c50aa76354892f4b/root",
     "namespaces": [
         "NEWIPC",
         "NEWNS",
         "NEWPID",
-        "NEWUTS"
+        "NEWUTS",
+        "NEWNET"
     ],
     "capabilities": [
         "SETPCAP",
@@ -34,5 +34,11 @@
         "AUDIT_CONTROL",
         "MAC_OVERRIDE",
         "MAC_ADMIN"
-    ]
+    ],
+    "network": {
+        "ip": "172.17.0.100/16",
+        "gateway": "172.17.42.1",
+        "bridge": "docker0",
+        "mtu": 1500
+    }
 }
diff --git a/components/engine/pkg/libcontainer/network/veth.go b/components/engine/pkg/libcontainer/network/veth.go
index 2ecce22c3e..05512e63c8 100644
--- a/components/engine/pkg/libcontainer/network/veth.go
+++ b/components/engine/pkg/libcontainer/network/veth.go
@@ -3,18 +3,16 @@ package network
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"os"
-	"syscall"
 )
 
 // SetupVeth sets up an existing network namespace with the specified
 // network configuration.
-func SetupVeth(config *libcontainer.Network) error {
-	if err := InterfaceDown(config.TempVethName); err != nil {
-		return fmt.Errorf("interface down %s %s", config.TempVethName, err)
+func SetupVeth(config *libcontainer.Network, tempVethName string) error {
+	if err := InterfaceDown(tempVethName); err != nil {
+		return fmt.Errorf("interface down %s %s", tempVethName, err)
 	}
-	if err := ChangeInterfaceName(config.TempVethName, "eth0"); err != nil {
-		return fmt.Errorf("change %s to eth0 %s", config.TempVethName, err)
+	if err := ChangeInterfaceName(tempVethName, "eth0"); err != nil {
+		return fmt.Errorf("change %s to eth0 %s", tempVethName, err)
 	}
 	if err := SetInterfaceIp("eth0", config.IP); err != nil {
 		return fmt.Errorf("set eth0 ip %s", err)
@@ -41,29 +39,3 @@ func SetupVeth(config *libcontainer.Network) error {
 	}
 	return nil
 }
-
-// SetupNamespaceMountDir prepares a new root for use as a mount
-// source for bind mounting namespace fd to an outside path
-func SetupNamespaceMountDir(root string) error {
-	if err := os.MkdirAll(root, 0666); err != nil {
-		return err
-	}
-	// make sure mounts are not unmounted by other mnt namespaces
-	if err := syscall.Mount("", root, "none", syscall.MS_SHARED|syscall.MS_REC, ""); err != nil && err != syscall.EINVAL {
-		return err
-	}
-	if err := syscall.Mount(root, root, "none", syscall.MS_BIND, ""); err != nil {
-		return err
-	}
-	return nil
-}
-
-// DeleteNetworkNamespace unmounts the binding path and removes the
-// file so that no references to the fd are present and the network
-// namespace is automatically cleaned up
-func DeleteNetworkNamespace(bindingPath string) error {
-	if err := syscall.Unmount(bindingPath, 0); err != nil {
-		return err
-	}
-	return os.Remove(bindingPath)
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index ef81b0ef87..9cd1741706 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -1,7 +1,9 @@
 package main
 
 import (
+	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
 	"github.com/dotcloud/docker/pkg/term"
 	"io"
@@ -25,11 +27,34 @@ func execCommand(container *libcontainer.Container) (pid int, err error) {
 		Cloneflags: flag,
 	}
 
+	inPipe, err := command.StdinPipe()
+	if err != nil {
+		return -1, err
+	}
+
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
 	pid = command.Process.Pid
 
+	if container.Network != nil {
+		name1, name2, err := createVethPair()
+		if err != nil {
+			log.Fatal(err)
+		}
+		if err := network.SetInterfaceMaster(name1, container.Network.Bridge); err != nil {
+			log.Fatal(err)
+		}
+		if err := network.InterfaceUp(name1); err != nil {
+			log.Fatal(err)
+		}
+		if err := network.SetInterfaceInNamespacePid(name2, pid); err != nil {
+			log.Fatal(err)
+		}
+		fmt.Fprint(inPipe, name2)
+		inPipe.Close()
+	}
+
 	go func() {
 		if _, err := io.Copy(os.Stdout, master); err != nil {
 			log.Println(err)
@@ -78,3 +103,11 @@ func createMasterAndConsole() (*os.File, string, error) {
 	}
 	return master, console, nil
 }
+
+func createVethPair() (name1 string, name2 string, err error) {
+	name1, name2 = "veth001", "veth002"
+	if err = network.CreateVethPair(name1, name2); err != nil {
+		return
+	}
+	return
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index b4b7de410c..2804f01e5f 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
+	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
+	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -50,6 +52,12 @@ func main() {
 		log.Fatal(err)
 	}
 
+	data, err := ioutil.ReadAll(os.Stdin)
+	if err != nil {
+		log.Fatalf("error reading from stdin %s", err)
+	}
+	tempVethName := string(data)
+
 	// close pipes so that we can replace it with the pty
 	os.Stdin.Close()
 	os.Stdout.Close()
@@ -81,7 +89,7 @@ func main() {
 	}
 
 	if container.Network != nil {
-		if err := setupNetworking(container); err != nil {
+		if err := setupNetworking(container, tempVethName); err != nil {
 			log.Fatalf("setup networking %s", err)
 		}
 	}
@@ -166,6 +174,6 @@ func setLogFile(container *libcontainer.Container) error {
 	return nil
 }
 
-func setupNetworking(conatiner *libcontainer.Container) error {
-	return nil
+func setupNetworking(container *libcontainer.Container, tempVethName string) error {
+	return network.SetupVeth(container.Network, tempVethName)
 }
diff --git a/components/engine/pkg/libcontainer/ubuntu.json b/components/engine/pkg/libcontainer/ubuntu.json
deleted file mode 100644
index 0a450ae066..0000000000
--- a/components/engine/pkg/libcontainer/ubuntu.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-    "id": "koye",
-    "namespace_pid": 3745,
-    "command": {
-        "args": [
-            "/sbin/init"
-        ],
-        "environment": [
-            "HOME=/",
-            "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
-            "container=docker",
-            "TERM=xterm"
-        ]
-    },
-    "rootfs": "/var/lib/docker/btrfs/subvolumes/7c0f15df1ad2e2fe04d7a6e079aec17406e9465a6a37dd16cb0dd754fc0167b3",
-    "namespaces": [
-        "NEWIPC",
-        "NEWNS",
-        "NEWPID",
-        "NEWUTS"
-    ]
-}

From 10d46be0eadf313eb59c1e0dba33bae9f4952fc9 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 15:54:53 -0800
Subject: [PATCH 191/403] Add dynamic veth name Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 5428964400ece4cd79cc5d482307df5e8913469f Component: engine

---
 .../engine/pkg/libcontainer/network/veth.go   | 41 -----------------
 .../engine/pkg/libcontainer/nsinit/exec.go    | 10 +++-
 .../engine/pkg/libcontainer/nsinit/init.go    | 46 +++++++++++++++----
 .../engine/pkg/libcontainer/utils/utils.go    | 24 ++--------
 4 files changed, 48 insertions(+), 73 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/network/veth.go

diff --git a/components/engine/pkg/libcontainer/network/veth.go b/components/engine/pkg/libcontainer/network/veth.go
deleted file mode 100644
index 05512e63c8..0000000000
--- a/components/engine/pkg/libcontainer/network/veth.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package network
-
-import (
-	"fmt"
-	"github.com/dotcloud/docker/pkg/libcontainer"
-)
-
-// SetupVeth sets up an existing network namespace with the specified
-// network configuration.
-func SetupVeth(config *libcontainer.Network, tempVethName string) error {
-	if err := InterfaceDown(tempVethName); err != nil {
-		return fmt.Errorf("interface down %s %s", tempVethName, err)
-	}
-	if err := ChangeInterfaceName(tempVethName, "eth0"); err != nil {
-		return fmt.Errorf("change %s to eth0 %s", tempVethName, err)
-	}
-	if err := SetInterfaceIp("eth0", config.IP); err != nil {
-		return fmt.Errorf("set eth0 ip %s", err)
-	}
-
-	if err := SetMtu("eth0", config.Mtu); err != nil {
-		return fmt.Errorf("set eth0 mtu to %d %s", config.Mtu, err)
-	}
-	if err := InterfaceUp("eth0"); err != nil {
-		return fmt.Errorf("eth0 up %s", err)
-	}
-
-	if err := SetMtu("lo", config.Mtu); err != nil {
-		return fmt.Errorf("set lo mtu to %d %s", config.Mtu, err)
-	}
-	if err := InterfaceUp("lo"); err != nil {
-		return fmt.Errorf("lo up %s", err)
-	}
-
-	if config.Gateway != "" {
-		if err := SetDefaultGateway(config.Gateway); err != nil {
-			return fmt.Errorf("set gateway to %s %s", config.Gateway, err)
-		}
-	}
-	return nil
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 9cd1741706..e0324074c5 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
+	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 	"github.com/dotcloud/docker/pkg/system"
 	"github.com/dotcloud/docker/pkg/term"
 	"io"
@@ -105,7 +106,14 @@ func createMasterAndConsole() (*os.File, string, error) {
 }
 
 func createVethPair() (name1 string, name2 string, err error) {
-	name1, name2 = "veth001", "veth002"
+	name1, err = utils.GenerateRandomName("dock", 4)
+	if err != nil {
+		return
+	}
+	name2, err = utils.GenerateRandomName("dock", 4)
+	if err != nil {
+		return
+	}
 	if err = network.CreateVethPair(name1, name2); err != nil {
 		return
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 2804f01e5f..fe8fd4b4db 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -52,11 +52,14 @@ func main() {
 		log.Fatal(err)
 	}
 
-	data, err := ioutil.ReadAll(os.Stdin)
-	if err != nil {
-		log.Fatalf("error reading from stdin %s", err)
+	var tempVethName string
+	if container.Network != nil {
+		data, err := ioutil.ReadAll(os.Stdin)
+		if err != nil {
+			log.Fatalf("error reading from stdin %s", err)
+		}
+		tempVethName = string(data)
 	}
-	tempVethName := string(data)
 
 	// close pipes so that we can replace it with the pty
 	os.Stdin.Close()
@@ -73,7 +76,6 @@ func main() {
 	if err := dupSlave(slave); err != nil {
 		log.Fatalf("dup2 slave %s", err)
 	}
-
 	if _, err := system.Setsid(); err != nil {
 		log.Fatalf("setsid %s", err)
 	}
@@ -83,13 +85,11 @@ func main() {
 	if err := system.ParentDeathSignal(); err != nil {
 		log.Fatalf("parent deth signal %s", err)
 	}
-
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		log.Fatalf("setup mount namespace %s", err)
 	}
-
 	if container.Network != nil {
-		if err := setupNetworking(container, tempVethName); err != nil {
+		if err := setupNetworking(container.Network, tempVethName); err != nil {
 			log.Fatalf("setup networking %s", err)
 		}
 	}
@@ -174,6 +174,32 @@ func setLogFile(container *libcontainer.Container) error {
 	return nil
 }
 
-func setupNetworking(container *libcontainer.Container, tempVethName string) error {
-	return network.SetupVeth(container.Network, tempVethName)
+func setupNetworking(config *libcontainer.Network, tempVethName string) error {
+	if err := network.InterfaceDown(tempVethName); err != nil {
+		return fmt.Errorf("interface down %s %s", tempVethName, err)
+	}
+	if err := network.ChangeInterfaceName(tempVethName, "eth0"); err != nil {
+		return fmt.Errorf("change %s to eth0 %s", tempVethName, err)
+	}
+	if err := network.SetInterfaceIp("eth0", config.IP); err != nil {
+		return fmt.Errorf("set eth0 ip %s", err)
+	}
+	if err := network.SetMtu("eth0", config.Mtu); err != nil {
+		return fmt.Errorf("set eth0 mtu to %d %s", config.Mtu, err)
+	}
+	if err := network.InterfaceUp("eth0"); err != nil {
+		return fmt.Errorf("eth0 up %s", err)
+	}
+	if err := network.SetMtu("lo", config.Mtu); err != nil {
+		return fmt.Errorf("set lo mtu to %d %s", config.Mtu, err)
+	}
+	if err := network.InterfaceUp("lo"); err != nil {
+		return fmt.Errorf("lo up %s", err)
+	}
+	if config.Gateway != "" {
+		if err := network.SetDefaultGateway(config.Gateway); err != nil {
+			return fmt.Errorf("set gateway to %s %s", config.Gateway, err)
+		}
+	}
+	return nil
 }
diff --git a/components/engine/pkg/libcontainer/utils/utils.go b/components/engine/pkg/libcontainer/utils/utils.go
index 7289fecf2e..d3223c3e4d 100644
--- a/components/engine/pkg/libcontainer/utils/utils.go
+++ b/components/engine/pkg/libcontainer/utils/utils.go
@@ -4,30 +4,12 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"io"
-	"os"
-	"syscall"
 )
 
-func WaitOnPid(pid int) (exitcode int, err error) {
-	child, err := os.FindProcess(pid)
-	if err != nil {
-		return -1, err
-	}
-	state, err := child.Wait()
-	if err != nil {
-		return -1, err
-	}
-	return getExitCode(state), nil
-}
-
-func getExitCode(state *os.ProcessState) int {
-	return state.Sys().(syscall.WaitStatus).ExitStatus()
-}
-
-func GenerateRandomName(size int) (string, error) {
-	id := make([]byte, size)
+func GenerateRandomName(prefix string, size int) (string, error) {
+	id := make([]byte, 32)
 	if _, err := io.ReadFull(rand.Reader, id); err != nil {
 		return "", err
 	}
-	return hex.EncodeToString(id), nil
+	return prefix + hex.EncodeToString(id)[:size], nil
 }

From 3c99ad70330fba581ecb2880e1fb18d57c4854af Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 16:40:36 -0800
Subject: [PATCH 192/403] General cleanup of libcontainer
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 61a119220d88d20bb1cca111e9c8ba7cdb45d4f6 Component: engine

---
 components/engine/pkg/libcontainer/errors.go  |  9 ---
 .../pkg/libcontainer/network/network.go       | 26 --------
 .../engine/pkg/libcontainer/nsinit/exec.go    | 51 +++++++--------
 .../engine/pkg/libcontainer/nsinit/init.go    | 63 +++++--------------
 .../engine/pkg/libcontainer/nsinit/main.go    | 42 +++++++++++++
 .../engine/pkg/libcontainer/nsinit/mount.go   | 61 +++++++-----------
 .../pkg/libcontainer/nsinit/ns_linux.go       | 25 +++-----
 7 files changed, 111 insertions(+), 166 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/errors.go
 create mode 100644 components/engine/pkg/libcontainer/nsinit/main.go

diff --git a/components/engine/pkg/libcontainer/errors.go b/components/engine/pkg/libcontainer/errors.go
deleted file mode 100644
index c6964ee8e6..0000000000
--- a/components/engine/pkg/libcontainer/errors.go
+++ /dev/null
@@ -1,9 +0,0 @@
-package libcontainer
-
-import (
-	"errors"
-)
-
-var (
-	ErrInvalidPid = errors.New("no ns pid found")
-)
diff --git a/components/engine/pkg/libcontainer/network/network.go b/components/engine/pkg/libcontainer/network/network.go
index 31c5d32492..8c7a4b618e 100644
--- a/components/engine/pkg/libcontainer/network/network.go
+++ b/components/engine/pkg/libcontainer/network/network.go
@@ -1,15 +1,10 @@
 package network
 
 import (
-	"errors"
 	"github.com/dotcloud/docker/pkg/netlink"
 	"net"
 )
 
-var (
-	ErrNoDefaultRoute = errors.New("no default network route found")
-)
-
 func InterfaceUp(name string) error {
 	iface, err := net.InterfaceByName(name)
 	if err != nil {
@@ -46,14 +41,6 @@ func SetInterfaceInNamespacePid(name string, nsPid int) error {
 	return netlink.NetworkSetNsPid(iface, nsPid)
 }
 
-func SetInterfaceInNamespaceFd(name string, fd int) error {
-	iface, err := net.InterfaceByName(name)
-	if err != nil {
-		return err
-	}
-	return netlink.NetworkSetNsFd(iface, fd)
-}
-
 func SetInterfaceMaster(name, master string) error {
 	iface, err := net.InterfaceByName(name)
 	if err != nil {
@@ -89,16 +76,3 @@ func SetMtu(name string, mtu int) error {
 	}
 	return netlink.NetworkSetMTU(iface, mtu)
 }
-
-func GetDefaultMtu() (int, error) {
-	routes, err := netlink.NetworkGetRoutes()
-	if err != nil {
-		return -1, err
-	}
-	for _, r := range routes {
-		if r.Default {
-			return r.Iface.MTU, nil
-		}
-	}
-	return -1, ErrNoDefaultRoute
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index e0324074c5..4ac070db08 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -8,65 +8,54 @@ import (
 	"github.com/dotcloud/docker/pkg/system"
 	"github.com/dotcloud/docker/pkg/term"
 	"io"
-	"log"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"syscall"
 )
 
-func execCommand(container *libcontainer.Container) (pid int, err error) {
+func execCommand(container *libcontainer.Container) (int, error) {
 	master, console, err := createMasterAndConsole()
 	if err != nil {
 		return -1, err
 	}
 
-	// we need CLONE_VFORK so we can wait on the child
-	flag := uintptr(getNamespaceFlags(container.Namespaces) | CLONE_VFORK)
-
-	command := exec.Command("nsinit", console)
+	command := exec.Command("nsinit", "init", console)
 	command.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: flag,
+		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces) | syscall.CLONE_VFORK), // we need CLONE_VFORK so we can wait on the child
 	}
 
 	inPipe, err := command.StdinPipe()
 	if err != nil {
 		return -1, err
 	}
-
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
-	pid = command.Process.Pid
+	if err := writePidFile(command); err != nil {
+		return -1, err
+	}
 
 	if container.Network != nil {
 		name1, name2, err := createVethPair()
 		if err != nil {
-			log.Fatal(err)
+			return -1, err
 		}
 		if err := network.SetInterfaceMaster(name1, container.Network.Bridge); err != nil {
-			log.Fatal(err)
+			return -1, err
 		}
 		if err := network.InterfaceUp(name1); err != nil {
-			log.Fatal(err)
+			return -1, err
 		}
-		if err := network.SetInterfaceInNamespacePid(name2, pid); err != nil {
-			log.Fatal(err)
+		if err := network.SetInterfaceInNamespacePid(name2, command.Process.Pid); err != nil {
+			return -1, err
 		}
 		fmt.Fprint(inPipe, name2)
 		inPipe.Close()
 	}
 
-	go func() {
-		if _, err := io.Copy(os.Stdout, master); err != nil {
-			log.Println(err)
-		}
-	}()
-
-	go func() {
-		if _, err := io.Copy(master, os.Stdin); err != nil {
-			log.Println(err)
-		}
-	}()
+	go io.Copy(os.Stdout, master)
+	go io.Copy(master, os.Stdin)
 
 	ws, err := term.GetWinsize(os.Stdin.Fd())
 	if err != nil {
@@ -83,9 +72,11 @@ func execCommand(container *libcontainer.Container) (pid int, err error) {
 	defer term.RestoreTerminal(os.Stdin.Fd(), state)
 
 	if err := command.Wait(); err != nil {
-		return pid, err
+		if _, ok := err.(*exec.ExitError); !ok {
+			return -1, err
+		}
 	}
-	return pid, nil
+	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
 func createMasterAndConsole() (*os.File, string, error) {
@@ -93,12 +84,10 @@ func createMasterAndConsole() (*os.File, string, error) {
 	if err != nil {
 		return nil, "", err
 	}
-
 	console, err := system.Ptsname(master)
 	if err != nil {
 		return nil, "", err
 	}
-
 	if err := system.Unlockpt(master); err != nil {
 		return nil, "", err
 	}
@@ -119,3 +108,7 @@ func createVethPair() (name1 string, name2 string, err error) {
 	}
 	return
 }
+
+func writePidFile(command *exec.Cmd) error {
+	return ioutil.WriteFile(".nspid", []byte(fmt.Sprint(command.Process.Pid)), 0655)
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index fe8fd4b4db..16a30812f9 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -1,7 +1,6 @@
 package main
 
 import (
-	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
@@ -14,49 +13,21 @@ import (
 	"syscall"
 )
 
-func loadContainer() (*libcontainer.Container, error) {
-	f, err := os.Open("container.json")
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	var container *libcontainer.Container
-	if err := json.NewDecoder(f).Decode(&container); err != nil {
-		return nil, err
-	}
-	return container, nil
-}
-
-func main() {
-	container, err := loadContainer()
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	if os.Args[1] == "exec" {
-		_, err := execCommand(container)
-		if err != nil {
-			log.Fatal(err)
-		}
-		os.Exit(0)
-	}
-	console := os.Args[1]
-
+func initCommand(container *libcontainer.Container, console string) error {
 	if err := setLogFile(container); err != nil {
-		log.Fatal(err)
+		return err
 	}
 
 	rootfs, err := resolveRootfs()
 	if err != nil {
-		log.Fatal(err)
+		return err
 	}
 
 	var tempVethName string
 	if container.Network != nil {
 		data, err := ioutil.ReadAll(os.Stdin)
 		if err != nil {
-			log.Fatalf("error reading from stdin %s", err)
+			return fmt.Errorf("error reading from stdin %s", err)
 		}
 		tempVethName = string(data)
 	}
@@ -68,48 +39,48 @@ func main() {
 
 	slave, err := openTerminal(console, syscall.O_RDWR)
 	if err != nil {
-		log.Fatalf("open terminal %s", err)
+		return fmt.Errorf("open terminal %s", err)
 	}
 	if slave.Fd() != 0 {
-		log.Fatalf("slave fd should be 0")
+		return fmt.Errorf("slave fd should be 0")
 	}
 	if err := dupSlave(slave); err != nil {
-		log.Fatalf("dup2 slave %s", err)
+		return fmt.Errorf("dup2 slave %s", err)
 	}
 	if _, err := system.Setsid(); err != nil {
-		log.Fatalf("setsid %s", err)
+		return fmt.Errorf("setsid %s", err)
 	}
 	if err := system.Setctty(); err != nil {
-		log.Fatalf("setctty %s", err)
+		return fmt.Errorf("setctty %s", err)
 	}
 	if err := system.ParentDeathSignal(); err != nil {
-		log.Fatalf("parent deth signal %s", err)
+		return fmt.Errorf("parent deth signal %s", err)
 	}
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
-		log.Fatalf("setup mount namespace %s", err)
+		return fmt.Errorf("setup mount namespace %s", err)
 	}
 	if container.Network != nil {
 		if err := setupNetworking(container.Network, tempVethName); err != nil {
-			log.Fatalf("setup networking %s", err)
+			return fmt.Errorf("setup networking %s", err)
 		}
 	}
 
 	if err := system.Sethostname(container.ID); err != nil {
-		log.Fatalf("sethostname %s", err)
+		return fmt.Errorf("sethostname %s", err)
 	}
 	if err := capabilities.DropCapabilities(container); err != nil {
-		log.Fatalf("drop capabilities %s", err)
+		return fmt.Errorf("drop capabilities %s", err)
 	}
 	if err := setupUser(container); err != nil {
-		log.Fatalf("setup user %s", err)
+		return fmt.Errorf("setup user %s", err)
 	}
 	if container.WorkingDir != "" {
 		if err := system.Chdir(container.WorkingDir); err != nil {
-			log.Fatalf("chdir to %s %s", container.WorkingDir, err)
+			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
 		}
 	}
 	if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
-		log.Fatalf("exec %s", err)
+		return fmt.Errorf("exec %s", err)
 	}
 	panic("unreachable")
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/main.go
new file mode 100644
index 0000000000..47abcce0c5
--- /dev/null
+++ b/components/engine/pkg/libcontainer/nsinit/main.go
@@ -0,0 +1,42 @@
+package main
+
+import (
+	"encoding/json"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"log"
+	"os"
+)
+
+func main() {
+	container, err := loadContainer()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	switch os.Args[1] {
+	case "exec":
+		exitCode, err := execCommand(container)
+		if err != nil {
+			log.Fatal(err)
+		}
+		os.Exit(exitCode)
+	case "init":
+		if err := initCommand(container, os.Args[2]); err != nil {
+			log.Fatal(err)
+		}
+	}
+}
+
+func loadContainer() (*libcontainer.Container, error) {
+	f, err := os.Open("container.json")
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	var container *libcontainer.Container
+	if err := json.NewDecoder(f).Decode(&container); err != nil {
+		return nil, err
+	}
+	return container, nil
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index f9ee969636..13ee13e001 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -3,68 +3,47 @@ package main
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/system"
-	"log"
 	"os"
 	"path/filepath"
 	"syscall"
 )
 
-var (
-	// default mount point options
-	defaults = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
-)
+// default mount point options
+const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
 
 func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := system.Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
-
 	if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mouting %s as bind %s", rootfs, err)
 	}
-
 	if readonly {
 		if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, ""); err != nil {
 			return fmt.Errorf("mounting %s as readonly %s", rootfs, err)
 		}
 	}
-
 	if err := mountSystem(rootfs); err != nil {
 		return fmt.Errorf("mount system %s", err)
 	}
-
 	if err := copyDevNodes(rootfs); err != nil {
 		return fmt.Errorf("copy dev nodes %s", err)
 	}
-
-	ptmx := filepath.Join(rootfs, "dev/ptmx")
-	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
-		return fmt.Errorf("symlink dev ptmx %s", err)
-	}
-
 	if err := setupDev(rootfs); err != nil {
 		return err
 	}
-
-	if err := setupConsole(rootfs, console); err != nil {
+	if err := setupPtmx(rootfs, console); err != nil {
 		return err
 	}
-
 	if err := system.Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
-
 	if err := system.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
 		return fmt.Errorf("mount move %s into / %s", rootfs, err)
 	}
-
 	if err := system.Chroot("."); err != nil {
 		return fmt.Errorf("chroot . %s", err)
 	}
-
 	if err := system.Chdir("/"); err != nil {
 		return fmt.Errorf("chdir / %s", err)
 	}
@@ -90,13 +69,10 @@ func copyDevNodes(rootfs string) error {
 		if err != nil {
 			return err
 		}
-
 		var (
 			dest = filepath.Join(rootfs, "dev", node)
 			st   = stat.Sys().(*syscall.Stat_t)
 		)
-
-		log.Printf("copy %s to %s %d\n", node, dest, st.Rdev)
 		if err := system.Mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) {
 			return fmt.Errorf("copy %s %s", node, err)
 		}
@@ -134,24 +110,22 @@ func setupConsole(rootfs, console string) error {
 	if err != nil {
 		return fmt.Errorf("stat console %s %s", console, err)
 	}
-	st := stat.Sys().(*syscall.Stat_t)
-
-	dest := filepath.Join(rootfs, "dev/console")
+	var (
+		st   = stat.Sys().(*syscall.Stat_t)
+		dest = filepath.Join(rootfs, "dev/console")
+	)
 	if err := os.Remove(dest); err != nil && !os.IsNotExist(err) {
 		return fmt.Errorf("remove %s %s", dest, err)
 	}
-
 	if err := os.Chmod(console, 0600); err != nil {
 		return err
 	}
 	if err := os.Chown(console, 0, 0); err != nil {
 		return err
 	}
-
 	if err := system.Mknod(dest, (st.Mode&^07777)|0600, int(st.Rdev)); err != nil {
 		return fmt.Errorf("mknod %s %s", dest, err)
 	}
-
 	if err := system.Mount(console, dest, "bind", syscall.MS_BIND, ""); err != nil {
 		return fmt.Errorf("bind %s to %s %s", console, dest, err)
 	}
@@ -168,10 +142,10 @@ func mountSystem(rootfs string) error {
 		flags  int
 		data   string
 	}{
-		{source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaults},
-		{source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaults},
+		{source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaultMountFlags},
+		{source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaultMountFlags},
 		{source: "tmpfs", path: filepath.Join(rootfs, "dev"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME, data: "mode=755"},
-		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaults, data: "mode=1777"},
+		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: "mode=1777"},
 		{source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: "newinstance,ptmxmode=0666,mode=620,gid=5"},
 		{source: "tmpfs", path: filepath.Join(rootfs, "run"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_STRICTATIME, data: "mode=755"},
 	} {
@@ -189,7 +163,7 @@ func remountProc() error {
 	if err := system.Unmount("/proc", syscall.MNT_DETACH); err != nil {
 		return err
 	}
-	if err := system.Mount("proc", "/proc", "proc", uintptr(defaults), ""); err != nil {
+	if err := system.Mount("proc", "/proc", "proc", uintptr(defaultMountFlags), ""); err != nil {
 		return err
 	}
 	return nil
@@ -201,9 +175,20 @@ func remountSys() error {
 			return err
 		}
 	} else {
-		if err := system.Mount("sysfs", "/sys", "sysfs", uintptr(defaults), ""); err != nil {
+		if err := system.Mount("sysfs", "/sys", "sysfs", uintptr(defaultMountFlags), ""); err != nil {
 			return err
 		}
 	}
 	return nil
 }
+
+func setupPtmx(rootfs, console string) error {
+	ptmx := filepath.Join(rootfs, "dev/ptmx")
+	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
+		return fmt.Errorf("symlink dev ptmx %s", err)
+	}
+	return setupConsole(rootfs, console)
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/ns_linux.go b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
index b54bc2b993..2392ffd770 100644
--- a/components/engine/pkg/libcontainer/nsinit/ns_linux.go
+++ b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
@@ -2,27 +2,16 @@ package main
 
 import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
-)
-
-const (
-	SIGCHLD       = 0x14
-	CLONE_VFORK   = 0x00004000
-	CLONE_NEWNS   = 0x00020000
-	CLONE_NEWUTS  = 0x04000000
-	CLONE_NEWIPC  = 0x08000000
-	CLONE_NEWUSER = 0x10000000
-	CLONE_NEWPID  = 0x20000000
-	CLONE_NEWNET  = 0x40000000
+	"syscall"
 )
 
 var namespaceMap = map[libcontainer.Namespace]int{
-	"": 0,
-	libcontainer.CLONE_NEWNS:   CLONE_NEWNS,
-	libcontainer.CLONE_NEWUTS:  CLONE_NEWUTS,
-	libcontainer.CLONE_NEWIPC:  CLONE_NEWIPC,
-	libcontainer.CLONE_NEWUSER: CLONE_NEWUSER,
-	libcontainer.CLONE_NEWPID:  CLONE_NEWPID,
-	libcontainer.CLONE_NEWNET:  CLONE_NEWNET,
+	libcontainer.CLONE_NEWNS:   syscall.CLONE_NEWNS,
+	libcontainer.CLONE_NEWUTS:  syscall.CLONE_NEWUTS,
+	libcontainer.CLONE_NEWIPC:  syscall.CLONE_NEWIPC,
+	libcontainer.CLONE_NEWUSER: syscall.CLONE_NEWUSER,
+	libcontainer.CLONE_NEWPID:  syscall.CLONE_NEWPID,
+	libcontainer.CLONE_NEWNET:  syscall.CLONE_NEWNET,
 }
 
 // getNamespaceFlags parses the container's Namespaces options to set the correct

From 92c44382e1fd2b4b594eb0764459a393e80a169f Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@dotcloud.com>
Date: Wed, 19 Feb 2014 16:50:10 -0800
Subject: [PATCH 193/403] OSX compilation

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@dotcloud.com> (github: creack)
Upstream-commit: f3c48ec584707a9acaf9d79c2e161dadf1d2c99b
Component: engine
---
 components/engine/pkg/libcontainer/nsinit/exec.go  |  2 ++
 components/engine/pkg/libcontainer/nsinit/init.go  |  2 ++
 components/engine/pkg/libcontainer/nsinit/main.go  | 13 +++++++++++++
 components/engine/pkg/libcontainer/nsinit/mount.go |  2 ++
 4 files changed, 19 insertions(+)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 4ac070db08..5b53be259c 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -1,3 +1,5 @@
+// +build linux
+
 package main
 
 import (
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 16a30812f9..1c90ecca23 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -1,3 +1,5 @@
+// +build linux
+
 package main
 
 import (
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/main.go
index 47abcce0c5..c9f9d7bc8f 100644
--- a/components/engine/pkg/libcontainer/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/main.go
@@ -2,17 +2,27 @@ package main
 
 import (
 	"encoding/json"
+	"errors"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"log"
 	"os"
 )
 
+var (
+	ErrUnsupported    = errors.New("Unsupported method")
+	ErrWrongArguments = errors.New("Wrong argument count")
+)
+
 func main() {
 	container, err := loadContainer()
 	if err != nil {
 		log.Fatal(err)
 	}
 
+	argc := len(os.Args)
+	if argc < 2 {
+		log.Fatal(ErrWrongArguments)
+	}
 	switch os.Args[1] {
 	case "exec":
 		exitCode, err := execCommand(container)
@@ -21,6 +31,9 @@ func main() {
 		}
 		os.Exit(exitCode)
 	case "init":
+		if argc != 3 {
+			log.Fatal(ErrWrongArguments)
+		}
 		if err := initCommand(container, os.Args[2]); err != nil {
 			log.Fatal(err)
 		}
diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 13ee13e001..baa850f0fb 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -1,3 +1,5 @@
+// +build linux
+
 package main
 
 import (

From ec270e1bfb22e5425b5c3520292d28f8edd64fbf Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 19:14:31 -0800
Subject: [PATCH 194/403] Refactor large funcs Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 5d62916c48cb97320b37640592805d97badfd8ff Component: engine

---
 .../engine/pkg/libcontainer/container.go      |  5 +-
 .../engine/pkg/libcontainer/container.json    |  3 +-
 .../engine/pkg/libcontainer/nsinit/exec.go    | 60 ++++++++-----
 .../engine/pkg/libcontainer/nsinit/init.go    | 87 +++++++++----------
 components/engine/pkg/libcontainer/types.go   | 48 +++++-----
 5 files changed, 107 insertions(+), 96 deletions(-)

diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index 3f3961d496..c8dbdd668f 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -1,14 +1,13 @@
 package libcontainer
 
 type Container struct {
-	ID           string       `json:"id,omitempty"`
-	Command      *Command     `json:"command,omitempty"`
+	Hostname     string       `json:"hostname,omitempty"`
 	ReadonlyFs   bool         `json:"readonly_fs,omitempty"`
 	User         string       `json:"user,omitempty"`
 	WorkingDir   string       `json:"working_dir,omitempty"`
+	Command      *Command     `json:"command,omitempty"`
 	Namespaces   Namespaces   `json:"namespaces,omitempty"`
 	Capabilities Capabilities `json:"capabilities,omitempty"`
-	LogFile      string       `json:"log_file,omitempty"`
 	Network      *Network     `json:"network,omitempty"`
 }
 
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index 8731170c2a..2abf01adb9 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -1,6 +1,5 @@
 {
     "id": "koye",
-    "log_file": "/root/logs",
     "command": {
         "args": [
             "/bin/bash"
@@ -9,7 +8,7 @@
             "HOME=/",
             "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
             "container=docker",
-            "TERM=xterm"
+            "TERM=xterm-256color"
         ]
     },
     "namespaces": [
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 5b53be259c..4abebd2941 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -27,6 +27,8 @@ func execCommand(container *libcontainer.Container) (int, error) {
 		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces) | syscall.CLONE_VFORK), // we need CLONE_VFORK so we can wait on the child
 	}
 
+	// create a pipe so that we can syncronize with the namespaced process and
+	// pass the veth name to the child
 	inPipe, err := command.StdinPipe()
 	if err != nil {
 		return -1, err
@@ -39,34 +41,17 @@ func execCommand(container *libcontainer.Container) (int, error) {
 	}
 
 	if container.Network != nil {
-		name1, name2, err := createVethPair()
+		vethPair, err := setupVeth(container.Network.Bridge, command.Process.Pid)
 		if err != nil {
 			return -1, err
 		}
-		if err := network.SetInterfaceMaster(name1, container.Network.Bridge); err != nil {
-			return -1, err
-		}
-		if err := network.InterfaceUp(name1); err != nil {
-			return -1, err
-		}
-		if err := network.SetInterfaceInNamespacePid(name2, command.Process.Pid); err != nil {
-			return -1, err
-		}
-		fmt.Fprint(inPipe, name2)
-		inPipe.Close()
+		sendVethName(vethPair, inPipe)
 	}
 
 	go io.Copy(os.Stdout, master)
 	go io.Copy(master, os.Stdin)
 
-	ws, err := term.GetWinsize(os.Stdin.Fd())
-	if err != nil {
-		return -1, err
-	}
-	if err := term.SetWinsize(master.Fd(), ws); err != nil {
-		return -1, err
-	}
-	state, err := term.SetRawTerminal(os.Stdin.Fd())
+	state, err := setupWindow(master)
 	if err != nil {
 		command.Process.Kill()
 		return -1, err
@@ -81,6 +66,41 @@ func execCommand(container *libcontainer.Container) (int, error) {
 	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
+func sendVethName(name string, pipe io.WriteCloser) {
+	// write the veth pair name to the child's stdin then close the
+	// pipe so that the child stops waiting
+	fmt.Fprint(pipe, name)
+	pipe.Close()
+}
+
+func setupVeth(bridge string, nspid int) (string, error) {
+	name1, name2, err := createVethPair()
+	if err != nil {
+		return "", err
+	}
+	if err := network.SetInterfaceMaster(name1, bridge); err != nil {
+		return "", err
+	}
+	if err := network.InterfaceUp(name1); err != nil {
+		return "", err
+	}
+	if err := network.SetInterfaceInNamespacePid(name2, nspid); err != nil {
+		return "", err
+	}
+	return name2, nil
+}
+
+func setupWindow(master *os.File) (*term.State, error) {
+	ws, err := term.GetWinsize(os.Stdin.Fd())
+	if err != nil {
+		return nil, err
+	}
+	if err := term.SetWinsize(master.Fd(), ws); err != nil {
+		return nil, err
+	}
+	return term.SetRawTerminal(os.Stdin.Fd())
+}
+
 func createMasterAndConsole() (*os.File, string, error) {
 	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
 	if err != nil {
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 1c90ecca23..d853a32d03 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -9,17 +9,12 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
 	"io/ioutil"
-	"log"
 	"os"
 	"path/filepath"
 	"syscall"
 )
 
 func initCommand(container *libcontainer.Container, console string) error {
-	if err := setLogFile(container); err != nil {
-		return err
-	}
-
 	rootfs, err := resolveRootfs()
 	if err != nil {
 		return err
@@ -27,11 +22,10 @@ func initCommand(container *libcontainer.Container, console string) error {
 
 	var tempVethName string
 	if container.Network != nil {
-		data, err := ioutil.ReadAll(os.Stdin)
+		tempVethName, err = getVethName()
 		if err != nil {
-			return fmt.Errorf("error reading from stdin %s", err)
+			return err
 		}
-		tempVethName = string(data)
 	}
 
 	// close pipes so that we can replace it with the pty
@@ -61,13 +55,10 @@ func initCommand(container *libcontainer.Container, console string) error {
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
-	if container.Network != nil {
-		if err := setupNetworking(container.Network, tempVethName); err != nil {
-			return fmt.Errorf("setup networking %s", err)
-		}
+	if err := setupNetworking(container.Network, tempVethName); err != nil {
+		return fmt.Errorf("setup networking %s", err)
 	}
-
-	if err := system.Sethostname(container.ID); err != nil {
+	if err := system.Sethostname(container.Hostname); err != nil {
 		return fmt.Errorf("sethostname %s", err)
 	}
 	if err := capabilities.DropCapabilities(container); err != nil {
@@ -136,43 +127,45 @@ func openTerminal(name string, flag int) (*os.File, error) {
 	return os.NewFile(uintptr(r), name), nil
 }
 
-func setLogFile(container *libcontainer.Container) error {
-	if container.LogFile != "" {
-		f, err := os.OpenFile(container.LogFile, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0655)
-		if err != nil {
-			return err
+func setupNetworking(config *libcontainer.Network, tempVethName string) error {
+	if config != nil {
+		if err := network.InterfaceDown(tempVethName); err != nil {
+			return fmt.Errorf("interface down %s %s", tempVethName, err)
+		}
+		if err := network.ChangeInterfaceName(tempVethName, "eth0"); err != nil {
+			return fmt.Errorf("change %s to eth0 %s", tempVethName, err)
+		}
+		if err := network.SetInterfaceIp("eth0", config.IP); err != nil {
+			return fmt.Errorf("set eth0 ip %s", err)
+		}
+		if err := network.SetMtu("eth0", config.Mtu); err != nil {
+			return fmt.Errorf("set eth0 mtu to %d %s", config.Mtu, err)
+		}
+		if err := network.InterfaceUp("eth0"); err != nil {
+			return fmt.Errorf("eth0 up %s", err)
+		}
+		if err := network.SetMtu("lo", config.Mtu); err != nil {
+			return fmt.Errorf("set lo mtu to %d %s", config.Mtu, err)
+		}
+		if err := network.InterfaceUp("lo"); err != nil {
+			return fmt.Errorf("lo up %s", err)
+		}
+		if config.Gateway != "" {
+			if err := network.SetDefaultGateway(config.Gateway); err != nil {
+				return fmt.Errorf("set gateway to %s %s", config.Gateway, err)
+			}
 		}
-		log.SetOutput(f)
 	}
 	return nil
 }
 
-func setupNetworking(config *libcontainer.Network, tempVethName string) error {
-	if err := network.InterfaceDown(tempVethName); err != nil {
-		return fmt.Errorf("interface down %s %s", tempVethName, err)
+// getVethName reads from Stdin the temp veth name
+// sent by the parent processes after the veth pair
+// has been created and setup
+func getVethName() (string, error) {
+	data, err := ioutil.ReadAll(os.Stdin)
+	if err != nil {
+		return "", fmt.Errorf("error reading from stdin %s", err)
 	}
-	if err := network.ChangeInterfaceName(tempVethName, "eth0"); err != nil {
-		return fmt.Errorf("change %s to eth0 %s", tempVethName, err)
-	}
-	if err := network.SetInterfaceIp("eth0", config.IP); err != nil {
-		return fmt.Errorf("set eth0 ip %s", err)
-	}
-	if err := network.SetMtu("eth0", config.Mtu); err != nil {
-		return fmt.Errorf("set eth0 mtu to %d %s", config.Mtu, err)
-	}
-	if err := network.InterfaceUp("eth0"); err != nil {
-		return fmt.Errorf("eth0 up %s", err)
-	}
-	if err := network.SetMtu("lo", config.Mtu); err != nil {
-		return fmt.Errorf("set lo mtu to %d %s", config.Mtu, err)
-	}
-	if err := network.InterfaceUp("lo"); err != nil {
-		return fmt.Errorf("lo up %s", err)
-	}
-	if config.Gateway != "" {
-		if err := network.SetDefaultGateway(config.Gateway); err != nil {
-			return fmt.Errorf("set gateway to %s %s", config.Gateway, err)
-		}
-	}
-	return nil
+	return string(data), nil
 }
diff --git a/components/engine/pkg/libcontainer/types.go b/components/engine/pkg/libcontainer/types.go
index db1c3b9738..b5d9932671 100644
--- a/components/engine/pkg/libcontainer/types.go
+++ b/components/engine/pkg/libcontainer/types.go
@@ -1,29 +1,5 @@
 package libcontainer
 
-type Namespace string
-type Namespaces []Namespace
-
-func (n Namespaces) Contains(ns Namespace) bool {
-	for _, nns := range n {
-		if nns == ns {
-			return true
-		}
-	}
-	return false
-}
-
-type Capability string
-type Capabilities []Capability
-
-func (c Capabilities) Contains(capp Capability) bool {
-	for _, cc := range c {
-		if cc == capp {
-			return true
-		}
-	}
-	return false
-}
-
 const (
 	CAP_SETPCAP        Capability = "SETPCAP"
 	CAP_SYS_MODULE     Capability = "SYS_MODULE"
@@ -47,3 +23,27 @@ const (
 	CLONE_NEWPID  Namespace = "NEWPID"  // pid
 	CLONE_NEWNET  Namespace = "NEWNET"  // network
 )
+
+type Namespace string
+type Namespaces []Namespace
+
+func (n Namespaces) Contains(ns Namespace) bool {
+	for _, nns := range n {
+		if nns == ns {
+			return true
+		}
+	}
+	return false
+}
+
+type Capability string
+type Capabilities []Capability
+
+func (c Capabilities) Contains(capp Capability) bool {
+	for _, cc := range c {
+		if cc == capp {
+			return true
+		}
+	}
+	return false
+}

From eba71238f8171d46f1ab9c21e8e6a9365360447e Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 19:53:25 -0800
Subject: [PATCH 195/403] Add execin function to running a process in a
 namespace Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 420b5eb211f877baac9622e7bedde2948c043619 Component: engine

---
 .../engine/pkg/libcontainer/container.json    |   2 +-
 .../engine/pkg/libcontainer/nsinit/execin.go  | 115 ++++++++++++++++++
 .../engine/pkg/libcontainer/nsinit/main.go    |   8 ++
 .../pkg/libcontainer/nsinit/ns_linux.go       |   9 ++
 4 files changed, 133 insertions(+), 1 deletion(-)
 create mode 100644 components/engine/pkg/libcontainer/nsinit/execin.go

diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index 2abf01adb9..c5807a7b28 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -1,5 +1,5 @@
 {
-    "id": "koye",
+    "hostname": "koye",
     "command": {
         "args": [
             "/bin/bash"
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
new file mode 100644
index 0000000000..362cf5afd5
--- /dev/null
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -0,0 +1,115 @@
+package main
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
+	"github.com/dotcloud/docker/pkg/system"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strconv"
+	"syscall"
+)
+
+func execinCommand(container *libcontainer.Container) (int, error) {
+	nspid, err := readPid()
+	if err != nil {
+		return -1, err
+	}
+
+	for _, ns := range container.Namespaces {
+		if err := system.Unshare(namespaceMap[ns]); err != nil {
+			return -1, err
+		}
+	}
+	fds, err := getNsFds(nspid, container)
+	closeFds := func() {
+		for _, f := range fds {
+			system.Closefd(f)
+		}
+	}
+	if err != nil {
+		closeFds()
+		return -1, err
+	}
+
+	for _, fd := range fds {
+		if fd > 0 {
+			if err := system.Setns(fd, 0); err != nil {
+				closeFds()
+				return -1, fmt.Errorf("setns %s", err)
+			}
+		}
+		system.Closefd(fd)
+	}
+
+	// if the container has a new pid and mount namespace we need to
+	// remount proc and sys to pick up the changes
+	if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
+		container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
+
+		pid, err := system.Fork()
+		if err != nil {
+			return -1, err
+		}
+		if pid == 0 {
+			// TODO: make all raw syscalls to be fork safe
+			if err := system.Unshare(syscall.CLONE_NEWNS); err != nil {
+				return -1, err
+			}
+			if err := remountProc(); err != nil {
+				return -1, fmt.Errorf("remount proc %s", err)
+			}
+			if err := remountSys(); err != nil {
+				return -1, fmt.Errorf("remount sys %s", err)
+			}
+			if err := capabilities.DropCapabilities(container); err != nil {
+				return -1, fmt.Errorf("drop capabilities %s", err)
+			}
+			if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+				return -1, err
+			}
+		}
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			return -1, err
+		}
+		state, err := proc.Wait()
+		if err != nil {
+			return -1, err
+		}
+		os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus())
+	}
+	if err := capabilities.DropCapabilities(container); err != nil {
+		return -1, fmt.Errorf("drop capabilities %s", err)
+	}
+	if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+		return -1, err
+	}
+	panic("unreachable")
+}
+
+func readPid() (int, error) {
+	data, err := ioutil.ReadFile(".nspid")
+	if err != nil {
+		return -1, err
+	}
+	pid, err := strconv.Atoi(string(data))
+	if err != nil {
+		return -1, err
+	}
+	return pid, nil
+}
+
+func getNsFds(pid int, container *libcontainer.Container) ([]uintptr, error) {
+	fds := make([]uintptr, len(container.Namespaces))
+	for i, ns := range container.Namespaces {
+		f, err := os.OpenFile(filepath.Join("/proc/", strconv.Itoa(pid), "ns", namespaceFileMap[ns]), os.O_RDONLY, 0)
+		if err != nil {
+			return fds, err
+		}
+		fds[i] = f.Fd()
+	}
+	return fds, nil
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/main.go
index c9f9d7bc8f..8fe700e064 100644
--- a/components/engine/pkg/libcontainer/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/main.go
@@ -37,6 +37,14 @@ func main() {
 		if err := initCommand(container, os.Args[2]); err != nil {
 			log.Fatal(err)
 		}
+	case "execin":
+		exitCode, err := execinCommand(container)
+		if err != nil {
+			log.Fatal(err)
+		}
+		os.Exit(exitCode)
+	default:
+		log.Fatalf("command not supported for nsinit %s", os.Args[1])
 	}
 }
 
diff --git a/components/engine/pkg/libcontainer/nsinit/ns_linux.go b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
index 2392ffd770..a2809eb199 100644
--- a/components/engine/pkg/libcontainer/nsinit/ns_linux.go
+++ b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
@@ -14,6 +14,15 @@ var namespaceMap = map[libcontainer.Namespace]int{
 	libcontainer.CLONE_NEWNET:  syscall.CLONE_NEWNET,
 }
 
+var namespaceFileMap = map[libcontainer.Namespace]string{
+	libcontainer.CLONE_NEWNS:   "mnt",
+	libcontainer.CLONE_NEWUTS:  "uts",
+	libcontainer.CLONE_NEWIPC:  "ipc",
+	libcontainer.CLONE_NEWUSER: "user",
+	libcontainer.CLONE_NEWPID:  "pid",
+	libcontainer.CLONE_NEWNET:  "net",
+}
+
 // getNamespaceFlags parses the container's Namespaces options to set the correct
 // flags on clone, unshare, and setns
 func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {

From e501c61ed362bc64550c8b645f8027b827e0ffb1 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 20:35:04 -0800
Subject: [PATCH 196/403] Refactor to remove cmd from container

Pass the container's command via args
Remove execin function and just look for an
existing nspid file to join the namespace
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: d84feb8fe5e40838c81321249189f1f0a02825bb
Component: engine
---
 .../engine/pkg/libcontainer/container.go      |  7 +---
 .../engine/pkg/libcontainer/container.json    | 17 +++------
 .../engine/pkg/libcontainer/nsinit/exec.go    | 21 ++++++++---
 .../engine/pkg/libcontainer/nsinit/execin.go  | 24 ++----------
 .../engine/pkg/libcontainer/nsinit/init.go    |  4 +-
 .../engine/pkg/libcontainer/nsinit/main.go    | 37 ++++++++++++++-----
 6 files changed, 55 insertions(+), 55 deletions(-)

diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index c8dbdd668f..763526f66b 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -5,17 +5,12 @@ type Container struct {
 	ReadonlyFs   bool         `json:"readonly_fs,omitempty"`
 	User         string       `json:"user,omitempty"`
 	WorkingDir   string       `json:"working_dir,omitempty"`
-	Command      *Command     `json:"command,omitempty"`
+	Env          []string     `json:"environment,omitempty"`
 	Namespaces   Namespaces   `json:"namespaces,omitempty"`
 	Capabilities Capabilities `json:"capabilities,omitempty"`
 	Network      *Network     `json:"network,omitempty"`
 }
 
-type Command struct {
-	Args []string `json:"args,omitempty"`
-	Env  []string `json:"environment,omitempty"`
-}
-
 type Network struct {
 	IP      string `json:"ip,omitempty"`
 	Gateway string `json:"gateway,omitempty"`
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index c5807a7b28..ccc9abb041 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -1,16 +1,11 @@
 {
     "hostname": "koye",
-    "command": {
-        "args": [
-            "/bin/bash"
-        ],
-        "environment": [
-            "HOME=/",
-            "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
-            "container=docker",
-            "TERM=xterm-256color"
-        ]
-    },
+    "environment": [
+        "HOME=/",
+        "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
+        "container=docker",
+        "TERM=xterm-256color"
+    ],
     "namespaces": [
         "NEWIPC",
         "NEWNS",
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 4abebd2941..67f907af53 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -16,17 +16,13 @@ import (
 	"syscall"
 )
 
-func execCommand(container *libcontainer.Container) (int, error) {
+func execCommand(container *libcontainer.Container, args []string) (int, error) {
 	master, console, err := createMasterAndConsole()
 	if err != nil {
 		return -1, err
 	}
 
-	command := exec.Command("nsinit", "init", console)
-	command.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces) | syscall.CLONE_VFORK), // we need CLONE_VFORK so we can wait on the child
-	}
-
+	command := createCommand(container, console, args)
 	// create a pipe so that we can syncronize with the namespaced process and
 	// pass the veth name to the child
 	inPipe, err := command.StdinPipe()
@@ -39,6 +35,7 @@ func execCommand(container *libcontainer.Container) (int, error) {
 	if err := writePidFile(command); err != nil {
 		return -1, err
 	}
+	defer deletePidFile()
 
 	if container.Network != nil {
 		vethPair, err := setupVeth(container.Network.Bridge, command.Process.Pid)
@@ -134,3 +131,15 @@ func createVethPair() (name1 string, name2 string, err error) {
 func writePidFile(command *exec.Cmd) error {
 	return ioutil.WriteFile(".nspid", []byte(fmt.Sprint(command.Process.Pid)), 0655)
 }
+
+func deletePidFile() error {
+	return os.Remove(".nspid")
+}
+
+func createCommand(container *libcontainer.Container, console string, args []string) *exec.Cmd {
+	command := exec.Command("nsinit", append([]string{"init", console}, args...)...)
+	command.SysProcAttr = &syscall.SysProcAttr{
+		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces) | syscall.CLONE_VFORK), // we need CLONE_VFORK so we can wait on the child
+	}
+	return command
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index 362cf5afd5..7f32620cb8 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -5,19 +5,13 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
 	"github.com/dotcloud/docker/pkg/system"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
 	"syscall"
 )
 
-func execinCommand(container *libcontainer.Container) (int, error) {
-	nspid, err := readPid()
-	if err != nil {
-		return -1, err
-	}
-
+func execinCommand(container *libcontainer.Container, nspid int, args []string) (int, error) {
 	for _, ns := range container.Namespaces {
 		if err := system.Unshare(namespaceMap[ns]); err != nil {
 			return -1, err
@@ -67,7 +61,7 @@ func execinCommand(container *libcontainer.Container) (int, error) {
 			if err := capabilities.DropCapabilities(container); err != nil {
 				return -1, fmt.Errorf("drop capabilities %s", err)
 			}
-			if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+			if err := system.Exec(args[0], args[0:], container.Env); err != nil {
 				return -1, err
 			}
 		}
@@ -84,24 +78,12 @@ func execinCommand(container *libcontainer.Container) (int, error) {
 	if err := capabilities.DropCapabilities(container); err != nil {
 		return -1, fmt.Errorf("drop capabilities %s", err)
 	}
-	if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+	if err := system.Exec(args[0], args[0:], container.Env); err != nil {
 		return -1, err
 	}
 	panic("unreachable")
 }
 
-func readPid() (int, error) {
-	data, err := ioutil.ReadFile(".nspid")
-	if err != nil {
-		return -1, err
-	}
-	pid, err := strconv.Atoi(string(data))
-	if err != nil {
-		return -1, err
-	}
-	return pid, nil
-}
-
 func getNsFds(pid int, container *libcontainer.Container) ([]uintptr, error) {
 	fds := make([]uintptr, len(container.Namespaces))
 	for i, ns := range container.Namespaces {
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index d853a32d03..82706fdadd 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -14,7 +14,7 @@ import (
 	"syscall"
 )
 
-func initCommand(container *libcontainer.Container, console string) error {
+func initCommand(container *libcontainer.Container, console string, args []string) error {
 	rootfs, err := resolveRootfs()
 	if err != nil {
 		return err
@@ -72,7 +72,7 @@ func initCommand(container *libcontainer.Container, console string) error {
 			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
 		}
 	}
-	if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+	if err := system.Exec(args[0], args[0:], container.Env); err != nil {
 		return fmt.Errorf("exec %s", err)
 	}
 	panic("unreachable")
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/main.go
index 8fe700e064..30c8b064e4 100644
--- a/components/engine/pkg/libcontainer/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/main.go
@@ -4,8 +4,10 @@ import (
 	"encoding/json"
 	"errors"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"io/ioutil"
 	"log"
 	"os"
+	"strconv"
 )
 
 var (
@@ -25,24 +27,29 @@ func main() {
 	}
 	switch os.Args[1] {
 	case "exec":
-		exitCode, err := execCommand(container)
+		var exitCode int
+		nspid, err := readPid()
+		if err != nil {
+			if !os.IsNotExist(err) {
+				log.Fatal(err)
+			}
+		}
+		if nspid > 0 {
+			exitCode, err = execinCommand(container, nspid, os.Args[2:])
+		} else {
+			exitCode, err = execCommand(container, os.Args[2:])
+		}
 		if err != nil {
 			log.Fatal(err)
 		}
 		os.Exit(exitCode)
 	case "init":
-		if argc != 3 {
+		if argc < 3 {
 			log.Fatal(ErrWrongArguments)
 		}
-		if err := initCommand(container, os.Args[2]); err != nil {
+		if err := initCommand(container, os.Args[2], os.Args[3:]); err != nil {
 			log.Fatal(err)
 		}
-	case "execin":
-		exitCode, err := execinCommand(container)
-		if err != nil {
-			log.Fatal(err)
-		}
-		os.Exit(exitCode)
 	default:
 		log.Fatalf("command not supported for nsinit %s", os.Args[1])
 	}
@@ -61,3 +68,15 @@ func loadContainer() (*libcontainer.Container, error) {
 	}
 	return container, nil
 }
+
+func readPid() (int, error) {
+	data, err := ioutil.ReadFile(".nspid")
+	if err != nil {
+		return -1, err
+	}
+	pid, err := strconv.Atoi(string(data))
+	if err != nil {
+		return -1, err
+	}
+	return pid, nil
+}

From 60c5e9ec9384d577fd39622b3f01a721c5c89b15 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 21:15:44 -0800
Subject: [PATCH 197/403] Update readme and add TODO
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 3a97fe27d8f5a9bbcf4992cc9efe33880e73f274 Component: engine

---
 components/engine/pkg/libcontainer/README.md | 75 ++++++++++++--------
 components/engine/pkg/libcontainer/TODO.md   | 17 +++++
 2 files changed, 61 insertions(+), 31 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/TODO.md

diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index 91d747863c..07fe4f7b2d 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -1,39 +1,34 @@
 ## libcontainer - reference implementation for containers
 
-#### playground
+#### background
+
+libcontainer specifies configuration options for what a container is.  It provides a native Go implementation 
+for using linux namespaces with no external dependencies.  libcontainer provides many convience functions for working with namespaces, networking, and management.  
 
 
-Use the cli package to test out functionality
-
-First setup a container configuration.  You will need a root fs, better go the path to a
-stopped docker container and use that.
-
+#### container
+A container is a self contained directory that is able to run one or more processes inside without 
+affecting the host system.  The directory is usually a full system tree.  Inside the directory
+a `container.json` file just be placed with the runtime configuration for how the process 
+should be contained and run.  Environment, networking, and different capabilities for the 
+process are specified in this file.
 
+Sample `container.json` file:
 ```json
 {
-    "id": "koye",
-    "namespace_pid": 12265,
-    "command": {
-        "args": [
-            "/bin/bash"
-        ],
-        "environment": [
-            "HOME=/",
-            "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
-            "container=docker",
-            "TERM=xterm"
-        ]
-    },
-    "rootfs": "/root/development/gocode/src/github.com/docker/libcontainer/namespaces/ubuntu",
-    "network": null,
-    "user": "",
-    "working_dir": "",
+    "hostname": "koye",
+    "environment": [
+        "HOME=/",
+        "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
+        "container=docker",
+        "TERM=xterm-256color"
+    ],
     "namespaces": [
-        "NEWNET",
         "NEWIPC",
         "NEWNS",
         "NEWPID",
-        "NEWUTS"
+        "NEWUTS",
+        "NEWNET"
     ],
     "capabilities": [
         "SETPCAP",
@@ -50,14 +45,32 @@ stopped docker container and use that.
         "AUDIT_CONTROL",
         "MAC_OVERRIDE",
         "MAC_ADMIN"
-    ]
+    ],
+    "network": {
+        "ip": "172.17.0.100/16",
+        "gateway": "172.17.42.1",
+        "bridge": "docker0",
+        "mtu": 1500
+    }
 }
 ```
 
-After you have a json file and a rootfs path to use just run:
-`./cli exec container.json`
+Using this configuration and the current directory holding the rootfs for a process to live, one can se libcontainer to exec the container. Running the life of the namespace a `.nspid` file 
+is written to the current directory with the pid of the namespace'd process to the external word.  A client can use this pid to wait, kill, or perform other operation with the container.  If a user tries to run an new process inside an existing container with a live namespace with namespace will be joined by the new process.
 
 
-If you want to attach to an existing namespace just use the same json
-file with the container still running and do:
-`./cli execin container.json`
+#### nsinit
+
+`nsinit` is a cli application used as the reference implementation of libcontainer.  It is able to 
+spawn or join new containers giving the current directory.  To use `nsinit` cd into a linux 
+rootfs and copy a `container.json` file into the directory with your specified configuration.
+
+To execution `/bin/bash` in the current directory as a container just run:
+```bash
+nsinit exec /bin/bash
+```
+
+If you wish to spawn another process inside the container while your current bash session is 
+running just run the exact same command again to get another bash shell or change the command.  If the original process dies, PID 1, all other processes spawned inside the container will also be killed and the namespace will be removed. 
+
+You can identify if a process is running in a container by looking to see if `.nspid` is in the root of the directory.   
diff --git a/components/engine/pkg/libcontainer/TODO.md b/components/engine/pkg/libcontainer/TODO.md
new file mode 100644
index 0000000000..f18c0b4c51
--- /dev/null
+++ b/components/engine/pkg/libcontainer/TODO.md
@@ -0,0 +1,17 @@
+#### goals
+* small and simple - line count is not everything but less code is better
+* clean lines between what we do in the pkg 
+* provide primitives for working with namespaces not cater to every option
+* extend via configuration not by features - host networking, no networking, veth network can be accomplished via adjusting the container.json, nothing to do with code
+
+#### tasks
+* proper tty for a new process in an existing container
+* use exec or raw syscalls for new process in existing container
+* setup proper user in namespace if specified
+* implement hook or clean interface for cgroups
+* example configs for different setups (host networking, boot init)
+* improve pkg documentation with comments
+* testing - this is hard in a low level pkg but we could do some, maybe
+* pivot root
+* selinux
+* apparmor

From 74894a63abe9443d1c8e2bf50c0e179082396b3a Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 21:21:49 -0800
Subject: [PATCH 198/403] Add CAP_NET_ADMIN Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: e0ff0f4dd6612e331459a2dec69adc728bc360fe Component: engine

---
 components/engine/pkg/libcontainer/capabilities/capabilities.go | 1 +
 components/engine/pkg/libcontainer/types.go                     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/components/engine/pkg/libcontainer/capabilities/capabilities.go b/components/engine/pkg/libcontainer/capabilities/capabilities.go
index 3301e10f7f..c19b719564 100644
--- a/components/engine/pkg/libcontainer/capabilities/capabilities.go
+++ b/components/engine/pkg/libcontainer/capabilities/capabilities.go
@@ -21,6 +21,7 @@ var capMap = map[libcontainer.Capability]capability.Cap{
 	libcontainer.CAP_AUDIT_CONTROL:  capability.CAP_AUDIT_CONTROL,
 	libcontainer.CAP_MAC_OVERRIDE:   capability.CAP_MAC_OVERRIDE,
 	libcontainer.CAP_MAC_ADMIN:      capability.CAP_MAC_ADMIN,
+	libcontainer.CAP_NET_ADMIN:      capability.CAP_NET_ADMIN,
 }
 
 // DropCapabilities drops capabilities for the current process based
diff --git a/components/engine/pkg/libcontainer/types.go b/components/engine/pkg/libcontainer/types.go
index b5d9932671..fcd00fd4f1 100644
--- a/components/engine/pkg/libcontainer/types.go
+++ b/components/engine/pkg/libcontainer/types.go
@@ -15,6 +15,7 @@ const (
 	CAP_AUDIT_CONTROL  Capability = "AUDIT_CONTROL"
 	CAP_MAC_OVERRIDE   Capability = "MAC_OVERRIDE"
 	CAP_MAC_ADMIN      Capability = "MAC_ADMIN"
+	CAP_NET_ADMIN      Capability = "NET_ADMIN"
 
 	CLONE_NEWNS   Namespace = "NEWNS"   // mount
 	CLONE_NEWUTS  Namespace = "NEWUTS"  // utsname

From 4441df6975553c68d201ec375c2e4b5c30d267f1 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 22:43:40 -0800
Subject: [PATCH 199/403] Add comments to many functions
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 70593be139647cdedca0130250626ea6e0b8a277 Component: engine

---
 .../libcontainer/capabilities/capabilities.go |  1 +
 .../engine/pkg/libcontainer/container.go      | 22 ++++++----
 .../engine/pkg/libcontainer/nsinit/exec.go    | 23 +++++++++--
 .../engine/pkg/libcontainer/nsinit/execin.go  | 10 ++---
 .../engine/pkg/libcontainer/nsinit/init.go    | 18 ++++----
 .../engine/pkg/libcontainer/nsinit/main.go    |  4 +-
 .../engine/pkg/libcontainer/nsinit/mount.go   | 41 +++++++++++++------
 .../pkg/libcontainer/nsinit/ns_linux.go       |  3 ++
 components/engine/pkg/libcontainer/types.go   | 18 +++++---
 .../engine/pkg/libcontainer/utils/utils.go    |  2 +
 10 files changed, 97 insertions(+), 45 deletions(-)

diff --git a/components/engine/pkg/libcontainer/capabilities/capabilities.go b/components/engine/pkg/libcontainer/capabilities/capabilities.go
index c19b719564..65fd455c26 100644
--- a/components/engine/pkg/libcontainer/capabilities/capabilities.go
+++ b/components/engine/pkg/libcontainer/capabilities/capabilities.go
@@ -41,6 +41,7 @@ func DropCapabilities(container *libcontainer.Container) error {
 	return nil
 }
 
+// getCapabilities returns the specific cap values for the libcontainer types
 func getCapabilities(container *libcontainer.Container) []capability.Cap {
 	drop := []capability.Cap{}
 	for _, c := range container.Capabilities {
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index 763526f66b..a6a57dab77 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -1,16 +1,22 @@
 package libcontainer
 
+// Container defines configuration options for how a
+// container is setup inside a directory and how a process should be executed
 type Container struct {
-	Hostname     string       `json:"hostname,omitempty"`
-	ReadonlyFs   bool         `json:"readonly_fs,omitempty"`
-	User         string       `json:"user,omitempty"`
-	WorkingDir   string       `json:"working_dir,omitempty"`
-	Env          []string     `json:"environment,omitempty"`
-	Namespaces   Namespaces   `json:"namespaces,omitempty"`
-	Capabilities Capabilities `json:"capabilities,omitempty"`
-	Network      *Network     `json:"network,omitempty"`
+	Hostname     string       `json:"hostname,omitempty"`     // hostname
+	ReadonlyFs   bool         `json:"readonly_fs,omitempty"`  // set the containers rootfs as readonly
+	User         string       `json:"user,omitempty"`         // user to execute the process as
+	WorkingDir   string       `json:"working_dir,omitempty"`  // current working directory
+	Env          []string     `json:"environment,omitempty"`  // environment to set
+	Namespaces   Namespaces   `json:"namespaces,omitempty"`   // namespaces to apply
+	Capabilities Capabilities `json:"capabilities,omitempty"` // capabilities to drop
+	Network      *Network     `json:"network,omitempty"`      // nil for host's network stack
 }
 
+// Network defines configuration for a container's networking stack
+//
+// The network configuration can be omited from a container causing the
+// container to be setup with the host's networking stack
 type Network struct {
 	IP      string `json:"ip,omitempty"`
 	Gateway string `json:"gateway,omitempty"`
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 67f907af53..202cfcab5e 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -38,7 +38,7 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 	defer deletePidFile()
 
 	if container.Network != nil {
-		vethPair, err := setupVeth(container.Network.Bridge, command.Process.Pid)
+		vethPair, err := initializeContainerVeth(container.Network.Bridge, command.Process.Pid)
 		if err != nil {
 			return -1, err
 		}
@@ -63,14 +63,21 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
+// sendVethName writes the veth pair name to the child's stdin then closes the
+// pipe so that the child stops waiting for more data
 func sendVethName(name string, pipe io.WriteCloser) {
-	// write the veth pair name to the child's stdin then close the
-	// pipe so that the child stops waiting
 	fmt.Fprint(pipe, name)
 	pipe.Close()
 }
 
-func setupVeth(bridge string, nspid int) (string, error) {
+// initializeContainerVeth will create a veth pair and setup the host's
+// side of the pair by setting the specified bridge as the master and bringing
+// up the interface.
+//
+// Then will with set the other side of the veth pair into the container's namespaced
+// using the pid and returns the veth's interface name to provide to the container to
+// finish setting up the interface inside the namespace
+func initializeContainerVeth(bridge string, nspid int) (string, error) {
 	name1, name2, err := createVethPair()
 	if err != nil {
 		return "", err
@@ -98,6 +105,8 @@ func setupWindow(master *os.File) (*term.State, error) {
 	return term.SetRawTerminal(os.Stdin.Fd())
 }
 
+// createMasterAndConsole will open /dev/ptmx on the host and retreive the
+// pts name for use as the pty slave inside the container
 func createMasterAndConsole() (*os.File, string, error) {
 	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
 	if err != nil {
@@ -113,6 +122,8 @@ func createMasterAndConsole() (*os.File, string, error) {
 	return master, console, nil
 }
 
+// createVethPair will automatically generage two random names for
+// the veth pair and ensure that they have been created
 func createVethPair() (name1 string, name2 string, err error) {
 	name1, err = utils.GenerateRandomName("dock", 4)
 	if err != nil {
@@ -128,6 +139,7 @@ func createVethPair() (name1 string, name2 string, err error) {
 	return
 }
 
+// writePidFile writes the namespaced processes pid to .nspid in the rootfs for the container
 func writePidFile(command *exec.Cmd) error {
 	return ioutil.WriteFile(".nspid", []byte(fmt.Sprint(command.Process.Pid)), 0655)
 }
@@ -136,6 +148,9 @@ func deletePidFile() error {
 	return os.Remove(".nspid")
 }
 
+// createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
+// defined on the container's configuration and use the current binary as the init with the
+// args provided
 func createCommand(container *libcontainer.Container, console string, args []string) *exec.Cmd {
 	command := exec.Command("nsinit", append([]string{"init", console}, args...)...)
 	command.SysProcAttr = &syscall.SysProcAttr{
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index 7f32620cb8..d6224f95e6 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -28,6 +28,7 @@ func execinCommand(container *libcontainer.Container, nspid int, args []string)
 		return -1, err
 	}
 
+	// foreach namespace fd, use setns to join an existing container's namespaces
 	for _, fd := range fds {
 		if fd > 0 {
 			if err := system.Setns(fd, 0); err != nil {
@@ -42,7 +43,6 @@ func execinCommand(container *libcontainer.Container, nspid int, args []string)
 	// remount proc and sys to pick up the changes
 	if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
 		container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
-
 		pid, err := system.Fork()
 		if err != nil {
 			return -1, err
@@ -58,12 +58,7 @@ func execinCommand(container *libcontainer.Container, nspid int, args []string)
 			if err := remountSys(); err != nil {
 				return -1, fmt.Errorf("remount sys %s", err)
 			}
-			if err := capabilities.DropCapabilities(container); err != nil {
-				return -1, fmt.Errorf("drop capabilities %s", err)
-			}
-			if err := system.Exec(args[0], args[0:], container.Env); err != nil {
-				return -1, err
-			}
+			goto dropAndExec
 		}
 		proc, err := os.FindProcess(pid)
 		if err != nil {
@@ -75,6 +70,7 @@ func execinCommand(container *libcontainer.Container, nspid int, args []string)
 		}
 		os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus())
 	}
+dropAndExec:
 	if err := capabilities.DropCapabilities(container); err != nil {
 		return -1, fmt.Errorf("drop capabilities %s", err)
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 82706fdadd..c77fd90447 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -37,9 +37,6 @@ func initCommand(container *libcontainer.Container, console string, args []strin
 	if err != nil {
 		return fmt.Errorf("open terminal %s", err)
 	}
-	if slave.Fd() != 0 {
-		return fmt.Errorf("slave fd should be 0")
-	}
 	if err := dupSlave(slave); err != nil {
 		return fmt.Errorf("dup2 slave %s", err)
 	}
@@ -55,7 +52,7 @@ func initCommand(container *libcontainer.Container, console string, args []strin
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
-	if err := setupNetworking(container.Network, tempVethName); err != nil {
+	if err := setupVethNetwork(container.Network, tempVethName); err != nil {
 		return fmt.Errorf("setup networking %s", err)
 	}
 	if err := system.Sethostname(container.Hostname); err != nil {
@@ -78,6 +75,8 @@ func initCommand(container *libcontainer.Container, console string, args []strin
 	panic("unreachable")
 }
 
+// resolveRootfs ensures that the current working directory is
+// not a symlink and returns the absolute path to the rootfs
 func resolveRootfs() (string, error) {
 	cwd, err := os.Getwd()
 	if err != nil {
@@ -104,8 +103,9 @@ func setupUser(container *libcontainer.Container) error {
 	return nil
 }
 
+// dupSlave dup2 the pty slave's fd into stdout and stdin and ensures that
+// the slave's fd is 0, or stdin
 func dupSlave(slave *os.File) error {
-	// we close Stdin,etc so our pty slave should have fd 0
 	if slave.Fd() != 0 {
 		return fmt.Errorf("slave fd not 0 %d", slave.Fd())
 	}
@@ -118,7 +118,8 @@ func dupSlave(slave *os.File) error {
 	return nil
 }
 
-// openTerminal is a clone of os.OpenFile without the O_CLOEXEC addition.
+// openTerminal is a clone of os.OpenFile without the O_CLOEXEC
+// used to open the pty slave inside the container namespace
 func openTerminal(name string, flag int) (*os.File, error) {
 	r, e := syscall.Open(name, flag, 0)
 	if e != nil {
@@ -127,7 +128,10 @@ func openTerminal(name string, flag int) (*os.File, error) {
 	return os.NewFile(uintptr(r), name), nil
 }
 
-func setupNetworking(config *libcontainer.Network, tempVethName string) error {
+// setupVethNetwork uses the Network config if it is not nil to initialize
+// the new veth interface inside the container for use by changing the name to eth0
+// setting the MTU and IP address along with the default gateway
+func setupVethNetwork(config *libcontainer.Network, tempVethName string) error {
 	if config != nil {
 		if err := network.InterfaceDown(tempVethName); err != nil {
 			return fmt.Errorf("interface down %s %s", tempVethName, err)
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/main.go
index 30c8b064e4..f45fe55689 100644
--- a/components/engine/pkg/libcontainer/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/main.go
@@ -26,7 +26,7 @@ func main() {
 		log.Fatal(ErrWrongArguments)
 	}
 	switch os.Args[1] {
-	case "exec":
+	case "exec": // this is executed outside of the namespace in the cwd
 		var exitCode int
 		nspid, err := readPid()
 		if err != nil {
@@ -43,7 +43,7 @@ func main() {
 			log.Fatal(err)
 		}
 		os.Exit(exitCode)
-	case "init":
+	case "init": // this is executed inside of the namespace to setup the container
 		if argc < 3 {
 			log.Fatal(ErrWrongArguments)
 		}
diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index baa850f0fb..6eb2e09060 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -10,10 +10,16 @@ import (
 	"syscall"
 )
 
-// default mount point options
+// default mount point flags
 const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
 
+// setupNewMountNamespace is used to initialize a new mount namespace for an new
+// container in the rootfs that is specified.
+//
+// There is no need to unmount the new mounts because as soon as the mount namespace
+// is no longer in use, the mounts will be removed automatically
 func setupNewMountNamespace(rootfs, console string, readonly bool) error {
+	// mount as slave so that the new mounts do not propagate to the host
 	if err := system.Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
@@ -55,6 +61,7 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	return nil
 }
 
+// copyDevNodes mknods the hosts devices so the new container has access to them
 func copyDevNodes(rootfs string) error {
 	oldMask := system.Umask(0000)
 	defer system.Umask(oldMask)
@@ -82,6 +89,8 @@ func copyDevNodes(rootfs string) error {
 	return nil
 }
 
+// setupDev symlinks the current processes pipes into the
+// appropriate destination on the containers rootfs
 func setupDev(rootfs string) error {
 	for _, link := range []struct {
 		from string
@@ -104,6 +113,7 @@ func setupDev(rootfs string) error {
 	return nil
 }
 
+// setupConsole ensures that the container has a proper /dev/console setup
 func setupConsole(rootfs, console string) error {
 	oldMask := system.Umask(0000)
 	defer system.Umask(oldMask)
@@ -161,6 +171,24 @@ func mountSystem(rootfs string) error {
 	return nil
 }
 
+// setupPtmx adds a symlink to pts/ptmx for /dev/ptmx and
+// finishes setting up /dev/console
+func setupPtmx(rootfs, console string) error {
+	ptmx := filepath.Join(rootfs, "dev/ptmx")
+	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
+		return fmt.Errorf("symlink dev ptmx %s", err)
+	}
+	if err := setupConsole(rootfs, console); err != nil {
+		return err
+	}
+	return nil
+}
+
+// remountProc is used to detach and remount the proc filesystem
+// commonly needed with running a new process inside an existing container
 func remountProc() error {
 	if err := system.Unmount("/proc", syscall.MNT_DETACH); err != nil {
 		return err
@@ -183,14 +211,3 @@ func remountSys() error {
 	}
 	return nil
 }
-
-func setupPtmx(rootfs, console string) error {
-	ptmx := filepath.Join(rootfs, "dev/ptmx")
-	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
-		return fmt.Errorf("symlink dev ptmx %s", err)
-	}
-	return setupConsole(rootfs, console)
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/ns_linux.go b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
index a2809eb199..481bdf79df 100644
--- a/components/engine/pkg/libcontainer/nsinit/ns_linux.go
+++ b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
@@ -14,6 +14,9 @@ var namespaceMap = map[libcontainer.Namespace]int{
 	libcontainer.CLONE_NEWNET:  syscall.CLONE_NEWNET,
 }
 
+// namespaceFileMap is used to convert the libcontainer types
+// into the names of the files located in /proc/<pid>/ns/* for
+// each namespace
 var namespaceFileMap = map[libcontainer.Namespace]string{
 	libcontainer.CLONE_NEWNS:   "mnt",
 	libcontainer.CLONE_NEWUTS:  "uts",
diff --git a/components/engine/pkg/libcontainer/types.go b/components/engine/pkg/libcontainer/types.go
index fcd00fd4f1..bb54ff5130 100644
--- a/components/engine/pkg/libcontainer/types.go
+++ b/components/engine/pkg/libcontainer/types.go
@@ -1,5 +1,8 @@
 package libcontainer
 
+// These constants are defined as string types so that
+// it is clear when adding the configuration in config files
+// instead of using ints or other types
 const (
 	CAP_SETPCAP        Capability = "SETPCAP"
 	CAP_SYS_MODULE     Capability = "SYS_MODULE"
@@ -25,9 +28,15 @@ const (
 	CLONE_NEWNET  Namespace = "NEWNET"  // network
 )
 
-type Namespace string
-type Namespaces []Namespace
+type (
+	Namespace    string
+	Namespaces   []Namespace
+	Capability   string
+	Capabilities []Capability
+)
 
+// Contains returns true if the specified Namespace is
+// in the slice
 func (n Namespaces) Contains(ns Namespace) bool {
 	for _, nns := range n {
 		if nns == ns {
@@ -37,9 +46,8 @@ func (n Namespaces) Contains(ns Namespace) bool {
 	return false
 }
 
-type Capability string
-type Capabilities []Capability
-
+// Contains returns true if the specified Capability is
+// in the slice
 func (c Capabilities) Contains(capp Capability) bool {
 	for _, cc := range c {
 		if cc == capp {
diff --git a/components/engine/pkg/libcontainer/utils/utils.go b/components/engine/pkg/libcontainer/utils/utils.go
index d3223c3e4d..5050997ffd 100644
--- a/components/engine/pkg/libcontainer/utils/utils.go
+++ b/components/engine/pkg/libcontainer/utils/utils.go
@@ -6,6 +6,8 @@ import (
 	"io"
 )
 
+// GenerateRandomName returns a new name joined with a prefix.  This size
+// specified is used to truncate the randomly generated value
 func GenerateRandomName(prefix string, size int) (string, error) {
 	id := make([]byte, 32)
 	if _, err := io.ReadFull(rand.Reader, id); err != nil {

From 99ce69e4d500bd1c46fcabf5f7be1b5c1e5e60c8 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 22:46:02 -0800
Subject: [PATCH 200/403] Remove privileged.json config
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 e133d895a6934e650f64f391f9f26b29b0379457 Component: engine

---
 .../engine/pkg/libcontainer/privileged.json   | 22 -------------------
 1 file changed, 22 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/privileged.json

diff --git a/components/engine/pkg/libcontainer/privileged.json b/components/engine/pkg/libcontainer/privileged.json
deleted file mode 100644
index be877ad335..0000000000
--- a/components/engine/pkg/libcontainer/privileged.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-    "id": "koye",
-    "namespace_pid": 3745,
-    "command": {
-        "args": [
-            "/usr/lib/systemd/systemd"
-        ],
-        "environment": [
-            "HOME=/",
-            "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
-            "container=docker",
-            "TERM="
-        ]
-    },
-    "rootfs": "/root/main/mycontainer",
-    "namespaces": [
-        "NEWIPC",
-        "NEWNS",
-        "NEWPID",
-        "NEWUTS"
-    ]
-}

From f93f48e322dfcf8f1eadf10a02774ce06ea7e3fc Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 20 Feb 2014 12:00:54 -0800
Subject: [PATCH 201/403] WIP for setup kmsg Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: f0b4dd6e5883a65dc23121934b6eed7e70ac2515 Component: engine

---
 .../engine/pkg/libcontainer/nsinit/mount.go   | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 6eb2e09060..67f9020350 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -43,6 +43,9 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := setupPtmx(rootfs, console); err != nil {
 		return err
 	}
+	if err := setupKmsg(rootfs); err != nil {
+		return err
+	}
 	if err := system.Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
@@ -211,3 +214,32 @@ func remountSys() error {
 	}
 	return nil
 }
+
+func setupKmsg(rootfs string) error {
+	oldMask := system.Umask(0000)
+	defer system.Umask(oldMask)
+
+	var (
+		source = filepath.Join(rootfs, "dev/kmsg")
+		dest   = filepath.Join(rootfs, "proc/kmsg")
+	)
+
+	if err := system.Mkfifo(source, 0600); err != nil {
+		return err
+	}
+
+	os.Chmod(source, 0600)
+	os.Chown(source, 0, 0)
+
+	if err := system.Mount(source, dest, "bind", syscall.MS_BIND, ""); err != nil {
+		return err
+	}
+	_, err := os.OpenFile(source, syscall.O_RDWR|syscall.O_NDELAY|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return err
+	}
+	if err := syscall.Unlink(source); err != nil {
+		return err
+	}
+	return nil
+}

From d2ac05db40608a02a37c36118fd48259b2150c84 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Thu, 20 Feb 2014 23:12:08 +0100
Subject: [PATCH 202/403] libcontainer: Initial version of cgroups support

This is a minimal version of raw cgroup support for libcontainer.
It has only enough for what docker needs, and it has no support
for systemd yet.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 664fc54e65ebc14ca9dd5bfc55e3dfe1796e51c8
Component: engine
---
 components/engine/pkg/cgroups/cgroups.go      |  16 +-
 .../engine/pkg/libcontainer/cgroup/cgroup.go  | 177 ++++++++++++++++++
 .../engine/pkg/libcontainer/container.go      |   7 +
 .../engine/pkg/libcontainer/container.json    |   5 +-
 .../engine/pkg/libcontainer/nsinit/exec.go    |  13 +-
 .../engine/pkg/libcontainer/nsinit/init.go    |  10 +-
 6 files changed, 218 insertions(+), 10 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/cgroup/cgroup.go

diff --git a/components/engine/pkg/cgroups/cgroups.go b/components/engine/pkg/cgroups/cgroups.go
index 91ac3842ac..b9318f99e7 100644
--- a/components/engine/pkg/cgroups/cgroups.go
+++ b/components/engine/pkg/cgroups/cgroups.go
@@ -40,6 +40,16 @@ func GetThisCgroupDir(subsystem string) (string, error) {
 	return parseCgroupFile(subsystem, f)
 }
 
+func GetInitCgroupDir(subsystem string) (string, error) {
+	f, err := os.Open("/proc/1/cgroup")
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	return parseCgroupFile(subsystem, f)
+}
+
 func parseCgroupFile(subsystem string, r io.Reader) (string, error) {
 	s := bufio.NewScanner(r)
 
@@ -49,8 +59,10 @@ func parseCgroupFile(subsystem string, r io.Reader) (string, error) {
 		}
 		text := s.Text()
 		parts := strings.Split(text, ":")
-		if parts[1] == subsystem {
-			return parts[2], nil
+		for _, subs := range strings.Split(parts[1], ",") {
+			if subs == subsystem {
+				return parts[2], nil
+			}
 		}
 	}
 	return "", fmt.Errorf("cgroup '%s' not found in /proc/self/cgroup", subsystem)
diff --git a/components/engine/pkg/libcontainer/cgroup/cgroup.go b/components/engine/pkg/libcontainer/cgroup/cgroup.go
new file mode 100644
index 0000000000..e30262ca50
--- /dev/null
+++ b/components/engine/pkg/libcontainer/cgroup/cgroup.go
@@ -0,0 +1,177 @@
+package cgroup
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/cgroups"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strconv"
+)
+
+// We have two implementation of cgroups support, one is based on
+// systemd and the dbus api, and one is based on raw cgroup fs operations
+// following the pre-single-writer model docs at:
+// http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups/
+const (
+	cgroupRoot = "/sys/fs/cgroup"
+)
+
+func useSystemd() bool {
+	return false
+}
+
+func applyCgroupSystemd(container *libcontainer.Container, pid int) error {
+	return fmt.Errorf("not supported yet")
+}
+
+func writeFile(dir, file, data string) error {
+	return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
+}
+
+func getCgroup(subsystem string, container *libcontainer.Container) (string, error) {
+	cgroup := container.CgroupName
+	if container.CgroupParent != "" {
+		cgroup = filepath.Join(container.CgroupParent, cgroup)
+	}
+
+	initPath, err := cgroups.GetInitCgroupDir(subsystem)
+	if err != nil {
+		return "", err
+	}
+
+	path := filepath.Join(cgroupRoot, subsystem, initPath, cgroup)
+
+	return path, nil
+}
+
+func joinCgroup(subsystem string, container *libcontainer.Container, pid int) (string, error) {
+	path, err := getCgroup(subsystem, container)
+	if err != nil {
+		return "", err
+	}
+
+	if err := os.MkdirAll(path, 0755); err != nil && !os.IsExist(err) {
+		return "", err
+	}
+
+	if err := writeFile(path, "tasks", strconv.Itoa(pid)); err != nil {
+		return "", err
+	}
+
+	return path, nil
+}
+
+func applyCgroupRaw(container *libcontainer.Container, pid int) (retErr error) {
+	if _, err := os.Stat(cgroupRoot); err != nil {
+		return fmt.Errorf("cgroups fs not found")
+	}
+
+	if !container.DeviceAccess {
+		dir, err := joinCgroup("devices", container, pid)
+		if err != nil {
+			return err
+		}
+		defer func() {
+			if retErr != nil {
+				os.RemoveAll(dir)
+			}
+		}()
+
+		if err := writeFile(dir, "devices.deny", "a"); err != nil {
+			return err
+		}
+
+		allow := []string{
+			// /dev/null, zero, full
+			"c 1:3 rwm",
+			"c 1:5 rwm",
+			"c 1:7 rwm",
+
+			// consoles
+			"c 5:1 rwm",
+			"c 5:0 rwm",
+			"c 4:0 rwm",
+			"c 4:1 rwm",
+
+			// /dev/urandom,/dev/random
+			"c 1:9 rwm",
+			"c 1:8 rwm",
+
+			// /dev/pts/ - pts namespaces are "coming soon"
+			"c 136:* rwm",
+			"c 5:2 rwm",
+
+			// tuntap
+			"c 10:200 rwm",
+		}
+
+		for _, val := range allow {
+			if err := writeFile(dir, "devices.allow", val); err != nil {
+				return err
+			}
+		}
+	}
+
+	if container.Memory != 0 || container.MemorySwap != 0 {
+		dir, err := joinCgroup("memory", container, pid)
+		if err != nil {
+			return err
+		}
+		defer func() {
+			if retErr != nil {
+				os.RemoveAll(dir)
+			}
+		}()
+
+		if container.Memory != 0 {
+			if err := writeFile(dir, "memory.limit_in_bytes", strconv.FormatInt(container.Memory, 10)); err != nil {
+				return err
+			}
+			if err := writeFile(dir, "memory.soft_limit_in_bytes", strconv.FormatInt(container.Memory, 10)); err != nil {
+				return err
+			}
+		}
+		if container.MemorySwap != 0 {
+			if err := writeFile(dir, "memory.memsw.limit_in_bytes", strconv.FormatInt(container.MemorySwap, 10)); err != nil {
+				return err
+			}
+		}
+	}
+
+	// We always want to join the cpu group, to allow fair cpu scheduling
+	// on a container basis
+	dir, err := joinCgroup("cpu", container, pid)
+	if err != nil {
+		return err
+	}
+	if container.CpuShares != 0 {
+		if err := writeFile(dir, "cpu.shares", strconv.FormatInt(container.CpuShares, 10)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func CleanupCgroup(container *libcontainer.Container) error {
+	path, _ := getCgroup("memory", container)
+	os.RemoveAll(path)
+	path, _ = getCgroup("devices", container)
+	os.RemoveAll(path)
+	path, _ = getCgroup("cpu", container)
+	os.RemoveAll(path)
+	return nil
+}
+
+func ApplyCgroup(container *libcontainer.Container, pid int) error {
+	if container.CgroupName == "" {
+		return nil
+	}
+
+	if useSystemd() {
+		return applyCgroupSystemd(container, pid)
+	} else {
+		return applyCgroupRaw(container, pid)
+	}
+}
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index a6a57dab77..b34ac8b351 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -11,6 +11,13 @@ type Container struct {
 	Namespaces   Namespaces   `json:"namespaces,omitempty"`   // namespaces to apply
 	Capabilities Capabilities `json:"capabilities,omitempty"` // capabilities to drop
 	Network      *Network     `json:"network,omitempty"`      // nil for host's network stack
+
+	CgroupName   string `json:"cgroup_name,omitempty"`   // name of cgroup
+	CgroupParent string `json:"cgroup_parent,omitempty"` // name of parent cgroup or slice
+	DeviceAccess bool   `json:"device_access,omitempty"` // name of parent cgroup or slice
+	Memory       int64  `json:"memory,omitempty"`        // Memory limit (in bytes)
+	MemorySwap   int64  `json:"memory_swap,omitempty"`   // Total memory usage (memory + swap); set `-1' to disable swap
+	CpuShares    int64  `json:"cpu_shares,omitempty"`    // CPU shares (relative weight vs. other containers)
 }
 
 // Network defines configuration for a container's networking stack
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index ccc9abb041..3e23600630 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -34,5 +34,8 @@
         "gateway": "172.17.42.1",
         "bridge": "docker0",
         "mtu": 1500
-    }
+    },
+    "cgroup_name": "docker-koye",
+    "cgroup_parent": "docker",
+    "memory": 524800
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 202cfcab5e..acff647c61 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -5,6 +5,7 @@ package main
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/cgroup"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 	"github.com/dotcloud/docker/pkg/system"
@@ -33,10 +34,18 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 		return -1, err
 	}
 	if err := writePidFile(command); err != nil {
+		command.Process.Kill()
 		return -1, err
 	}
 	defer deletePidFile()
 
+	// Do this before syncing with child so that no children
+	// can escape the cgroup
+	if err := cgroup.ApplyCgroup(container, command.Process.Pid); err != nil {
+		command.Process.Kill()
+		return -1, err
+	}
+
 	if container.Network != nil {
 		vethPair, err := initializeContainerVeth(container.Network.Bridge, command.Process.Pid)
 		if err != nil {
@@ -45,6 +54,9 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 		sendVethName(vethPair, inPipe)
 	}
 
+	// Sync with child
+	inPipe.Close()
+
 	go io.Copy(os.Stdout, master)
 	go io.Copy(master, os.Stdin)
 
@@ -67,7 +79,6 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 // pipe so that the child stops waiting for more data
 func sendVethName(name string, pipe io.WriteCloser) {
 	fmt.Fprint(pipe, name)
-	pipe.Close()
 }
 
 // initializeContainerVeth will create a veth pair and setup the host's
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index c77fd90447..f619276e60 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -20,12 +20,10 @@ func initCommand(container *libcontainer.Container, console string, args []strin
 		return err
 	}
 
-	var tempVethName string
-	if container.Network != nil {
-		tempVethName, err = getVethName()
-		if err != nil {
-			return err
-		}
+	// We always read this as it is a way to sync with the parent as well
+	tempVethName, err := getVethName()
+	if err != nil {
+		return err
 	}
 
 	// close pipes so that we can replace it with the pty

From 02c5334532f7ba7592547840563edec596ee3b61 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 20 Feb 2014 14:40:00 -0800
Subject: [PATCH 203/403] Revert "WIP for setup kmsg"

This reverts commit 80db9a918337c4ae80ffa9a001da13bd24e848c8.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 5f84738ef139f696e339afb8280eb74917f2167c
Component: engine
---
 .../engine/pkg/libcontainer/nsinit/mount.go   | 32 -------------------
 1 file changed, 32 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 67f9020350..6eb2e09060 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -43,9 +43,6 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := setupPtmx(rootfs, console); err != nil {
 		return err
 	}
-	if err := setupKmsg(rootfs); err != nil {
-		return err
-	}
 	if err := system.Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
@@ -214,32 +211,3 @@ func remountSys() error {
 	}
 	return nil
 }
-
-func setupKmsg(rootfs string) error {
-	oldMask := system.Umask(0000)
-	defer system.Umask(oldMask)
-
-	var (
-		source = filepath.Join(rootfs, "dev/kmsg")
-		dest   = filepath.Join(rootfs, "proc/kmsg")
-	)
-
-	if err := system.Mkfifo(source, 0600); err != nil {
-		return err
-	}
-
-	os.Chmod(source, 0600)
-	os.Chown(source, 0, 0)
-
-	if err := system.Mount(source, dest, "bind", syscall.MS_BIND, ""); err != nil {
-		return err
-	}
-	_, err := os.OpenFile(source, syscall.O_RDWR|syscall.O_NDELAY|syscall.O_CLOEXEC, 0)
-	if err != nil {
-		return err
-	}
-	if err := syscall.Unlink(source); err != nil {
-		return err
-	}
-	return nil
-}

From dc9b9ecbccf5528a05e89e345e03ed051592ea9b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 20 Feb 2014 14:40:36 -0800
Subject: [PATCH 204/403] Remove clone_vfork Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: f00f37413826e31e9eb87096b67c609fdfa457b9 Component: engine

---
 components/engine/pkg/libcontainer/nsinit/exec.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index acff647c61..f73ad3281e 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -165,7 +165,7 @@ func deletePidFile() error {
 func createCommand(container *libcontainer.Container, console string, args []string) *exec.Cmd {
 	command := exec.Command("nsinit", append([]string{"init", console}, args...)...)
 	command.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces) | syscall.CLONE_VFORK), // we need CLONE_VFORK so we can wait on the child
+		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces)),
 	}
 	return command
 }

From 680db4b285f2b12e12bc25ed48536e728dcdddff Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 20 Feb 2014 15:48:48 -0800
Subject: [PATCH 205/403] Refactory cgroups into general pkg
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 c44258630575f70231b11fb55bc4edc3fb677cab Component: engine

---
 components/engine/pkg/cgroups/cgroups.go      |  61 +++++++-
 .../engine/pkg/libcontainer/cgroup/cgroup.go  | 131 +++++++-----------
 .../engine/pkg/libcontainer/container.go      |  28 ++--
 .../engine/pkg/libcontainer/container.json    |   8 +-
 4 files changed, 124 insertions(+), 104 deletions(-)

diff --git a/components/engine/pkg/cgroups/cgroups.go b/components/engine/pkg/cgroups/cgroups.go
index b9318f99e7..1e96caa7e3 100644
--- a/components/engine/pkg/cgroups/cgroups.go
+++ b/components/engine/pkg/cgroups/cgroups.go
@@ -5,10 +5,23 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/mount"
 	"io"
+	"io/ioutil"
 	"os"
+	"path/filepath"
+	"strconv"
 	"strings"
 )
 
+type Cgroup struct {
+	Name   string `json:"name,omitempty"`
+	Parent string `json:"parent,omitempty"`
+
+	DeviceAccess bool  `json:"device_access,omitempty"` // name of parent cgroup or slice
+	Memory       int64 `json:"memory,omitempty"`        // Memory limit (in bytes)
+	MemorySwap   int64 `json:"memory_swap,omitempty"`   // Total memory usage (memory + swap); set `-1' to disable swap
+	CpuShares    int64 `json:"cpu_shares,omitempty"`    // CPU shares (relative weight vs. other containers)
+}
+
 // https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt
 func FindCgroupMountpoint(subsystem string) (string, error) {
 	mounts, err := mount.GetMounts()
@@ -25,7 +38,6 @@ func FindCgroupMountpoint(subsystem string) (string, error) {
 			}
 		}
 	}
-
 	return "", fmt.Errorf("cgroup mountpoint not found for %s", subsystem)
 }
 
@@ -50,9 +62,50 @@ func GetInitCgroupDir(subsystem string) (string, error) {
 	return parseCgroupFile(subsystem, f)
 }
 
+func (c *Cgroup) Path(root, subsystem string) (string, error) {
+	cgroup := c.Name
+	if c.Parent != "" {
+		cgroup = filepath.Join(c.Parent, cgroup)
+	}
+	initPath, err := GetInitCgroupDir(subsystem)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(root, subsystem, initPath, cgroup), nil
+}
+
+func (c *Cgroup) Join(root, subsystem string, pid int) (string, error) {
+	path, err := c.Path(root, subsystem)
+	if err != nil {
+		return "", err
+	}
+	if err := os.MkdirAll(path, 0755); err != nil && !os.IsExist(err) {
+		return "", err
+	}
+	if err := writeFile(path, "tasks", strconv.Itoa(pid)); err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
+func (c *Cgroup) Cleanup(root string) error {
+	get := func(subsystem string) string {
+		path, _ := c.Path(root, subsystem)
+		return path
+	}
+
+	for _, path := range []string{
+		get("memory"),
+		get("devices"),
+		get("cpu"),
+	} {
+		os.RemoveAll(path)
+	}
+	return nil
+}
+
 func parseCgroupFile(subsystem string, r io.Reader) (string, error) {
 	s := bufio.NewScanner(r)
-
 	for s.Scan() {
 		if err := s.Err(); err != nil {
 			return "", err
@@ -67,3 +120,7 @@ func parseCgroupFile(subsystem string, r io.Reader) (string, error) {
 	}
 	return "", fmt.Errorf("cgroup '%s' not found in /proc/self/cgroup", subsystem)
 }
+
+func writeFile(dir, file, data string) error {
+	return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
+}
diff --git a/components/engine/pkg/libcontainer/cgroup/cgroup.go b/components/engine/pkg/libcontainer/cgroup/cgroup.go
index e30262ca50..5f27ac3ffb 100644
--- a/components/engine/pkg/libcontainer/cgroup/cgroup.go
+++ b/components/engine/pkg/libcontainer/cgroup/cgroup.go
@@ -10,71 +10,46 @@ import (
 	"strconv"
 )
 
-// We have two implementation of cgroups support, one is based on
-// systemd and the dbus api, and one is based on raw cgroup fs operations
-// following the pre-single-writer model docs at:
-// http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups/
-const (
-	cgroupRoot = "/sys/fs/cgroup"
-)
-
-func useSystemd() bool {
-	return false
-}
-
-func applyCgroupSystemd(container *libcontainer.Container, pid int) error {
-	return fmt.Errorf("not supported yet")
-}
-
-func writeFile(dir, file, data string) error {
-	return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
-}
-
-func getCgroup(subsystem string, container *libcontainer.Container) (string, error) {
-	cgroup := container.CgroupName
-	if container.CgroupParent != "" {
-		cgroup = filepath.Join(container.CgroupParent, cgroup)
+func ApplyCgroup(container *libcontainer.Container, pid int) (err error) {
+	if container.Cgroups == nil {
+		return nil
 	}
 
-	initPath, err := cgroups.GetInitCgroupDir(subsystem)
+	// We have two implementation of cgroups support, one is based on
+	// systemd and the dbus api, and one is based on raw cgroup fs operations
+	// following the pre-single-writer model docs at:
+	// http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups/
+	//
+	// we can pick any subsystem to find the root
+	cgroupRoot, err := cgroups.FindCgroupMountpoint("memory")
 	if err != nil {
-		return "", err
+		return err
 	}
-
-	path := filepath.Join(cgroupRoot, subsystem, initPath, cgroup)
-
-	return path, nil
-}
-
-func joinCgroup(subsystem string, container *libcontainer.Container, pid int) (string, error) {
-	path, err := getCgroup(subsystem, container)
-	if err != nil {
-		return "", err
-	}
-
-	if err := os.MkdirAll(path, 0755); err != nil && !os.IsExist(err) {
-		return "", err
-	}
-
-	if err := writeFile(path, "tasks", strconv.Itoa(pid)); err != nil {
-		return "", err
-	}
-
-	return path, nil
-}
-
-func applyCgroupRaw(container *libcontainer.Container, pid int) (retErr error) {
+	cgroupRoot = filepath.Dir(cgroupRoot)
 	if _, err := os.Stat(cgroupRoot); err != nil {
 		return fmt.Errorf("cgroups fs not found")
 	}
+	if err := setupDevices(container, cgroupRoot, pid); err != nil {
+		return err
+	}
+	if err := setupMemory(container, cgroupRoot, pid); err != nil {
+		return err
+	}
+	if err := setupCpu(container, cgroupRoot, pid); err != nil {
+		return err
+	}
+	return nil
+}
 
-	if !container.DeviceAccess {
-		dir, err := joinCgroup("devices", container, pid)
+func setupDevices(container *libcontainer.Container, cgroupRoot string, pid int) (err error) {
+	if !container.Cgroups.DeviceAccess {
+		dir, err := container.Cgroups.Join(cgroupRoot, "devices", pid)
 		if err != nil {
 			return err
 		}
+
 		defer func() {
-			if retErr != nil {
+			if err != nil {
 				os.RemoveAll(dir)
 			}
 		}()
@@ -113,65 +88,53 @@ func applyCgroupRaw(container *libcontainer.Container, pid int) (retErr error) {
 			}
 		}
 	}
+	return nil
+}
 
-	if container.Memory != 0 || container.MemorySwap != 0 {
-		dir, err := joinCgroup("memory", container, pid)
+func setupMemory(container *libcontainer.Container, cgroupRoot string, pid int) (err error) {
+	if container.Cgroups.Memory != 0 || container.Cgroups.MemorySwap != 0 {
+		dir, err := container.Cgroups.Join(cgroupRoot, "memory", pid)
 		if err != nil {
 			return err
 		}
 		defer func() {
-			if retErr != nil {
+			if err != nil {
 				os.RemoveAll(dir)
 			}
 		}()
 
-		if container.Memory != 0 {
-			if err := writeFile(dir, "memory.limit_in_bytes", strconv.FormatInt(container.Memory, 10)); err != nil {
+		if container.Cgroups.Memory != 0 {
+			if err := writeFile(dir, "memory.limit_in_bytes", strconv.FormatInt(container.Cgroups.Memory, 10)); err != nil {
 				return err
 			}
-			if err := writeFile(dir, "memory.soft_limit_in_bytes", strconv.FormatInt(container.Memory, 10)); err != nil {
+			if err := writeFile(dir, "memory.soft_limit_in_bytes", strconv.FormatInt(container.Cgroups.Memory, 10)); err != nil {
 				return err
 			}
 		}
-		if container.MemorySwap != 0 {
-			if err := writeFile(dir, "memory.memsw.limit_in_bytes", strconv.FormatInt(container.MemorySwap, 10)); err != nil {
+		if container.Cgroups.MemorySwap != 0 {
+			if err := writeFile(dir, "memory.memsw.limit_in_bytes", strconv.FormatInt(container.Cgroups.MemorySwap, 10)); err != nil {
 				return err
 			}
 		}
 	}
+	return nil
+}
 
+func setupCpu(container *libcontainer.Container, cgroupRoot string, pid int) (err error) {
 	// We always want to join the cpu group, to allow fair cpu scheduling
 	// on a container basis
-	dir, err := joinCgroup("cpu", container, pid)
+	dir, err := container.Cgroups.Join(cgroupRoot, "cpu", pid)
 	if err != nil {
 		return err
 	}
-	if container.CpuShares != 0 {
-		if err := writeFile(dir, "cpu.shares", strconv.FormatInt(container.CpuShares, 10)); err != nil {
+	if container.Cgroups.CpuShares != 0 {
+		if err := writeFile(dir, "cpu.shares", strconv.FormatInt(container.Cgroups.CpuShares, 10)); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func CleanupCgroup(container *libcontainer.Container) error {
-	path, _ := getCgroup("memory", container)
-	os.RemoveAll(path)
-	path, _ = getCgroup("devices", container)
-	os.RemoveAll(path)
-	path, _ = getCgroup("cpu", container)
-	os.RemoveAll(path)
-	return nil
-}
-
-func ApplyCgroup(container *libcontainer.Container, pid int) error {
-	if container.CgroupName == "" {
-		return nil
-	}
-
-	if useSystemd() {
-		return applyCgroupSystemd(container, pid)
-	} else {
-		return applyCgroupRaw(container, pid)
-	}
+func writeFile(dir, file, data string) error {
+	return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
 }
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index b34ac8b351..4c0e39a798 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -1,23 +1,21 @@
 package libcontainer
 
+import (
+	"github.com/dotcloud/docker/pkg/cgroups"
+)
+
 // Container defines configuration options for how a
 // container is setup inside a directory and how a process should be executed
 type Container struct {
-	Hostname     string       `json:"hostname,omitempty"`     // hostname
-	ReadonlyFs   bool         `json:"readonly_fs,omitempty"`  // set the containers rootfs as readonly
-	User         string       `json:"user,omitempty"`         // user to execute the process as
-	WorkingDir   string       `json:"working_dir,omitempty"`  // current working directory
-	Env          []string     `json:"environment,omitempty"`  // environment to set
-	Namespaces   Namespaces   `json:"namespaces,omitempty"`   // namespaces to apply
-	Capabilities Capabilities `json:"capabilities,omitempty"` // capabilities to drop
-	Network      *Network     `json:"network,omitempty"`      // nil for host's network stack
-
-	CgroupName   string `json:"cgroup_name,omitempty"`   // name of cgroup
-	CgroupParent string `json:"cgroup_parent,omitempty"` // name of parent cgroup or slice
-	DeviceAccess bool   `json:"device_access,omitempty"` // name of parent cgroup or slice
-	Memory       int64  `json:"memory,omitempty"`        // Memory limit (in bytes)
-	MemorySwap   int64  `json:"memory_swap,omitempty"`   // Total memory usage (memory + swap); set `-1' to disable swap
-	CpuShares    int64  `json:"cpu_shares,omitempty"`    // CPU shares (relative weight vs. other containers)
+	Hostname     string          `json:"hostname,omitempty"`     // hostname
+	ReadonlyFs   bool            `json:"readonly_fs,omitempty"`  // set the containers rootfs as readonly
+	User         string          `json:"user,omitempty"`         // user to execute the process as
+	WorkingDir   string          `json:"working_dir,omitempty"`  // current working directory
+	Env          []string        `json:"environment,omitempty"`  // environment to set
+	Namespaces   Namespaces      `json:"namespaces,omitempty"`   // namespaces to apply
+	Capabilities Capabilities    `json:"capabilities,omitempty"` // capabilities to drop
+	Network      *Network        `json:"network,omitempty"`      // nil for host's network stack
+	Cgroups      *cgroups.Cgroup `json:"cgroups,omitempty"`
 }
 
 // Network defines configuration for a container's networking stack
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index 3e23600630..2207543bd0 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -35,7 +35,9 @@
         "bridge": "docker0",
         "mtu": 1500
     },
-    "cgroup_name": "docker-koye",
-    "cgroup_parent": "docker",
-    "memory": 524800
+    "cgroups": {
+        "name": "docker-koye",
+        "parent": "docker",
+        "memory": 524800
+    }
 }

From 9aba82e1b27effba65c72df740a584b9fda6b00a Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 20 Feb 2014 15:50:55 -0800
Subject: [PATCH 206/403] Change IP to address because it includes the subnet
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 3cb698125da7b55a7d7ec43b33858f35844a6143 Component: engine

---
 components/engine/pkg/libcontainer/README.md      | 7 ++++++-
 components/engine/pkg/libcontainer/container.go   | 2 +-
 components/engine/pkg/libcontainer/container.json | 2 +-
 components/engine/pkg/libcontainer/nsinit/init.go | 2 +-
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index 07fe4f7b2d..163161c178 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -47,10 +47,15 @@ Sample `container.json` file:
         "MAC_ADMIN"
     ],
     "network": {
-        "ip": "172.17.0.100/16",
+        "address": "172.17.0.100/16",
         "gateway": "172.17.42.1",
         "bridge": "docker0",
         "mtu": 1500
+    },
+    "cgroups": {
+        "name": "docker-koye",
+        "parent": "docker",
+        "memory": 524800
     }
 }
 ```
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index 4c0e39a798..e6e4b4747e 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -23,7 +23,7 @@ type Container struct {
 // The network configuration can be omited from a container causing the
 // container to be setup with the host's networking stack
 type Network struct {
-	IP      string `json:"ip,omitempty"`
+	Address string `json:"address,omitempty"`
 	Gateway string `json:"gateway,omitempty"`
 	Bridge  string `json:"bridge,omitempty"`
 	Mtu     int    `json:"mtu,omitempty"`
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index 2207543bd0..c1a07dc55b 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -30,7 +30,7 @@
         "MAC_ADMIN"
     ],
     "network": {
-        "ip": "172.17.0.100/16",
+        "address": "172.17.0.100/16",
         "gateway": "172.17.42.1",
         "bridge": "docker0",
         "mtu": 1500
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index f619276e60..f89e53982c 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -137,7 +137,7 @@ func setupVethNetwork(config *libcontainer.Network, tempVethName string) error {
 		if err := network.ChangeInterfaceName(tempVethName, "eth0"); err != nil {
 			return fmt.Errorf("change %s to eth0 %s", tempVethName, err)
 		}
-		if err := network.SetInterfaceIp("eth0", config.IP); err != nil {
+		if err := network.SetInterfaceIp("eth0", config.Address); err != nil {
 			return fmt.Errorf("set eth0 ip %s", err)
 		}
 		if err := network.SetMtu("eth0", config.Mtu); err != nil {

From 3b343c063f3b536473776b856a4eb060ef512798 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 20 Feb 2014 16:11:22 -0800
Subject: [PATCH 207/403] Move rest of cgroups functions into cgroups pkg
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 7020e208c70dfca5ebc97d699553e4bf1c6ab0bb Component: engine

---
 components/engine/pkg/cgroups/cgroups.go      | 122 +++++++++++++++
 .../engine/pkg/libcontainer/cgroup/cgroup.go  | 140 ------------------
 .../engine/pkg/libcontainer/nsinit/exec.go    |   9 +-
 3 files changed, 127 insertions(+), 144 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/cgroup/cgroup.go

diff --git a/components/engine/pkg/cgroups/cgroups.go b/components/engine/pkg/cgroups/cgroups.go
index 1e96caa7e3..96002f0af9 100644
--- a/components/engine/pkg/cgroups/cgroups.go
+++ b/components/engine/pkg/cgroups/cgroups.go
@@ -124,3 +124,125 @@ func parseCgroupFile(subsystem string, r io.Reader) (string, error) {
 func writeFile(dir, file, data string) error {
 	return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
 }
+
+func (c *Cgroup) Apply(pid int) error {
+	// We have two implementation of cgroups support, one is based on
+	// systemd and the dbus api, and one is based on raw cgroup fs operations
+	// following the pre-single-writer model docs at:
+	// http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups/
+	//
+	// we can pick any subsystem to find the root
+	cgroupRoot, err := FindCgroupMountpoint("memory")
+	if err != nil {
+		return err
+	}
+	cgroupRoot = filepath.Dir(cgroupRoot)
+
+	if _, err := os.Stat(cgroupRoot); err != nil {
+		return fmt.Errorf("cgroups fs not found")
+	}
+	if err := c.setupDevices(cgroupRoot, pid); err != nil {
+		return err
+	}
+	if err := c.setupMemory(cgroupRoot, pid); err != nil {
+		return err
+	}
+	if err := c.setupCpu(cgroupRoot, pid); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (c *Cgroup) setupDevices(cgroupRoot string, pid int) (err error) {
+	if !c.DeviceAccess {
+		dir, err := c.Join(cgroupRoot, "devices", pid)
+		if err != nil {
+			return err
+		}
+
+		defer func() {
+			if err != nil {
+				os.RemoveAll(dir)
+			}
+		}()
+
+		if err := writeFile(dir, "devices.deny", "a"); err != nil {
+			return err
+		}
+
+		allow := []string{
+			// /dev/null, zero, full
+			"c 1:3 rwm",
+			"c 1:5 rwm",
+			"c 1:7 rwm",
+
+			// consoles
+			"c 5:1 rwm",
+			"c 5:0 rwm",
+			"c 4:0 rwm",
+			"c 4:1 rwm",
+
+			// /dev/urandom,/dev/random
+			"c 1:9 rwm",
+			"c 1:8 rwm",
+
+			// /dev/pts/ - pts namespaces are "coming soon"
+			"c 136:* rwm",
+			"c 5:2 rwm",
+
+			// tuntap
+			"c 10:200 rwm",
+		}
+
+		for _, val := range allow {
+			if err := writeFile(dir, "devices.allow", val); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (c *Cgroup) setupMemory(cgroupRoot string, pid int) (err error) {
+	if c.Memory != 0 || c.MemorySwap != 0 {
+		dir, err := c.Join(cgroupRoot, "memory", pid)
+		if err != nil {
+			return err
+		}
+		defer func() {
+			if err != nil {
+				os.RemoveAll(dir)
+			}
+		}()
+
+		if c.Memory != 0 {
+			if err := writeFile(dir, "memory.limit_in_bytes", strconv.FormatInt(c.Memory, 10)); err != nil {
+				return err
+			}
+			if err := writeFile(dir, "memory.soft_limit_in_bytes", strconv.FormatInt(c.Memory, 10)); err != nil {
+				return err
+			}
+		}
+		if c.MemorySwap != 0 {
+			if err := writeFile(dir, "memory.memsw.limit_in_bytes", strconv.FormatInt(c.MemorySwap, 10)); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (c *Cgroup) setupCpu(cgroupRoot string, pid int) (err error) {
+	// We always want to join the cpu group, to allow fair cpu scheduling
+	// on a container basis
+	dir, err := c.Join(cgroupRoot, "cpu", pid)
+	if err != nil {
+		return err
+	}
+	if c.CpuShares != 0 {
+		if err := writeFile(dir, "cpu.shares", strconv.FormatInt(c.CpuShares, 10)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/components/engine/pkg/libcontainer/cgroup/cgroup.go b/components/engine/pkg/libcontainer/cgroup/cgroup.go
deleted file mode 100644
index 5f27ac3ffb..0000000000
--- a/components/engine/pkg/libcontainer/cgroup/cgroup.go
+++ /dev/null
@@ -1,140 +0,0 @@
-package cgroup
-
-import (
-	"fmt"
-	"github.com/dotcloud/docker/pkg/cgroups"
-	"github.com/dotcloud/docker/pkg/libcontainer"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strconv"
-)
-
-func ApplyCgroup(container *libcontainer.Container, pid int) (err error) {
-	if container.Cgroups == nil {
-		return nil
-	}
-
-	// We have two implementation of cgroups support, one is based on
-	// systemd and the dbus api, and one is based on raw cgroup fs operations
-	// following the pre-single-writer model docs at:
-	// http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups/
-	//
-	// we can pick any subsystem to find the root
-	cgroupRoot, err := cgroups.FindCgroupMountpoint("memory")
-	if err != nil {
-		return err
-	}
-	cgroupRoot = filepath.Dir(cgroupRoot)
-	if _, err := os.Stat(cgroupRoot); err != nil {
-		return fmt.Errorf("cgroups fs not found")
-	}
-	if err := setupDevices(container, cgroupRoot, pid); err != nil {
-		return err
-	}
-	if err := setupMemory(container, cgroupRoot, pid); err != nil {
-		return err
-	}
-	if err := setupCpu(container, cgroupRoot, pid); err != nil {
-		return err
-	}
-	return nil
-}
-
-func setupDevices(container *libcontainer.Container, cgroupRoot string, pid int) (err error) {
-	if !container.Cgroups.DeviceAccess {
-		dir, err := container.Cgroups.Join(cgroupRoot, "devices", pid)
-		if err != nil {
-			return err
-		}
-
-		defer func() {
-			if err != nil {
-				os.RemoveAll(dir)
-			}
-		}()
-
-		if err := writeFile(dir, "devices.deny", "a"); err != nil {
-			return err
-		}
-
-		allow := []string{
-			// /dev/null, zero, full
-			"c 1:3 rwm",
-			"c 1:5 rwm",
-			"c 1:7 rwm",
-
-			// consoles
-			"c 5:1 rwm",
-			"c 5:0 rwm",
-			"c 4:0 rwm",
-			"c 4:1 rwm",
-
-			// /dev/urandom,/dev/random
-			"c 1:9 rwm",
-			"c 1:8 rwm",
-
-			// /dev/pts/ - pts namespaces are "coming soon"
-			"c 136:* rwm",
-			"c 5:2 rwm",
-
-			// tuntap
-			"c 10:200 rwm",
-		}
-
-		for _, val := range allow {
-			if err := writeFile(dir, "devices.allow", val); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func setupMemory(container *libcontainer.Container, cgroupRoot string, pid int) (err error) {
-	if container.Cgroups.Memory != 0 || container.Cgroups.MemorySwap != 0 {
-		dir, err := container.Cgroups.Join(cgroupRoot, "memory", pid)
-		if err != nil {
-			return err
-		}
-		defer func() {
-			if err != nil {
-				os.RemoveAll(dir)
-			}
-		}()
-
-		if container.Cgroups.Memory != 0 {
-			if err := writeFile(dir, "memory.limit_in_bytes", strconv.FormatInt(container.Cgroups.Memory, 10)); err != nil {
-				return err
-			}
-			if err := writeFile(dir, "memory.soft_limit_in_bytes", strconv.FormatInt(container.Cgroups.Memory, 10)); err != nil {
-				return err
-			}
-		}
-		if container.Cgroups.MemorySwap != 0 {
-			if err := writeFile(dir, "memory.memsw.limit_in_bytes", strconv.FormatInt(container.Cgroups.MemorySwap, 10)); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func setupCpu(container *libcontainer.Container, cgroupRoot string, pid int) (err error) {
-	// We always want to join the cpu group, to allow fair cpu scheduling
-	// on a container basis
-	dir, err := container.Cgroups.Join(cgroupRoot, "cpu", pid)
-	if err != nil {
-		return err
-	}
-	if container.Cgroups.CpuShares != 0 {
-		if err := writeFile(dir, "cpu.shares", strconv.FormatInt(container.Cgroups.CpuShares, 10)); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func writeFile(dir, file, data string) error {
-	return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index f73ad3281e..f04e9bee20 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -5,7 +5,6 @@ package main
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"github.com/dotcloud/docker/pkg/libcontainer/cgroup"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 	"github.com/dotcloud/docker/pkg/system"
@@ -41,9 +40,11 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 
 	// Do this before syncing with child so that no children
 	// can escape the cgroup
-	if err := cgroup.ApplyCgroup(container, command.Process.Pid); err != nil {
-		command.Process.Kill()
-		return -1, err
+	if container.Cgroups != nil {
+		if err := container.Cgroups.Apply(command.Process.Pid); err != nil {
+			command.Process.Kill()
+			return -1, err
+		}
 	}
 
 	if container.Network != nil {

From ee2c282f60bef018aa86492d6fc522097e3ca1b1 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 20 Feb 2014 17:53:50 -0800
Subject: [PATCH 208/403] Use flag for init

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: b519d3ea5a50ad7c15d576a89ec9846c4fc123fa
Component: engine
---
 .../engine/pkg/libcontainer/nsinit/exec.go    |  2 +-
 .../engine/pkg/libcontainer/nsinit/main.go    | 19 +++++++++++--------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index f04e9bee20..6d87f3b66d 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -164,7 +164,7 @@ func deletePidFile() error {
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
 func createCommand(container *libcontainer.Container, console string, args []string) *exec.Cmd {
-	command := exec.Command("nsinit", append([]string{"init", console}, args...)...)
+	command := exec.Command("nsinit", append([]string{"-console", console, "init"}, args...)...)
 	command.SysProcAttr = &syscall.SysProcAttr{
 		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces)),
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/main.go
index f45fe55689..e7240df041 100644
--- a/components/engine/pkg/libcontainer/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"errors"
+	"flag"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"io/ioutil"
 	"log"
@@ -16,16 +17,18 @@ var (
 )
 
 func main() {
+	console := flag.String("console", "", "Console (pty slave) name")
+	flag.Parse()
+
 	container, err := loadContainer()
 	if err != nil {
 		log.Fatal(err)
 	}
 
-	argc := len(os.Args)
-	if argc < 2 {
+	if flag.NArg() < 1 {
 		log.Fatal(ErrWrongArguments)
 	}
-	switch os.Args[1] {
+	switch flag.Arg(0) {
 	case "exec": // this is executed outside of the namespace in the cwd
 		var exitCode int
 		nspid, err := readPid()
@@ -35,23 +38,23 @@ func main() {
 			}
 		}
 		if nspid > 0 {
-			exitCode, err = execinCommand(container, nspid, os.Args[2:])
+			exitCode, err = execinCommand(container, nspid, flag.Args()[1:])
 		} else {
-			exitCode, err = execCommand(container, os.Args[2:])
+			exitCode, err = execCommand(container, flag.Args()[1:])
 		}
 		if err != nil {
 			log.Fatal(err)
 		}
 		os.Exit(exitCode)
 	case "init": // this is executed inside of the namespace to setup the container
-		if argc < 3 {
+		if flag.NArg() < 2 {
 			log.Fatal(ErrWrongArguments)
 		}
-		if err := initCommand(container, os.Args[2], os.Args[3:]); err != nil {
+		if err := initCommand(container, *console, flag.Args()[1:]); err != nil {
 			log.Fatal(err)
 		}
 	default:
-		log.Fatalf("command not supported for nsinit %s", os.Args[1])
+		log.Fatalf("command not supported for nsinit %s", flag.Arg(0))
 	}
 }
 

From 60d018051a703d45abe5f70576e5fbb35ec2363c Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 20 Feb 2014 17:58:13 -0800
Subject: [PATCH 209/403] Use a custom pipe instead of stdin for sync net
 namespace

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 8dec4adcb3fd905eb05f07678fa7f5bb47d8242f
Component: engine
---
 .../engine/pkg/libcontainer/nsinit/exec.go       | 16 ++++++++++------
 .../engine/pkg/libcontainer/nsinit/init.go       | 11 +++++++----
 .../engine/pkg/libcontainer/nsinit/main.go       |  3 ++-
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 6d87f3b66d..8007ed4691 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -22,16 +22,20 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 		return -1, err
 	}
 
-	command := createCommand(container, console, args)
 	// create a pipe so that we can syncronize with the namespaced process and
 	// pass the veth name to the child
-	inPipe, err := command.StdinPipe()
+	r, w, err := os.Pipe()
 	if err != nil {
 		return -1, err
 	}
+	system.UsetCloseOnExec(r.Fd())
+
+	command := createCommand(container, console, r.Fd(), args)
+
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
+
 	if err := writePidFile(command); err != nil {
 		command.Process.Kill()
 		return -1, err
@@ -52,11 +56,11 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 		if err != nil {
 			return -1, err
 		}
-		sendVethName(vethPair, inPipe)
+		sendVethName(vethPair, w)
 	}
 
 	// Sync with child
-	inPipe.Close()
+	w.Close()
 
 	go io.Copy(os.Stdout, master)
 	go io.Copy(master, os.Stdin)
@@ -163,8 +167,8 @@ func deletePidFile() error {
 // createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
-func createCommand(container *libcontainer.Container, console string, args []string) *exec.Cmd {
-	command := exec.Command("nsinit", append([]string{"-console", console, "init"}, args...)...)
+func createCommand(container *libcontainer.Container, console string, pipe uintptr, args []string) *exec.Cmd {
+	command := exec.Command("nsinit", append([]string{"-console", console, "-pipe", fmt.Sprint(pipe), "init"}, args...)...)
 	command.SysProcAttr = &syscall.SysProcAttr{
 		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces)),
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index f89e53982c..a0815eef1b 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -8,20 +8,21 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
+	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"syscall"
 )
 
-func initCommand(container *libcontainer.Container, console string, args []string) error {
+func initCommand(container *libcontainer.Container, console string, pipe io.ReadCloser, args []string) error {
 	rootfs, err := resolveRootfs()
 	if err != nil {
 		return err
 	}
 
 	// We always read this as it is a way to sync with the parent as well
-	tempVethName, err := getVethName()
+	tempVethName, err := getVethName(pipe)
 	if err != nil {
 		return err
 	}
@@ -164,8 +165,10 @@ func setupVethNetwork(config *libcontainer.Network, tempVethName string) error {
 // getVethName reads from Stdin the temp veth name
 // sent by the parent processes after the veth pair
 // has been created and setup
-func getVethName() (string, error) {
-	data, err := ioutil.ReadAll(os.Stdin)
+func getVethName(pipe io.ReadCloser) (string, error) {
+	defer pipe.Close()
+
+	data, err := ioutil.ReadAll(pipe)
 	if err != nil {
 		return "", fmt.Errorf("error reading from stdin %s", err)
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/main.go
index e7240df041..6f2825b25b 100644
--- a/components/engine/pkg/libcontainer/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/main.go
@@ -18,6 +18,7 @@ var (
 
 func main() {
 	console := flag.String("console", "", "Console (pty slave) name")
+	pipeFd := flag.Int("pipe", 0, "sync pipe fd")
 	flag.Parse()
 
 	container, err := loadContainer()
@@ -50,7 +51,7 @@ func main() {
 		if flag.NArg() < 2 {
 			log.Fatal(ErrWrongArguments)
 		}
-		if err := initCommand(container, *console, flag.Args()[1:]); err != nil {
+		if err := initCommand(container, *console, os.NewFile(uintptr(*pipeFd), "pipe"), flag.Args()[1:]); err != nil {
 			log.Fatal(err)
 		}
 	default:

From 961a3fcf1357f28af6c179f3c30f877f0b3c500a Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 20 Feb 2014 17:59:08 -0800
Subject: [PATCH 210/403] Minor cleanup

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 83dfdd1d9587a7335bbf3a4656572baefae4f28d
Component: engine
---
 components/engine/pkg/libcontainer/nsinit/exec.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 8007ed4691..7f552c2961 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -56,11 +56,12 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 		if err != nil {
 			return -1, err
 		}
-		sendVethName(vethPair, w)
+		sendVethName(w, vethPair)
 	}
 
 	// Sync with child
 	w.Close()
+	r.Close()
 
 	go io.Copy(os.Stdout, master)
 	go io.Copy(master, os.Stdin)
@@ -82,7 +83,7 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 
 // sendVethName writes the veth pair name to the child's stdin then closes the
 // pipe so that the child stops waiting for more data
-func sendVethName(name string, pipe io.WriteCloser) {
+func sendVethName(pipe io.Writer, name string) {
 	fmt.Fprint(pipe, name)
 }
 

From 24e3f599c0019f72daeb90dd99ae61fafa0068cf Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 20 Feb 2014 18:05:40 -0800
Subject: [PATCH 211/403] Handle non-tty mode

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 1a4fb0921919720ab379bc82b7508580057770ee
Component: engine
---
 .../engine/pkg/libcontainer/nsinit/exec.go    | 55 +++++++++++++++----
 .../engine/pkg/libcontainer/nsinit/init.go    | 30 +++++-----
 .../engine/pkg/libcontainer/nsinit/main.go    |  9 ++-
 .../engine/pkg/libcontainer/nsinit/mount.go   |  6 +-
 4 files changed, 70 insertions(+), 30 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 7f552c2961..b290ace3ce 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -16,10 +16,21 @@ import (
 	"syscall"
 )
 
-func execCommand(container *libcontainer.Container, args []string) (int, error) {
-	master, console, err := createMasterAndConsole()
-	if err != nil {
-		return -1, err
+func execCommand(container *libcontainer.Container, tty bool, args []string) (int, error) {
+	var (
+		master  *os.File
+		console string
+		err     error
+
+		inPipe           io.WriteCloser
+		outPipe, errPipe io.ReadCloser
+	)
+
+	if tty {
+		master, console, err = createMasterAndConsole()
+		if err != nil {
+			return -1, err
+		}
 	}
 
 	// create a pipe so that we can syncronize with the namespaced process and
@@ -32,6 +43,21 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 
 	command := createCommand(container, console, r.Fd(), args)
 
+	if !tty {
+		inPipe, err = command.StdinPipe()
+		if err != nil {
+			return -1, err
+		}
+		outPipe, err = command.StdoutPipe()
+		if err != nil {
+			return -1, err
+		}
+		errPipe, err = command.StderrPipe()
+		if err != nil {
+			return -1, err
+		}
+	}
+
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
@@ -63,15 +89,20 @@ func execCommand(container *libcontainer.Container, args []string) (int, error)
 	w.Close()
 	r.Close()
 
-	go io.Copy(os.Stdout, master)
-	go io.Copy(master, os.Stdin)
-
-	state, err := setupWindow(master)
-	if err != nil {
-		command.Process.Kill()
-		return -1, err
+	if tty {
+		go io.Copy(os.Stdout, master)
+		go io.Copy(master, os.Stdin)
+		state, err := setupWindow(master)
+		if err != nil {
+			command.Process.Kill()
+			return -1, err
+		}
+		defer term.RestoreTerminal(os.Stdin.Fd(), state)
+	} else {
+		go io.Copy(inPipe, os.Stdin)
+		go io.Copy(os.Stdout, outPipe)
+		go io.Copy(os.Stderr, errPipe)
 	}
-	defer term.RestoreTerminal(os.Stdin.Fd(), state)
 
 	if err := command.Wait(); err != nil {
 		if _, ok := err.(*exec.ExitError); !ok {
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index a0815eef1b..ef7fc4e44c 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -27,23 +27,27 @@ func initCommand(container *libcontainer.Container, console string, pipe io.Read
 		return err
 	}
 
-	// close pipes so that we can replace it with the pty
-	os.Stdin.Close()
-	os.Stdout.Close()
-	os.Stderr.Close()
+	if console != "" {
+		// close pipes so that we can replace it with the pty
+		os.Stdin.Close()
+		os.Stdout.Close()
+		os.Stderr.Close()
+		slave, err := openTerminal(console, syscall.O_RDWR)
+		if err != nil {
+			return fmt.Errorf("open terminal %s", err)
+		}
+		if err := dupSlave(slave); err != nil {
+			return fmt.Errorf("dup2 slave %s", err)
+		}
+	}
 
-	slave, err := openTerminal(console, syscall.O_RDWR)
-	if err != nil {
-		return fmt.Errorf("open terminal %s", err)
-	}
-	if err := dupSlave(slave); err != nil {
-		return fmt.Errorf("dup2 slave %s", err)
-	}
 	if _, err := system.Setsid(); err != nil {
 		return fmt.Errorf("setsid %s", err)
 	}
-	if err := system.Setctty(); err != nil {
-		return fmt.Errorf("setctty %s", err)
+	if console != "" {
+		if err := system.Setctty(); err != nil {
+			return fmt.Errorf("setctty %s", err)
+		}
 	}
 	if err := system.ParentDeathSignal(); err != nil {
 		return fmt.Errorf("parent deth signal %s", err)
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/main.go
index 6f2825b25b..f66ff0d855 100644
--- a/components/engine/pkg/libcontainer/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/main.go
@@ -17,8 +17,11 @@ var (
 )
 
 func main() {
-	console := flag.String("console", "", "Console (pty slave) name")
-	pipeFd := flag.Int("pipe", 0, "sync pipe fd")
+	var (
+		console = flag.String("console", "", "Console (pty slave) name")
+		tty     = flag.Bool("tty", false, "Create a tty")
+		pipeFd  = flag.Int("pipe", 0, "sync pipe fd")
+	)
 	flag.Parse()
 
 	container, err := loadContainer()
@@ -41,7 +44,7 @@ func main() {
 		if nspid > 0 {
 			exitCode, err = execinCommand(container, nspid, flag.Args()[1:])
 		} else {
-			exitCode, err = execCommand(container, flag.Args()[1:])
+			exitCode, err = execCommand(container, *tty, flag.Args()[1:])
 		}
 		if err != nil {
 			log.Fatal(err)
diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 6eb2e09060..9cf69f4184 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -40,8 +40,10 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := setupDev(rootfs); err != nil {
 		return err
 	}
-	if err := setupPtmx(rootfs, console); err != nil {
-		return err
+	if console != "" {
+		if err := setupPtmx(rootfs, console); err != nil {
+			return err
+		}
 	}
 	if err := system.Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)

From a4597085bf1ab56eb15a074cee60e923a3ba828b Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 20 Feb 2014 18:10:30 -0800
Subject: [PATCH 212/403] Make sure to close the pipe upon ctrl-d

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 66baa0653b636180b8b5c57c58f4bbc805aca8c5
Component: engine
---
 components/engine/pkg/libcontainer/nsinit/exec.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index b290ace3ce..44d9aff5f7 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -99,7 +99,10 @@ func execCommand(container *libcontainer.Container, tty bool, args []string) (in
 		}
 		defer term.RestoreTerminal(os.Stdin.Fd(), state)
 	} else {
-		go io.Copy(inPipe, os.Stdin)
+		go func() {
+			defer inPipe.Close()
+			io.Copy(inPipe, os.Stdin)
+		}()
 		go io.Copy(os.Stdout, outPipe)
 		go io.Copy(os.Stderr, errPipe)
 	}
@@ -109,6 +112,7 @@ func execCommand(container *libcontainer.Container, tty bool, args []string) (in
 			return -1, err
 		}
 	}
+
 	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 

From 3ec79ee2525879ef8acdf9fd8a82300fd82bdd9f Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 20 Feb 2014 18:27:42 -0800
Subject: [PATCH 213/403] Make nsinit a proper go pkg and add the main in
 another dir Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 1316007e54e0c5a25f0d67675df7dec40286f5e8 Component: engine

---
 components/engine/pkg/libcontainer/README.md               | 4 +++-
 components/engine/pkg/libcontainer/nsinit/exec.go          | 6 ++++--
 components/engine/pkg/libcontainer/nsinit/execin.go        | 5 +++--
 components/engine/pkg/libcontainer/nsinit/init.go          | 6 ++++--
 components/engine/pkg/libcontainer/nsinit/mount.go         | 2 +-
 components/engine/pkg/libcontainer/nsinit/ns_linux.go      | 2 +-
 .../engine/pkg/libcontainer/nsinit/{ => nsinit}/main.go    | 7 ++++---
 7 files changed, 20 insertions(+), 12 deletions(-)
 rename components/engine/pkg/libcontainer/nsinit/{ => nsinit}/main.go (87%)

diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index 163161c178..3a2a843b69 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -72,9 +72,11 @@ rootfs and copy a `container.json` file into the directory with your specified c
 
 To execution `/bin/bash` in the current directory as a container just run:
 ```bash
-nsinit exec /bin/bash
+nsinit -tty exec /bin/bash
 ```
 
+If you want a proper tty setup inside the new container you must use the `-tty` flag when running nsinit.
+
 If you wish to spawn another process inside the container while your current bash session is 
 running just run the exact same command again to get another bash shell or change the command.  If the original process dies, PID 1, all other processes spawned inside the container will also be killed and the namespace will be removed. 
 
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 44d9aff5f7..9d0f7fff4e 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -1,6 +1,6 @@
 // +build linux
 
-package main
+package nsinit
 
 import (
 	"fmt"
@@ -16,7 +16,9 @@ import (
 	"syscall"
 )
 
-func execCommand(container *libcontainer.Container, tty bool, args []string) (int, error) {
+// Exec performes setup outside of a namespace so that a container can be
+// executed.  Exec is a high level function for working with container namespaces.
+func Exec(container *libcontainer.Container, tty bool, args []string) (int, error) {
 	var (
 		master  *os.File
 		console string
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index d6224f95e6..85a89905c1 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -1,4 +1,4 @@
-package main
+package nsinit
 
 import (
 	"fmt"
@@ -11,7 +11,8 @@ import (
 	"syscall"
 )
 
-func execinCommand(container *libcontainer.Container, nspid int, args []string) (int, error) {
+// ExecIn uses an existing pid and joins the pid's namespaces with the new command.
+func ExecIn(container *libcontainer.Container, nspid int, args []string) (int, error) {
 	for _, ns := range container.Namespaces {
 		if err := system.Unshare(namespaceMap[ns]); err != nil {
 			return -1, err
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index ef7fc4e44c..f80d785bc4 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -1,6 +1,6 @@
 // +build linux
 
-package main
+package nsinit
 
 import (
 	"fmt"
@@ -15,7 +15,9 @@ import (
 	"syscall"
 )
 
-func initCommand(container *libcontainer.Container, console string, pipe io.ReadCloser, args []string) error {
+// Init is the init process that first runs inside a new namespace to setup mounts, users, networking,
+// and other options required for the new container.
+func Init(container *libcontainer.Container, console string, pipe io.ReadCloser, args []string) error {
 	rootfs, err := resolveRootfs()
 	if err != nil {
 		return err
diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 9cf69f4184..a73e97e375 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -1,6 +1,6 @@
 // +build linux
 
-package main
+package nsinit
 
 import (
 	"fmt"
diff --git a/components/engine/pkg/libcontainer/nsinit/ns_linux.go b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
index 481bdf79df..e42d4b88d7 100644
--- a/components/engine/pkg/libcontainer/nsinit/ns_linux.go
+++ b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
@@ -1,4 +1,4 @@
-package main
+package nsinit
 
 import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
diff --git a/components/engine/pkg/libcontainer/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
similarity index 87%
rename from components/engine/pkg/libcontainer/nsinit/main.go
rename to components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index f66ff0d855..9d3c201aa6 100644
--- a/components/engine/pkg/libcontainer/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"flag"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
 	"io/ioutil"
 	"log"
 	"os"
@@ -42,9 +43,9 @@ func main() {
 			}
 		}
 		if nspid > 0 {
-			exitCode, err = execinCommand(container, nspid, flag.Args()[1:])
+			exitCode, err = nsinit.ExecIn(container, nspid, flag.Args()[1:])
 		} else {
-			exitCode, err = execCommand(container, *tty, flag.Args()[1:])
+			exitCode, err = nsinit.Exec(container, *tty, flag.Args()[1:])
 		}
 		if err != nil {
 			log.Fatal(err)
@@ -54,7 +55,7 @@ func main() {
 		if flag.NArg() < 2 {
 			log.Fatal(ErrWrongArguments)
 		}
-		if err := initCommand(container, *console, os.NewFile(uintptr(*pipeFd), "pipe"), flag.Args()[1:]); err != nil {
+		if err := nsinit.Init(container, *console, os.NewFile(uintptr(*pipeFd), "pipe"), flag.Args()[1:]); err != nil {
 			log.Fatal(err)
 		}
 	default:

From 71f9b20db78b52f226fef6251531c8e0764dcd20 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 20 Feb 2014 18:38:28 -0800
Subject: [PATCH 214/403] Refactor the flag management for main
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 6b2e963ce0aef802e60eafe0e895f24abb294a07 Component: engine

---
 .../engine/pkg/libcontainer/nsinit/exec.go    | 13 +++------
 .../engine/pkg/libcontainer/nsinit/init.go    |  1 -
 .../pkg/libcontainer/nsinit/nsinit/main.go    | 27 ++++++++++++-------
 3 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 9d0f7fff4e..d2b87b66ba 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -44,18 +44,14 @@ func Exec(container *libcontainer.Container, tty bool, args []string) (int, erro
 	system.UsetCloseOnExec(r.Fd())
 
 	command := createCommand(container, console, r.Fd(), args)
-
 	if !tty {
-		inPipe, err = command.StdinPipe()
-		if err != nil {
+		if inPipe, err = command.StdinPipe(); err != nil {
 			return -1, err
 		}
-		outPipe, err = command.StdoutPipe()
-		if err != nil {
+		if outPipe, err = command.StdoutPipe(); err != nil {
 			return -1, err
 		}
-		errPipe, err = command.StderrPipe()
-		if err != nil {
+		if errPipe, err = command.StderrPipe(); err != nil {
 			return -1, err
 		}
 	}
@@ -63,7 +59,6 @@ func Exec(container *libcontainer.Container, tty bool, args []string) (int, erro
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
-
 	if err := writePidFile(command); err != nil {
 		command.Process.Kill()
 		return -1, err
@@ -94,6 +89,7 @@ func Exec(container *libcontainer.Container, tty bool, args []string) (int, erro
 	if tty {
 		go io.Copy(os.Stdout, master)
 		go io.Copy(master, os.Stdin)
+
 		state, err := setupWindow(master)
 		if err != nil {
 			command.Process.Kill()
@@ -114,7 +110,6 @@ func Exec(container *libcontainer.Container, tty bool, args []string) (int, erro
 			return -1, err
 		}
 	}
-
 	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index f80d785bc4..88a5c3c5d5 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -173,7 +173,6 @@ func setupVethNetwork(config *libcontainer.Network, tempVethName string) error {
 // has been created and setup
 func getVethName(pipe io.ReadCloser) (string, error) {
 	defer pipe.Close()
-
 	data, err := ioutil.ReadAll(pipe)
 	if err != nil {
 		return "", fmt.Errorf("error reading from stdin %s", err)
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index 9d3c201aa6..33a7747594 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -12,27 +12,34 @@ import (
 	"strconv"
 )
 
+var (
+	console string
+	tty     bool
+	pipeFd  int
+)
+
 var (
 	ErrUnsupported    = errors.New("Unsupported method")
 	ErrWrongArguments = errors.New("Wrong argument count")
 )
 
-func main() {
-	var (
-		console = flag.String("console", "", "Console (pty slave) name")
-		tty     = flag.Bool("tty", false, "Create a tty")
-		pipeFd  = flag.Int("pipe", 0, "sync pipe fd")
-	)
-	flag.Parse()
+func init() {
+	flag.StringVar(&console, "console", "", "console (pty slave) path")
+	flag.BoolVar(&tty, "tty", false, "create a tty")
+	flag.IntVar(&pipeFd, "pipe", 0, "sync pipe fd")
 
+	flag.Parse()
+}
+
+func main() {
 	container, err := loadContainer()
 	if err != nil {
 		log.Fatal(err)
 	}
-
 	if flag.NArg() < 1 {
 		log.Fatal(ErrWrongArguments)
 	}
+
 	switch flag.Arg(0) {
 	case "exec": // this is executed outside of the namespace in the cwd
 		var exitCode int
@@ -45,7 +52,7 @@ func main() {
 		if nspid > 0 {
 			exitCode, err = nsinit.ExecIn(container, nspid, flag.Args()[1:])
 		} else {
-			exitCode, err = nsinit.Exec(container, *tty, flag.Args()[1:])
+			exitCode, err = nsinit.Exec(container, tty, flag.Args()[1:])
 		}
 		if err != nil {
 			log.Fatal(err)
@@ -55,7 +62,7 @@ func main() {
 		if flag.NArg() < 2 {
 			log.Fatal(ErrWrongArguments)
 		}
-		if err := nsinit.Init(container, *console, os.NewFile(uintptr(*pipeFd), "pipe"), flag.Args()[1:]); err != nil {
+		if err := nsinit.Init(container, console, os.NewFile(uintptr(pipeFd), "pipe"), flag.Args()[1:]); err != nil {
 			log.Fatal(err)
 		}
 	default:

From 8be796c4b1fabe963d014208eaf0cc15125c102d Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 13:53:11 -0800
Subject: [PATCH 215/403] Move tty into container.json
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 7f247e7006761ac8922a58651a76b194a4655ffa Component: engine

---
 components/engine/pkg/libcontainer/README.md             | 7 +++----
 components/engine/pkg/libcontainer/container.go          | 1 +
 components/engine/pkg/libcontainer/container.json        | 3 ++-
 components/engine/pkg/libcontainer/nsinit/exec.go        | 8 ++++----
 components/engine/pkg/libcontainer/nsinit/nsinit/main.go | 4 +---
 5 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index 3a2a843b69..89a4ec0c48 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -17,6 +17,7 @@ Sample `container.json` file:
 ```json
 {
     "hostname": "koye",
+    "tty": true,
     "environment": [
         "HOME=/",
         "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
@@ -55,7 +56,7 @@ Sample `container.json` file:
     "cgroups": {
         "name": "docker-koye",
         "parent": "docker",
-        "memory": 524800
+        "memory": 5248000
     }
 }
 ```
@@ -72,11 +73,9 @@ rootfs and copy a `container.json` file into the directory with your specified c
 
 To execution `/bin/bash` in the current directory as a container just run:
 ```bash
-nsinit -tty exec /bin/bash
+nsinit exec /bin/bash
 ```
 
-If you want a proper tty setup inside the new container you must use the `-tty` flag when running nsinit.
-
 If you wish to spawn another process inside the container while your current bash session is 
 running just run the exact same command again to get another bash shell or change the command.  If the original process dies, PID 1, all other processes spawned inside the container will also be killed and the namespace will be removed. 
 
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index e6e4b4747e..3c1b62b65a 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -12,6 +12,7 @@ type Container struct {
 	User         string          `json:"user,omitempty"`         // user to execute the process as
 	WorkingDir   string          `json:"working_dir,omitempty"`  // current working directory
 	Env          []string        `json:"environment,omitempty"`  // environment to set
+	Tty          bool            `json:"tty,omitempty"`          // setup a proper tty or not
 	Namespaces   Namespaces      `json:"namespaces,omitempty"`   // namespaces to apply
 	Capabilities Capabilities    `json:"capabilities,omitempty"` // capabilities to drop
 	Network      *Network        `json:"network,omitempty"`      // nil for host's network stack
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index c1a07dc55b..07e52df428 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -1,5 +1,6 @@
 {
     "hostname": "koye",
+    "tty": true,
     "environment": [
         "HOME=/",
         "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin",
@@ -38,6 +39,6 @@
     "cgroups": {
         "name": "docker-koye",
         "parent": "docker",
-        "memory": 524800
+        "memory": 5248000
     }
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index d2b87b66ba..e2adf3d4f2 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -18,7 +18,7 @@ import (
 
 // Exec performes setup outside of a namespace so that a container can be
 // executed.  Exec is a high level function for working with container namespaces.
-func Exec(container *libcontainer.Container, tty bool, args []string) (int, error) {
+func Exec(container *libcontainer.Container, args []string) (int, error) {
 	var (
 		master  *os.File
 		console string
@@ -28,7 +28,7 @@ func Exec(container *libcontainer.Container, tty bool, args []string) (int, erro
 		outPipe, errPipe io.ReadCloser
 	)
 
-	if tty {
+	if container.Tty {
 		master, console, err = createMasterAndConsole()
 		if err != nil {
 			return -1, err
@@ -44,7 +44,7 @@ func Exec(container *libcontainer.Container, tty bool, args []string) (int, erro
 	system.UsetCloseOnExec(r.Fd())
 
 	command := createCommand(container, console, r.Fd(), args)
-	if !tty {
+	if !container.Tty {
 		if inPipe, err = command.StdinPipe(); err != nil {
 			return -1, err
 		}
@@ -86,7 +86,7 @@ func Exec(container *libcontainer.Container, tty bool, args []string) (int, erro
 	w.Close()
 	r.Close()
 
-	if tty {
+	if container.Tty {
 		go io.Copy(os.Stdout, master)
 		go io.Copy(master, os.Stdin)
 
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index 33a7747594..6508a3e9dd 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -14,7 +14,6 @@ import (
 
 var (
 	console string
-	tty     bool
 	pipeFd  int
 )
 
@@ -25,7 +24,6 @@ var (
 
 func init() {
 	flag.StringVar(&console, "console", "", "console (pty slave) path")
-	flag.BoolVar(&tty, "tty", false, "create a tty")
 	flag.IntVar(&pipeFd, "pipe", 0, "sync pipe fd")
 
 	flag.Parse()
@@ -52,7 +50,7 @@ func main() {
 		if nspid > 0 {
 			exitCode, err = nsinit.ExecIn(container, nspid, flag.Args()[1:])
 		} else {
-			exitCode, err = nsinit.Exec(container, tty, flag.Args()[1:])
+			exitCode, err = nsinit.Exec(container, flag.Args()[1:])
 		}
 		if err != nil {
 			log.Fatal(err)

From 2c3593d92d8736370f8a9333dbf33dd19228f0b7 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 14:49:55 -0800
Subject: [PATCH 216/403] Add good logging support to both sides
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 50c752fcb06497e9e597049a1007c53d77032d17 Component: engine

---
 .../engine/pkg/libcontainer/nsinit/exec.go    | 35 ++++++++++++++---
 .../engine/pkg/libcontainer/nsinit/init.go    | 23 ++++++-----
 .../pkg/libcontainer/nsinit/nsinit/main.go    | 39 ++++++++++++++++---
 3 files changed, 76 insertions(+), 21 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index e2adf3d4f2..24e722a22f 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -11,6 +11,7 @@ import (
 	"github.com/dotcloud/docker/pkg/term"
 	"io"
 	"io/ioutil"
+	"log"
 	"os"
 	"os/exec"
 	"syscall"
@@ -18,7 +19,7 @@ import (
 
 // Exec performes setup outside of a namespace so that a container can be
 // executed.  Exec is a high level function for working with container namespaces.
-func Exec(container *libcontainer.Container, args []string) (int, error) {
+func Exec(container *libcontainer.Container, logFile string, args []string) (int, error) {
 	var (
 		master  *os.File
 		console string
@@ -29,6 +30,7 @@ func Exec(container *libcontainer.Container, args []string) (int, error) {
 	)
 
 	if container.Tty {
+		log.Printf("setting up master and console")
 		master, console, err = createMasterAndConsole()
 		if err != nil {
 			return -1, err
@@ -43,8 +45,9 @@ func Exec(container *libcontainer.Container, args []string) (int, error) {
 	}
 	system.UsetCloseOnExec(r.Fd())
 
-	command := createCommand(container, console, r.Fd(), args)
+	command := createCommand(container, console, logFile, r.Fd(), args)
 	if !container.Tty {
+		log.Printf("opening pipes on command")
 		if inPipe, err = command.StdinPipe(); err != nil {
 			return -1, err
 		}
@@ -56,9 +59,11 @@ func Exec(container *libcontainer.Container, args []string) (int, error) {
 		}
 	}
 
+	log.Printf("staring init")
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
+	log.Printf("writting state file")
 	if err := writePidFile(command); err != nil {
 		command.Process.Kill()
 		return -1, err
@@ -68,6 +73,7 @@ func Exec(container *libcontainer.Container, args []string) (int, error) {
 	// Do this before syncing with child so that no children
 	// can escape the cgroup
 	if container.Cgroups != nil {
+		log.Printf("setting up cgroups")
 		if err := container.Cgroups.Apply(command.Process.Pid); err != nil {
 			command.Process.Kill()
 			return -1, err
@@ -75,18 +81,22 @@ func Exec(container *libcontainer.Container, args []string) (int, error) {
 	}
 
 	if container.Network != nil {
-		vethPair, err := initializeContainerVeth(container.Network.Bridge, command.Process.Pid)
+		log.Printf("creating veth pair")
+		vethPair, err := initializeContainerVeth(container.Network.Bridge, container.Network.Mtu, command.Process.Pid)
 		if err != nil {
 			return -1, err
 		}
+		log.Printf("sending %s as veth pair name", vethPair)
 		sendVethName(w, vethPair)
 	}
 
 	// Sync with child
+	log.Printf("closing sync pipes")
 	w.Close()
 	r.Close()
 
 	if container.Tty {
+		log.Printf("starting copy for tty")
 		go io.Copy(os.Stdout, master)
 		go io.Copy(master, os.Stdin)
 
@@ -97,6 +107,7 @@ func Exec(container *libcontainer.Container, args []string) (int, error) {
 		}
 		defer term.RestoreTerminal(os.Stdin.Fd(), state)
 	} else {
+		log.Printf("starting copy for std pipes")
 		go func() {
 			defer inPipe.Close()
 			io.Copy(inPipe, os.Stdin)
@@ -105,11 +116,13 @@ func Exec(container *libcontainer.Container, args []string) (int, error) {
 		go io.Copy(os.Stderr, errPipe)
 	}
 
+	log.Printf("waiting on process")
 	if err := command.Wait(); err != nil {
 		if _, ok := err.(*exec.ExitError); !ok {
 			return -1, err
 		}
 	}
+	log.Printf("process ended")
 	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
@@ -126,17 +139,22 @@ func sendVethName(pipe io.Writer, name string) {
 // Then will with set the other side of the veth pair into the container's namespaced
 // using the pid and returns the veth's interface name to provide to the container to
 // finish setting up the interface inside the namespace
-func initializeContainerVeth(bridge string, nspid int) (string, error) {
+func initializeContainerVeth(bridge string, mtu, nspid int) (string, error) {
 	name1, name2, err := createVethPair()
 	if err != nil {
 		return "", err
 	}
+	log.Printf("veth pair created %s <> %s", name1, name2)
 	if err := network.SetInterfaceMaster(name1, bridge); err != nil {
 		return "", err
 	}
+	if err := network.SetMtu(name1, mtu); err != nil {
+		return "", err
+	}
 	if err := network.InterfaceUp(name1); err != nil {
 		return "", err
 	}
+	log.Printf("setting %s inside %d namespace", name2, nspid)
 	if err := network.SetInterfaceInNamespacePid(name2, nspid); err != nil {
 		return "", err
 	}
@@ -200,8 +218,13 @@ func deletePidFile() error {
 // createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
-func createCommand(container *libcontainer.Container, console string, pipe uintptr, args []string) *exec.Cmd {
-	command := exec.Command("nsinit", append([]string{"-console", console, "-pipe", fmt.Sprint(pipe), "init"}, args...)...)
+func createCommand(container *libcontainer.Container, console, logFile string, pipe uintptr, args []string) *exec.Cmd {
+	command := exec.Command("nsinit", append([]string{
+		"-console", console,
+		"-pipe", fmt.Sprint(pipe),
+		"-log", logFile,
+		"init"}, args...)...)
+
 	command.SysProcAttr = &syscall.SysProcAttr{
 		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces)),
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 88a5c3c5d5..8fc5f3d05c 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -10,6 +10,7 @@ import (
 	"github.com/dotcloud/docker/pkg/system"
 	"io"
 	"io/ioutil"
+	"log"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -17,19 +18,23 @@ import (
 
 // Init is the init process that first runs inside a new namespace to setup mounts, users, networking,
 // and other options required for the new container.
-func Init(container *libcontainer.Container, console string, pipe io.ReadCloser, args []string) error {
-	rootfs, err := resolveRootfs()
+func Init(container *libcontainer.Container, uncleanRootfs, console string, pipe io.ReadCloser, args []string) error {
+	rootfs, err := resolveRootfs(uncleanRootfs)
 	if err != nil {
 		return err
 	}
+	log.Printf("initializing namespace at %s", rootfs)
 
 	// We always read this as it is a way to sync with the parent as well
 	tempVethName, err := getVethName(pipe)
 	if err != nil {
 		return err
 	}
-
+	if tempVethName != "" {
+		log.Printf("received veth name %s", tempVethName)
+	}
 	if console != "" {
+		log.Printf("setting up console for %s", console)
 		// close pipes so that we can replace it with the pty
 		os.Stdin.Close()
 		os.Stdout.Close()
@@ -42,7 +47,6 @@ func Init(container *libcontainer.Container, console string, pipe io.ReadCloser,
 			return fmt.Errorf("dup2 slave %s", err)
 		}
 	}
-
 	if _, err := system.Setsid(); err != nil {
 		return fmt.Errorf("setsid %s", err)
 	}
@@ -63,9 +67,11 @@ func Init(container *libcontainer.Container, console string, pipe io.ReadCloser,
 	if err := system.Sethostname(container.Hostname); err != nil {
 		return fmt.Errorf("sethostname %s", err)
 	}
+	log.Printf("dropping capabilities")
 	if err := capabilities.DropCapabilities(container); err != nil {
 		return fmt.Errorf("drop capabilities %s", err)
 	}
+	log.Printf("setting user in namespace")
 	if err := setupUser(container); err != nil {
 		return fmt.Errorf("setup user %s", err)
 	}
@@ -74,6 +80,7 @@ func Init(container *libcontainer.Container, console string, pipe io.ReadCloser,
 			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
 		}
 	}
+	log.Printf("execing %s goodbye", args[0])
 	if err := system.Exec(args[0], args[0:], container.Env); err != nil {
 		return fmt.Errorf("exec %s", err)
 	}
@@ -82,12 +89,8 @@ func Init(container *libcontainer.Container, console string, pipe io.ReadCloser,
 
 // resolveRootfs ensures that the current working directory is
 // not a symlink and returns the absolute path to the rootfs
-func resolveRootfs() (string, error) {
-	cwd, err := os.Getwd()
-	if err != nil {
-		return "", err
-	}
-	rootfs, err := filepath.Abs(cwd)
+func resolveRootfs(uncleanRootfs string) (string, error) {
+	rootfs, err := filepath.Abs(uncleanRootfs)
 	if err != nil {
 		return "", err
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index 6508a3e9dd..0873c09fe0 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -6,6 +6,7 @@ import (
 	"flag"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
+	"io"
 	"io/ioutil"
 	"log"
 	"os"
@@ -15,6 +16,7 @@ import (
 var (
 	console string
 	pipeFd  int
+	logFile string
 )
 
 var (
@@ -24,22 +26,27 @@ var (
 
 func init() {
 	flag.StringVar(&console, "console", "", "console (pty slave) path")
+	flag.StringVar(&logFile, "log", "none", "log options (none, stderr, or a file path)")
 	flag.IntVar(&pipeFd, "pipe", 0, "sync pipe fd")
 
 	flag.Parse()
 }
 
 func main() {
+	if flag.NArg() < 1 {
+		log.Fatal(ErrWrongArguments)
+	}
 	container, err := loadContainer()
 	if err != nil {
 		log.Fatal(err)
 	}
-	if flag.NArg() < 1 {
-		log.Fatal(ErrWrongArguments)
+	if err := setupLogging(); err != nil {
+		log.Fatal(err)
 	}
-
 	switch flag.Arg(0) {
 	case "exec": // this is executed outside of the namespace in the cwd
+		log.SetPrefix("[nsinit exec] ")
+
 		var exitCode int
 		nspid, err := readPid()
 		if err != nil {
@@ -50,17 +57,22 @@ func main() {
 		if nspid > 0 {
 			exitCode, err = nsinit.ExecIn(container, nspid, flag.Args()[1:])
 		} else {
-			exitCode, err = nsinit.Exec(container, flag.Args()[1:])
+			exitCode, err = nsinit.Exec(container, logFile, flag.Args()[1:])
 		}
 		if err != nil {
 			log.Fatal(err)
 		}
 		os.Exit(exitCode)
 	case "init": // this is executed inside of the namespace to setup the container
+		log.SetPrefix("[nsinit init] ")
+		cwd, err := os.Getwd()
+		if err != nil {
+			log.Fatal(err)
+		}
 		if flag.NArg() < 2 {
 			log.Fatal(ErrWrongArguments)
 		}
-		if err := nsinit.Init(container, console, os.NewFile(uintptr(pipeFd), "pipe"), flag.Args()[1:]); err != nil {
+		if err := nsinit.Init(container, cwd, console, os.NewFile(uintptr(pipeFd), "pipe"), flag.Args()[1:]); err != nil {
 			log.Fatal(err)
 		}
 	default:
@@ -93,3 +105,20 @@ func readPid() (int, error) {
 	}
 	return pid, nil
 }
+
+func setupLogging() (err error) {
+	var writer io.Writer
+	switch logFile {
+	case "stderr":
+		writer = os.Stderr
+	case "none", "":
+		writer = ioutil.Discard
+	default:
+		writer, err = os.OpenFile(logFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0755)
+		if err != nil {
+			return err
+		}
+	}
+	log.SetOutput(writer)
+	return nil
+}

From eb2bb513c8cb2c150fe29082a6dacd59a563539d Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 15:32:50 -0800
Subject: [PATCH 217/403] User os.Args[0] as name to reexec
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 ba025cb75cceaa8536d0d512889ea86f13349950 Component: engine

---
 components/engine/pkg/libcontainer/nsinit/exec.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 24e722a22f..ba548a2bd7 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -219,7 +219,9 @@ func deletePidFile() error {
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
 func createCommand(container *libcontainer.Container, console, logFile string, pipe uintptr, args []string) *exec.Cmd {
-	command := exec.Command("nsinit", append([]string{
+	// get our binary name so we can always reexec ourself
+	name := os.Args[0]
+	command := exec.Command(name, append([]string{
 		"-console", console,
 		"-pipe", fmt.Sprint(pipe),
 		"-log", logFile,

From e210f44a119067f277023d6131ba96247a951a6b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 16:17:18 -0800
Subject: [PATCH 218/403] Use lookup path for init
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 a352ecb01a788eff3446fe12191ca0434fce1eed Component: engine

---
 components/engine/pkg/libcontainer/nsinit/exec.go |  1 +
 components/engine/pkg/libcontainer/nsinit/init.go | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index ba548a2bd7..80fe8495ff 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -230,5 +230,6 @@ func createCommand(container *libcontainer.Container, console, logFile string, p
 	command.SysProcAttr = &syscall.SysProcAttr{
 		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces)),
 	}
+	command.Env = container.Env
 	return command
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 8fc5f3d05c..04716ba645 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -12,6 +12,7 @@ import (
 	"io/ioutil"
 	"log"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"syscall"
 )
@@ -80,8 +81,13 @@ func Init(container *libcontainer.Container, uncleanRootfs, console string, pipe
 			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
 		}
 	}
-	log.Printf("execing %s goodbye", args[0])
-	if err := system.Exec(args[0], args[0:], container.Env); err != nil {
+	name, err := exec.LookPath(args[0])
+	if err != nil {
+		return err
+	}
+
+	log.Printf("execing %s goodbye", name)
+	if err := system.Exec(name, args[0:], container.Env); err != nil {
 		return fmt.Errorf("exec %s", err)
 	}
 	panic("unreachable")

From e38028e81a665105490376da8daa9f02456f0db8 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 16:28:43 -0800
Subject: [PATCH 219/403] Pass pipes into Exec function
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 c8fd81c27821576f339ccf4fd85c47375ba34042 Component: engine

---
 components/engine/pkg/libcontainer/nsinit/exec.go  | 14 +++++++-------
 .../engine/pkg/libcontainer/nsinit/nsinit/main.go  |  4 +++-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 80fe8495ff..98f5209f03 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -19,7 +19,7 @@ import (
 
 // Exec performes setup outside of a namespace so that a container can be
 // executed.  Exec is a high level function for working with container namespaces.
-func Exec(container *libcontainer.Container, logFile string, args []string) (int, error) {
+func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.Writer, logFile string, args []string) (int, error) {
 	var (
 		master  *os.File
 		console string
@@ -97,23 +97,23 @@ func Exec(container *libcontainer.Container, logFile string, args []string) (int
 
 	if container.Tty {
 		log.Printf("starting copy for tty")
-		go io.Copy(os.Stdout, master)
-		go io.Copy(master, os.Stdin)
+		go io.Copy(stdout, master)
+		go io.Copy(master, stdin)
 
 		state, err := setupWindow(master)
 		if err != nil {
 			command.Process.Kill()
 			return -1, err
 		}
-		defer term.RestoreTerminal(os.Stdin.Fd(), state)
+		defer term.RestoreTerminal(uintptr(syscall.Stdin), state)
 	} else {
 		log.Printf("starting copy for std pipes")
 		go func() {
 			defer inPipe.Close()
-			io.Copy(inPipe, os.Stdin)
+			io.Copy(inPipe, stdin)
 		}()
-		go io.Copy(os.Stdout, outPipe)
-		go io.Copy(os.Stderr, errPipe)
+		go io.Copy(stdout, outPipe)
+		go io.Copy(stderr, errPipe)
 	}
 
 	log.Printf("waiting on process")
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index 0873c09fe0..e6e3827713 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -57,7 +57,9 @@ func main() {
 		if nspid > 0 {
 			exitCode, err = nsinit.ExecIn(container, nspid, flag.Args()[1:])
 		} else {
-			exitCode, err = nsinit.Exec(container, logFile, flag.Args()[1:])
+			exitCode, err = nsinit.Exec(container,
+				os.Stdin, os.Stdout, os.Stderr,
+				logFile, flag.Args()[1:])
 		}
 		if err != nil {
 			log.Fatal(err)

From dd4492ebc4c2fd42e280bd128d513b6294bd4d99 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 16:40:32 -0800
Subject: [PATCH 220/403] Pass tty master to Exec Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 332755b99d345a8ffbf4fb636ca8fed604a233c0 Component: engine

---
 components/engine/pkg/libcontainer/nsinit/exec.go        | 3 +--
 components/engine/pkg/libcontainer/nsinit/nsinit/main.go | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 98f5209f03..3622196b78 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -19,9 +19,8 @@ import (
 
 // Exec performes setup outside of a namespace so that a container can be
 // executed.  Exec is a high level function for working with container namespaces.
-func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.Writer, logFile string, args []string) (int, error) {
+func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.Writer, master *os.File, logFile string, args []string) (int, error) {
 	var (
-		master  *os.File
 		console string
 		err     error
 
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index e6e3827713..28d42d4643 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -58,7 +58,7 @@ func main() {
 			exitCode, err = nsinit.ExecIn(container, nspid, flag.Args()[1:])
 		} else {
 			exitCode, err = nsinit.Exec(container,
-				os.Stdin, os.Stdout, os.Stderr,
+				os.Stdin, os.Stdout, os.Stderr, nil,
 				logFile, flag.Args()[1:])
 		}
 		if err != nil {

From 4fbf234237ed624593b6625315d5439956b047f6 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 17:11:57 -0800
Subject: [PATCH 221/403] Initial commit of libcontainer running docker
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 2419e63d243255ef38f16799ffdc64084aa18fe4 Component: engine

---
 components/engine/container.go                |   1 +
 .../execdriver/namespaces/default_template.go |  41 ++
 .../engine/execdriver/namespaces/driver.go    | 349 ++++++++++++++++++
 .../engine/execdriver/namespaces/term.go      |  26 ++
 .../engine/pkg/libcontainer/nsinit/exec.go    |   2 +-
 .../pkg/libcontainer/nsinit/ns_linux.go       |   2 +-
 components/engine/runtime.go                  |   5 +-
 7 files changed, 422 insertions(+), 4 deletions(-)
 create mode 100644 components/engine/execdriver/namespaces/default_template.go
 create mode 100644 components/engine/execdriver/namespaces/driver.go
 create mode 100644 components/engine/execdriver/namespaces/term.go

diff --git a/components/engine/container.go b/components/engine/container.go
index ca53bb57c7..76e51cdad3 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -530,6 +530,7 @@ func (container *Container) Start() (err error) {
 	}
 
 	populateCommand(container)
+	container.command.Env = env
 
 	// Setup logging of stdout and stderr to disk
 	if err := container.runtime.LogToDisk(container.stdout, container.logPath("json"), "stdout"); err != nil {
diff --git a/components/engine/execdriver/namespaces/default_template.go b/components/engine/execdriver/namespaces/default_template.go
new file mode 100644
index 0000000000..79b6ac1c11
--- /dev/null
+++ b/components/engine/execdriver/namespaces/default_template.go
@@ -0,0 +1,41 @@
+package namespaces
+
+import (
+	"github.com/dotcloud/docker/pkg/cgroups"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+)
+
+// getDefaultTemplate returns the docker default for
+// the libcontainer configuration file
+func getDefaultTemplate() *libcontainer.Container {
+	return &libcontainer.Container{
+		Capabilities: libcontainer.Capabilities{
+			libcontainer.CAP_SETPCAP,
+			libcontainer.CAP_SYS_MODULE,
+			libcontainer.CAP_SYS_RAWIO,
+			libcontainer.CAP_SYS_PACCT,
+			libcontainer.CAP_SYS_ADMIN,
+			libcontainer.CAP_SYS_NICE,
+			libcontainer.CAP_SYS_RESOURCE,
+			libcontainer.CAP_SYS_TIME,
+			libcontainer.CAP_SYS_TTY_CONFIG,
+			libcontainer.CAP_MKNOD,
+			libcontainer.CAP_AUDIT_WRITE,
+			libcontainer.CAP_AUDIT_CONTROL,
+			libcontainer.CAP_MAC_ADMIN,
+			libcontainer.CAP_MAC_OVERRIDE,
+			libcontainer.CAP_NET_ADMIN,
+		},
+		Namespaces: libcontainer.Namespaces{
+			libcontainer.CLONE_NEWIPC,
+			libcontainer.CLONE_NEWNET,
+			libcontainer.CLONE_NEWNS,
+			libcontainer.CLONE_NEWPID,
+			libcontainer.CLONE_NEWUTS,
+		},
+		Cgroups: &cgroups.Cgroup{
+			Name:         "docker",
+			DeviceAccess: false,
+		},
+	}
+}
diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
new file mode 100644
index 0000000000..e243c64703
--- /dev/null
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -0,0 +1,349 @@
+package namespaces
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"github.com/dotcloud/docker/execdriver"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/network"
+	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
+	"github.com/dotcloud/docker/pkg/libcontainer/utils"
+	"github.com/dotcloud/docker/pkg/system"
+	"github.com/dotcloud/docker/pkg/term"
+	"io"
+	"io/ioutil"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+const (
+	DriverName = "namespaces"
+	Version    = "0.1"
+)
+
+var (
+	ErrNotSupported = errors.New("not supported")
+)
+
+func init() {
+	execdriver.RegisterInitFunc(DriverName, func(args *execdriver.InitArgs) error {
+		return nil
+	})
+}
+
+type driver struct {
+}
+
+func NewDriver() (*driver, error) {
+	return &driver{}, nil
+}
+
+func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
+	container := createContainer(c)
+	if err := writeContainerFile(container, c.Rootfs); err != nil {
+		return -1, err
+	}
+
+	var (
+		console string
+		master  *os.File
+		err     error
+
+		inPipe           io.WriteCloser
+		outPipe, errPipe io.ReadCloser
+	)
+
+	if container.Tty {
+		log.Printf("setting up master and console")
+		master, console, err = createMasterAndConsole()
+		if err != nil {
+			return -1, err
+		}
+	}
+	c.Terminal = NewTerm(pipes, master)
+
+	// create a pipe so that we can syncronize with the namespaced process and
+	// pass the veth name to the child
+	r, w, err := os.Pipe()
+	if err != nil {
+		return -1, err
+	}
+	system.UsetCloseOnExec(r.Fd())
+
+	args := append([]string{c.Entrypoint}, c.Arguments...)
+	createCommand(c, container, console, "/nsinit.logs", r.Fd(), args)
+	command := c
+
+	if !container.Tty {
+		log.Printf("opening pipes on command")
+		if inPipe, err = command.StdinPipe(); err != nil {
+			return -1, err
+		}
+		if outPipe, err = command.StdoutPipe(); err != nil {
+			return -1, err
+		}
+		if errPipe, err = command.StderrPipe(); err != nil {
+			return -1, err
+		}
+	}
+
+	log.Printf("staring init")
+	if err := command.Start(); err != nil {
+		return -1, err
+	}
+	log.Printf("writting state file")
+	if err := writePidFile(c.Rootfs, command.Process.Pid); err != nil {
+		command.Process.Kill()
+		return -1, err
+	}
+	defer deletePidFile(c.Rootfs)
+
+	// Do this before syncing with child so that no children
+	// can escape the cgroup
+	if container.Cgroups != nil {
+		log.Printf("setting up cgroups")
+		if err := container.Cgroups.Apply(command.Process.Pid); err != nil {
+			command.Process.Kill()
+			return -1, err
+		}
+	}
+
+	if container.Network != nil {
+		log.Printf("creating veth pair")
+		vethPair, err := initializeContainerVeth(container.Network.Bridge, container.Network.Mtu, command.Process.Pid)
+		if err != nil {
+			return -1, err
+		}
+		log.Printf("sending %s as veth pair name", vethPair)
+		sendVethName(w, vethPair)
+	}
+
+	// Sync with child
+	log.Printf("closing sync pipes")
+	w.Close()
+	r.Close()
+
+	if container.Tty {
+		log.Printf("starting copy for tty")
+		go io.Copy(pipes.Stdout, master)
+		if pipes.Stdin != nil {
+			go io.Copy(master, pipes.Stdin)
+		}
+
+		/*
+			state, err := setupWindow(master)
+			if err != nil {
+				command.Process.Kill()
+				return -1, err
+			}
+			defer term.RestoreTerminal(uintptr(syscall.Stdin), state)
+		*/
+	} else {
+		log.Printf("starting copy for std pipes")
+		if pipes.Stdin != nil {
+			go func() {
+				defer inPipe.Close()
+				io.Copy(inPipe, pipes.Stdin)
+			}()
+		}
+		go io.Copy(pipes.Stdout, outPipe)
+		go io.Copy(pipes.Stderr, errPipe)
+	}
+
+	if startCallback != nil {
+		startCallback(c)
+	}
+
+	log.Printf("waiting on process")
+	if err := command.Wait(); err != nil {
+		if _, ok := err.(*exec.ExitError); !ok {
+			return -1, err
+		}
+	}
+	log.Printf("process ended")
+	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
+}
+
+func (d *driver) Kill(p *execdriver.Command, sig int) error {
+	return p.Process.Kill()
+}
+
+func (d *driver) Restore(c *execdriver.Command) error {
+	return ErrNotSupported
+}
+
+func (d *driver) Info(id string) execdriver.Info {
+	return nil
+}
+
+func (d *driver) Name() string {
+	return fmt.Sprintf("%s-%s", DriverName, Version)
+}
+
+func (d *driver) GetPidsForContainer(id string) ([]int, error) {
+	return nil, ErrNotSupported
+}
+
+func writeContainerFile(container *libcontainer.Container, rootfs string) error {
+	data, err := json.Marshal(container)
+	if err != nil {
+		return err
+	}
+	return ioutil.WriteFile(filepath.Join(rootfs, "container.json"), data, 0755)
+}
+
+func getEnv(key string, env []string) string {
+	for _, pair := range env {
+		parts := strings.Split(pair, "=")
+		if parts[0] == key {
+			return parts[1]
+		}
+	}
+	return ""
+}
+
+// sendVethName writes the veth pair name to the child's stdin then closes the
+// pipe so that the child stops waiting for more data
+func sendVethName(pipe io.Writer, name string) {
+	fmt.Fprint(pipe, name)
+}
+
+// initializeContainerVeth will create a veth pair and setup the host's
+// side of the pair by setting the specified bridge as the master and bringing
+// up the interface.
+//
+// Then will with set the other side of the veth pair into the container's namespaced
+// using the pid and returns the veth's interface name to provide to the container to
+// finish setting up the interface inside the namespace
+func initializeContainerVeth(bridge string, mtu, nspid int) (string, error) {
+	name1, name2, err := createVethPair()
+	if err != nil {
+		return "", err
+	}
+	log.Printf("veth pair created %s <> %s", name1, name2)
+	if err := network.SetInterfaceMaster(name1, bridge); err != nil {
+		return "", err
+	}
+	if err := network.SetMtu(name1, mtu); err != nil {
+		return "", err
+	}
+	if err := network.InterfaceUp(name1); err != nil {
+		return "", err
+	}
+	log.Printf("setting %s inside %d namespace", name2, nspid)
+	if err := network.SetInterfaceInNamespacePid(name2, nspid); err != nil {
+		return "", err
+	}
+	return name2, nil
+}
+
+func setupWindow(master *os.File) (*term.State, error) {
+	ws, err := term.GetWinsize(os.Stdin.Fd())
+	if err != nil {
+		return nil, err
+	}
+	if err := term.SetWinsize(master.Fd(), ws); err != nil {
+		return nil, err
+	}
+	return term.SetRawTerminal(os.Stdin.Fd())
+}
+
+// createMasterAndConsole will open /dev/ptmx on the host and retreive the
+// pts name for use as the pty slave inside the container
+func createMasterAndConsole() (*os.File, string, error) {
+	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, "", err
+	}
+	console, err := system.Ptsname(master)
+	if err != nil {
+		return nil, "", err
+	}
+	if err := system.Unlockpt(master); err != nil {
+		return nil, "", err
+	}
+	return master, console, nil
+}
+
+// createVethPair will automatically generage two random names for
+// the veth pair and ensure that they have been created
+func createVethPair() (name1 string, name2 string, err error) {
+	name1, err = utils.GenerateRandomName("dock", 4)
+	if err != nil {
+		return
+	}
+	name2, err = utils.GenerateRandomName("dock", 4)
+	if err != nil {
+		return
+	}
+	if err = network.CreateVethPair(name1, name2); err != nil {
+		return
+	}
+	return
+}
+
+// writePidFile writes the namespaced processes pid to .nspid in the rootfs for the container
+func writePidFile(rootfs string, pid int) error {
+	return ioutil.WriteFile(filepath.Join(rootfs, ".nspid"), []byte(fmt.Sprint(pid)), 0655)
+}
+
+func deletePidFile(rootfs string) error {
+	return os.Remove(filepath.Join(rootfs, ".nspid"))
+}
+
+// createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
+// defined on the container's configuration and use the current binary as the init with the
+// args provided
+func createCommand(c *execdriver.Command, container *libcontainer.Container,
+	console, logFile string, pipe uintptr, args []string) {
+
+	aname, _ := exec.LookPath("nsinit")
+	c.Path = aname
+	c.Args = append([]string{
+		aname,
+		"-console", console,
+		"-pipe", fmt.Sprint(pipe),
+		"-log", logFile,
+		"init",
+	}, args...)
+	c.SysProcAttr = &syscall.SysProcAttr{
+		Cloneflags: uintptr(nsinit.GetNamespaceFlags(container.Namespaces)),
+	}
+	c.Env = container.Env
+	c.Dir = c.Rootfs
+}
+
+func createContainer(c *execdriver.Command) *libcontainer.Container {
+	container := getDefaultTemplate()
+
+	container.Hostname = getEnv("HOSTNAME", c.Env)
+	container.Tty = c.Tty
+	container.User = c.User
+	container.WorkingDir = c.WorkingDir
+	container.Env = c.Env
+
+	container.Env = append(container.Env, "container=docker")
+
+	if c.Network != nil {
+		container.Network = &libcontainer.Network{
+			Mtu:     c.Network.Mtu,
+			Address: fmt.Sprintf("%s/%d", c.Network.IPAddress, c.Network.IPPrefixLen),
+			Gateway: c.Network.Gateway,
+			Bridge:  c.Network.Bridge,
+		}
+	}
+	if c.Privileged {
+		container.Capabilities = nil
+	}
+	if c.Resources != nil {
+		container.Cgroups.CpuShares = c.Resources.CpuShares
+		container.Cgroups.Memory = c.Resources.Memory
+		container.Cgroups.MemorySwap = c.Resources.MemorySwap
+	}
+	return container
+}
diff --git a/components/engine/execdriver/namespaces/term.go b/components/engine/execdriver/namespaces/term.go
new file mode 100644
index 0000000000..682c6a27b1
--- /dev/null
+++ b/components/engine/execdriver/namespaces/term.go
@@ -0,0 +1,26 @@
+package namespaces
+
+import (
+	"github.com/dotcloud/docker/execdriver"
+	"github.com/dotcloud/docker/pkg/term"
+	"os"
+)
+
+type NsinitTerm struct {
+	master *os.File
+}
+
+func NewTerm(pipes *execdriver.Pipes, master *os.File) *NsinitTerm {
+	return &NsinitTerm{master}
+}
+
+func (t *NsinitTerm) Close() error {
+	return t.master.Close()
+}
+
+func (t *NsinitTerm) Resize(h, w int) error {
+	if t.master != nil {
+		return term.SetWinsize(t.master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+	}
+	return nil
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 3622196b78..6671ebe129 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -227,7 +227,7 @@ func createCommand(container *libcontainer.Container, console, logFile string, p
 		"init"}, args...)...)
 
 	command.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: uintptr(getNamespaceFlags(container.Namespaces)),
+		Cloneflags: uintptr(GetNamespaceFlags(container.Namespaces)),
 	}
 	command.Env = container.Env
 	return command
diff --git a/components/engine/pkg/libcontainer/nsinit/ns_linux.go b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
index e42d4b88d7..58af24798f 100644
--- a/components/engine/pkg/libcontainer/nsinit/ns_linux.go
+++ b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
@@ -28,7 +28,7 @@ var namespaceFileMap = map[libcontainer.Namespace]string{
 
 // getNamespaceFlags parses the container's Namespaces options to set the correct
 // flags on clone, unshare, and setns
-func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
+func GetNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
 	for _, ns := range namespaces {
 		flag |= namespaceMap[ns]
 	}
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index a38109cca0..9f16d6213b 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -7,7 +7,8 @@ import (
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/execdriver"
-	"github.com/dotcloud/docker/execdriver/lxc"
+	_ "github.com/dotcloud/docker/execdriver/lxc"
+	"github.com/dotcloud/docker/execdriver/namespaces"
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/graphdriver/aufs"
 	_ "github.com/dotcloud/docker/graphdriver/btrfs"
@@ -703,7 +704,7 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 
 	sysInfo := sysinfo.New(false)
 
-	ed, err := lxc.NewDriver(config.Root, sysInfo.AppArmor)
+	ed, err := namespaces.NewDriver()
 	if err != nil {
 		return nil, err
 	}

From 2cf8cc3b3a200ca369a9c3bd67daaefb1a6da30d Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Fri, 21 Feb 2014 18:07:51 +0200
Subject: [PATCH 222/403] Remove Vagrantfile and remove it from all docs

This removes the Vagrantfile and updates the documentation to remove
the steps which explain how to install Docker in a VM via Vagrant.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 67d55860a52bec8b1a1327355b4f27674ec912aa
Component: engine
---
 components/engine/.gitignore                  |   1 +
 components/engine/MAINTAINERS                 |   1 -
 components/engine/Vagrantfile                 | 206 -----------------
 .../sources/contributing/devenvironment.rst   |   8 -
 components/engine/docs/sources/faq.rst        |   6 +-
 components/engine/docs/sources/index.rst      |   2 +-
 .../docs/sources/installation/amazon.rst      | 111 +--------
 .../docs/sources/installation/windows.rst     | 213 +++---------------
 8 files changed, 37 insertions(+), 511 deletions(-)
 delete mode 100644 components/engine/Vagrantfile

diff --git a/components/engine/.gitignore b/components/engine/.gitignore
index a40d9e067c..0087b47302 100644
--- a/components/engine/.gitignore
+++ b/components/engine/.gitignore
@@ -22,3 +22,4 @@ bundles/
 .git/
 vendor/pkg/
 pyenv
+Vagrantfile
diff --git a/components/engine/MAINTAINERS b/components/engine/MAINTAINERS
index 895fba563a..a08f8f3140 100644
--- a/components/engine/MAINTAINERS
+++ b/components/engine/MAINTAINERS
@@ -6,4 +6,3 @@ Michael Crosby <michael@crosbymichael.com> (@crosbymichael)
 api.go: Victor Vieux <victor@dotcloud.com> (@vieux)
 Dockerfile: Tianon Gravi <admwiggin@gmail.com> (@tianon)
 Makefile: Tianon Gravi <admwiggin@gmail.com> (@tianon)
-Vagrantfile: Cristian Staretu <cristian.staretu@gmail.com> (@unclejack)
diff --git a/components/engine/Vagrantfile b/components/engine/Vagrantfile
deleted file mode 100644
index 23f262020a..0000000000
--- a/components/engine/Vagrantfile
+++ /dev/null
@@ -1,206 +0,0 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
-
-BOX_NAME = ENV['BOX_NAME'] || "ubuntu"
-BOX_URI = ENV['BOX_URI'] || "http://files.vagrantup.com/precise64.box"
-VF_BOX_URI = ENV['BOX_URI'] || "http://files.vagrantup.com/precise64_vmware_fusion.box"
-AWS_BOX_URI = ENV['BOX_URI'] || "https://github.com/mitchellh/vagrant-aws/raw/master/dummy.box"
-AWS_REGION = ENV['AWS_REGION'] || "us-east-1"
-AWS_AMI = ENV['AWS_AMI'] || "ami-69f5a900"
-AWS_INSTANCE_TYPE = ENV['AWS_INSTANCE_TYPE'] || 't1.micro'
-SSH_PRIVKEY_PATH = ENV['SSH_PRIVKEY_PATH']
-PRIVATE_NETWORK = ENV['PRIVATE_NETWORK']
-
-# Boolean that forwards the Docker dynamic ports 49000-49900
-# See http://docs.docker.io/en/latest/use/port_redirection/ for more
-# $ FORWARD_DOCKER_PORTS=1 vagrant [up|reload]
-FORWARD_DOCKER_PORTS = ENV['FORWARD_DOCKER_PORTS']
-VAGRANT_RAM = ENV['VAGRANT_RAM'] || 512
-VAGRANT_CORES = ENV['VAGRANT_CORES'] || 1
-
-# You may also provide a comma-separated list of ports
-# for Vagrant to forward. For example:
-# $ FORWARD_PORTS=8080,27017 vagrant [up|reload]
-FORWARD_PORTS = ENV['FORWARD_PORTS']
-
-# A script to upgrade from the 12.04 kernel to the raring backport kernel (3.8)
-# and install docker.
-$script = <<SCRIPT
-# The username to add to the docker group will be passed as the first argument
-# to the script.  If nothing is passed, default to "vagrant".
-user="$1"
-if [ -z "$user" ]; then
-    user=vagrant
-fi
-
-# Enable memory cgroup and swap accounting
-sed -i 's/GRUB_CMDLINE_LINUX=""/GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1"/g' /etc/default/grub
-update-grub
-
-# Adding an apt gpg key is idempotent.
-apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9
-
-# Creating the docker.list file is idempotent, but it may overwrite desired
-# settings if it already exists.  This could be solved with md5sum but it
-# doesn't seem worth it.
-echo 'deb http://get.docker.io/ubuntu docker main' > \
-    /etc/apt/sources.list.d/docker.list
-
-# Update remote package metadata.  'apt-get update' is idempotent.
-apt-get update -q
-
-# Install docker.  'apt-get install' is idempotent.
-apt-get install -q -y lxc-docker
-
-usermod -a -G docker "$user"
-
-tmp=`mktemp -q` && {
-    # Only install the backport kernel, don't bother upgrading if the backport is
-    # already installed.  We want parse the output of apt so we need to save it
-    # with 'tee'.  NOTE: The installation of the kernel will trigger dkms to
-    # install vboxguest if needed.
-    apt-get install -q -y --no-upgrade linux-image-generic-lts-raring | \
-        tee "$tmp"
-
-    # Parse the number of installed packages from the output
-    NUM_INST=`awk '$2 == "upgraded," && $4 == "newly" { print $3 }' "$tmp"`
-    rm "$tmp"
-}
-
-# If the number of installed packages is greater than 0, we want to reboot (the
-# backport kernel was installed but is not running).
-if [ "$NUM_INST" -gt 0 ];
-then
-    echo "Rebooting down to activate new kernel."
-    echo "/vagrant will not be mounted.  Use 'vagrant halt' followed by"
-    echo "'vagrant up' to ensure /vagrant is mounted."
-    shutdown -r now
-fi
-SCRIPT
-
-# We need to install the virtualbox guest additions *before* we do the normal
-# docker installation.  As such this script is prepended to the common docker
-# install script above.  This allows the install of the backport kernel to
-# trigger dkms to build the virtualbox guest module install.
-$vbox_script = <<VBOX_SCRIPT + $script
-# Install the VirtualBox guest additions if they aren't already installed.
-if [ ! -d /opt/VBoxGuestAdditions-4.3.6/ ]; then
-    # Update remote package metadata.  'apt-get update' is idempotent.
-    apt-get update -q
-
-    # Kernel Headers and dkms are required to build the vbox guest kernel
-    # modules.
-    apt-get install -q -y linux-headers-generic-lts-raring dkms
-
-    echo 'Downloading VBox Guest Additions...'
-    wget -cq http://dlc.sun.com.edgesuite.net/virtualbox/4.3.6/VBoxGuestAdditions_4.3.6.iso
-    echo "95648fcdb5d028e64145a2fe2f2f28c946d219da366389295a61fed296ca79f0  VBoxGuestAdditions_4.3.6.iso" | sha256sum --check || exit 1
-
-    mount -o loop,ro /home/vagrant/VBoxGuestAdditions_4.3.6.iso /mnt
-    /mnt/VBoxLinuxAdditions.run --nox11
-    umount /mnt
-fi
-VBOX_SCRIPT
-
-Vagrant::Config.run do |config|
-  # Setup virtual machine box. This VM configuration code is always executed.
-  config.vm.box = BOX_NAME
-  config.vm.box_url = BOX_URI
-
-  # Use the specified private key path if it is specified and not empty.
-  if SSH_PRIVKEY_PATH
-      config.ssh.private_key_path = SSH_PRIVKEY_PATH
-  end
-
-  config.ssh.forward_agent = true
-end
-
-# Providers were added on Vagrant >= 1.1.0
-#
-# NOTE: The vagrant "vm.provision" appends its arguments to a list and executes
-# them in order.  If you invoke "vm.provision :shell, :inline => $script"
-# twice then vagrant will run the script two times.  Unfortunately when you use
-# providers and the override argument to set up provisioners (like the vbox
-# guest extensions) they 1) don't replace the other provisioners (they append
-# to the end of the list) and 2) you can't control the order the provisioners
-# are executed (you can only append to the list).  If you want the virtualbox
-# only script to run before the other script, you have to jump through a lot of
-# hoops.
-#
-# Here is my only repeatable solution: make one script that is common ($script)
-# and another script that is the virtual box guest *prepended* to the common
-# script.  Only ever use "vm.provision" *one time* per provider.  That means
-# every single provider has an override, and every single one configures
-# "vm.provision".  Much saddness, but such is life.
-Vagrant::VERSION >= "1.1.0" and Vagrant.configure("2") do |config|
-  config.vm.provider :aws do |aws, override|
-    username = "ubuntu"
-    override.vm.box_url = AWS_BOX_URI
-    override.vm.provision :shell, :inline => $script, :args => username
-    aws.access_key_id = ENV["AWS_ACCESS_KEY"]
-    aws.secret_access_key = ENV["AWS_SECRET_KEY"]
-    aws.keypair_name = ENV["AWS_KEYPAIR_NAME"]
-    override.ssh.username = username
-    aws.region = AWS_REGION
-    aws.ami    = AWS_AMI
-    aws.instance_type = AWS_INSTANCE_TYPE
-  end
-
-  config.vm.provider :rackspace do |rs, override|
-    override.vm.provision :shell, :inline => $script
-    rs.username = ENV["RS_USERNAME"]
-    rs.api_key  = ENV["RS_API_KEY"]
-    rs.public_key_path = ENV["RS_PUBLIC_KEY"]
-    rs.flavor   = /512MB/
-    rs.image    = /Ubuntu/
-  end
-
-  config.vm.provider :vmware_fusion do |f, override|
-    override.vm.box_url = VF_BOX_URI
-    override.vm.synced_folder ".", "/vagrant", disabled: true
-    override.vm.provision :shell, :inline => $script
-    f.vmx["displayName"] = "docker"
-  end
-
-  config.vm.provider :virtualbox do |vb, override|
-    override.vm.provision :shell, :inline => $vbox_script
-    vb.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
-    vb.customize ["modifyvm", :id, "--natdnsproxy1", "on"]
-    vb.customize ["modifyvm", :id, "--memory", VAGRANT_RAM]
-    vb.customize ["modifyvm", :id, "--cpus", VAGRANT_CORES]
-  end
-end
-
-# If this is a version 1 config, virtualbox is the only option.  A version 2
-# config would have already been set in the above provider section.
-Vagrant::VERSION < "1.1.0" and Vagrant::Config.run do |config|
-  config.vm.provision :shell, :inline => $vbox_script
-end
-
-# Setup port forwarding per loaded environment variables
-forward_ports = FORWARD_DOCKER_PORTS.nil? ? [] : [*49153..49900]
-forward_ports += FORWARD_PORTS.split(',').map{|i| i.to_i } if FORWARD_PORTS
-if forward_ports.any?
-  Vagrant::VERSION < "1.1.0" and Vagrant::Config.run do |config|
-    forward_ports.each do |port|
-      config.vm.forward_port port, port
-    end
-  end
-
-  Vagrant::VERSION >= "1.1.0" and Vagrant.configure("2") do |config|
-    forward_ports.each do |port|
-      config.vm.network :forwarded_port, :host => port, :guest => port, auto_correct: true
-    end
-  end
-end
-
-if !PRIVATE_NETWORK.nil?
-  Vagrant::VERSION < "1.1.0" and Vagrant::Config.run do |config|
-    config.vm.network :hostonly, PRIVATE_NETWORK
-  end
-
-  Vagrant::VERSION >= "1.1.0" and Vagrant.configure("2") do |config|
-    config.vm.network "private_network", ip: PRIVATE_NETWORK
-  end
-end
-
diff --git a/components/engine/docs/sources/contributing/devenvironment.rst b/components/engine/docs/sources/contributing/devenvironment.rst
index cab4c71afb..f0a1398d70 100644
--- a/components/engine/docs/sources/contributing/devenvironment.rst
+++ b/components/engine/docs/sources/contributing/devenvironment.rst
@@ -92,14 +92,6 @@ To execute the test cases, run this command:
 
 	sudo make test
 
-
-Note: if you're running the tests in vagrant, you need to specify a dns entry in 
-the command (either edit the Makefile, or run the step manually): 
-
-.. code-block:: bash
-
-	sudo docker run -dns 8.8.8.8 -privileged -v `pwd`:/go/src/github.com/dotcloud/docker docker hack/make.sh test
-
 If the test are successful then the tail of the output should look something like this
 
 .. code-block:: bash
diff --git a/components/engine/docs/sources/faq.rst b/components/engine/docs/sources/faq.rst
index 5c8e69703f..2b48cc564c 100644
--- a/components/engine/docs/sources/faq.rst
+++ b/components/engine/docs/sources/faq.rst
@@ -25,9 +25,9 @@ Does Docker run on Mac OS X or Windows?
 
    Not at this time, Docker currently only runs on Linux, but you can
    use VirtualBox to run Docker in a virtual machine on your box, and
-   get the best of both worlds. Check out the
-   :ref:`macosx` and :ref:`windows` installation
-   guides.
+   get the best of both worlds. Check out the :ref:`macosx` and
+   :ref:`windows` installation guides. The small Linux distribution boot2docker
+   can be run inside virtual machines on these two operating systems.
 
 How do containers compare to virtual machines?
 ..............................................
diff --git a/components/engine/docs/sources/index.rst b/components/engine/docs/sources/index.rst
index 346a6619c5..df111f6aa5 100644
--- a/components/engine/docs/sources/index.rst
+++ b/components/engine/docs/sources/index.rst
@@ -24,6 +24,6 @@ For a high-level overview of Docker, please see the `Introduction
 Docker, we have a `quick start <http://www.docker.io/gettingstarted>`_
 and a more in-depth guide to :ref:`ubuntu_linux` and other
 :ref:`installation_list` paths including prebuilt binaries,
-Vagrant-created VMs, Rackspace and Amazon instances.
+Rackspace and Amazon instances.
 
 Enough reading! :ref:`Try it out! <running_examples>`
diff --git a/components/engine/docs/sources/installation/amazon.rst b/components/engine/docs/sources/installation/amazon.rst
index 31090a070c..b5465e25f8 100644
--- a/components/engine/docs/sources/installation/amazon.rst
+++ b/components/engine/docs/sources/installation/amazon.rst
@@ -10,8 +10,7 @@ Amazon EC2
 There are several ways to install Docker on AWS EC2:
 
 * :ref:`amazonquickstart` or
-* :ref:`amazonstandard` or
-* :ref:`amazonvagrant`
+* :ref:`amazonstandard`
 
 **You'll need an** `AWS account <http://aws.amazon.com/>`_ **first, of course.**
 
@@ -73,112 +72,4 @@ running Ubuntu. Just follow Step 1 from :ref:`amazonquickstart` to
 pick an image (or use one of your own) and skip the step with the
 *User Data*. Then continue with the :ref:`ubuntu_linux` instructions.
 
-.. _amazonvagrant:
-
-Use Vagrant
------------
-
-.. include:: install_unofficial.inc
-  
-And finally, if you prefer to work through Vagrant, you can install
-Docker that way too. Vagrant 1.1 or higher is required.
-
-1. Install vagrant from http://www.vagrantup.com/ (or use your package manager)
-2. Install the vagrant aws plugin
-
-   ::
-
-       vagrant plugin install vagrant-aws
-
-
-3. Get the docker sources, this will give you the latest Vagrantfile.
-
-   ::
-
-      git clone https://github.com/dotcloud/docker.git
-
-
-4. Check your AWS environment.
-
-   Create a keypair specifically for EC2, give it a name and save it
-   to your disk. *I usually store these in my ~/.ssh/ folder*.
-
-   Check that your default security group has an inbound rule to
-   accept SSH (port 22) connections.
-
-5. Inform Vagrant of your settings
-
-   Vagrant will read your access credentials from your environment, so
-   we need to set them there first. Make sure you have everything on
-   amazon aws setup so you can (manually) deploy a new image to EC2.
-
-   Note that where possible these variables are the same as those honored by
-   the ec2 api tools.
-   ::
-
-       export AWS_ACCESS_KEY=xxx
-       export AWS_SECRET_KEY=xxx
-       export AWS_KEYPAIR_NAME=xxx
-       export SSH_PRIVKEY_PATH=xxx
-
-       export BOX_NAME=xxx
-       export AWS_REGION=xxx
-       export AWS_AMI=xxx
-       export AWS_INSTANCE_TYPE=xxx
-
-   The required environment variables are:
-
-   * ``AWS_ACCESS_KEY`` - The API key used to make requests to AWS
-   * ``AWS_SECRET_KEY`` - The secret key to make AWS API requests
-   * ``AWS_KEYPAIR_NAME`` - The name of the keypair used for this EC2 instance
-   * ``SSH_PRIVKEY_PATH`` - The path to the private key for the named
-     keypair, for example ``~/.ssh/docker.pem``
-
-   There are a number of optional environment variables:
-
-   * ``BOX_NAME`` - The name of the vagrant box to use.  Defaults to
-     ``ubuntu``.
-   * ``AWS_REGION`` - The aws region to spawn the vm in.  Defaults to
-     ``us-east-1``.
-   * ``AWS_AMI`` - The aws AMI to start with as a base.  This must be
-     be an ubuntu 12.04 precise image.  You must change this value if
-     ``AWS_REGION`` is set to a value other than ``us-east-1``.
-     This is because AMIs are region specific.  Defaults to ``ami-69f5a900``.
-   * ``AWS_INSTANCE_TYPE`` - The aws instance type.  Defaults to ``t1.micro``.
-
-   You can check if they are set correctly by doing something like
-
-   ::
-
-      echo $AWS_ACCESS_KEY
-
-6. Do the magic!
-
-   ::
-
-      vagrant up --provider=aws
-
-
-   If it stalls indefinitely on ``[default] Waiting for SSH to become
-   available...``, Double check your default security zone on AWS
-   includes rights to SSH (port 22) to your container.
-
-   If you have an advanced AWS setup, you might want to have a look at
-   `vagrant-aws <https://github.com/mitchellh/vagrant-aws>`_.
-
-7. Connect to your machine
-
-   .. code-block:: bash
-
-      vagrant ssh
-
-8. Your first command
-
-   Now you are in the VM, run docker
-
-   .. code-block:: bash
-
-      sudo docker
-
-
 Continue with the :ref:`hello_world` example.
diff --git a/components/engine/docs/sources/installation/windows.rst b/components/engine/docs/sources/installation/windows.rst
index 9d965ea3fe..d00b012e6c 100644
--- a/components/engine/docs/sources/installation/windows.rst
+++ b/components/engine/docs/sources/installation/windows.rst
@@ -1,223 +1,72 @@
 :title: Installation on Windows
 :description: Please note this project is currently under heavy development. It should not be used in production.
-:keywords: Docker, Docker documentation, Windows, requirements, virtualbox, vagrant, git, ssh, putty, cygwin
+:keywords: Docker, Docker documentation, Windows, requirements, virtualbox, boot2docker
 
 .. _windows:
 
 Windows
 =======
 
-Docker can run on Windows using a VM like VirtualBox. You then run
-Linux within the VM.
+Docker can run on Windows using a virtualization platform like VirtualBox. A Linux
+distribution is run inside a virtual machine and that's where Docker will run. 
 
 Installation
 ------------
 
 .. include:: install_header.inc
 
-.. include:: install_unofficial.inc
+1. Install virtualbox from https://www.virtualbox.org - or follow this `tutorial <http://www.slideshare.net/julienbarbier42/install-virtualbox-on-windows-7>`_.
 
-1. Install virtualbox from https://www.virtualbox.org - or follow this tutorial__
+2. Download the latest boot2docker.iso from https://github.com/boot2docker/boot2docker/releases.
 
-.. __: http://www.slideshare.net/julienbarbier42/install-virtualbox-on-windows-7
+3. Start VirtualBox.
 
-2. Install vagrant from http://www.vagrantup.com - or follow this tutorial__
+4. Create a new Virtual machine with the following settings:
 
-.. __: http://www.slideshare.net/julienbarbier42/install-vagrant-on-windows-7
+ - `Name: boot2docker`
+ - `Type: Linux`
+ - `Version: Linux 2.6 (64 bit)`
+ - `Memory size: 1024 MB`
+ - `Hard drive: Do not add a virtual hard drive`
 
-3. Install git with ssh from http://git-scm.com/downloads - or follow this tutorial__
+5. Open the settings of the virtual machine:
 
-.. __: http://www.slideshare.net/julienbarbier42/install-git-with-ssh-on-windows-7
+   5.1. go to Storage
 
+   5.2. click the empty slot below `Controller: IDE`
 
-We recommend having at least 2Gb of free disk space and 2Gb of RAM (or more).
+   5.3. click the disc icon on the right of `IDE Secondary Master`
 
-Opening a command prompt
-------------------------
+   5.4. click `Choose a virtual CD/DVD disk file`
 
-First open a cmd prompt. Press Windows key and then press “R”
-key. This will open the RUN dialog box for you. Type “cmd” and press
-Enter. Or you can click on Start, type “cmd” in the “Search programs
-and files” field, and click on cmd.exe.
+6. Browse to the path where you've saved the `boot2docker.iso`, select the `boot2docker.iso` and click open.
 
-.. image:: images/win/_01.gif
-   :alt: Git install
-   :align: center
+7. Click OK on the Settings dialog to save the changes and close the window.
 
-This should open a cmd prompt window.
+8. Start the virtual machine by clicking the green start button.
 
-.. image:: images/win/_02.gif
-   :alt: run docker
-   :align: center
-
-Alternatively, you can also use a Cygwin terminal, or Git Bash (or any
-other command line program you are usually using). The next steps
-would be the same.
-
-.. _launch_ubuntu:
-
-Launch an Ubuntu virtual server
--------------------------------
-
-Let’s download and run an Ubuntu image with docker binaries already
-installed.
-
-.. code-block:: bash
-
-	git clone https://github.com/dotcloud/docker.git 
-	cd docker
-	vagrant up
-
-.. image:: images/win/run_02_.gif
-   :alt: run docker
-   :align: center
-
-Congratulations! You are running an Ubuntu server with docker
-installed on it. You do not see it though, because it is running in
-the background.
-
-Log onto your Ubuntu server
----------------------------
-
-Let’s log into your Ubuntu server now. To do so you have two choices:
-
-- Use Vagrant on Windows command prompt OR
-- Use SSH
-
-Using Vagrant on Windows Command Prompt
-```````````````````````````````````````
-
-Run the following command
-
-.. code-block:: bash
-
-	vagrant ssh
-
-You may see an error message starting with “`ssh` executable not
-found”. In this case it means that you do not have SSH in your
-PATH. If you do not have SSH in your PATH you can set it up with the
-“set” command. For instance, if your ssh.exe is in the folder named
-“C:\Program Files (x86)\Git\bin”, then you can run the following
-command:
-
-.. code-block:: bash
-
-	set PATH=%PATH%;C:\Program Files (x86)\Git\bin
-
-.. image:: images/win/run_03.gif
-   :alt: run docker
-   :align: center
-
-Using SSH
-`````````
-
-First step is to get the IP and port of your Ubuntu server. Simply run:
-
-.. code-block:: bash
-
-	vagrant ssh-config 
-
-You should see an output with HostName and Port information. In this
-example, HostName is 127.0.0.1 and port is 2222. And the User is
-“vagrant”. The password is not shown, but it is also “vagrant”.
-
-.. image:: images/win/ssh-config.gif
-   :alt: run docker
-   :align: center
-
-You can now use this information for connecting via SSH to your
-server. To do so you can:
-
-- Use putty.exe OR
-- Use SSH from a terminal
-
-Use putty.exe
-'''''''''''''
-
-You can download putty.exe from this page
-http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Launch
-putty.exe and simply enter the information you got from last step.
-
-.. image:: images/win/putty.gif
-   :alt: run docker
-   :align: center
-
-Open, and enter user = vagrant and password = vagrant.
-
-.. image:: images/win/putty_2.gif
-   :alt: run docker
-   :align: center
-
-SSH from a terminal
-'''''''''''''''''''
-
-You can also run this command on your favorite terminal (windows
-prompt, cygwin, git-bash, …). Make sure to adapt the IP and port from
-what you got from the vagrant ssh-config command.
-
-.. code-block:: bash
-
-	ssh vagrant@127.0.0.1 –p 2222
-
-Enter user = vagrant and password = vagrant.
-
-.. image:: images/win/cygwin.gif
-   :alt: run docker
-   :align: center
-
-Congratulations, you are now logged onto your Ubuntu Server, running
-on top of your Windows machine !
+9. The boot2docker virtual machine should boot now.
 
 Running Docker
 --------------
 
-First you have to be root in order to run docker. Simply run the
-following command:
+boot2docker will log you in automatically so you can start using Docker right
+away.
 
-.. code-block:: bash
-
-	sudo su
-
-You are now ready for the docker’s “hello world” example. Run
+Let's try the “hello world” example. Run
 
 .. code-block:: bash
 
 	docker run busybox echo hello world
 
-.. image:: images/win/run_04.gif
-   :alt: run docker
-   :align: center
+This will download the small busybox image and print hello world.
 
-All done!
 
-Now you can continue with the :ref:`hello_world` example.
+Observations
+------------
 
-Troubleshooting
----------------
+Persistent storage
+``````````````````
 
-VM does not boot
-````````````````
-
-.. image:: images/win/ts_go_bios.JPG
-
-If you run into this error message "The VM failed to remain in the
-'running' state while attempting to boot", please check that your
-computer has virtualization technology available and activated by
-going to the BIOS. Here's an example for an HP computer (System
-configuration / Device configuration)
-
-.. image:: images/win/hp_bios_vm.JPG
-
-On some machines the BIOS menu can only be accessed before startup.
-To access BIOS in this scenario you should restart your computer and 
-press ESC/Enter when prompted to access the boot and BIOS controls. Typically
-the option to allow virtualization is contained within the BIOS/Security menu.
-
-Docker is not installed
-```````````````````````
-
-.. image:: images/win/ts_no_docker.JPG
-
-If you run into this error message "The program 'docker' is currently
-not installed", try deleting the docker folder and restart from
-:ref:`launch_ubuntu`
+The virtual machine created above lacks any persistent data storage. All images
+and containers will be lost when shutting down or rebooting the VM.

From 7b25c9e59d3c447234f1fdfae8c2b02fd4075cb3 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 21:14:21 -0800
Subject: [PATCH 223/403] Export functions of nsinit
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 9876e5b8901199bad2ab424593131d574b582bf9 Component: engine

---
 .../engine/pkg/libcontainer/nsinit/exec.go    | 30 ++++++++++---------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 6671ebe129..b2eaa0bc65 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -30,7 +30,7 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 
 	if container.Tty {
 		log.Printf("setting up master and console")
-		master, console, err = createMasterAndConsole()
+		master, console, err = CreateMasterAndConsole()
 		if err != nil {
 			return -1, err
 		}
@@ -44,7 +44,7 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 	}
 	system.UsetCloseOnExec(r.Fd())
 
-	command := createCommand(container, console, logFile, r.Fd(), args)
+	command := CreateCommand(container, console, logFile, r.Fd(), args)
 	if !container.Tty {
 		log.Printf("opening pipes on command")
 		if inPipe, err = command.StdinPipe(); err != nil {
@@ -81,12 +81,12 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 
 	if container.Network != nil {
 		log.Printf("creating veth pair")
-		vethPair, err := initializeContainerVeth(container.Network.Bridge, container.Network.Mtu, command.Process.Pid)
+		vethPair, err := InitializeContainerVeth(container.Network.Bridge, container.Network.Mtu, command.Process.Pid)
 		if err != nil {
 			return -1, err
 		}
 		log.Printf("sending %s as veth pair name", vethPair)
-		sendVethName(w, vethPair)
+		SendVethName(w, vethPair)
 	}
 
 	// Sync with child
@@ -99,7 +99,7 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 		go io.Copy(stdout, master)
 		go io.Copy(master, stdin)
 
-		state, err := setupWindow(master)
+		state, err := SetupWindow(master, os.Stdin)
 		if err != nil {
 			command.Process.Kill()
 			return -1, err
@@ -125,9 +125,9 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
-// sendVethName writes the veth pair name to the child's stdin then closes the
+// SendVethName writes the veth pair name to the child's stdin then closes the
 // pipe so that the child stops waiting for more data
-func sendVethName(pipe io.Writer, name string) {
+func SendVethName(pipe io.Writer, name string) {
 	fmt.Fprint(pipe, name)
 }
 
@@ -138,7 +138,7 @@ func sendVethName(pipe io.Writer, name string) {
 // Then will with set the other side of the veth pair into the container's namespaced
 // using the pid and returns the veth's interface name to provide to the container to
 // finish setting up the interface inside the namespace
-func initializeContainerVeth(bridge string, mtu, nspid int) (string, error) {
+func InitializeContainerVeth(bridge string, mtu, nspid int) (string, error) {
 	name1, name2, err := createVethPair()
 	if err != nil {
 		return "", err
@@ -160,20 +160,22 @@ func initializeContainerVeth(bridge string, mtu, nspid int) (string, error) {
 	return name2, nil
 }
 
-func setupWindow(master *os.File) (*term.State, error) {
-	ws, err := term.GetWinsize(os.Stdin.Fd())
+// SetupWindow gets the parent window size and sets the master
+// pty to the current size and set the parents mode to RAW
+func SetupWindow(master, parent *os.File) (*term.State, error) {
+	ws, err := term.GetWinsize(parent.Fd())
 	if err != nil {
 		return nil, err
 	}
 	if err := term.SetWinsize(master.Fd(), ws); err != nil {
 		return nil, err
 	}
-	return term.SetRawTerminal(os.Stdin.Fd())
+	return term.SetRawTerminal(parent.Fd())
 }
 
-// createMasterAndConsole will open /dev/ptmx on the host and retreive the
+// CreateMasterAndConsole will open /dev/ptmx on the host and retreive the
 // pts name for use as the pty slave inside the container
-func createMasterAndConsole() (*os.File, string, error) {
+func CreateMasterAndConsole() (*os.File, string, error) {
 	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
 	if err != nil {
 		return nil, "", err
@@ -217,7 +219,7 @@ func deletePidFile() error {
 // createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
-func createCommand(container *libcontainer.Container, console, logFile string, pipe uintptr, args []string) *exec.Cmd {
+func CreateCommand(container *libcontainer.Container, console, logFile string, pipe uintptr, args []string) *exec.Cmd {
 	// get our binary name so we can always reexec ourself
 	name := os.Args[0]
 	command := exec.Command(name, append([]string{

From 5eca2c008a9ba90edc84551d7472cc0663d4eca7 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 22:20:15 -0800
Subject: [PATCH 224/403] Refactor network creation and initialization into
 strategies Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 5a4069f3aacd0dc30ee7c5dd97f0dc9a6e416f35 Component: engine

---
 components/engine/pkg/libcontainer/README.md  |   9 +-
 .../engine/pkg/libcontainer/container.go      |  13 ++-
 .../engine/pkg/libcontainer/container.json    |   9 +-
 .../pkg/libcontainer/network/strategy.go      |  32 ++++++
 .../engine/pkg/libcontainer/network/veth.go   | 103 ++++++++++++++++++
 .../engine/pkg/libcontainer/nsinit/exec.go    |  97 ++++++-----------
 .../engine/pkg/libcontainer/nsinit/init.go    |  55 +++-------
 7 files changed, 211 insertions(+), 107 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/network/strategy.go
 create mode 100644 components/engine/pkg/libcontainer/network/veth.go

diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index 89a4ec0c48..36553af5bc 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -45,12 +45,17 @@ Sample `container.json` file:
         "AUDIT_WRITE",
         "AUDIT_CONTROL",
         "MAC_OVERRIDE",
-        "MAC_ADMIN"
+        "MAC_ADMIN",
+        "NET_ADMIN"
     ],
     "network": {
+        "type": "veth",
+        "context": {
+            "bridge": "docker0",
+            "prefix": "dock"
+        },
         "address": "172.17.0.100/16",
         "gateway": "172.17.42.1",
-        "bridge": "docker0",
         "mtu": 1500
     },
     "cgroups": {
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index 3c1b62b65a..4a47977334 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -4,6 +4,10 @@ import (
 	"github.com/dotcloud/docker/pkg/cgroups"
 )
 
+// Context is a generic key value pair that allows
+// arbatrary data to be sent
+type Context map[string]string
+
 // Container defines configuration options for how a
 // container is setup inside a directory and how a process should be executed
 type Container struct {
@@ -24,8 +28,9 @@ type Container struct {
 // The network configuration can be omited from a container causing the
 // container to be setup with the host's networking stack
 type Network struct {
-	Address string `json:"address,omitempty"`
-	Gateway string `json:"gateway,omitempty"`
-	Bridge  string `json:"bridge,omitempty"`
-	Mtu     int    `json:"mtu,omitempty"`
+	Type    string  `json:"type,omitempty"`    // type of networking to setup i.e. veth, macvlan, etc
+	Context Context `json:"context,omitempty"` // generic context for type specific networking options
+	Address string  `json:"address,omitempty"`
+	Gateway string  `json:"gateway,omitempty"`
+	Mtu     int     `json:"mtu,omitempty"`
 }
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index 07e52df428..c2b21f8609 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -28,12 +28,17 @@
         "AUDIT_WRITE",
         "AUDIT_CONTROL",
         "MAC_OVERRIDE",
-        "MAC_ADMIN"
+        "MAC_ADMIN",
+        "NET_ADMIN"
     ],
     "network": {
+        "type": "veth",
+        "context": {
+            "bridge": "docker0",
+            "prefix": "dock"
+        },
         "address": "172.17.0.100/16",
         "gateway": "172.17.42.1",
-        "bridge": "docker0",
         "mtu": 1500
     },
     "cgroups": {
diff --git a/components/engine/pkg/libcontainer/network/strategy.go b/components/engine/pkg/libcontainer/network/strategy.go
new file mode 100644
index 0000000000..8ecc11a24d
--- /dev/null
+++ b/components/engine/pkg/libcontainer/network/strategy.go
@@ -0,0 +1,32 @@
+package network
+
+import (
+	"errors"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+)
+
+var (
+	ErrNotValidStrategyType = errors.New("not a valid network strategy type")
+)
+
+var strategies = map[string]NetworkStrategy{
+	"veth": &Veth{},
+}
+
+// NetworkStrategy represends a specific network configuration for
+// a containers networking stack
+type NetworkStrategy interface {
+	Create(*libcontainer.Network, int) (libcontainer.Context, error)
+	Initialize(*libcontainer.Network, libcontainer.Context) error
+}
+
+// GetStrategy returns the specific network strategy for the
+// provided type.  If no strategy is registered for the type an
+// ErrNotValidStrategyType is returned.
+func GetStrategy(tpe string) (NetworkStrategy, error) {
+	s, exists := strategies[tpe]
+	if !exists {
+		return nil, ErrNotValidStrategyType
+	}
+	return s, nil
+}
diff --git a/components/engine/pkg/libcontainer/network/veth.go b/components/engine/pkg/libcontainer/network/veth.go
new file mode 100644
index 0000000000..61fec5500c
--- /dev/null
+++ b/components/engine/pkg/libcontainer/network/veth.go
@@ -0,0 +1,103 @@
+package network
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/utils"
+	"log"
+)
+
+type Veth struct {
+}
+
+func (v *Veth) Create(n *libcontainer.Network, nspid int) (libcontainer.Context, error) {
+	log.Printf("creating veth network")
+	var (
+		bridge string
+		prefix string
+		exists bool
+	)
+	if bridge, exists = n.Context["bridge"]; !exists {
+		return nil, fmt.Errorf("bridge does not exist in network context")
+	}
+	if prefix, exists = n.Context["prefix"]; !exists {
+		return nil, fmt.Errorf("veth prefix does not exist in network context")
+	}
+	name1, name2, err := createVethPair(prefix)
+	if err != nil {
+		return nil, err
+	}
+	context := libcontainer.Context{
+		"vethHost":  name1,
+		"vethChild": name2,
+	}
+	log.Printf("veth pair created %s <> %s", name1, name2)
+	if err := SetInterfaceMaster(name1, bridge); err != nil {
+		return context, err
+	}
+	if err := SetMtu(name1, n.Mtu); err != nil {
+		return context, err
+	}
+	if err := InterfaceUp(name1); err != nil {
+		return context, err
+	}
+	log.Printf("setting %s inside %d namespace", name2, nspid)
+	if err := SetInterfaceInNamespacePid(name2, nspid); err != nil {
+		return context, err
+	}
+	return context, nil
+}
+
+func (v *Veth) Initialize(config *libcontainer.Network, context libcontainer.Context) error {
+	var (
+		vethChild string
+		exists    bool
+	)
+	if vethChild, exists = context["vethChild"]; !exists {
+		return fmt.Errorf("vethChild does not exist in network context")
+	}
+	if err := InterfaceDown(vethChild); err != nil {
+		return fmt.Errorf("interface down %s %s", vethChild, err)
+	}
+	if err := ChangeInterfaceName(vethChild, "eth0"); err != nil {
+		return fmt.Errorf("change %s to eth0 %s", vethChild, err)
+	}
+	if err := SetInterfaceIp("eth0", config.Address); err != nil {
+		return fmt.Errorf("set eth0 ip %s", err)
+	}
+	if err := SetMtu("eth0", config.Mtu); err != nil {
+		return fmt.Errorf("set eth0 mtu to %d %s", config.Mtu, err)
+	}
+	if err := InterfaceUp("eth0"); err != nil {
+		return fmt.Errorf("eth0 up %s", err)
+	}
+	if err := SetMtu("lo", config.Mtu); err != nil {
+		return fmt.Errorf("set lo mtu to %d %s", config.Mtu, err)
+	}
+	if err := InterfaceUp("lo"); err != nil {
+		return fmt.Errorf("lo up %s", err)
+	}
+	if config.Gateway != "" {
+		if err := SetDefaultGateway(config.Gateway); err != nil {
+			return fmt.Errorf("set gateway to %s %s", config.Gateway, err)
+		}
+	}
+	return nil
+}
+
+// createVethPair will automatically generage two random names for
+// the veth pair and ensure that they have been created
+func createVethPair(prefix string) (name1 string, name2 string, err error) {
+	name1, err = utils.GenerateRandomName(prefix, 4)
+	if err != nil {
+		return
+	}
+	name2, err = utils.GenerateRandomName(prefix, 4)
+	if err != nil {
+		return
+	}
+	if err = CreateVethPair(name1, name2); err != nil {
+		return
+	}
+	return
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index b2eaa0bc65..6c4d7666a2 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -3,10 +3,10 @@
 package nsinit
 
 import (
+	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
-	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 	"github.com/dotcloud/docker/pkg/system"
 	"github.com/dotcloud/docker/pkg/term"
 	"io"
@@ -19,11 +19,11 @@ import (
 
 // Exec performes setup outside of a namespace so that a container can be
 // executed.  Exec is a high level function for working with container namespaces.
-func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.Writer, master *os.File, logFile string, args []string) (int, error) {
+func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.Writer,
+	master *os.File, logFile string, args []string) (int, error) {
 	var (
-		console string
-		err     error
-
+		console          string
+		err              error
 		inPipe           io.WriteCloser
 		outPipe, errPipe io.ReadCloser
 	)
@@ -46,7 +46,7 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 
 	command := CreateCommand(container, console, logFile, r.Fd(), args)
 	if !container.Tty {
-		log.Printf("opening pipes on command")
+		log.Printf("opening std pipes")
 		if inPipe, err = command.StdinPipe(); err != nil {
 			return -1, err
 		}
@@ -78,15 +78,9 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 			return -1, err
 		}
 	}
-
-	if container.Network != nil {
-		log.Printf("creating veth pair")
-		vethPair, err := InitializeContainerVeth(container.Network.Bridge, container.Network.Mtu, command.Process.Pid)
-		if err != nil {
-			return -1, err
-		}
-		log.Printf("sending %s as veth pair name", vethPair)
-		SendVethName(w, vethPair)
+	if err := InitializeNetworking(container, command.Process.Pid, w); err != nil {
+		command.Process.Kill()
+		return -1, err
 	}
 
 	// Sync with child
@@ -104,7 +98,7 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 			command.Process.Kill()
 			return -1, err
 		}
-		defer term.RestoreTerminal(uintptr(syscall.Stdin), state)
+		defer term.RestoreTerminal(os.Stdin.Fd(), state)
 	} else {
 		log.Printf("starting copy for std pipes")
 		go func() {
@@ -125,39 +119,34 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
-// SendVethName writes the veth pair name to the child's stdin then closes the
-// pipe so that the child stops waiting for more data
-func SendVethName(pipe io.Writer, name string) {
-	fmt.Fprint(pipe, name)
+func InitializeNetworking(container *libcontainer.Container, nspid int, pipe io.Writer) error {
+	if container.Network != nil {
+		log.Printf("creating host network configuration type %s", container.Network.Type)
+		strategy, err := network.GetStrategy(container.Network.Type)
+		if err != nil {
+			return err
+		}
+		networkContext, err := strategy.Create(container.Network, nspid)
+		if err != nil {
+			return err
+		}
+		log.Printf("sending %v as network context", networkContext)
+		if err := SendContext(pipe, networkContext); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
-// initializeContainerVeth will create a veth pair and setup the host's
-// side of the pair by setting the specified bridge as the master and bringing
-// up the interface.
-//
-// Then will with set the other side of the veth pair into the container's namespaced
-// using the pid and returns the veth's interface name to provide to the container to
-// finish setting up the interface inside the namespace
-func InitializeContainerVeth(bridge string, mtu, nspid int) (string, error) {
-	name1, name2, err := createVethPair()
+// SendContext writes the veth pair name to the child's stdin then closes the
+// pipe so that the child stops waiting for more data
+func SendContext(pipe io.Writer, context libcontainer.Context) error {
+	data, err := json.Marshal(context)
 	if err != nil {
-		return "", err
+		return err
 	}
-	log.Printf("veth pair created %s <> %s", name1, name2)
-	if err := network.SetInterfaceMaster(name1, bridge); err != nil {
-		return "", err
-	}
-	if err := network.SetMtu(name1, mtu); err != nil {
-		return "", err
-	}
-	if err := network.InterfaceUp(name1); err != nil {
-		return "", err
-	}
-	log.Printf("setting %s inside %d namespace", name2, nspid)
-	if err := network.SetInterfaceInNamespacePid(name2, nspid); err != nil {
-		return "", err
-	}
-	return name2, nil
+	pipe.Write(data)
+	return nil
 }
 
 // SetupWindow gets the parent window size and sets the master
@@ -190,29 +179,13 @@ func CreateMasterAndConsole() (*os.File, string, error) {
 	return master, console, nil
 }
 
-// createVethPair will automatically generage two random names for
-// the veth pair and ensure that they have been created
-func createVethPair() (name1 string, name2 string, err error) {
-	name1, err = utils.GenerateRandomName("dock", 4)
-	if err != nil {
-		return
-	}
-	name2, err = utils.GenerateRandomName("dock", 4)
-	if err != nil {
-		return
-	}
-	if err = network.CreateVethPair(name1, name2); err != nil {
-		return
-	}
-	return
-}
-
 // writePidFile writes the namespaced processes pid to .nspid in the rootfs for the container
 func writePidFile(command *exec.Cmd) error {
 	return ioutil.WriteFile(".nspid", []byte(fmt.Sprint(command.Process.Pid)), 0655)
 }
 
 func deletePidFile() error {
+	log.Printf("removing .nspid file")
 	return os.Remove(".nspid")
 }
 
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 04716ba645..f530d4a52a 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -3,6 +3,7 @@
 package nsinit
 
 import (
+	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
@@ -27,13 +28,10 @@ func Init(container *libcontainer.Container, uncleanRootfs, console string, pipe
 	log.Printf("initializing namespace at %s", rootfs)
 
 	// We always read this as it is a way to sync with the parent as well
-	tempVethName, err := getVethName(pipe)
+	context, err := GetContextFromParent(pipe)
 	if err != nil {
 		return err
 	}
-	if tempVethName != "" {
-		log.Printf("received veth name %s", tempVethName)
-	}
 	if console != "" {
 		log.Printf("setting up console for %s", console)
 		// close pipes so that we can replace it with the pty
@@ -62,7 +60,7 @@ func Init(container *libcontainer.Container, uncleanRootfs, console string, pipe
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
-	if err := setupVethNetwork(container.Network, tempVethName); err != nil {
+	if err := setupNetwork(container.Network, context); err != nil {
 		return fmt.Errorf("setup networking %s", err)
 	}
 	if err := system.Sethostname(container.Hostname); err != nil {
@@ -145,46 +143,29 @@ func openTerminal(name string, flag int) (*os.File, error) {
 // setupVethNetwork uses the Network config if it is not nil to initialize
 // the new veth interface inside the container for use by changing the name to eth0
 // setting the MTU and IP address along with the default gateway
-func setupVethNetwork(config *libcontainer.Network, tempVethName string) error {
+func setupNetwork(config *libcontainer.Network, context libcontainer.Context) error {
 	if config != nil {
-		if err := network.InterfaceDown(tempVethName); err != nil {
-			return fmt.Errorf("interface down %s %s", tempVethName, err)
-		}
-		if err := network.ChangeInterfaceName(tempVethName, "eth0"); err != nil {
-			return fmt.Errorf("change %s to eth0 %s", tempVethName, err)
-		}
-		if err := network.SetInterfaceIp("eth0", config.Address); err != nil {
-			return fmt.Errorf("set eth0 ip %s", err)
-		}
-		if err := network.SetMtu("eth0", config.Mtu); err != nil {
-			return fmt.Errorf("set eth0 mtu to %d %s", config.Mtu, err)
-		}
-		if err := network.InterfaceUp("eth0"); err != nil {
-			return fmt.Errorf("eth0 up %s", err)
-		}
-		if err := network.SetMtu("lo", config.Mtu); err != nil {
-			return fmt.Errorf("set lo mtu to %d %s", config.Mtu, err)
-		}
-		if err := network.InterfaceUp("lo"); err != nil {
-			return fmt.Errorf("lo up %s", err)
-		}
-		if config.Gateway != "" {
-			if err := network.SetDefaultGateway(config.Gateway); err != nil {
-				return fmt.Errorf("set gateway to %s %s", config.Gateway, err)
-			}
+		strategy, err := network.GetStrategy(config.Type)
+		if err != nil {
+			return err
 		}
+		return strategy.Initialize(config, context)
 	}
 	return nil
 }
 
-// getVethName reads from Stdin the temp veth name
-// sent by the parent processes after the veth pair
-// has been created and setup
-func getVethName(pipe io.ReadCloser) (string, error) {
+func GetContextFromParent(pipe io.ReadCloser) (libcontainer.Context, error) {
 	defer pipe.Close()
 	data, err := ioutil.ReadAll(pipe)
 	if err != nil {
-		return "", fmt.Errorf("error reading from stdin %s", err)
+		return nil, fmt.Errorf("error reading from stdin %s", err)
 	}
-	return string(data), nil
+	var context libcontainer.Context
+	if len(data) > 0 {
+		if err := json.Unmarshal(data, &context); err != nil {
+			return nil, err
+		}
+		log.Printf("received context %v", context)
+	}
+	return context, nil
 }

From 3e12f802f59fe59d1f3ff07403fce95dde4823d5 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 22:37:09 -0800
Subject: [PATCH 225/403] Refactor exec method Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: dd59f7fb286f2abff6cee2699e62fff564425149 Component: engine

---
 .../engine/pkg/libcontainer/nsinit/exec.go    | 138 ++++++++++--------
 1 file changed, 77 insertions(+), 61 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 6c4d7666a2..3cbe43ae7a 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -22,20 +22,10 @@ import (
 func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.Writer,
 	master *os.File, logFile string, args []string) (int, error) {
 	var (
-		console          string
-		err              error
-		inPipe           io.WriteCloser
-		outPipe, errPipe io.ReadCloser
+		console string
+		err     error
 	)
 
-	if container.Tty {
-		log.Printf("setting up master and console")
-		master, console, err = CreateMasterAndConsole()
-		if err != nil {
-			return -1, err
-		}
-	}
-
 	// create a pipe so that we can syncronize with the namespaced process and
 	// pass the veth name to the child
 	r, w, err := os.Pipe()
@@ -44,49 +34,15 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 	}
 	system.UsetCloseOnExec(r.Fd())
 
+	if container.Tty {
+		log.Printf("setting up master and console")
+		master, console, err = CreateMasterAndConsole()
+		if err != nil {
+			return -1, err
+		}
+	}
+
 	command := CreateCommand(container, console, logFile, r.Fd(), args)
-	if !container.Tty {
-		log.Printf("opening std pipes")
-		if inPipe, err = command.StdinPipe(); err != nil {
-			return -1, err
-		}
-		if outPipe, err = command.StdoutPipe(); err != nil {
-			return -1, err
-		}
-		if errPipe, err = command.StderrPipe(); err != nil {
-			return -1, err
-		}
-	}
-
-	log.Printf("staring init")
-	if err := command.Start(); err != nil {
-		return -1, err
-	}
-	log.Printf("writting state file")
-	if err := writePidFile(command); err != nil {
-		command.Process.Kill()
-		return -1, err
-	}
-	defer deletePidFile()
-
-	// Do this before syncing with child so that no children
-	// can escape the cgroup
-	if container.Cgroups != nil {
-		log.Printf("setting up cgroups")
-		if err := container.Cgroups.Apply(command.Process.Pid); err != nil {
-			command.Process.Kill()
-			return -1, err
-		}
-	}
-	if err := InitializeNetworking(container, command.Process.Pid, w); err != nil {
-		command.Process.Kill()
-		return -1, err
-	}
-
-	// Sync with child
-	log.Printf("closing sync pipes")
-	w.Close()
-	r.Close()
 
 	if container.Tty {
 		log.Printf("starting copy for tty")
@@ -100,15 +56,39 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 		}
 		defer term.RestoreTerminal(os.Stdin.Fd(), state)
 	} else {
-		log.Printf("starting copy for std pipes")
-		go func() {
-			defer inPipe.Close()
-			io.Copy(inPipe, stdin)
-		}()
-		go io.Copy(stdout, outPipe)
-		go io.Copy(stderr, errPipe)
+		if err := startStdCopy(command, stdin, stdout, stderr); err != nil {
+			command.Process.Kill()
+			return -1, err
+		}
 	}
 
+	log.Printf("staring init")
+	if err := command.Start(); err != nil {
+		return -1, err
+	}
+	log.Printf("writing state file")
+	if err := writePidFile(command); err != nil {
+		command.Process.Kill()
+		return -1, err
+	}
+	defer deletePidFile()
+
+	// Do this before syncing with child so that no children
+	// can escape the cgroup
+	if err := SetupCgroups(container, command.Process.Pid); err != nil {
+		command.Process.Kill()
+		return -1, err
+	}
+	if err := InitializeNetworking(container, command.Process.Pid, w); err != nil {
+		command.Process.Kill()
+		return -1, err
+	}
+
+	// Sync with child
+	log.Printf("closing sync pipes")
+	w.Close()
+	r.Close()
+
 	log.Printf("waiting on process")
 	if err := command.Wait(); err != nil {
 		if _, ok := err.(*exec.ExitError); !ok {
@@ -119,6 +99,16 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
+func SetupCgroups(container *libcontainer.Container, nspid int) error {
+	if container.Cgroups != nil {
+		log.Printf("setting up cgroups")
+		if err := container.Cgroups.Apply(nspid); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func InitializeNetworking(container *libcontainer.Container, nspid int, pipe io.Writer) error {
 	if container.Network != nil {
 		log.Printf("creating host network configuration type %s", container.Network.Type)
@@ -207,3 +197,29 @@ func CreateCommand(container *libcontainer.Container, console, logFile string, p
 	command.Env = container.Env
 	return command
 }
+
+func startStdCopy(command *exec.Cmd, stdin io.Reader, stdout, stderr io.Writer) error {
+	log.Printf("opening std pipes")
+	inPipe, err := command.StdinPipe()
+	if err != nil {
+		return err
+	}
+	outPipe, err := command.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	errPipe, err := command.StderrPipe()
+	if err != nil {
+		return err
+	}
+
+	log.Printf("starting copy for std pipes")
+	go func() {
+		defer inPipe.Close()
+		io.Copy(inPipe, stdin)
+	}()
+	go io.Copy(stdout, outPipe)
+	go io.Copy(stderr, errPipe)
+
+	return nil
+}

From 5daf4091ffa1dcce8a704c8977cd0d7205d3a157 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 21 Feb 2014 22:58:30 -0800
Subject: [PATCH 226/403] Add syncpipe for passing context
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 2412656ef54cb4df36df2f8122e1fda24ec8e8a4 Component: engine

---
 .../engine/pkg/libcontainer/nsinit/exec.go    | 27 ++-----
 .../engine/pkg/libcontainer/nsinit/init.go    | 44 +++++------
 .../pkg/libcontainer/nsinit/nsinit/main.go    |  6 +-
 .../pkg/libcontainer/nsinit/sync_pipe.go      | 73 +++++++++++++++++++
 4 files changed, 102 insertions(+), 48 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/nsinit/sync_pipe.go

diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index 3cbe43ae7a..ec75e9c923 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -3,7 +3,6 @@
 package nsinit
 
 import (
-	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
@@ -28,11 +27,10 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 
 	// create a pipe so that we can syncronize with the namespaced process and
 	// pass the veth name to the child
-	r, w, err := os.Pipe()
+	syncPipe, err := NewSyncPipe()
 	if err != nil {
 		return -1, err
 	}
-	system.UsetCloseOnExec(r.Fd())
 
 	if container.Tty {
 		log.Printf("setting up master and console")
@@ -42,8 +40,7 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 		}
 	}
 
-	command := CreateCommand(container, console, logFile, r.Fd(), args)
-
+	command := CreateCommand(container, console, logFile, syncPipe.child.Fd(), args)
 	if container.Tty {
 		log.Printf("starting copy for tty")
 		go io.Copy(stdout, master)
@@ -79,15 +76,14 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 		command.Process.Kill()
 		return -1, err
 	}
-	if err := InitializeNetworking(container, command.Process.Pid, w); err != nil {
+	if err := InitializeNetworking(container, command.Process.Pid, syncPipe); err != nil {
 		command.Process.Kill()
 		return -1, err
 	}
 
 	// Sync with child
 	log.Printf("closing sync pipes")
-	w.Close()
-	r.Close()
+	syncPipe.Close()
 
 	log.Printf("waiting on process")
 	if err := command.Wait(); err != nil {
@@ -109,7 +105,7 @@ func SetupCgroups(container *libcontainer.Container, nspid int) error {
 	return nil
 }
 
-func InitializeNetworking(container *libcontainer.Container, nspid int, pipe io.Writer) error {
+func InitializeNetworking(container *libcontainer.Container, nspid int, pipe *SyncPipe) error {
 	if container.Network != nil {
 		log.Printf("creating host network configuration type %s", container.Network.Type)
 		strategy, err := network.GetStrategy(container.Network.Type)
@@ -121,24 +117,13 @@ func InitializeNetworking(container *libcontainer.Container, nspid int, pipe io.
 			return err
 		}
 		log.Printf("sending %v as network context", networkContext)
-		if err := SendContext(pipe, networkContext); err != nil {
+		if err := pipe.SendToChild(networkContext); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-// SendContext writes the veth pair name to the child's stdin then closes the
-// pipe so that the child stops waiting for more data
-func SendContext(pipe io.Writer, context libcontainer.Context) error {
-	data, err := json.Marshal(context)
-	if err != nil {
-		return err
-	}
-	pipe.Write(data)
-	return nil
-}
-
 // SetupWindow gets the parent window size and sets the master
 // pty to the current size and set the parents mode to RAW
 func SetupWindow(master, parent *os.File) (*term.State, error) {
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index f530d4a52a..cdedc14769 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -3,14 +3,11 @@
 package nsinit
 
 import (
-	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
-	"io"
-	"io/ioutil"
 	"log"
 	"os"
 	"os/exec"
@@ -20,7 +17,7 @@ import (
 
 // Init is the init process that first runs inside a new namespace to setup mounts, users, networking,
 // and other options required for the new container.
-func Init(container *libcontainer.Container, uncleanRootfs, console string, pipe io.ReadCloser, args []string) error {
+func Init(container *libcontainer.Container, uncleanRootfs, console string, syncPipe *SyncPipe, args []string) error {
 	rootfs, err := resolveRootfs(uncleanRootfs)
 	if err != nil {
 		return err
@@ -28,16 +25,18 @@ func Init(container *libcontainer.Container, uncleanRootfs, console string, pipe
 	log.Printf("initializing namespace at %s", rootfs)
 
 	// We always read this as it is a way to sync with the parent as well
-	context, err := GetContextFromParent(pipe)
+	context, err := syncPipe.ReadFromParent()
 	if err != nil {
+		syncPipe.Close()
 		return err
 	}
+	syncPipe.Close()
+	log.Printf("received context from parent %v", context)
+
 	if console != "" {
 		log.Printf("setting up console for %s", console)
 		// close pipes so that we can replace it with the pty
-		os.Stdin.Close()
-		os.Stdout.Close()
-		os.Stderr.Close()
+		closeStdPipes()
 		slave, err := openTerminal(console, syscall.O_RDWR)
 		if err != nil {
 			return fmt.Errorf("open terminal %s", err)
@@ -79,18 +78,27 @@ func Init(container *libcontainer.Container, uncleanRootfs, console string, pipe
 			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
 		}
 	}
+	return execArgs(args, container.Env)
+}
+
+func execArgs(args []string, env []string) error {
 	name, err := exec.LookPath(args[0])
 	if err != nil {
 		return err
 	}
-
 	log.Printf("execing %s goodbye", name)
-	if err := system.Exec(name, args[0:], container.Env); err != nil {
+	if err := system.Exec(name, args[0:], env); err != nil {
 		return fmt.Errorf("exec %s", err)
 	}
 	panic("unreachable")
 }
 
+func closeStdPipes() {
+	os.Stdin.Close()
+	os.Stdout.Close()
+	os.Stderr.Close()
+}
+
 // resolveRootfs ensures that the current working directory is
 // not a symlink and returns the absolute path to the rootfs
 func resolveRootfs(uncleanRootfs string) (string, error) {
@@ -153,19 +161,3 @@ func setupNetwork(config *libcontainer.Network, context libcontainer.Context) er
 	}
 	return nil
 }
-
-func GetContextFromParent(pipe io.ReadCloser) (libcontainer.Context, error) {
-	defer pipe.Close()
-	data, err := ioutil.ReadAll(pipe)
-	if err != nil {
-		return nil, fmt.Errorf("error reading from stdin %s", err)
-	}
-	var context libcontainer.Context
-	if len(data) > 0 {
-		if err := json.Unmarshal(data, &context); err != nil {
-			return nil, err
-		}
-		log.Printf("received context %v", context)
-	}
-	return context, nil
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index 28d42d4643..2400ab6903 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -74,7 +74,11 @@ func main() {
 		if flag.NArg() < 2 {
 			log.Fatal(ErrWrongArguments)
 		}
-		if err := nsinit.Init(container, cwd, console, os.NewFile(uintptr(pipeFd), "pipe"), flag.Args()[1:]); err != nil {
+		syncPipe, err := nsinit.NewSyncPipeFromFd(0, uintptr(pipeFd))
+		if err != nil {
+			log.Fatal(err)
+		}
+		if err := nsinit.Init(container, cwd, console, syncPipe, flag.Args()[1:]); err != nil {
 			log.Fatal(err)
 		}
 	default:
diff --git a/components/engine/pkg/libcontainer/nsinit/sync_pipe.go b/components/engine/pkg/libcontainer/nsinit/sync_pipe.go
new file mode 100644
index 0000000000..7b29e98680
--- /dev/null
+++ b/components/engine/pkg/libcontainer/nsinit/sync_pipe.go
@@ -0,0 +1,73 @@
+package nsinit
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/system"
+	"io/ioutil"
+	"os"
+)
+
+// SyncPipe allows communication to and from the child processes
+// to it's parent and allows the two independent processes to
+// syncronize their state.
+type SyncPipe struct {
+	parent, child *os.File
+}
+
+func NewSyncPipe() (s *SyncPipe, err error) {
+	s = &SyncPipe{}
+	s.child, s.parent, err = os.Pipe()
+	if err != nil {
+		return nil, err
+	}
+	system.UsetCloseOnExec(s.child.Fd())
+	return s, nil
+}
+
+func NewSyncPipeFromFd(parendFd, childFd uintptr) (*SyncPipe, error) {
+	s := &SyncPipe{}
+	if parendFd > 0 {
+		s.parent = os.NewFile(parendFd, "parendPipe")
+	} else if childFd > 0 {
+		s.child = os.NewFile(childFd, "childPipe")
+	} else {
+		return nil, fmt.Errorf("no valid sync pipe fd specified")
+	}
+	return s, nil
+}
+
+func (s *SyncPipe) SendToChild(context libcontainer.Context) error {
+	data, err := json.Marshal(context)
+	if err != nil {
+		return err
+	}
+	s.parent.Write(data)
+	return nil
+}
+
+func (s *SyncPipe) ReadFromParent() (libcontainer.Context, error) {
+	data, err := ioutil.ReadAll(s.child)
+	if err != nil {
+		return nil, fmt.Errorf("error reading from sync pipe %s", err)
+	}
+	var context libcontainer.Context
+	if len(data) > 0 {
+		if err := json.Unmarshal(data, &context); err != nil {
+			return nil, err
+		}
+	}
+	return context, nil
+
+}
+
+func (s *SyncPipe) Close() error {
+	if s.parent != nil {
+		s.parent.Close()
+	}
+	if s.child != nil {
+		s.child.Close()
+	}
+	return nil
+}

From db3809fb1379421b6befb153a685f8bae5425960 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 22 Feb 2014 00:29:21 -0800
Subject: [PATCH 227/403] Abstract out diff implementations for importing
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 ae423a036e6f884572491b1ff5ef8a626b1592aa Component: engine

---
 .../engine/pkg/libcontainer/nsinit/command.go |  34 ++++++
 .../engine/pkg/libcontainer/nsinit/exec.go    | 107 +++--------------
 .../pkg/libcontainer/nsinit/nsinit/main.go    |   4 +-
 .../engine/pkg/libcontainer/nsinit/state.go   |  24 ++++
 .../engine/pkg/libcontainer/nsinit/term.go    | 109 ++++++++++++++++++
 5 files changed, 184 insertions(+), 94 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/nsinit/command.go
 create mode 100644 components/engine/pkg/libcontainer/nsinit/state.go
 create mode 100644 components/engine/pkg/libcontainer/nsinit/term.go

diff --git a/components/engine/pkg/libcontainer/nsinit/command.go b/components/engine/pkg/libcontainer/nsinit/command.go
new file mode 100644
index 0000000000..b1c5631b4b
--- /dev/null
+++ b/components/engine/pkg/libcontainer/nsinit/command.go
@@ -0,0 +1,34 @@
+package nsinit
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+type CommandFactory interface {
+	Create(container *libcontainer.Container, console, logFile string, syncFd uintptr, args []string) *exec.Cmd
+}
+
+type DefaultCommandFactory struct{}
+
+// Create will return an exec.Cmd with the Cloneflags set to the proper namespaces
+// defined on the container's configuration and use the current binary as the init with the
+// args provided
+func (c *DefaultCommandFactory) Create(container *libcontainer.Container, console, logFile string, pipe uintptr, args []string) *exec.Cmd {
+	// get our binary name so we can always reexec ourself
+	name := os.Args[0]
+	command := exec.Command(name, append([]string{
+		"-console", console,
+		"-pipe", fmt.Sprint(pipe),
+		"-log", logFile,
+		"init"}, args...)...)
+
+	command.SysProcAttr = &syscall.SysProcAttr{
+		Cloneflags: uintptr(GetNamespaceFlags(container.Namespaces)),
+	}
+	command.Env = container.Env
+	return command
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index ec75e9c923..ee83f4f107 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -3,13 +3,9 @@
 package nsinit
 
 import (
-	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
-	"github.com/dotcloud/docker/pkg/term"
-	"io"
-	"io/ioutil"
 	"log"
 	"os"
 	"os/exec"
@@ -18,9 +14,11 @@ import (
 
 // Exec performes setup outside of a namespace so that a container can be
 // executed.  Exec is a high level function for working with container namespaces.
-func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.Writer,
-	master *os.File, logFile string, args []string) (int, error) {
+func Exec(container *libcontainer.Container,
+	factory CommandFactory, state StateWriter, term Terminal,
+	logFile string, args []string) (int, error) {
 	var (
+		master  *os.File
 		console string
 		err     error
 	)
@@ -38,37 +36,28 @@ func Exec(container *libcontainer.Container, stdin io.Reader, stdout, stderr io.
 		if err != nil {
 			return -1, err
 		}
+		term.SetMaster(master)
 	}
 
-	command := CreateCommand(container, console, logFile, syncPipe.child.Fd(), args)
-	if container.Tty {
-		log.Printf("starting copy for tty")
-		go io.Copy(stdout, master)
-		go io.Copy(master, stdin)
-
-		state, err := SetupWindow(master, os.Stdin)
-		if err != nil {
-			command.Process.Kill()
-			return -1, err
-		}
-		defer term.RestoreTerminal(os.Stdin.Fd(), state)
-	} else {
-		if err := startStdCopy(command, stdin, stdout, stderr); err != nil {
-			command.Process.Kill()
-			return -1, err
-		}
+	command := factory.Create(container, console, logFile, syncPipe.child.Fd(), args)
+	if err := term.Attach(command); err != nil {
+		return -1, err
 	}
+	defer term.Close()
 
 	log.Printf("staring init")
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
 	log.Printf("writing state file")
-	if err := writePidFile(command); err != nil {
+	if err := state.WritePid(command.Process.Pid); err != nil {
 		command.Process.Kill()
 		return -1, err
 	}
-	defer deletePidFile()
+	defer func() {
+		log.Printf("removing state file")
+		state.DeletePid()
+	}()
 
 	// Do this before syncing with child so that no children
 	// can escape the cgroup
@@ -124,19 +113,6 @@ func InitializeNetworking(container *libcontainer.Container, nspid int, pipe *Sy
 	return nil
 }
 
-// SetupWindow gets the parent window size and sets the master
-// pty to the current size and set the parents mode to RAW
-func SetupWindow(master, parent *os.File) (*term.State, error) {
-	ws, err := term.GetWinsize(parent.Fd())
-	if err != nil {
-		return nil, err
-	}
-	if err := term.SetWinsize(master.Fd(), ws); err != nil {
-		return nil, err
-	}
-	return term.SetRawTerminal(parent.Fd())
-}
-
 // CreateMasterAndConsole will open /dev/ptmx on the host and retreive the
 // pts name for use as the pty slave inside the container
 func CreateMasterAndConsole() (*os.File, string, error) {
@@ -153,58 +129,3 @@ func CreateMasterAndConsole() (*os.File, string, error) {
 	}
 	return master, console, nil
 }
-
-// writePidFile writes the namespaced processes pid to .nspid in the rootfs for the container
-func writePidFile(command *exec.Cmd) error {
-	return ioutil.WriteFile(".nspid", []byte(fmt.Sprint(command.Process.Pid)), 0655)
-}
-
-func deletePidFile() error {
-	log.Printf("removing .nspid file")
-	return os.Remove(".nspid")
-}
-
-// createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
-// defined on the container's configuration and use the current binary as the init with the
-// args provided
-func CreateCommand(container *libcontainer.Container, console, logFile string, pipe uintptr, args []string) *exec.Cmd {
-	// get our binary name so we can always reexec ourself
-	name := os.Args[0]
-	command := exec.Command(name, append([]string{
-		"-console", console,
-		"-pipe", fmt.Sprint(pipe),
-		"-log", logFile,
-		"init"}, args...)...)
-
-	command.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: uintptr(GetNamespaceFlags(container.Namespaces)),
-	}
-	command.Env = container.Env
-	return command
-}
-
-func startStdCopy(command *exec.Cmd, stdin io.Reader, stdout, stderr io.Writer) error {
-	log.Printf("opening std pipes")
-	inPipe, err := command.StdinPipe()
-	if err != nil {
-		return err
-	}
-	outPipe, err := command.StdoutPipe()
-	if err != nil {
-		return err
-	}
-	errPipe, err := command.StderrPipe()
-	if err != nil {
-		return err
-	}
-
-	log.Printf("starting copy for std pipes")
-	go func() {
-		defer inPipe.Close()
-		io.Copy(inPipe, stdin)
-	}()
-	go io.Copy(stdout, outPipe)
-	go io.Copy(stderr, errPipe)
-
-	return nil
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index 2400ab6903..c299412c7b 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -57,8 +57,10 @@ func main() {
 		if nspid > 0 {
 			exitCode, err = nsinit.ExecIn(container, nspid, flag.Args()[1:])
 		} else {
+			term := nsinit.NewTerminal(os.Stdin, os.Stdout, os.Stderr, container.Tty)
 			exitCode, err = nsinit.Exec(container,
-				os.Stdin, os.Stdout, os.Stderr, nil,
+				&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{},
+				term,
 				logFile, flag.Args()[1:])
 		}
 		if err != nil {
diff --git a/components/engine/pkg/libcontainer/nsinit/state.go b/components/engine/pkg/libcontainer/nsinit/state.go
new file mode 100644
index 0000000000..1f0fedd110
--- /dev/null
+++ b/components/engine/pkg/libcontainer/nsinit/state.go
@@ -0,0 +1,24 @@
+package nsinit
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+)
+
+type StateWriter interface {
+	WritePid(pid int) error
+	DeletePid() error
+}
+
+type DefaultStateWriter struct {
+}
+
+// writePidFile writes the namespaced processes pid to .nspid in the rootfs for the container
+func (*DefaultStateWriter) WritePid(pid int) error {
+	return ioutil.WriteFile(".nspid", []byte(fmt.Sprint(pid)), 0655)
+}
+
+func (*DefaultStateWriter) DeletePid() error {
+	return os.Remove(".nspid")
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/term.go b/components/engine/pkg/libcontainer/nsinit/term.go
new file mode 100644
index 0000000000..649246891e
--- /dev/null
+++ b/components/engine/pkg/libcontainer/nsinit/term.go
@@ -0,0 +1,109 @@
+package nsinit
+
+import (
+	"github.com/dotcloud/docker/pkg/term"
+	"io"
+	"os"
+	"os/exec"
+)
+
+type Terminal interface {
+	io.Closer
+	SetMaster(*os.File)
+	Attach(*exec.Cmd) error
+}
+
+func NewTerminal(stdin io.Reader, stdout, stderr io.Writer, tty bool) Terminal {
+	if tty {
+		return &TtyTerminal{
+			stdin:  stdin,
+			stdout: stdout,
+			stderr: stderr,
+		}
+	}
+	return &StdTerminal{
+		stdin:  stdin,
+		stdout: stdout,
+		stderr: stderr,
+	}
+}
+
+type TtyTerminal struct {
+	stdin          io.Reader
+	stdout, stderr io.Writer
+	master         *os.File
+	state          *term.State
+}
+
+func (t *TtyTerminal) SetMaster(master *os.File) {
+	t.master = master
+}
+
+func (t *TtyTerminal) Attach(command *exec.Cmd) error {
+	go io.Copy(t.stdout, t.master)
+	go io.Copy(t.master, t.stdin)
+
+	state, err := t.setupWindow(t.master, os.Stdin)
+	if err != nil {
+		command.Process.Kill()
+		return err
+	}
+	t.state = state
+	return err
+}
+
+// SetupWindow gets the parent window size and sets the master
+// pty to the current size and set the parents mode to RAW
+func (t *TtyTerminal) setupWindow(master, parent *os.File) (*term.State, error) {
+	ws, err := term.GetWinsize(parent.Fd())
+	if err != nil {
+		return nil, err
+	}
+	if err := term.SetWinsize(master.Fd(), ws); err != nil {
+		return nil, err
+	}
+	return term.SetRawTerminal(parent.Fd())
+}
+
+func (t *TtyTerminal) Close() error {
+	term.RestoreTerminal(os.Stdin.Fd(), t.state)
+	return t.master.Close()
+}
+
+type StdTerminal struct {
+	stdin          io.Reader
+	stdout, stderr io.Writer
+}
+
+func (s *StdTerminal) SetMaster(*os.File) {
+	// no need to set master on non tty
+}
+
+func (s *StdTerminal) Close() error {
+	return nil
+}
+
+func (s *StdTerminal) Attach(command *exec.Cmd) error {
+	inPipe, err := command.StdinPipe()
+	if err != nil {
+		return err
+	}
+	outPipe, err := command.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	errPipe, err := command.StderrPipe()
+	if err != nil {
+		return err
+	}
+
+	go func() {
+		defer inPipe.Close()
+		io.Copy(inPipe, s.stdin)
+	}()
+
+	go io.Copy(s.stdout, outPipe)
+	go io.Copy(s.stderr, errPipe)
+
+	return nil
+}

From 0c8ed4441e85db4d8700cec9c82bbefc1e7b17eb Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 22 Feb 2014 01:21:26 -0800
Subject: [PATCH 228/403] Refactor driver to use Exec function from nsini
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 fac41af25bd5f42269424a788783a4280dd7fc9c Component: engine

---
 components/engine/execdriver/lxc/term.go      |  37 +--
 .../engine/execdriver/namespaces/driver.go    | 296 +++++-------------
 .../engine/pkg/libcontainer/nsinit/state.go   |  10 +-
 .../engine/pkg/libcontainer/nsinit/term.go    |   9 +
 4 files changed, 113 insertions(+), 239 deletions(-)

diff --git a/components/engine/execdriver/lxc/term.go b/components/engine/execdriver/lxc/term.go
index d772f60972..db58c3181a 100644
--- a/components/engine/execdriver/lxc/term.go
+++ b/components/engine/execdriver/lxc/term.go
@@ -6,6 +6,7 @@ import (
 	"github.com/kr/pty"
 	"io"
 	"os"
+	"os/exec"
 )
 
 func SetTerminal(command *execdriver.Command, pipes *execdriver.Pipes) error {
@@ -26,8 +27,8 @@ func SetTerminal(command *execdriver.Command, pipes *execdriver.Pipes) error {
 }
 
 type TtyConsole struct {
-	master *os.File
-	slave  *os.File
+	MasterPty *os.File
+	SlavePty  *os.File
 }
 
 func NewTtyConsole(command *execdriver.Command, pipes *execdriver.Pipes) (*TtyConsole, error) {
@@ -36,28 +37,28 @@ func NewTtyConsole(command *execdriver.Command, pipes *execdriver.Pipes) (*TtyCo
 		return nil, err
 	}
 	tty := &TtyConsole{
-		master: ptyMaster,
-		slave:  ptySlave,
+		MasterPty: ptyMaster,
+		SlavePty:  ptySlave,
 	}
-	if err := tty.attach(command, pipes); err != nil {
+	if err := tty.AttachPipes(&command.Cmd, pipes); err != nil {
 		tty.Close()
 		return nil, err
 	}
+	command.Console = tty.SlavePty.Name()
 	return tty, nil
 }
 
 func (t *TtyConsole) Master() *os.File {
-	return t.master
+	return t.MasterPty
 }
 
 func (t *TtyConsole) Resize(h, w int) error {
-	return term.SetWinsize(t.master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+	return term.SetWinsize(t.MasterPty.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
 }
 
-func (t *TtyConsole) attach(command *execdriver.Command, pipes *execdriver.Pipes) error {
-	command.Stdout = t.slave
-	command.Stderr = t.slave
-	command.Console = t.slave.Name()
+func (t *TtyConsole) AttachPipes(command *exec.Cmd, pipes *execdriver.Pipes) error {
+	command.Stdout = t.SlavePty
+	command.Stderr = t.SlavePty
 
 	go func() {
 		if wb, ok := pipes.Stdout.(interface {
@@ -65,24 +66,24 @@ func (t *TtyConsole) attach(command *execdriver.Command, pipes *execdriver.Pipes
 		}); ok {
 			defer wb.CloseWriters()
 		}
-		io.Copy(pipes.Stdout, t.master)
+		io.Copy(pipes.Stdout, t.MasterPty)
 	}()
 
 	if pipes.Stdin != nil {
-		command.Stdin = t.slave
+		command.Stdin = t.SlavePty
 		command.SysProcAttr.Setctty = true
 
 		go func() {
 			defer pipes.Stdin.Close()
-			io.Copy(t.master, pipes.Stdin)
+			io.Copy(t.MasterPty, pipes.Stdin)
 		}()
 	}
 	return nil
 }
 
 func (t *TtyConsole) Close() error {
-	t.slave.Close()
-	return t.master.Close()
+	t.SlavePty.Close()
+	return t.MasterPty.Close()
 }
 
 type StdConsole struct {
@@ -91,13 +92,13 @@ type StdConsole struct {
 func NewStdConsole(command *execdriver.Command, pipes *execdriver.Pipes) (*StdConsole, error) {
 	std := &StdConsole{}
 
-	if err := std.attach(command, pipes); err != nil {
+	if err := std.AttachPipes(&command.Cmd, pipes); err != nil {
 		return nil, err
 	}
 	return std, nil
 }
 
-func (s *StdConsole) attach(command *execdriver.Command, pipes *execdriver.Pipes) error {
+func (s *StdConsole) AttachPipes(command *exec.Cmd, pipes *execdriver.Pipes) error {
 	command.Stdout = pipes.Stdout
 	command.Stderr = pipes.Stderr
 
diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index e243c64703..a3f095f464 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -5,15 +5,10 @@ import (
 	"errors"
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
+	"github.com/dotcloud/docker/execdriver/lxc"
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
-	"github.com/dotcloud/docker/pkg/libcontainer/utils"
-	"github.com/dotcloud/docker/pkg/system"
-	"github.com/dotcloud/docker/pkg/term"
-	"io"
 	"io/ioutil"
-	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -44,129 +39,31 @@ func NewDriver() (*driver, error) {
 }
 
 func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
-	container := createContainer(c)
+	var (
+		term        nsinit.Terminal
+		container   = createContainer(c)
+		factory     = &dockerCommandFactory{c}
+		stateWriter = &dockerStateWriter{
+			callback: startCallback,
+			c:        c,
+			dsw:      &nsinit.DefaultStateWriter{c.Rootfs},
+		}
+	)
+	if c.Tty {
+		term = &dockerTtyTerm{
+			pipes: pipes,
+		}
+	} else {
+		term = &dockerStdTerm{
+			pipes: pipes,
+		}
+	}
+	c.Terminal = term
 	if err := writeContainerFile(container, c.Rootfs); err != nil {
 		return -1, err
 	}
-
-	var (
-		console string
-		master  *os.File
-		err     error
-
-		inPipe           io.WriteCloser
-		outPipe, errPipe io.ReadCloser
-	)
-
-	if container.Tty {
-		log.Printf("setting up master and console")
-		master, console, err = createMasterAndConsole()
-		if err != nil {
-			return -1, err
-		}
-	}
-	c.Terminal = NewTerm(pipes, master)
-
-	// create a pipe so that we can syncronize with the namespaced process and
-	// pass the veth name to the child
-	r, w, err := os.Pipe()
-	if err != nil {
-		return -1, err
-	}
-	system.UsetCloseOnExec(r.Fd())
-
 	args := append([]string{c.Entrypoint}, c.Arguments...)
-	createCommand(c, container, console, "/nsinit.logs", r.Fd(), args)
-	command := c
-
-	if !container.Tty {
-		log.Printf("opening pipes on command")
-		if inPipe, err = command.StdinPipe(); err != nil {
-			return -1, err
-		}
-		if outPipe, err = command.StdoutPipe(); err != nil {
-			return -1, err
-		}
-		if errPipe, err = command.StderrPipe(); err != nil {
-			return -1, err
-		}
-	}
-
-	log.Printf("staring init")
-	if err := command.Start(); err != nil {
-		return -1, err
-	}
-	log.Printf("writting state file")
-	if err := writePidFile(c.Rootfs, command.Process.Pid); err != nil {
-		command.Process.Kill()
-		return -1, err
-	}
-	defer deletePidFile(c.Rootfs)
-
-	// Do this before syncing with child so that no children
-	// can escape the cgroup
-	if container.Cgroups != nil {
-		log.Printf("setting up cgroups")
-		if err := container.Cgroups.Apply(command.Process.Pid); err != nil {
-			command.Process.Kill()
-			return -1, err
-		}
-	}
-
-	if container.Network != nil {
-		log.Printf("creating veth pair")
-		vethPair, err := initializeContainerVeth(container.Network.Bridge, container.Network.Mtu, command.Process.Pid)
-		if err != nil {
-			return -1, err
-		}
-		log.Printf("sending %s as veth pair name", vethPair)
-		sendVethName(w, vethPair)
-	}
-
-	// Sync with child
-	log.Printf("closing sync pipes")
-	w.Close()
-	r.Close()
-
-	if container.Tty {
-		log.Printf("starting copy for tty")
-		go io.Copy(pipes.Stdout, master)
-		if pipes.Stdin != nil {
-			go io.Copy(master, pipes.Stdin)
-		}
-
-		/*
-			state, err := setupWindow(master)
-			if err != nil {
-				command.Process.Kill()
-				return -1, err
-			}
-			defer term.RestoreTerminal(uintptr(syscall.Stdin), state)
-		*/
-	} else {
-		log.Printf("starting copy for std pipes")
-		if pipes.Stdin != nil {
-			go func() {
-				defer inPipe.Close()
-				io.Copy(inPipe, pipes.Stdin)
-			}()
-		}
-		go io.Copy(pipes.Stdout, outPipe)
-		go io.Copy(pipes.Stderr, errPipe)
-	}
-
-	if startCallback != nil {
-		startCallback(c)
-	}
-
-	log.Printf("waiting on process")
-	if err := command.Wait(); err != nil {
-		if _, ok := err.(*exec.ExitError); !ok {
-			return -1, err
-		}
-	}
-	log.Printf("process ended")
-	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
+	return nsinit.Exec(container, factory, stateWriter, term, "/nsinit.log", args)
 }
 
 func (d *driver) Kill(p *execdriver.Command, sig int) error {
@@ -207,107 +104,22 @@ func getEnv(key string, env []string) string {
 	return ""
 }
 
-// sendVethName writes the veth pair name to the child's stdin then closes the
-// pipe so that the child stops waiting for more data
-func sendVethName(pipe io.Writer, name string) {
-	fmt.Fprint(pipe, name)
-}
-
-// initializeContainerVeth will create a veth pair and setup the host's
-// side of the pair by setting the specified bridge as the master and bringing
-// up the interface.
-//
-// Then will with set the other side of the veth pair into the container's namespaced
-// using the pid and returns the veth's interface name to provide to the container to
-// finish setting up the interface inside the namespace
-func initializeContainerVeth(bridge string, mtu, nspid int) (string, error) {
-	name1, name2, err := createVethPair()
-	if err != nil {
-		return "", err
-	}
-	log.Printf("veth pair created %s <> %s", name1, name2)
-	if err := network.SetInterfaceMaster(name1, bridge); err != nil {
-		return "", err
-	}
-	if err := network.SetMtu(name1, mtu); err != nil {
-		return "", err
-	}
-	if err := network.InterfaceUp(name1); err != nil {
-		return "", err
-	}
-	log.Printf("setting %s inside %d namespace", name2, nspid)
-	if err := network.SetInterfaceInNamespacePid(name2, nspid); err != nil {
-		return "", err
-	}
-	return name2, nil
-}
-
-func setupWindow(master *os.File) (*term.State, error) {
-	ws, err := term.GetWinsize(os.Stdin.Fd())
-	if err != nil {
-		return nil, err
-	}
-	if err := term.SetWinsize(master.Fd(), ws); err != nil {
-		return nil, err
-	}
-	return term.SetRawTerminal(os.Stdin.Fd())
-}
-
-// createMasterAndConsole will open /dev/ptmx on the host and retreive the
-// pts name for use as the pty slave inside the container
-func createMasterAndConsole() (*os.File, string, error) {
-	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, "", err
-	}
-	console, err := system.Ptsname(master)
-	if err != nil {
-		return nil, "", err
-	}
-	if err := system.Unlockpt(master); err != nil {
-		return nil, "", err
-	}
-	return master, console, nil
-}
-
-// createVethPair will automatically generage two random names for
-// the veth pair and ensure that they have been created
-func createVethPair() (name1 string, name2 string, err error) {
-	name1, err = utils.GenerateRandomName("dock", 4)
-	if err != nil {
-		return
-	}
-	name2, err = utils.GenerateRandomName("dock", 4)
-	if err != nil {
-		return
-	}
-	if err = network.CreateVethPair(name1, name2); err != nil {
-		return
-	}
-	return
-}
-
-// writePidFile writes the namespaced processes pid to .nspid in the rootfs for the container
-func writePidFile(rootfs string, pid int) error {
-	return ioutil.WriteFile(filepath.Join(rootfs, ".nspid"), []byte(fmt.Sprint(pid)), 0655)
-}
-
-func deletePidFile(rootfs string) error {
-	return os.Remove(filepath.Join(rootfs, ".nspid"))
+type dockerCommandFactory struct {
+	c *execdriver.Command
 }
 
 // createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
-func createCommand(c *execdriver.Command, container *libcontainer.Container,
-	console, logFile string, pipe uintptr, args []string) {
-
+func (d *dockerCommandFactory) Create(container *libcontainer.Container,
+	console, logFile string, syncFd uintptr, args []string) *exec.Cmd {
+	c := d.c
 	aname, _ := exec.LookPath("nsinit")
 	c.Path = aname
 	c.Args = append([]string{
 		aname,
 		"-console", console,
-		"-pipe", fmt.Sprint(pipe),
+		"-pipe", fmt.Sprint(syncFd),
 		"-log", logFile,
 		"init",
 	}, args...)
@@ -316,6 +128,26 @@ func createCommand(c *execdriver.Command, container *libcontainer.Container,
 	}
 	c.Env = container.Env
 	c.Dir = c.Rootfs
+
+	return &c.Cmd
+}
+
+type dockerStateWriter struct {
+	dsw      nsinit.StateWriter
+	c        *execdriver.Command
+	callback execdriver.StartCallback
+}
+
+func (d *dockerStateWriter) WritePid(pid int) error {
+	err := d.dsw.WritePid(pid)
+	if d.callback != nil {
+		d.callback(d.c)
+	}
+	return err
+}
+
+func (d *dockerStateWriter) DeletePid() error {
+	return d.dsw.DeletePid()
 }
 
 func createContainer(c *execdriver.Command) *libcontainer.Container {
@@ -334,7 +166,11 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 			Mtu:     c.Network.Mtu,
 			Address: fmt.Sprintf("%s/%d", c.Network.IPAddress, c.Network.IPPrefixLen),
 			Gateway: c.Network.Gateway,
-			Bridge:  c.Network.Bridge,
+			Type:    "veth",
+			Context: libcontainer.Context{
+				"prefix": "dock",
+				"bridge": c.Network.Bridge,
+			},
 		}
 	}
 	if c.Privileged {
@@ -347,3 +183,29 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 	}
 	return container
 }
+
+type dockerStdTerm struct {
+	lxc.StdConsole
+	pipes *execdriver.Pipes
+}
+
+func (d *dockerStdTerm) Attach(cmd *exec.Cmd) error {
+	return d.AttachPipes(cmd, d.pipes)
+}
+
+func (d *dockerStdTerm) SetMaster(master *os.File) {
+	// do nothing
+}
+
+type dockerTtyTerm struct {
+	lxc.TtyConsole
+	pipes *execdriver.Pipes
+}
+
+func (t *dockerTtyTerm) Attach(cmd *exec.Cmd) error {
+	return t.AttachPipes(cmd, t.pipes)
+}
+
+func (t *dockerTtyTerm) SetMaster(master *os.File) {
+	t.MasterPty = master
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/state.go b/components/engine/pkg/libcontainer/nsinit/state.go
index 1f0fedd110..2dbaaa5977 100644
--- a/components/engine/pkg/libcontainer/nsinit/state.go
+++ b/components/engine/pkg/libcontainer/nsinit/state.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
+	"path/filepath"
 )
 
 type StateWriter interface {
@@ -12,13 +13,14 @@ type StateWriter interface {
 }
 
 type DefaultStateWriter struct {
+	Root string
 }
 
 // writePidFile writes the namespaced processes pid to .nspid in the rootfs for the container
-func (*DefaultStateWriter) WritePid(pid int) error {
-	return ioutil.WriteFile(".nspid", []byte(fmt.Sprint(pid)), 0655)
+func (d *DefaultStateWriter) WritePid(pid int) error {
+	return ioutil.WriteFile(filepath.Join(d.Root, ".nspid"), []byte(fmt.Sprint(pid)), 0655)
 }
 
-func (*DefaultStateWriter) DeletePid() error {
-	return os.Remove(".nspid")
+func (d *DefaultStateWriter) DeletePid() error {
+	return os.Remove(filepath.Join(d.Root, ".nspid"))
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/term.go b/components/engine/pkg/libcontainer/nsinit/term.go
index 649246891e..58dccab2b8 100644
--- a/components/engine/pkg/libcontainer/nsinit/term.go
+++ b/components/engine/pkg/libcontainer/nsinit/term.go
@@ -11,6 +11,7 @@ type Terminal interface {
 	io.Closer
 	SetMaster(*os.File)
 	Attach(*exec.Cmd) error
+	Resize(h, w int) error
 }
 
 func NewTerminal(stdin io.Reader, stdout, stderr io.Writer, tty bool) Terminal {
@@ -35,6 +36,10 @@ type TtyTerminal struct {
 	state          *term.State
 }
 
+func (t *TtyTerminal) Resize(h, w int) error {
+	return term.SetWinsize(t.master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+}
+
 func (t *TtyTerminal) SetMaster(master *os.File) {
 	t.master = master
 }
@@ -83,6 +88,10 @@ func (s *StdTerminal) Close() error {
 	return nil
 }
 
+func (s *StdTerminal) Resize(h, w int) error {
+	return nil
+}
+
 func (s *StdTerminal) Attach(command *exec.Cmd) error {
 	inPipe, err := command.StdinPipe()
 	if err != nil {

From 0b2fdfff35fc0dc011c01c5085d69b3d20a9adf6 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Sat, 22 Feb 2014 01:28:59 -0800
Subject: [PATCH 229/403] Fix tty copy for driver Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 172260a49be6c3516edc6869d58957e844f9c69b Component: engine

---
 components/engine/execdriver/namespaces/driver.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index a3f095f464..efbb09d131 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -8,6 +8,7 @@ import (
 	"github.com/dotcloud/docker/execdriver/lxc"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
+	"io"
 	"io/ioutil"
 	"os"
 	"os/exec"
@@ -203,7 +204,11 @@ type dockerTtyTerm struct {
 }
 
 func (t *dockerTtyTerm) Attach(cmd *exec.Cmd) error {
-	return t.AttachPipes(cmd, t.pipes)
+	go io.Copy(t.pipes.Stdout, t.MasterPty)
+	if t.pipes.Stdin != nil {
+		go io.Copy(t.MasterPty, t.pipes.Stdin)
+	}
+	return nil
 }
 
 func (t *dockerTtyTerm) SetMaster(master *os.File) {

From 6253b6b7aac62b5fd428739c685900cc7a7ea038 Mon Sep 17 00:00:00 2001
From: Matthias Klumpp <matthias@tenstral.net>
Date: Wed, 19 Feb 2014 22:30:01 +0100
Subject: [PATCH 230/403] contrib/debootstrap: Add initial support for Tanglu

This will add support for Tanglu, a Debian based Linux-distribution.

Docker-DCO-1.1-Signed-off-by: Matthias Klumpp <matthias@tenstral.net> (github: Ximion)
Upstream-commit: 4bfc8e97222b8908176d2420060bbeae613a571c
Component: engine
---
 .../engine/contrib/mkimage-debootstrap.sh     | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/components/engine/contrib/mkimage-debootstrap.sh b/components/engine/contrib/mkimage-debootstrap.sh
index 1c18c120ef..8ed4570289 100755
--- a/components/engine/contrib/mkimage-debootstrap.sh
+++ b/components/engine/contrib/mkimage-debootstrap.sh
@@ -44,6 +44,8 @@ debianStable=wheezy
 debianUnstable=sid
 # this should match the name found at http://releases.ubuntu.com/
 ubuntuLatestLTS=precise
+# this should match the name found at http://releases.tanglu.org/
+tangluLatest=aequorea
 
 while getopts v:i:a:p:dst name; do
 	case "$name" in
@@ -201,6 +203,13 @@ if [ -z "$strictDebootstrap" ]; then
 					s/ $suite-updates main/ ${suite}-security main/
 				" etc/apt/sources.list
 				;;
+			Tanglu)
+				# add the updates repository
+				if [ "$suite" = "$tangluLatest" ]; then
+					# ${suite}-updates only applies to stable Tanglu versions
+					sudo sed -i "p; s/ $suite main$/ ${suite}-updates main/" etc/apt/sources.list
+				fi
+				;;
 		esac
 	fi
 	
@@ -248,6 +257,19 @@ else
 					fi
 				fi
 				;;
+			Tanglu)
+				if [ "$suite" = "$tangluLatest" ]; then
+					# tag latest
+					$docker tag $repo:$suite $repo:latest
+				fi
+				if [ -r etc/lsb-release ]; then
+					lsbRelease="$(. etc/lsb-release && echo "$DISTRIB_RELEASE")"
+					if [ "$lsbRelease" ]; then
+						# tag specific Tanglu version number, if available (1.0, 2.0, etc.)
+						$docker tag $repo:$suite $repo:$lsbRelease
+					fi
+				fi
+				;;
 		esac
 	fi
 fi

From 3e5bd5938634708fa7ba03d2441ed651ae5e4ee4 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Sat, 22 Feb 2014 20:01:45 -0700
Subject: [PATCH 231/403] Extract our default PATH value to a constant for
 great reuse

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: b3ffc1f8358a9aa89448b37ea630c5783f0672d8
Component: engine
---
 components/engine/buildfile.go   | 2 +-
 components/engine/container.go   | 4 +++-
 components/engine/links/links.go | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/components/engine/buildfile.go b/components/engine/buildfile.go
index b30a220ddc..6fae6a24a5 100644
--- a/components/engine/buildfile.go
+++ b/components/engine/buildfile.go
@@ -110,7 +110,7 @@ func (b *buildFile) CmdFrom(name string) error {
 		b.config = image.Config
 	}
 	if b.config.Env == nil || len(b.config.Env) == 0 {
-		b.config.Env = append(b.config.Env, "HOME=/", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin")
+		b.config.Env = append(b.config.Env, "HOME=/", "PATH="+defaultPathEnv)
 	}
 	// Process ONBUILD triggers if they exist
 	if nTriggers := len(b.config.OnBuild); nTriggers != 0 {
diff --git a/components/engine/container.go b/components/engine/container.go
index ca53bb57c7..3a277fb1f9 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -23,6 +23,8 @@ import (
 	"time"
 )
 
+const defaultPathEnv = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
 var (
 	ErrNotATTY               = errors.New("The PTY is not a file")
 	ErrNoTTY                 = errors.New("No PTY found")
@@ -447,7 +449,7 @@ func (container *Container) Start() (err error) {
 	// Setup environment
 	env := []string{
 		"HOME=/",
-		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+		"PATH=" + defaultPathEnv,
 		"HOSTNAME=" + container.Config.Hostname,
 	}
 
diff --git a/components/engine/links/links.go b/components/engine/links/links.go
index 68ac98ee07..7665a06a11 100644
--- a/components/engine/links/links.go
+++ b/components/engine/links/links.go
@@ -72,7 +72,7 @@ func (l *Link) ToEnv() []string {
 			if len(parts) != 2 {
 				continue
 			}
-			// Ignore a few variables that are added during docker build
+			// Ignore a few variables that are added during docker build (and not really relevant to linked containers)
 			if parts[0] == "HOME" || parts[0] == "PATH" {
 				continue
 			}

From afb31c48bd42879498211cb1a9d31fc81a1197f9 Mon Sep 17 00:00:00 2001
From: Morgante Pell <morgante.pell@morgante.net>
Date: Sun, 23 Feb 2014 14:36:21 -0500
Subject: [PATCH 232/403] Remove trailing slash from host parameter in docker
 init.

(This causes errors on Docker 0.8)

Docker-DCO-1.1-Signed-off-by: Morgante Pell <morgante.pell@morgante.net> (github: morgante)
Upstream-commit: 2a7f7c86da00210cb90eafd77ee01354f98ec4fc
Component: engine
---
 components/engine/contrib/vagrant-docker/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/contrib/vagrant-docker/README.md b/components/engine/contrib/vagrant-docker/README.md
index 836f503059..d422492fe9 100644
--- a/components/engine/contrib/vagrant-docker/README.md
+++ b/components/engine/contrib/vagrant-docker/README.md
@@ -31,7 +31,7 @@ stop on runlevel [!2345]
 respawn
 
 script
-    /usr/bin/docker -d -H=tcp://0.0.0.0:4243/
+    /usr/bin/docker -d -H=tcp://0.0.0.0:4243
 end script
 ```
 

From 09b4fa1ad0fe66179191d38243489157231b9bd9 Mon Sep 17 00:00:00 2001
From: Brian Goff <cpuguy83@gmail.com>
Date: Sun, 23 Feb 2014 15:45:44 -0500
Subject: [PATCH 233/403] Remove uneeded wording in Dockerfile format

Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
Upstream-commit: cfdfd46e49404ad9dfb28810bd7a83658f35c42b
Component: engine
---
 components/engine/docs/sources/reference/builder.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/reference/builder.rst b/components/engine/docs/sources/reference/builder.rst
index 6fabd6629d..9f7a816801 100644
--- a/components/engine/docs/sources/reference/builder.rst
+++ b/components/engine/docs/sources/reference/builder.rst
@@ -74,7 +74,7 @@ When you're done with your build, you're ready to look into
 2. Format
 =========
 
-The Dockerfile format is quite simple:
+Here is the format of the Dockerfile:
 
 ::
 

From f208199d26847002938220ad0931028f981cbc4b Mon Sep 17 00:00:00 2001
From: Sam Alba <sam.alba@gmail.com>
Date: Sun, 23 Feb 2014 18:33:46 -0800
Subject: [PATCH 234/403] registry: Added simple checksums (sha256) for layers

Docker-DCO-1.1-Signed-off-by: Sam Alba <sam@docker.com> (github: samalba)
Upstream-commit: 8d230cf89cfe3c6c5293d7807c1bffa1cf799d6b
Component: engine
---
 components/engine/registry/registry.go | 29 ++++++++++++++++----------
 components/engine/server.go            |  3 ++-
 components/engine/utils/checksum.go    | 24 +++++++++++++++++++++
 3 files changed, 44 insertions(+), 12 deletions(-)
 create mode 100644 components/engine/utils/checksum.go

diff --git a/components/engine/registry/registry.go b/components/engine/registry/registry.go
index df94302305..7bdf12c883 100644
--- a/components/engine/registry/registry.go
+++ b/components/engine/registry/registry.go
@@ -2,6 +2,7 @@ package registry
 
 import (
 	"bytes"
+	"crypto/sha256"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -388,6 +389,7 @@ func (r *Registry) PushImageChecksumRegistry(imgData *ImgData, registry string,
 	}
 	setTokenAuth(req, token)
 	req.Header.Set("X-Docker-Checksum", imgData.Checksum)
+	req.Header.Set("X-Docker-Checksum-Payload", imgData.ChecksumPayload)
 
 	res, err := doWithCookies(r.client, req)
 	if err != nil {
@@ -446,26 +448,28 @@ func (r *Registry) PushImageJSONRegistry(imgData *ImgData, jsonRaw []byte, regis
 	return nil
 }
 
-func (r *Registry) PushImageLayerRegistry(imgID string, layer io.Reader, registry string, token []string, jsonRaw []byte) (checksum string, err error) {
+func (r *Registry) PushImageLayerRegistry(imgID string, layer io.Reader, registry string, token []string, jsonRaw []byte) (checksum string, checksumPayload string, err error) {
 
 	utils.Debugf("[registry] Calling PUT %s", registry+"images/"+imgID+"/layer")
 
-	tarsumLayer := &utils.TarSum{Reader: layer}
+	h := sha256.New()
+	checksumLayer := &utils.CheckSum{Reader: layer, Hash: h}
+	tarsumLayer := &utils.TarSum{Reader: checksumLayer}
 
 	req, err := r.reqFactory.NewRequest("PUT", registry+"images/"+imgID+"/layer", tarsumLayer)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 	req.ContentLength = -1
 	req.TransferEncoding = []string{"chunked"}
 	setTokenAuth(req, token)
 	res, err := doWithCookies(r.client, req)
 	if err != nil {
-		return "", fmt.Errorf("Failed to upload layer: %s", err)
+		return "", "", fmt.Errorf("Failed to upload layer: %s", err)
 	}
 	if rc, ok := layer.(io.Closer); ok {
 		if err := rc.Close(); err != nil {
-			return "", err
+			return "", "", err
 		}
 	}
 	defer res.Body.Close()
@@ -473,11 +477,13 @@ func (r *Registry) PushImageLayerRegistry(imgID string, layer io.Reader, registr
 	if res.StatusCode != 200 {
 		errBody, err := ioutil.ReadAll(res.Body)
 		if err != nil {
-			return "", utils.NewHTTPRequestError(fmt.Sprintf("HTTP code %d while uploading metadata and error when trying to parse response body: %s", res.StatusCode, err), res)
+			return "", "", utils.NewHTTPRequestError(fmt.Sprintf("HTTP code %d while uploading metadata and error when trying to parse response body: %s", res.StatusCode, err), res)
 		}
-		return "", utils.NewHTTPRequestError(fmt.Sprintf("Received HTTP code %d while uploading layer: %s", res.StatusCode, errBody), res)
+		return "", "", utils.NewHTTPRequestError(fmt.Sprintf("Received HTTP code %d while uploading layer: %s", res.StatusCode, errBody), res)
 	}
-	return tarsumLayer.Sum(jsonRaw), nil
+
+	checksumPayload = "sha256:" + checksumLayer.Sum()
+	return tarsumLayer.Sum(jsonRaw), checksumPayload, nil
 }
 
 // push a tag on the registry.
@@ -671,9 +677,10 @@ type RepositoryData struct {
 }
 
 type ImgData struct {
-	ID       string `json:"id"`
-	Checksum string `json:"checksum,omitempty"`
-	Tag      string `json:",omitempty"`
+	ID              string `json:"id"`
+	Checksum        string `json:"checksum,omitempty"`
+	ChecksumPayload string `json:"checksum,omitempty"`
+	Tag             string `json:",omitempty"`
 }
 
 type Registry struct {
diff --git a/components/engine/server.go b/components/engine/server.go
index 0ed96fee31..b9fd92716a 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1504,11 +1504,12 @@ func (srv *Server) pushImage(r *registry.Registry, out io.Writer, remote, imgID,
 	defer os.RemoveAll(layerData.Name())
 
 	// Send the layer
-	checksum, err = r.PushImageLayerRegistry(imgData.ID, utils.ProgressReader(layerData, int(layerData.Size), out, sf, false, utils.TruncateID(imgData.ID), "Pushing"), ep, token, jsonRaw)
+	checksum, checksumPayload, err := r.PushImageLayerRegistry(imgData.ID, utils.ProgressReader(layerData, int(layerData.Size), out, sf, false, utils.TruncateID(imgData.ID), "Pushing"), ep, token, jsonRaw)
 	if err != nil {
 		return "", err
 	}
 	imgData.Checksum = checksum
+	imgData.ChecksumPayload = checksumPayload
 	// Send the checksum
 	if err := r.PushImageChecksumRegistry(imgData, ep, token); err != nil {
 		return "", err
diff --git a/components/engine/utils/checksum.go b/components/engine/utils/checksum.go
new file mode 100644
index 0000000000..1c85aa63a3
--- /dev/null
+++ b/components/engine/utils/checksum.go
@@ -0,0 +1,24 @@
+package utils
+
+import (
+	"encoding/hex"
+	"hash"
+	"io"
+)
+
+type CheckSum struct {
+	io.Reader
+	Hash hash.Hash
+}
+
+func (cs *CheckSum) Read(buf []byte) (int, error) {
+	n, err := cs.Reader.Read(buf)
+	if err == nil {
+		cs.Hash.Write(buf[:n])
+	}
+	return n, err
+}
+
+func (cs *CheckSum) Sum() string {
+	return hex.EncodeToString(cs.Hash.Sum(nil))
+}

From 5561829e308da9b8b4fe38cec9f571dac73d7391 Mon Sep 17 00:00:00 2001
From: Sam Alba <sam.alba@gmail.com>
Date: Mon, 24 Feb 2014 09:04:27 -0800
Subject: [PATCH 235/403] registry: Fixed tests

Docker-DCO-1.1-Signed-off-by: Sam Alba <sam@docker.com> (github: samalba)
Upstream-commit: f420bb29793f0196024d21121d0ef89d2c678bdf
Component: engine
---
 components/engine/registry/registry_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/registry/registry_test.go b/components/engine/registry/registry_test.go
index 16bc431e55..5b33485d0f 100644
--- a/components/engine/registry/registry_test.go
+++ b/components/engine/registry/registry_test.go
@@ -124,7 +124,7 @@ func TestPushImageJSONRegistry(t *testing.T) {
 func TestPushImageLayerRegistry(t *testing.T) {
 	r := spawnTestRegistry(t)
 	layer := strings.NewReader("")
-	_, err := r.PushImageLayerRegistry(IMAGE_ID, layer, makeURL("/v1/"), TOKEN, []byte{})
+	_, _, err := r.PushImageLayerRegistry(IMAGE_ID, layer, makeURL("/v1/"), TOKEN, []byte{})
 	if err != nil {
 		t.Fatal(err)
 	}

From d6c00b381a3a9b0a9c4317ee0e3c0a24601ae817 Mon Sep 17 00:00:00 2001
From: Vincent Batts <vbatts@redhat.com>
Date: Mon, 24 Feb 2014 13:42:09 -0500
Subject: [PATCH 236/403] seperate out the terminal functions from lxc to the
 pkg/term

  Since these functions are indepenent of lxc, and could be used by
  other drivers.

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Upstream-commit: de848a14caf1636cc24e621a35d7073cebe5444d
Component: engine
---
 components/engine/execdriver/lxc/driver.go                   | 3 ++-
 .../engine/{execdriver/lxc/term.go => pkg/term/driver.go}    | 5 ++---
 2 files changed, 4 insertions(+), 4 deletions(-)
 rename components/engine/{execdriver/lxc/term.go => pkg/term/driver.go} (94%)

diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index 5be7ad2219..145965a383 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/pkg/cgroups"
+	"github.com/dotcloud/docker/pkg/term"
 	"github.com/dotcloud/docker/utils"
 	"io/ioutil"
 	"log"
@@ -77,7 +78,7 @@ func (d *driver) Name() string {
 }
 
 func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
-	if err := SetTerminal(c, pipes); err != nil {
+	if err := term.SetTerminal(c, pipes); err != nil {
 		return -1, err
 	}
 	configPath, err := d.generateLXCConfig(c)
diff --git a/components/engine/execdriver/lxc/term.go b/components/engine/pkg/term/driver.go
similarity index 94%
rename from components/engine/execdriver/lxc/term.go
rename to components/engine/pkg/term/driver.go
index d772f60972..6e1fae41ba 100644
--- a/components/engine/execdriver/lxc/term.go
+++ b/components/engine/pkg/term/driver.go
@@ -1,8 +1,7 @@
-package lxc
+package term
 
 import (
 	"github.com/dotcloud/docker/execdriver"
-	"github.com/dotcloud/docker/pkg/term"
 	"github.com/kr/pty"
 	"io"
 	"os"
@@ -51,7 +50,7 @@ func (t *TtyConsole) Master() *os.File {
 }
 
 func (t *TtyConsole) Resize(h, w int) error {
-	return term.SetWinsize(t.master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+	return SetWinsize(t.master.Fd(), &Winsize{Height: uint16(h), Width: uint16(w)})
 }
 
 func (t *TtyConsole) attach(command *execdriver.Command, pipes *execdriver.Pipes) error {

From 7ebf071730d1f55ff2e12388bb68b133f05f4f84 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 10:46:20 -0800
Subject: [PATCH 237/403] Look for cpu subsystem instead of memory
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 a08e78a78c4b548919515fa7910db56990ef44dc Component: engine

---
 components/engine/pkg/cgroups/cgroups.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/pkg/cgroups/cgroups.go b/components/engine/pkg/cgroups/cgroups.go
index 96002f0af9..e260d67661 100644
--- a/components/engine/pkg/cgroups/cgroups.go
+++ b/components/engine/pkg/cgroups/cgroups.go
@@ -132,7 +132,7 @@ func (c *Cgroup) Apply(pid int) error {
 	// http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups/
 	//
 	// we can pick any subsystem to find the root
-	cgroupRoot, err := FindCgroupMountpoint("memory")
+	cgroupRoot, err := FindCgroupMountpoint("cpu")
 	if err != nil {
 		return err
 	}

From 14989a215ec0deaa6bd3bf950b5d4fdd9554d493 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Wed, 19 Feb 2014 15:27:57 -0800
Subject: [PATCH 238/403] Register built-in engine commands at runtime instead
 of compile-time

This allows selective loading of commands, and paves the way to dynamic
plugins.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 919665a20a41f8e1b105342b1864ec05eb50cc97
Component: engine
---
 components/engine/api/api.go                  |  4 --
 components/engine/builtins/builtins.go        | 40 +++++++++++++++++++
 components/engine/docker/docker.go            |  4 +-
 components/engine/networkdriver/lxc/driver.go |  6 ---
 components/engine/server.go                   |  6 +--
 components/engine/version.go                  |  6 +--
 6 files changed, 45 insertions(+), 21 deletions(-)
 create mode 100644 components/engine/builtins/builtins.go

diff --git a/components/engine/api/api.go b/components/engine/api/api.go
index fe965ddafa..0fe1eb0fee 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/api.go
@@ -50,10 +50,6 @@ func ValidateHost(val string) (string, error) {
 
 type HttpApiFunc func(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error
 
-func init() {
-	engine.Register("serveapi", ServeApi)
-}
-
 func hijackServer(w http.ResponseWriter) (io.ReadCloser, io.Writer, error) {
 	conn, _, err := w.(http.Hijacker).Hijack()
 	if err != nil {
diff --git a/components/engine/builtins/builtins.go b/components/engine/builtins/builtins.go
new file mode 100644
index 0000000000..5b146cd20f
--- /dev/null
+++ b/components/engine/builtins/builtins.go
@@ -0,0 +1,40 @@
+package builtins
+
+import (
+	"github.com/dotcloud/docker/engine"
+
+	"github.com/dotcloud/docker"
+	"github.com/dotcloud/docker/api"
+	"github.com/dotcloud/docker/networkdriver/lxc"
+)
+
+func Register(eng *engine.Engine) {
+	daemon(eng)
+	remote(eng)
+}
+
+// remote: a RESTful api for cross-docker communication
+func remote(eng *engine.Engine) {
+	eng.Register("serveapi", api.ServeApi)
+}
+
+// daemon: a default execution and storage backend for Docker on Linux,
+// with the following underlying components:
+//
+// * Pluggable storage drivers including aufs, vfs, lvm and btrfs.
+// * Pluggable execution drivers including lxc and chroot.
+//
+// In practice `daemon` still includes most core Docker components, including:
+//
+// * The reference registry client implementation
+// * Image management
+// * The build facility
+// * Logging
+//
+// These components should be broken off into plugins of their own.
+//
+func daemon(eng *engine.Engine) {
+	eng.Register("initserver", docker.InitServer)
+	eng.Register("init_networkdriver", lxc.InitDriver)
+	eng.Register("version", docker.GetVersion)
+}
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 9e93b71767..a2e1184c83 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -6,8 +6,8 @@ import (
 	"os"
 	"strings"
 
-	_ "github.com/dotcloud/docker"
 	"github.com/dotcloud/docker/api"
+	"github.com/dotcloud/docker/builtins"
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	flag "github.com/dotcloud/docker/pkg/mflag"
@@ -81,6 +81,8 @@ func main() {
 		if err != nil {
 			log.Fatal(err)
 		}
+		// Load builtins
+		builtins.Register(eng)
 		// load the daemon in the background so we can immediately start
 		// the http api so that connections don't fail while the daemon
 		// is booting
diff --git a/components/engine/networkdriver/lxc/driver.go b/components/engine/networkdriver/lxc/driver.go
index 0bc24b91b6..6185c42752 100644
--- a/components/engine/networkdriver/lxc/driver.go
+++ b/components/engine/networkdriver/lxc/driver.go
@@ -57,12 +57,6 @@ var (
 	currentInterfaces = make(map[string]*networkInterface)
 )
 
-func init() {
-	if err := engine.Register("init_networkdriver", InitDriver); err != nil {
-		panic(err)
-	}
-}
-
 func InitDriver(job *engine.Job) engine.Status {
 	var (
 		network        *net.IPNet
diff --git a/components/engine/server.go b/components/engine/server.go
index 0ed96fee31..190ccbcc4b 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -34,14 +34,10 @@ func (srv *Server) Close() error {
 	return srv.runtime.Close()
 }
 
-func init() {
-	engine.Register("initserver", jobInitServer)
-}
-
 // jobInitApi runs the remote api server `srv` as a daemon,
 // Only one api server can run at the same time - this is enforced by a pidfile.
 // The signals SIGINT, SIGQUIT and SIGTERM are intercepted for cleanup.
-func jobInitServer(job *engine.Job) engine.Status {
+func InitServer(job *engine.Job) engine.Status {
 	job.Logf("Creating server")
 	srv, err := NewServer(job.Eng, DaemonConfigFromJob(job))
 	if err != nil {
diff --git a/components/engine/version.go b/components/engine/version.go
index 88298a16cb..d88def9619 100644
--- a/components/engine/version.go
+++ b/components/engine/version.go
@@ -7,11 +7,7 @@ import (
 	"runtime"
 )
 
-func init() {
-	engine.Register("version", jobVersion)
-}
-
-func jobVersion(job *engine.Job) engine.Status {
+func GetVersion(job *engine.Job) engine.Status {
 	if _, err := dockerVersion().WriteTo(job.Stdout); err != nil {
 		job.Errorf("%s", err)
 		return engine.StatusErr

From 95f410bd66b5f5bbe5c333a80be0adfe425c3136 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Mon, 24 Feb 2014 19:22:48 +0000
Subject: [PATCH 239/403] Cleanup integration tests

Refactor integration tests to remove special cases in the creation of
test engines. All test engines are now created through newTestEngine.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 92c3927b5de73f81c490900b2718d218ec097bd3
Component: engine
---
 components/engine/integration/runtime_test.go | 56 +++----------------
 components/engine/integration/server_test.go  | 16 +-----
 components/engine/integration/utils_test.go   | 45 +++++++--------
 3 files changed, 29 insertions(+), 88 deletions(-)

diff --git a/components/engine/integration/runtime_test.go b/components/engine/integration/runtime_test.go
index ca2119ce1f..9eaf778b96 100644
--- a/components/engine/integration/runtime_test.go
+++ b/components/engine/integration/runtime_test.go
@@ -123,19 +123,8 @@ func init() {
 }
 
 func setupBaseImage() {
-	eng, err := engine.New(unitTestStoreBase)
-	if err != nil {
-		log.Fatalf("Can't initialize engine at %s: %s", unitTestStoreBase, err)
-	}
-	job := eng.Job("initserver")
-	job.Setenv("Root", unitTestStoreBase)
-	job.SetenvBool("Autorestart", false)
-	job.Setenv("BridgeIface", unitTestNetworkBridge)
-	if err := job.Run(); err != nil {
-		log.Fatalf("Unable to create a runtime for tests: %s", err)
-	}
-
-	job = eng.Job("inspect", unitTestImageName, "image")
+	eng := newTestEngine(log.New(os.Stderr, "", 0), false, unitTestStoreBase)
+	job := eng.Job("inspect", unitTestImageName, "image")
 	img, _ := job.Stdout.AddEnv()
 	// If the unit test is not found, try to download it.
 	if err := job.Run(); err != nil || img.Get("id") != unitTestImageID {
@@ -575,18 +564,7 @@ func TestRestore(t *testing.T) {
 
 	// Here are are simulating a docker restart - that is, reloading all containers
 	// from scratch
-	root := eng.Root()
-	eng, err := engine.New(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	job := eng.Job("initserver")
-	job.Setenv("Root", eng.Root())
-	job.SetenvBool("Autorestart", false)
-	if err := job.Run(); err != nil {
-		t.Fatal(err)
-	}
-
+	eng = newTestEngine(t, false, eng.Root())
 	runtime2 := mkRuntimeFromEngine(eng, t)
 	if len(runtime2.List()) != 2 {
 		t.Errorf("Expected 2 container, %v found", len(runtime2.List()))
@@ -612,22 +590,14 @@ func TestRestore(t *testing.T) {
 }
 
 func TestReloadContainerLinks(t *testing.T) {
-	// FIXME: here we don't use NewTestEngine because it calls initserver with Autorestart=false,
-	// and we want to set it to true.
 	root, err := newTestDirectory(unitTestStoreBase)
 	if err != nil {
 		t.Fatal(err)
 	}
-	eng, err := engine.New(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	job := eng.Job("initserver")
-	job.Setenv("Root", eng.Root())
-	job.SetenvBool("Autorestart", true)
-	if err := job.Run(); err != nil {
-		t.Fatal(err)
-	}
+	// FIXME: here we don't use NewTestEngine because it calls initserver with Autorestart=false,
+	// and we want to set it to true.
+
+	eng := newTestEngine(t, true, root)
 
 	runtime1 := mkRuntimeFromEngine(eng, t)
 	defer nuke(runtime1)
@@ -668,17 +638,7 @@ func TestReloadContainerLinks(t *testing.T) {
 
 	// Here are are simulating a docker restart - that is, reloading all containers
 	// from scratch
-	eng, err = engine.New(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	job = eng.Job("initserver")
-	job.Setenv("Root", eng.Root())
-	job.SetenvBool("Autorestart", false)
-	if err := job.Run(); err != nil {
-		t.Fatal(err)
-	}
-
+	eng = newTestEngine(t, false, root)
 	runtime2 := mkRuntimeFromEngine(eng, t)
 	if len(runtime2.List()) != 2 {
 		t.Errorf("Expected 2 container, %v found", len(runtime2.List()))
diff --git a/components/engine/integration/server_test.go b/components/engine/integration/server_test.go
index 2b7ef13cbd..2234bcab08 100644
--- a/components/engine/integration/server_test.go
+++ b/components/engine/integration/server_test.go
@@ -2,7 +2,6 @@ package docker
 
 import (
 	"github.com/dotcloud/docker"
-	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/runconfig"
 	"strings"
 	"testing"
@@ -258,20 +257,7 @@ func TestRestartKillWait(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	eng, err = engine.New(eng.Root())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	job = eng.Job("initserver")
-	job.Setenv("Root", eng.Root())
-	job.SetenvBool("AutoRestart", false)
-	// TestGetEnabledCors and TestOptionsRoute require EnableCors=true
-	job.SetenvBool("EnableCors", true)
-	if err := job.Run(); err != nil {
-		t.Fatal(err)
-	}
-
+	eng = newTestEngine(t, false, eng.Root())
 	srv = mkServerFromEngine(eng, t)
 
 	job = srv.Eng.Job("containers")
diff --git a/components/engine/integration/utils_test.go b/components/engine/integration/utils_test.go
index 947ace11d9..fc66e8bcbd 100644
--- a/components/engine/integration/utils_test.go
+++ b/components/engine/integration/utils_test.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/dotcloud/docker"
+	"github.com/dotcloud/docker/builtins"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
@@ -27,26 +28,12 @@ import (
 // Create a temporary runtime suitable for unit testing.
 // Call t.Fatal() at the first error.
 func mkRuntime(f utils.Fataler) *docker.Runtime {
-	root, err := newTestDirectory(unitTestStoreBase)
-	if err != nil {
-		f.Fatal(err)
-	}
-	config := &docker.DaemonConfig{
-		Root:        root,
-		AutoRestart: false,
-		Mtu:         docker.GetDefaultNetworkMtu(),
-	}
-
-	eng, err := engine.New(root)
-	if err != nil {
-		f.Fatal(err)
-	}
-
-	r, err := docker.NewRuntimeFromDirectory(config, eng)
-	if err != nil {
-		f.Fatal(err)
-	}
-	return r
+	eng := newTestEngine(f, false, "")
+	return mkRuntimeFromEngine(eng, f)
+	// FIXME:
+	// [...]
+	// Mtu:         docker.GetDefaultNetworkMtu(),
+	// [...]
 }
 
 func createNamedTestContainer(eng *engine.Engine, config *runconfig.Config, f utils.Fataler, name string) (shortId string) {
@@ -185,20 +172,24 @@ func mkRuntimeFromEngine(eng *engine.Engine, t utils.Fataler) *docker.Runtime {
 	return runtime
 }
 
-func NewTestEngine(t utils.Fataler) *engine.Engine {
-	root, err := newTestDirectory(unitTestStoreBase)
-	if err != nil {
-		t.Fatal(err)
+func newTestEngine(t utils.Fataler, autorestart bool, root string) *engine.Engine {
+	if root == "" {
+		if dir, err := newTestDirectory(unitTestStoreBase); err != nil {
+			t.Fatal(err)
+		} else {
+			root = dir
+		}
 	}
 	eng, err := engine.New(root)
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Load default plugins
+	builtins.Register(eng)
 	// (This is manually copied and modified from main() until we have a more generic plugin system)
 	job := eng.Job("initserver")
 	job.Setenv("Root", root)
-	job.SetenvBool("AutoRestart", false)
+	job.SetenvBool("AutoRestart", autorestart)
 	// TestGetEnabledCors and TestOptionsRoute require EnableCors=true
 	job.SetenvBool("EnableCors", true)
 	if err := job.Run(); err != nil {
@@ -207,6 +198,10 @@ func NewTestEngine(t utils.Fataler) *engine.Engine {
 	return eng
 }
 
+func NewTestEngine(t utils.Fataler) *engine.Engine {
+	return newTestEngine(t, false, "")
+}
+
 func newTestDirectory(templateDir string) (dir string, err error) {
 	return utils.TestDirectory(templateDir)
 }

From f14c0fd180c59d3f405118754236b13494f384d5 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Sat, 15 Feb 2014 15:05:28 -0800
Subject: [PATCH 240/403] Engine.ParseJob: create a new job from a shell-like
 text command.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 2019a73f0387af273be3b6e085fdae0e5a67ba3b
Component: engine
---
 components/engine/engine/engine.go | 43 ++++++++++++++++++++++++++++++
 components/engine/engine/env.go    |  7 +++++
 components/engine/engine/job.go    |  4 +++
 3 files changed, 54 insertions(+)

diff --git a/components/engine/engine/engine.go b/components/engine/engine/engine.go
index ec880b9c85..5814955fdd 100644
--- a/components/engine/engine/engine.go
+++ b/components/engine/engine/engine.go
@@ -1,6 +1,7 @@
 package engine
 
 import (
+	"bufio"
 	"fmt"
 	"github.com/dotcloud/docker/utils"
 	"io"
@@ -136,6 +137,48 @@ func (eng *Engine) Job(name string, args ...string) *Job {
 	return job
 }
 
+// ParseJob creates a new job from a text description using a shell-like syntax.
+//
+// The following syntax is used to parse `input`:
+//
+// * Words are separated using standard whitespaces as separators.
+// * Quotes and backslashes are not interpreted.
+// * Words of the form 'KEY=[VALUE]' are added to the job environment.
+// * All other words are added to the job arguments.
+//
+// For example:
+//
+// job, _ := eng.ParseJob("VERBOSE=1 echo hello TEST=true world")
+//
+// The resulting job will have:
+//	job.Args={"echo", "hello", "world"}
+//	job.Env={"VERBOSE":"1", "TEST":"true"}
+//
+func (eng *Engine) ParseJob(input string) (*Job, error) {
+	// FIXME: use a full-featured command parser
+	scanner := bufio.NewScanner(strings.NewReader(input))
+	scanner.Split(bufio.ScanWords)
+	var (
+		cmd []string
+		env Env
+	)
+	for scanner.Scan() {
+		word := scanner.Text()
+		kv := strings.SplitN(word, "=", 2)
+		if len(kv) == 2 {
+			env.Set(kv[0], kv[1])
+		} else {
+			cmd = append(cmd, word)
+		}
+	}
+	if len(cmd) == 0 {
+		return nil, fmt.Errorf("empty command: '%s'", input)
+	}
+	job := eng.Job(cmd[0], cmd[1:]...)
+	job.Env().Init(&env)
+	return job, nil
+}
+
 func (eng *Engine) Logf(format string, args ...interface{}) (n int, err error) {
 	if os.Getenv("TEST") == "" {
 		prefixedFormat := fmt.Sprintf("[%s] %s\n", eng, strings.TrimRight(format, "\n"))
diff --git a/components/engine/engine/env.go b/components/engine/engine/env.go
index ce8c34bb24..7a6d946444 100644
--- a/components/engine/engine/env.go
+++ b/components/engine/engine/env.go
@@ -36,6 +36,13 @@ func (env *Env) Exists(key string) bool {
 	return exists
 }
 
+func (env *Env) Init(src *Env) {
+	*env = make([]string, 0, len(*src))
+	for _, val := range *src {
+		(*env) = append((*env), val)
+	}
+}
+
 func (env *Env) GetBool(key string) (value bool) {
 	s := strings.ToLower(strings.Trim(env.Get(key), " \t"))
 	if s == "" || s == "0" || s == "no" || s == "false" || s == "none" {
diff --git a/components/engine/engine/job.go b/components/engine/engine/job.go
index 1f35ac85ff..9edb077a6d 100644
--- a/components/engine/engine/job.go
+++ b/components/engine/engine/job.go
@@ -102,6 +102,10 @@ func (job *Job) String() string {
 	return fmt.Sprintf("%s.%s%s", job.Eng, job.CallString(), job.StatusString())
 }
 
+func (job *Job) Env() *Env {
+	return job.env
+}
+
 func (job *Job) EnvExists(key string) (value bool) {
 	return job.env.Exists(key)
 }

From e69a84baec0fa517a5547d4f999334f29eec4937 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Sat, 15 Feb 2014 15:07:50 -0800
Subject: [PATCH 241/403] Engine: clearer job error reporting

* Job.Error and Job.Errorf always print a newline.
* Avoid redundant prefixing of error messages.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 8a1778301bffaf46abbce5cb76c1add47bd241a0
Component: engine
---
 components/engine/engine/job.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/components/engine/engine/job.go b/components/engine/engine/job.go
index 1f35ac85ff..8e478f5053 100644
--- a/components/engine/engine/job.go
+++ b/components/engine/engine/job.go
@@ -74,7 +74,7 @@ func (job *Job) Run() error {
 		return err
 	}
 	if job.status != 0 {
-		return fmt.Errorf("%s: %s", job.Name, errorMessage)
+		return fmt.Errorf("%s", errorMessage)
 	}
 	return nil
 }
@@ -197,11 +197,14 @@ func (job *Job) Printf(format string, args ...interface{}) (n int, err error) {
 }
 
 func (job *Job) Errorf(format string, args ...interface{}) Status {
+	if format[len(format)-1] != '\n' {
+		format = format + "\n"
+	}
 	fmt.Fprintf(job.Stderr, format, args...)
 	return StatusErr
 }
 
 func (job *Job) Error(err error) Status {
-	fmt.Fprintf(job.Stderr, "%s", err)
+	fmt.Fprintf(job.Stderr, "%s\n", err)
 	return StatusErr
 }

From fbf1d0f7237c925b593200f13bc07bdaee513b63 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Mon, 24 Feb 2014 11:48:14 -0800
Subject: [PATCH 242/403] api/common.go: code shared by the server and client
 implementation of the Docker remote api.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 551355c9adac6a8b36244e1962e7a104611ae4af
Component: engine
---
 components/engine/api/common.go             | 45 +++++++++++++++++++++
 components/engine/api/{api.go => server.go} | 37 -----------------
 2 files changed, 45 insertions(+), 37 deletions(-)
 create mode 100644 components/engine/api/common.go
 rename components/engine/api/{api.go => server.go} (96%)

diff --git a/components/engine/api/common.go b/components/engine/api/common.go
new file mode 100644
index 0000000000..59e7d3d525
--- /dev/null
+++ b/components/engine/api/common.go
@@ -0,0 +1,45 @@
+package api
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/engine"
+	"github.com/dotcloud/docker/utils"
+	"mime"
+	"strings"
+)
+
+const (
+	APIVERSION        = 1.9
+	DEFAULTHTTPHOST   = "127.0.0.1"
+	DEFAULTUNIXSOCKET = "/var/run/docker.sock"
+)
+
+func ValidateHost(val string) (string, error) {
+	host, err := utils.ParseHost(DEFAULTHTTPHOST, DEFAULTUNIXSOCKET, val)
+	if err != nil {
+		return val, err
+	}
+	return host, nil
+}
+
+//TODO remove, used on < 1.5 in getContainersJSON
+func displayablePorts(ports *engine.Table) string {
+	result := []string{}
+	for _, port := range ports.Data {
+		if port.Get("IP") == "" {
+			result = append(result, fmt.Sprintf("%d/%s", port.GetInt("PublicPort"), port.Get("Type")))
+		} else {
+			result = append(result, fmt.Sprintf("%s:%d->%d/%s", port.Get("IP"), port.GetInt("PublicPort"), port.GetInt("PrivatePort"), port.Get("Type")))
+		}
+	}
+	return strings.Join(result, ", ")
+}
+
+func MatchesContentType(contentType, expectedType string) bool {
+	mimetype, _, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		utils.Errorf("Error parsing media type: %s error: %s", contentType, err.Error())
+	}
+	return err == nil && mimetype == expectedType
+}
+
diff --git a/components/engine/api/api.go b/components/engine/api/server.go
similarity index 96%
rename from components/engine/api/api.go
rename to components/engine/api/server.go
index 0fe1eb0fee..4b10a2dae1 100644
--- a/components/engine/api/api.go
+++ b/components/engine/api/server.go
@@ -17,7 +17,6 @@ import (
 	"io"
 	"io/ioutil"
 	"log"
-	"mime"
 	"net"
 	"net/http"
 	"net/http/pprof"
@@ -29,25 +28,10 @@ import (
 	"time"
 )
 
-// FIXME: move code common to client and server to common.go
-const (
-	APIVERSION        = 1.9
-	DEFAULTHTTPHOST   = "127.0.0.1"
-	DEFAULTUNIXSOCKET = "/var/run/docker.sock"
-)
-
 var (
 	activationLock chan struct{}
 )
 
-func ValidateHost(val string) (string, error) {
-	host, err := utils.ParseHost(DEFAULTHTTPHOST, DEFAULTUNIXSOCKET, val)
-	if err != nil {
-		return val, err
-	}
-	return host, nil
-}
-
 type HttpApiFunc func(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error
 
 func hijackServer(w http.ResponseWriter) (io.ReadCloser, io.Writer, error) {
@@ -129,27 +113,6 @@ func getBoolParam(value string) (bool, error) {
 	return ret, nil
 }
 
-//TODO remove, used on < 1.5 in getContainersJSON
-func displayablePorts(ports *engine.Table) string {
-	result := []string{}
-	for _, port := range ports.Data {
-		if port.Get("IP") == "" {
-			result = append(result, fmt.Sprintf("%d/%s", port.GetInt("PublicPort"), port.Get("Type")))
-		} else {
-			result = append(result, fmt.Sprintf("%s:%d->%d/%s", port.Get("IP"), port.GetInt("PublicPort"), port.GetInt("PrivatePort"), port.Get("Type")))
-		}
-	}
-	return strings.Join(result, ", ")
-}
-
-func MatchesContentType(contentType, expectedType string) bool {
-	mimetype, _, err := mime.ParseMediaType(contentType)
-	if err != nil {
-		utils.Errorf("Error parsing media type: %s error: %s", contentType, err.Error())
-	}
-	return err == nil && mimetype == expectedType
-}
-
 func postAuth(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	var (
 		authConfig, err = ioutil.ReadAll(r.Body)

From 48edd91d266c2ffe620fca6de38fa50c732ffb8c Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Sat, 22 Feb 2014 17:09:22 -0700
Subject: [PATCH 243/403] Add "SteamOS" support to mkimage-debootstrap
 (requires a debootstrap script like
 https://github.com/tianon/gentoo-overlay/blob/master/dev-util/debootstrap-valve/files/scripts/alchemist)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: cd94c9d66693253ce71d8c691cb937980dd96565
Component: engine
---
 components/engine/contrib/mkimage-debootstrap.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/components/engine/contrib/mkimage-debootstrap.sh b/components/engine/contrib/mkimage-debootstrap.sh
index 8ed4570289..bf89600973 100755
--- a/components/engine/contrib/mkimage-debootstrap.sh
+++ b/components/engine/contrib/mkimage-debootstrap.sh
@@ -210,6 +210,10 @@ if [ -z "$strictDebootstrap" ]; then
 					sudo sed -i "p; s/ $suite main$/ ${suite}-updates main/" etc/apt/sources.list
 				fi
 				;;
+			SteamOS)
+				# add contrib and non-free
+				sudo sed -i "s/ $suite main$/ $suite main contrib non-free/" etc/apt/sources.list
+				;;
 		esac
 	fi
 	
@@ -270,6 +274,15 @@ else
 					fi
 				fi
 				;;
+			SteamOS)
+				if [ -r etc/lsb-release ]; then
+					lsbRelease="$(. etc/lsb-release && echo "$DISTRIB_RELEASE")"
+					if [ "$lsbRelease" ]; then
+						# tag specific SteamOS version number, if available (1.0, 2.0, etc.)
+						$docker tag $repo:$suite $repo:$lsbRelease
+					fi
+				fi
+				;;
 		esac
 	fi
 fi

From 54e2291890be9b31a77d1eaede21c0df61e3f01c Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 12:21:13 -0800
Subject: [PATCH 244/403] Compile nsinit into docker for use with dockerinit
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 8f20058307cb30c9697b8dbee1c7bf2b1e0ba766 Component: engine

---
 components/engine/docker/docker.go            |  2 +-
 components/engine/execdriver/driver.go        |  2 ++
 .../engine/execdriver/namespaces/driver.go    | 33 ++++++++++++++++---
 components/engine/sysinit/sysinit.go          |  4 +++
 4 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 9e93b71767..6c6ad66abf 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -17,7 +17,7 @@ import (
 )
 
 func main() {
-	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || selfPath == "/.dockerinit" {
+	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || strings.Contains(selfPath, "/.dockerinit") {
 		// Running in init mode
 		sysinit.SysInit()
 		return
diff --git a/components/engine/execdriver/driver.go b/components/engine/execdriver/driver.go
index a6d865caf3..8b5dd5ccc7 100644
--- a/components/engine/execdriver/driver.go
+++ b/components/engine/execdriver/driver.go
@@ -51,6 +51,8 @@ type InitArgs struct {
 	Args       []string
 	Mtu        int
 	Driver     string
+	Console    string
+	Pipe       int
 }
 
 // Driver specific information based on
diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index efbb09d131..5657b8cc46 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -28,6 +28,28 @@ var (
 
 func init() {
 	execdriver.RegisterInitFunc(DriverName, func(args *execdriver.InitArgs) error {
+		var container *libcontainer.Container
+		f, err := os.Open("container.json")
+		if err != nil {
+			return err
+		}
+		if err := json.NewDecoder(f).Decode(&container); err != nil {
+			f.Close()
+			return err
+		}
+		f.Close()
+
+		cwd, err := os.Getwd()
+		if err != nil {
+			return err
+		}
+		syncPipe, err := nsinit.NewSyncPipeFromFd(0, uintptr(args.Pipe))
+		if err != nil {
+			return err
+		}
+		if err := nsinit.Init(container, cwd, args.Console, syncPipe, args.Args); err != nil {
+			return err
+		}
 		return nil
 	})
 }
@@ -115,14 +137,15 @@ type dockerCommandFactory struct {
 func (d *dockerCommandFactory) Create(container *libcontainer.Container,
 	console, logFile string, syncFd uintptr, args []string) *exec.Cmd {
 	c := d.c
-	aname, _ := exec.LookPath("nsinit")
-	c.Path = aname
+	// we need to join the rootfs because nsinit will setup the rootfs and chroot
+	initPath := filepath.Join(c.Rootfs, c.InitPath)
+
+	c.Path = initPath
 	c.Args = append([]string{
-		aname,
+		initPath,
+		"-driver", DriverName,
 		"-console", console,
 		"-pipe", fmt.Sprint(syncFd),
-		"-log", logFile,
-		"init",
 	}, args...)
 	c.SysProcAttr = &syscall.SysProcAttr{
 		Cloneflags: uintptr(nsinit.GetNamespaceFlags(container.Namespaces)),
diff --git a/components/engine/sysinit/sysinit.go b/components/engine/sysinit/sysinit.go
index b02cf027aa..e10c0baad0 100644
--- a/components/engine/sysinit/sysinit.go
+++ b/components/engine/sysinit/sysinit.go
@@ -53,6 +53,8 @@ func SysInit() {
 		privileged = flag.Bool("privileged", false, "privileged mode")
 		mtu        = flag.Int("mtu", 1500, "interface mtu")
 		driver     = flag.String("driver", "", "exec driver")
+		pipe       = flag.Int("pipe", 0, "sync pipe fd")
+		console    = flag.String("console", "", "console (pty slave) path")
 	)
 	flag.Parse()
 
@@ -79,6 +81,8 @@ func SysInit() {
 		Args:       flag.Args(),
 		Mtu:        *mtu,
 		Driver:     *driver,
+		Console:    *console,
+		Pipe:       *pipe,
 	}
 
 	if err := executeProgram(args); err != nil {

From 031e369945cbd41a86d6f48f38dbdcaf336779d6 Mon Sep 17 00:00:00 2001
From: Vincent Batts <vbatts@redhat.com>
Date: Mon, 24 Feb 2014 15:28:45 -0500
Subject: [PATCH 245/403] Move the terminal setup to execdriver, instead of
 ./pkg/term

  It is independent of any particular driver, but likely used by
  multiple execdrivers. Also, pkg/... is not to have any links to
  docker, which this terminal setup does.

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Upstream-commit: fabc478e7e33fd3b3c00c3bd74bad0d87a2c23e3
Component: engine
---
 .../driver.go => execdriver/termconsole.go}    | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)
 rename components/engine/{pkg/term/driver.go => execdriver/termconsole.go} (74%)

diff --git a/components/engine/pkg/term/driver.go b/components/engine/execdriver/termconsole.go
similarity index 74%
rename from components/engine/pkg/term/driver.go
rename to components/engine/execdriver/termconsole.go
index 6e1fae41ba..2da48d1864 100644
--- a/components/engine/pkg/term/driver.go
+++ b/components/engine/execdriver/termconsole.go
@@ -1,15 +1,15 @@
-package term
+package execdriver
 
 import (
-	"github.com/dotcloud/docker/execdriver"
+	"github.com/dotcloud/docker/pkg/term"
 	"github.com/kr/pty"
 	"io"
 	"os"
 )
 
-func SetTerminal(command *execdriver.Command, pipes *execdriver.Pipes) error {
+func SetTerminal(command *Command, pipes *Pipes) error {
 	var (
-		term execdriver.Terminal
+		term Terminal
 		err  error
 	)
 	if command.Tty {
@@ -29,7 +29,7 @@ type TtyConsole struct {
 	slave  *os.File
 }
 
-func NewTtyConsole(command *execdriver.Command, pipes *execdriver.Pipes) (*TtyConsole, error) {
+func NewTtyConsole(command *Command, pipes *Pipes) (*TtyConsole, error) {
 	ptyMaster, ptySlave, err := pty.Open()
 	if err != nil {
 		return nil, err
@@ -50,10 +50,10 @@ func (t *TtyConsole) Master() *os.File {
 }
 
 func (t *TtyConsole) Resize(h, w int) error {
-	return SetWinsize(t.master.Fd(), &Winsize{Height: uint16(h), Width: uint16(w)})
+	return term.SetWinsize(t.master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
 }
 
-func (t *TtyConsole) attach(command *execdriver.Command, pipes *execdriver.Pipes) error {
+func (t *TtyConsole) attach(command *Command, pipes *Pipes) error {
 	command.Stdout = t.slave
 	command.Stderr = t.slave
 	command.Console = t.slave.Name()
@@ -87,7 +87,7 @@ func (t *TtyConsole) Close() error {
 type StdConsole struct {
 }
 
-func NewStdConsole(command *execdriver.Command, pipes *execdriver.Pipes) (*StdConsole, error) {
+func NewStdConsole(command *Command, pipes *Pipes) (*StdConsole, error) {
 	std := &StdConsole{}
 
 	if err := std.attach(command, pipes); err != nil {
@@ -96,7 +96,7 @@ func NewStdConsole(command *execdriver.Command, pipes *execdriver.Pipes) (*StdCo
 	return std, nil
 }
 
-func (s *StdConsole) attach(command *execdriver.Command, pipes *execdriver.Pipes) error {
+func (s *StdConsole) attach(command *Command, pipes *Pipes) error {
 	command.Stdout = pipes.Stdout
 	command.Stderr = pipes.Stderr
 

From 32c3efbd4e86f883dae6777b35542cbeb06283b8 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Mon, 24 Feb 2014 12:26:56 -0800
Subject: [PATCH 246/403] Engine: cleanup side effects between tests

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 62b21daded2ea9b703a6e5fa0479e007016b1edb
Component: engine
---
 components/engine/engine/engine.go      | 4 ++++
 components/engine/engine/engine_test.go | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/components/engine/engine/engine.go b/components/engine/engine/engine.go
index 5814955fdd..946e8a9ece 100644
--- a/components/engine/engine/engine.go
+++ b/components/engine/engine/engine.go
@@ -29,6 +29,10 @@ func Register(name string, handler Handler) error {
 	return nil
 }
 
+func unregister(name string) {
+	delete(globalHandlers, name)
+}
+
 // The Engine is the core of Docker.
 // It acts as a store for *containers*, and allows manipulation of these
 // containers by executing *jobs*.
diff --git a/components/engine/engine/engine_test.go b/components/engine/engine/engine_test.go
index da59610727..90b61cda9a 100644
--- a/components/engine/engine/engine_test.go
+++ b/components/engine/engine/engine_test.go
@@ -16,6 +16,8 @@ func TestRegister(t *testing.T) {
 	if err := Register("dummy1", nil); err == nil {
 		t.Fatalf("Expecting error, got none")
 	}
+	// Register is global so let's cleanup to avoid conflicts
+	defer unregister("dummy1")
 
 	eng := newTestEngine(t)
 
@@ -32,6 +34,7 @@ func TestRegister(t *testing.T) {
 	if err := eng.Register("dummy2", nil); err == nil {
 		t.Fatalf("Expecting error, got none")
 	}
+	defer unregister("dummy2")
 }
 
 func TestJob(t *testing.T) {
@@ -48,6 +51,7 @@ func TestJob(t *testing.T) {
 	}
 
 	eng.Register("dummy2", h)
+	defer unregister("dummy2")
 	job2 := eng.Job("dummy2", "--level=awesome")
 
 	if job2.handler == nil {

From 171ee11139ac39391f522fc88f68004cf35dd6fa Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Sat, 15 Feb 2014 15:06:21 -0800
Subject: [PATCH 247/403] Engine: builtin command 'commands' returns a list of
 registered commands

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: cd846ecb60ad936d58d70762ed91cffa906cef93
Component: engine
---
 components/engine/engine/engine.go      | 18 ++++++++++++++++++
 components/engine/engine/engine_test.go | 19 +++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/components/engine/engine/engine.go b/components/engine/engine/engine.go
index 946e8a9ece..68e109e7f2 100644
--- a/components/engine/engine/engine.go
+++ b/components/engine/engine/engine.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"sort"
 	"strings"
 )
 
@@ -110,6 +111,12 @@ func New(root string) (*Engine, error) {
 		Stderr:   os.Stderr,
 		Stdin:    os.Stdin,
 	}
+	eng.Register("commands", func(job *Job) Status {
+		for _, name := range eng.commands() {
+			job.Printf("%s\n", name)
+		}
+		return StatusOK
+	})
 	// Copy existing global handlers
 	for k, v := range globalHandlers {
 		eng.handlers[k] = v
@@ -121,6 +128,17 @@ func (eng *Engine) String() string {
 	return fmt.Sprintf("%s|%s", eng.Root(), eng.id[:8])
 }
 
+// Commands returns a list of all currently registered commands,
+// sorted alphabetically.
+func (eng *Engine) commands() []string {
+	names := make([]string, 0, len(eng.handlers))
+	for name := range eng.handlers {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return names
+}
+
 // Job creates a new job which can later be executed.
 // This function mimics `Command` from the standard os/exec package.
 func (eng *Engine) Job(name string, args ...string) *Job {
diff --git a/components/engine/engine/engine_test.go b/components/engine/engine/engine_test.go
index 90b61cda9a..e922d8a875 100644
--- a/components/engine/engine/engine_test.go
+++ b/components/engine/engine/engine_test.go
@@ -1,6 +1,7 @@
 package engine
 
 import (
+	"bytes"
 	"io/ioutil"
 	"os"
 	"path"
@@ -63,6 +64,24 @@ func TestJob(t *testing.T) {
 	}
 }
 
+func TestEngineCommands(t *testing.T) {
+	eng := newTestEngine(t)
+	defer os.RemoveAll(eng.Root())
+	handler := func(job *Job) Status { return StatusOK }
+	eng.Register("foo", handler)
+	eng.Register("bar", handler)
+	eng.Register("echo", handler)
+	eng.Register("die", handler)
+	var output bytes.Buffer
+	commands := eng.Job("commands")
+	commands.Stdout.Add(&output)
+	commands.Run()
+	expected := "bar\ncommands\ndie\necho\nfoo\n"
+	if result := output.String(); result != expected {
+		t.Fatalf("Unexpected output:\nExpected = %v\nResult   = %v\n", expected, result)
+	}
+}
+
 func TestEngineRoot(t *testing.T) {
 	tmp, err := ioutil.TempDir("", "docker-test-TestEngineCreateDir")
 	if err != nil {

From 0070aebcd1eadb8ba41669e16edb9ce4887714f8 Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Mon, 24 Feb 2014 12:06:08 -0800
Subject: [PATCH 248/403] Engine: add tests for ParseJob()

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: d985fd49843b31b227b46d5ed71914002e2e0de9
Component: engine
---
 components/engine/engine/engine_test.go | 38 +++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/components/engine/engine/engine_test.go b/components/engine/engine/engine_test.go
index da59610727..cb3b939cbc 100644
--- a/components/engine/engine/engine_test.go
+++ b/components/engine/engine/engine_test.go
@@ -5,6 +5,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -114,3 +115,40 @@ func TestEngineLogf(t *testing.T) {
 		t.Fatalf("Test: Logf() should print at least as much as the input\ninput=%d\nprinted=%d", len(input), n)
 	}
 }
+
+func TestParseJob(t *testing.T) {
+	eng := newTestEngine(t)
+	defer os.RemoveAll(eng.Root())
+	// Verify that the resulting job calls to the right place
+	var called bool
+	eng.Register("echo", func(job *Job) Status {
+		called = true
+		return StatusOK
+	})
+	input := "echo DEBUG=1 hello world VERBOSITY=42"
+	job, err := eng.ParseJob(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if job.Name != "echo" {
+		t.Fatalf("Invalid job name: %v", job.Name)
+	}
+	if strings.Join(job.Args, ":::") != "hello:::world" {
+		t.Fatalf("Invalid job args: %v", job.Args)
+	}
+	if job.Env().Get("DEBUG") != "1" {
+		t.Fatalf("Invalid job env: %v", job.Env)
+	}
+	if job.Env().Get("VERBOSITY") != "42" {
+		t.Fatalf("Invalid job env: %v", job.Env)
+	}
+	if len(job.Env().Map()) != 2 {
+		t.Fatalf("Invalid job env: %v", job.Env)
+	}
+	if err := job.Run(); err != nil {
+		t.Fatal(err)
+	}
+	if !called {
+		t.Fatalf("Job was not called")
+	}
+}

From 1560c87c83d9713037a0ffd08bab696f6eb0321e Mon Sep 17 00:00:00 2001
From: Solomon Hykes <solomon@dotcloud.com>
Date: Mon, 24 Feb 2014 12:08:37 -0800
Subject: [PATCH 249/403] Engine: tiny cosmetic fix

To make @creack happy :)

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Upstream-commit: 0469e7d0622add573f2f9c357564ff0076db9346
Component: engine
---
 components/engine/engine/env.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/engine/env.go b/components/engine/engine/env.go
index 7a6d946444..c43a5ec971 100644
--- a/components/engine/engine/env.go
+++ b/components/engine/engine/env.go
@@ -37,7 +37,7 @@ func (env *Env) Exists(key string) bool {
 }
 
 func (env *Env) Init(src *Env) {
-	*env = make([]string, 0, len(*src))
+	(*env) = make([]string, 0, len(*src))
 	for _, val := range *src {
 		(*env) = append((*env), val)
 	}

From e085e22f6b6dc36a81056f77e8f5408a7e23fccb Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Mon, 24 Feb 2014 13:38:58 -0700
Subject: [PATCH 250/403] Adjust kernel version parsing to be more lenient of
 strange things like "3.12-1-amd64"

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 2ae8180de2d814e04834d41f20b2c96a06995678
Component: engine
---
 components/engine/utils/utils.go      | 12 +++++++++---
 components/engine/utils/utils_test.go |  1 +
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 1aba80ff41..f24e17c38e 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -606,16 +606,22 @@ func GetKernelVersion() (*KernelVersionInfo, error) {
 func ParseRelease(release string) (*KernelVersionInfo, error) {
 	var (
 		kernel, major, minor, parsed int
-		flavor                       string
+		flavor, partial              string
 	)
 
 	// Ignore error from Sscanf to allow an empty flavor.  Instead, just
 	// make sure we got all the version numbers.
-	parsed, _ = fmt.Sscanf(release, "%d.%d.%d%s", &kernel, &major, &minor, &flavor)
-	if parsed < 3 {
+	parsed, _ = fmt.Sscanf(release, "%d.%d%s", &kernel, &major, &partial)
+	if parsed < 2 {
 		return nil, errors.New("Can't parse kernel version " + release)
 	}
 
+	// sometimes we have 3.12.25-gentoo, but sometimes we just have 3.12-1-amd64
+	parsed, _ = fmt.Sscanf(partial, ".%d%s", &minor, &flavor)
+	if parsed < 1 {
+		flavor = partial
+	}
+
 	return &KernelVersionInfo{
 		Kernel: kernel,
 		Major:  major,
diff --git a/components/engine/utils/utils_test.go b/components/engine/utils/utils_test.go
index 7e63a45cf7..78f4ca2bd2 100644
--- a/components/engine/utils/utils_test.go
+++ b/components/engine/utils/utils_test.go
@@ -420,6 +420,7 @@ func TestParseRelease(t *testing.T) {
 	assertParseRelease(t, "3.4.54.longterm-1", &KernelVersionInfo{Kernel: 3, Major: 4, Minor: 54, Flavor: ".longterm-1"}, 0)
 	assertParseRelease(t, "3.8.0-19-generic", &KernelVersionInfo{Kernel: 3, Major: 8, Minor: 0, Flavor: "-19-generic"}, 0)
 	assertParseRelease(t, "3.12.8tag", &KernelVersionInfo{Kernel: 3, Major: 12, Minor: 8, Flavor: "tag"}, 0)
+	assertParseRelease(t, "3.12-1-amd64", &KernelVersionInfo{Kernel: 3, Major: 12, Minor: 0, Flavor: "-1-amd64"}, 0)
 }
 
 func TestParsePortMapping(t *testing.T) {

From 28b09e351d82837763519210adbfdab9ed841b63 Mon Sep 17 00:00:00 2001
From: Sam Alba <sam.alba@gmail.com>
Date: Mon, 24 Feb 2014 12:40:33 -0800
Subject: [PATCH 251/403] registry: Removed checksumPayload from exported
 fields

Docker-DCO-1.1-Signed-off-by: Sam Alba <sam@docker.com> (github: samalba)
Upstream-commit: 522c0765f11569feb1dbc7facfbb802e0f1fb84e
Component: engine
---
 components/engine/registry/registry.go | 4 ++--
 components/engine/server.go            | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/components/engine/registry/registry.go b/components/engine/registry/registry.go
index 7bdf12c883..d0ddedb7ba 100644
--- a/components/engine/registry/registry.go
+++ b/components/engine/registry/registry.go
@@ -389,7 +389,7 @@ func (r *Registry) PushImageChecksumRegistry(imgData *ImgData, registry string,
 	}
 	setTokenAuth(req, token)
 	req.Header.Set("X-Docker-Checksum", imgData.Checksum)
-	req.Header.Set("X-Docker-Checksum-Payload", imgData.ChecksumPayload)
+	req.Header.Set("X-Docker-Checksum-Payload", imgData.checksumPayload)
 
 	res, err := doWithCookies(r.client, req)
 	if err != nil {
@@ -679,8 +679,8 @@ type RepositoryData struct {
 type ImgData struct {
 	ID              string `json:"id"`
 	Checksum        string `json:"checksum,omitempty"`
-	ChecksumPayload string `json:"checksum,omitempty"`
 	Tag             string `json:",omitempty"`
+	checksumPayload string
 }
 
 type Registry struct {
diff --git a/components/engine/server.go b/components/engine/server.go
index b9fd92716a..01adcc30eb 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1509,7 +1509,7 @@ func (srv *Server) pushImage(r *registry.Registry, out io.Writer, remote, imgID,
 		return "", err
 	}
 	imgData.Checksum = checksum
-	imgData.ChecksumPayload = checksumPayload
+	imgData.checksumPayload = checksumPayload
 	// Send the checksum
 	if err := r.PushImageChecksumRegistry(imgData, ep, token); err != nil {
 		return "", err

From 07cc777e62a8a0190baa9e344341723a1ad3ede9 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 13:40:17 -0800
Subject: [PATCH 252/403] Fix tests with dockerinit lookup path
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 01f9815b55742654b2f35d13c3aba6a9e48634c7 Component: engine

---
 components/engine/docker/docker.go            |  2 +-
 .../engine/execdriver/namespaces/driver.go    |  3 ++-
 components/engine/integration/runtime_test.go |  2 +-
 .../pkg/libcontainer/nsinit/nsinit/main.go    |  4 +++-
 components/engine/sysinit/sysinit.go          | 24 ++++++++++++++++++-
 5 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 6c6ad66abf..66c4dbf02a 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -17,7 +17,7 @@ import (
 )
 
 func main() {
-	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || strings.Contains(selfPath, "/.dockerinit") {
+	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || strings.Contains(selfPath, ".dockerinit") {
 		// Running in init mode
 		sysinit.SysInit()
 		return
diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index 5657b8cc46..9f153bd3eb 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -86,7 +86,7 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 		return -1, err
 	}
 	args := append([]string{c.Entrypoint}, c.Arguments...)
-	return nsinit.Exec(container, factory, stateWriter, term, "/nsinit.log", args)
+	return nsinit.Exec(container, factory, stateWriter, term, "", args)
 }
 
 func (d *driver) Kill(p *execdriver.Command, sig int) error {
@@ -146,6 +146,7 @@ func (d *dockerCommandFactory) Create(container *libcontainer.Container,
 		"-driver", DriverName,
 		"-console", console,
 		"-pipe", fmt.Sprint(syncFd),
+		"-log", logFile,
 	}, args...)
 	c.SysProcAttr = &syscall.SysProcAttr{
 		Cloneflags: uintptr(nsinit.GetNamespaceFlags(container.Namespaces)),
diff --git a/components/engine/integration/runtime_test.go b/components/engine/integration/runtime_test.go
index ca2119ce1f..522e910562 100644
--- a/components/engine/integration/runtime_test.go
+++ b/components/engine/integration/runtime_test.go
@@ -85,7 +85,7 @@ func init() {
 	os.Setenv("TEST", "1")
 
 	// Hack to run sys init during unit testing
-	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || selfPath == "/.dockerinit" {
+	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || strings.Contains(selfPath, ".dockerinit") {
 		sysinit.SysInit()
 		return
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index c299412c7b..786c9c1ea6 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -24,7 +24,7 @@ var (
 	ErrWrongArguments = errors.New("Wrong argument count")
 )
 
-func init() {
+func registerFlags() {
 	flag.StringVar(&console, "console", "", "console (pty slave) path")
 	flag.StringVar(&logFile, "log", "none", "log options (none, stderr, or a file path)")
 	flag.IntVar(&pipeFd, "pipe", 0, "sync pipe fd")
@@ -33,6 +33,8 @@ func init() {
 }
 
 func main() {
+	registerFlags()
+
 	if flag.NArg() < 1 {
 		log.Fatal(ErrWrongArguments)
 	}
diff --git a/components/engine/sysinit/sysinit.go b/components/engine/sysinit/sysinit.go
index e10c0baad0..6d604fcccc 100644
--- a/components/engine/sysinit/sysinit.go
+++ b/components/engine/sysinit/sysinit.go
@@ -7,6 +7,7 @@ import (
 	"github.com/dotcloud/docker/execdriver"
 	_ "github.com/dotcloud/docker/execdriver/chroot"
 	_ "github.com/dotcloud/docker/execdriver/lxc"
+	"io"
 	"io/ioutil"
 	"log"
 	"os"
@@ -55,9 +56,14 @@ func SysInit() {
 		driver     = flag.String("driver", "", "exec driver")
 		pipe       = flag.Int("pipe", 0, "sync pipe fd")
 		console    = flag.String("console", "", "console (pty slave) path")
+		logFile    = flag.String("log", "", "log file path")
 	)
 	flag.Parse()
 
+	if err := setupLogging(*logFile); err != nil {
+		log.Fatalf("setup logging %s", err)
+	}
+
 	// Get env
 	var env []string
 	content, err := ioutil.ReadFile("/.dockerenv")
@@ -67,7 +73,6 @@ func SysInit() {
 	if err := json.Unmarshal(content, &env); err != nil {
 		log.Fatalf("Unable to unmarshal environment variables: %v", err)
 	}
-
 	// Propagate the plugin-specific container env variable
 	env = append(env, "container="+os.Getenv("container"))
 
@@ -89,3 +94,20 @@ func SysInit() {
 		log.Fatal(err)
 	}
 }
+
+func setupLogging(logFile string) (err error) {
+	var writer io.Writer
+	switch logFile {
+	case "stderr":
+		writer = os.Stderr
+	case "none", "":
+		writer = ioutil.Discard
+	default:
+		writer, err = os.OpenFile(logFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0755)
+		if err != nil {
+			return err
+		}
+	}
+	log.SetOutput(writer)
+	return nil
+}

From 8a923765fcfc83bdda02add862295db9c0833cda Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 11:08:20 -0800
Subject: [PATCH 253/403] Use the cpu cgroup subsystem instead of memory
 because its non optional Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 757c7581c8334b6b527d1c922fe5007d5004eca2 Component: engine

---
 components/engine/execdriver/lxc/driver.go | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index 5be7ad2219..fce6d6717c 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -301,9 +301,8 @@ func (d *driver) Info(id string) execdriver.Info {
 func (d *driver) GetPidsForContainer(id string) ([]int, error) {
 	pids := []int{}
 
-	// memory is chosen randomly, any cgroup used by docker works
-	subsystem := "memory"
-
+	// cpu is chosen because it is the only non optional subsystem in cgroups
+	subsystem := "cpu"
 	cgroupRoot, err := cgroups.FindCgroupMountpoint(subsystem)
 	if err != nil {
 		return pids, err

From 9ab15c1e2d97b34696f804306b9f6e597f39fa90 Mon Sep 17 00:00:00 2001
From: Josh Hawn <josh.hawn@docker.com>
Date: Mon, 24 Feb 2014 13:28:49 -0800
Subject: [PATCH 254/403] Added documentation for docker.io OAuth & Accounts

OAuth docs:
  documented the OAuth authorization flow and how to register your application

Account docs:
  documented getting/updating user profile data
  documented getting/updating user email data

Docker-DCO-1.1-Signed-off-by: Josh hawn <josh.hawn@docker.com> (github: jlhawn)
Upstream-commit: 00bb76f35b4d21d0aaddb23f93d663ec02faea1a
Component: engine
---
 .../docs/sources/reference/api/README.md      |   1 +
 .../_static/io_oauth_authorization_page.jpg   | Bin 0 -> 71954 bytes
 .../reference/api/docker_io_accounts_api.rst  | 308 ++++++++++++++++++
 .../reference/api/docker_io_oauth_api.rst     | 233 +++++++++++++
 .../docs/sources/reference/api/index.rst      |   2 +
 5 files changed, 544 insertions(+)
 create mode 100644 components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.jpg
 create mode 100644 components/engine/docs/sources/reference/api/docker_io_accounts_api.rst
 create mode 100644 components/engine/docs/sources/reference/api/docker_io_oauth_api.rst

diff --git a/components/engine/docs/sources/reference/api/README.md b/components/engine/docs/sources/reference/api/README.md
index 10dede382b..ec42b89733 100644
--- a/components/engine/docs/sources/reference/api/README.md
+++ b/components/engine/docs/sources/reference/api/README.md
@@ -3,3 +3,4 @@ This directory holds the authoritative specifications of APIs defined and implem
 * The remote API by which a docker node can be queried over HTTP
 * The registry API by which a docker node can download and upload container images for storage and sharing
 * The index search API by which a docker node can search the public index for images to download
+* The docker.io OAuth and accounts API which 3rd party services can use to access account information
diff --git a/components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.jpg b/components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..5c331987c2afbcf1667bde09967596223a9ad308
GIT binary patch
literal 71954
zcmeFYWmr^g+c3I@?(RmqyJH9`5fPB??vO4SL`CURP*gw=5D^gRR#F9|yITZgK!E{<
znZ3sQ*5~=&_kP}Q?|tm!*nhr-4Ch+winHq)(bMQ<fZ~d_o;Co1Kmc9v2SBef4CrZU
z+Fv&|)YiMI1-<|PhE~Ub03R$00Pyt-4m8%$;IOc?;=o@7AOImi0nh+Sj?O^=>esJd
z1^(l8JPD2luQ3tKTK{p_Kfj=KaSd_?0LXRlwUbMbvo8qOg1_&b0|J8q02}-TxWa-1
zFz{m#rU?WQ1mQOr*!?f~JqC9A3m*S9=7zB*IOZz=5Rf=J2D$?P@lWtMN2s$qxDE*o
z0N_#ixp?{k02Mz7t2%o)x`4d!0LKXX`ubzwhak-F^l$69{~PS+==5hzM@RQR@L#lm
zGr^57dj<vgI7a-s`Tz36*Czzz*RP8c{3P)R)HMeGa)Ug3=IyWl2ljKiX88NLCrHt6
z*ds*O^f&ArqzUr!uemOcm-T<cA>O9yzhTEf5c+$JXRzLl-*BM6@t^hme6C^i;};Gd
zu6lo9*B~vE-_PAVwe^0(ksde9f5V}kX4ihhLEa{RaESEK{PR38#P|=+Zh_i=X!H#N
zXa2pfv*W+^3ih}G>igexxn9=#4ZHf8{=p|8SmVz+0Y1O<`xpMMK01G%2ZfsanHwB<
z<Ii(1$150p{WU%y`1&8709OGm;4;7gXab&qAK(i30*>I_W$-Qt2mpM*yNF=d@L+H*
zpy?kF5$Nge5zL_uT8%4*o}aU*Fo&eLgfswPY!EXB0Dc(%vMmVR(7&GD1m`O%007qW
ze?4;)0)S>=&<x)E>lwE!sP|6+pk>WDBrx=^^>8qMZ~-EK9JFmlfDPaR_yG|>5|9Oy
z05uT%D}W(z1F!__0B67h#6J)S1EPW3Ks=BHqyvwDTp%AP0$u?Xz&oG;Xazn1y+A)O
z3`_uXz%sA_>;Q1!7&r%=4nBkwLJeVrutRttLJ&!aJVX_u1-S|_hFC%zAnp)9NC+ev
zatD$G$%N!WUO>tq)sQC02goPL2xJDb0@;QfLe8+Tu}H9JuvoEpvBa?CvDC5jv2I}5
zV!318#EQhai<OG?7^@KL4OTtY2dsXq39MzT9jqg40Gk+_4x1BO1X~_k6Wb8m3fm1k
z5IY7t5jz{Z5W5n)8M_aA40{=S7yA?k4~H6u14jf$2}c*l6vr9oCQb}aGEOeeE1Y_q
zZk#ck6&yGY3YQd@1y=}H5myh_0@ock3^yJ(8@B|v4z~w)0(S%V7!MDR4v!B{4o?@)
z63+`S3NIP&IbIdsd%O|6HM}Eye0)ZHA$%2lLwra4VElOeC-`shJMc&GH}DYz#02aF
zk_6fWRs?<oaRk`}uL;@-MhUhE&Iu_9c?cB=4GCQcBM8$7UlKMG4iRn;o)b|L@e!#I
z-5~NJx=r+$sFJ9MXrAZ?F){HaVg+I&Vo%~&;>W~qi9Zsr5TBAzkqDA#lGu=hkff57
zlDsFGA^AZ{O3F*BMruVGOqxnsM%qQXNQxk%CKDyoBXc2xkv%1=CmSXEPEJV9L#|G4
zM;=L@O<qGjM7~QwNWn{?N#RHlL-CZNiDHW4h?1I8g3^%Emol01HRUJDuT=O{yi{6L
zE>w4^im1A%)~K<mxu`X%ovH6ozohP=-k`yw;iJ)`@uEqhsi65n1E-~;m8LbL4X1rd
z+eW)ghfT*zr$^^Qmqz!FZj$bdo|Rsm-jzOqzLI{F{)B;<L5;zcA(5eqVS?d|k%Li-
z(VH=Yv4L@c35Q9L$%rY8DUYd#X_uLXS&7-1Ig$At^DGM%iy(_JOB72H%K*y}D;uj0
zYXIvL)-KjvHaa#nHZQh^Z0&5@?9}Y4?4Ilo**n<3anN$8bNFyP=IG{tbFy&ia)xle
z;QYdQeu?jr>7}?!RhJgHh`8jr+_)Zcb#lSE*|`n4qq)nuXL$&D<as=Ja(Mc9PI&ov
z&3W(hHt>GsW8l-{i{vZko98Fxhw|U#FXSH=z!Q)c@D_M3Ff52AC?n`0_*8I62uny-
z$W!RK(1<Xuu!69kaG~&&2#JWgNT^7;$ciYP=vC1;(FW1)V%%a@Vi{t6VkmJLaUb!Q
z;&T#I5?3VRB$_1-B?Tp&C7();OOZ-xOTnZXr4FQpq+O-+q^D)5WejBQ%XG?I$jZqE
z%2vv5%W=y&$UT#rlBbcsE}ty_Q2|#$Ljk7Hs&J|(s~D{KPH|sJM9Ev}wbEB*K4n+s
zm&$7@msA{8UZ^aqa;Q3}7N{;mIiZfwLg=a*mzs-OiQ1OBfV!9Z8};uR;u?V(bs8s{
ziki1H-(SYQtaCZ>@)s>CEmN&rtwrri+V0xr+Hf5iohY66y12Ufx*57tdaQcRdS!a>
zD{@zEUFp^*(Kpf0)nC0Tcs1~9vjLXD6@x5;`D;Aa{H`?^0)~2qS%wSO`L5r*-eQDj
zblvEw(WbG4akO!t3AKs6$!nA28yYv#Zp@kTn}(Qnnvt8?n3b8Gm|r%}G+(w5v$$o^
zZ^>loY1wFnZ)IjxVs&J#W&Ox{!$!s?-e%I4&o<ollO2<tk6oKRxxJ%(jRUTOxx;G*
zq@$r@q2rO0p3^fYxU;5nj`NO-n#)6%ZC4f7OxG<p6}L>cukI@DS?=2&P>*bnT~AHV
zT+ah9U9Wtv6K_NBQg5`6xlffZfv<yalOL6zw_mqEn}4|fNPtj4e8BQe#hZ_A!UOdK
zOM)Olwn2@-G+?qb5W*jFFJvWDHS}pHBFrqTCY&<dFMJ?EFd`vhD^feMI0`4qIjS?7
zGx~P)$}RO<FJd4uPBEP@F4$ezMyyWktJ_4ky>Ac3iN|He{k&s-r}-}H-PpTp_jK-+
z$CJee#!uZ>x}X05=Yi*gF9}i!PZCgxE{UI$#FMg<kjc);pHn1K9;cvF-BQ1#$)@F{
z<E8thPi8<fUS(2dMrN*M8D!Nz<an6)@aH4@N1w8#v-5L^azb*JA76dk_=NjO`V(ZX
zNAAQ^ji*)5Se_+3J9+N%d^ArjuQH!CKPmsLz_Vcbh0crmLf*pcBD|u|qRp3PFZ+t+
zi_1!wN|H)0O8rWgUm3sZE|V)Od(HAXtsJX7q<s60&70wh%N324B9$+y=&F+50&hd!
zeyet<o_weOuCqqIrm~i&_E{ZuU1B|?KB6Ap;L)($XxTW@bfu}YS*f|MMYN@~m9zC}
z8*N)!J5l@Hc63K%$I<(M_q!k5Kdg1ycg}TLbd7f#b${v6@A=rP-P_ft-q-O_<zwq7
z#ZOJ2<v%y{%l6j~$PCmC$_&<hk^NFXBsbJJtT5a>qCC<*3LX70c6qFKTyMO8;@ZT>
zr0L}Jl+D!gw9E9@8K0Sh+0fbZx!8H!`NRc^h3rL^#lj_lrK)Aw<+hc}D+8-0t8;74
zYdh;f>&T6}o1~lBTkKn9UnRe`ZfkE3f3yC!u@kU!z8k+sx%ccl|M%K`wfzCO1$^Tm
z@Bn?7{DbjF=}+mOok!P?7LR?8&rcE&jEGmK@~3@g=4V^yVMu)B;|qa{W|Tf^9_@=p
z2RH^g{>lZg!A~qVHvl*+1prb@0H7WQ03x!#a^znlz!Vw+jsamah$v(S>p8X^jsPw`
z?g8F5{uIFy;R?|S2`(uwnLc?iMFHg$H8G7UZ6sY4{T8DjlOuBu%Mcqby9|dbXX>SQ
zT%+9Id9nD&_{jx`LC<$8v?shGGA7z3Rww>aB3<&9l$W%bjGC;V9JL%$enVkEu~zAs
z@*Nc~Rb!~Cny@;%2Aw9wWkM|+tqbiF9k}jSz2z&@`d_a07_?riF|4@$+NjL<wMoT|
zD${DS8uJ>9TFY9i8tZp9)wWf3Rrc>38XZ444LHxZY`Xq*LwgW=(s^C-7V?qth5G6F
zn+CYv3=2#NDhcignGQV&Cyd~Tl#99+?R+adCJ~ksTX6eDT>hQMchm00$4A}2`M@o~
zD)Cy9da_Ike=18FRXTA7VJ2}F#Y2WioY_J-(vMZ1XyqC_HGO9N+&RxXKe!<FMS9_j
zqPmx#i<e4%z9J}Nc`a71@y4{my)wM&!Q1TW!gu90HMPxk9rZm8pBe|7Mw%yDrd#LQ
zmfF`lcHSR#Vt3JY^Y<wCUhi}M81^ag^Rxb{fe(WtUzUgVhL1+hMv-IZ<A{l)$%Cmq
zP}|mK7w4wuM;8VcKQ8qw_pW?i9bH>k-`+Udf_x>}X86XnBf6`wr}<rPUmt$?K=P3O
z@bE|9&nHLT$I2&UCrgN`)7UekbI$Vv<cEt4lml8Ejs9QcFN({7`va8!H-c5d17ac)
z9#Snb5ArmMPRbwDA~g22Pw2)ONEr>7?lHe-Ic5`Lx93Rati3eJ^^=F3mxYg)pHqNA
zkXR5Qv?}~Xq*=5`ELl8M!a-6`N?e*=`a))1_Oo1-{6mFEMLQ)8WnL8ml^xX)Xro$@
zdWJ@vX4qvPEhlX=9erI@J&7w^`m|T^uObY-U7I%?x&G0p)41KF<wm1vo!MLSa*Gnn
z7go8}4{cIx@7u-M!yI6aaZZWOSuW39OWoeOH+sDH{OC30J>fI&yY9E^kGP2!NFO8|
ztPx@n>KAq=JSXB!WJlC!^!lwM7*;INZL&C$J9u|ccYog7j$gPx@}MW7F|j-;FF8FW
zE;TI8H{CtMJ<}^I@L}YmJK0G&S&yGSDa<W<`u17f^VYo1{QiQ;7wd&bFY$^QN(4)l
zUtKG+e;rUB`zF1jpt7o}?d|94iFZpiUu)rYh<bD*UK43EO$$>iM;mXuaEH`;l@C`s
zExUZWVLe&BrG3pG2R|);J{-Uqr2E1<Br~ira&^>X%zWHx!e-KL%6{5m#$ncR&T-yx
z!Ew=X$$8mhC15prEpa_}qkOYvYvAj`_TD$-F3BF#ciw$bxYz+7r~&97D?dLR6&%N$
z*dP>78BUMS#?Id&Q!czv+Gwu-BLDwv|6izyXq0J#K>ObZ?cbUCDa$w;DZ4U<H)qbJ
zcCJ-!6fY$oC%>S8fFPd`r!bQUg(#sIAofFiOJZ8`qg1_giOeI}J90PWZ58wt<&?OT
z$&?W)YpTQ0_i8ojuQUoYpI&~Xm8yMTCssFHFW`#1zTMRu271?24P~#383`EknsDE^
zWXfsAZq8!CXh~;9Wlds(Zws-#usgLsaX>hpJ7c*JxRSfkxwCk1dh&V+dW-o;`pWnz
z_(KD9ZW;yJ2L%MjhGc}k2&)c%A2AfU5VaGHh{1vp#gg16jDvttbp7u5z0UZm`_CUF
zCWIt9CK)8lr*Nf`r(UG(rLShpXHI8LJ)C|tlRcd?{dnrhWbXLWv1cRChw=vVzZ8tT
zm@HfXBOSc>tQ6-JX&LQnwsPJ#q7~AWidE3Jn$?%zY1Le=)u>aeS7}gelxvb|7Hbh|
z<!!sv&ep;Fp7{e?CwG@fw_J}#uR)*rN2gCdpF{g$0}lo>zC0ev8-6iTI9f3FY&>To
zV=`&#?)0shuvz~(k9mg$%SDr=>&r$f=BrL?H`n7f9&NtbYWX_2z5MNP7iW*=JNLdM
zT;<^Mq4p2$pPEO|W2F;Wgv6=P8Sgm<lJSBXMT*A5$p5ci2_`1sfi>kzFix1>2Y{;?
z0Fb8y0K7zC8-fe~u9E`54Fv#8BMrckk^->Ai~ht92!QjepTq!g0z!ZsSRWe!_JBVC
z18d4cpbq#1EC4?sL=aAhBIE|dACd?uh4ex;u<)?>v95x(-ea)7+r?(Y*2Rv*uEPF`
z!wptyFLA!&ih{LRCmuPT16~b20lou%3jqT`IKeC-l&}=6lVXVWi0z3-NG_8!kP4FK
zk<pT+kQ0#Kqrj!OPf0?VMa4>0MlDC(M`KR2MH@j!OjkfJM?cKq!$`zf&UB6GC-XBF
z9hM)g1#AXvXY8dMrkuE(^_RT3IJsuIAMqITQu9vm<?=fS@Cob*)(AxiLq+gJhD4u=
zd5FtP5KAmc)=Q;J`^a3Cm6T(Xr&b_Sq)?()=2Q_=g+fi#ywvY%ywLn`c}*K%M^IN^
z&-2PX{er742GiG0t}_~`7`vLJ-Dol00d?8XGR~^jdc&5^PTM}rq1<uVnbF0>HN$Ph
zgWA)=tH68LSIIBcf9s}JU}-RENLc84_>G9ZD3$2?7)jXM+Y)i_?n>ROzAy5iB#|xY
zaSC;6MmlB2!z`wUh1nuGEl&(`*Pg-hxblZz+$&Nq#xD8vD)Y7d8}Ul)s@dw=nvA-e
z4Mt7kEyS&>?RD?tJ1x3}d$IcFKGpX>8Vnt>8qpXNpWvU8oH3nyyl}o8x{BPm|CRpR
zn?3FQ^~3u|Vkh%wsTY@j`H$c7r~f5?Sy2Ah!488ja0^HU3V<50hcE}g!HxkNL=JKt
z;th$16oH+9Wh@957nU}bH&!NA3)Ut!HMRzJ2=;62bsSC{N1S4uU0i8g815h*E1o}I
zH$Dq~DE=5&OFtwyC3GPCOe9BCLd-~<LV`^aNpe8yNxDL2O*TbtMm|MhO|eSpO?g6f
zkD89Uj7F7ajMkGDO_xJ2K|csepN#PxlLa#tb0v!nD=BLSTOd0R`!q))rwZrcrB_^z
z+^pPlJWqM;__+CY`0E5>1+NOx3#|!PibRNNi_wT}h&M{4O1es^NwY|w%Ph!tf${8x
zLayRdr9$OOl{V0yZK|O)m^BqI+i2a^F4Gy&J-x!F54~z{aO>K0!}jZ|#)Kx4H|$JP
z%-YR=SPED<SwFQIvm>%scL;Z^cG_{_cXf9wbKmon_KNZT?91rq?f?EJV_;~|RETou
z%W(3DTan+R9dAv;jA94luHG5EcRhaefpNk}(zWEzsk&)>8G4yt9-2N{%<+DFmYe*H
z^Lb0YWdW+N{H0w9ed&1FqjIYX&dS}lP45zG?dqi)Nt?D>I@%s~xPFlC0=fr#pMCWG
ztTsSD2p<|4DIZIn2%U1Dai5D^C|%lFRbMaMBH9kw+4yb+AN^r?G>kAiTe<)<PS9=q
zmj8dY|HWVSf9aR~`~9;29?<@AvG~A_PXJa9RtMHMu&1Mi9fn<wy^6z%V+HnT=5aZ}
zZp>R;B;FOgr+EALTKLbwj*2Nk9U(noG~pVN0Z}tCKk;J{0#E~XN$p9;$*z+1l53EE
zpwOV`rMyZxLFGubPaQ);MpHm5N!v?jL-&(DjX{`UfYFbMnyH1^m4%AsJ!=3P2iq|F
zZ4OC}P0pv6Ot{Fn`ni*M40tJdXZQ;FeFYQ*aRo<&o(p@5$cf^M&WKft-;=PDRFq<r
zI+I?M>65LKE0=$zP^s9WG@!hqat5VSlTo+Oh|w&)Jf@AUBc<!Cmwu&Lf7O8SnuMX%
z_4`H*#@jd8OwG+Q&4(>1tW2!4ZKmy*?5!Q1IW9VLxp=wOx<fp!dlq_~_!#<@`x6ED
z-kb>12!0pJ7gi9#68SWm<yIj~Ft#pE^UnA^k9g#R^hD02w<#*ApVG}THnYMXkz~Jo
ztomf`Y1DJJyzT=3LiVD`;zy-cWjwEs-h8age;e`6yjHHBxe=>rw`HpBLr3X{_%8b%
zi9X23;m-vFfnRin*+)*tCMW8ra%XPO`7Jmt*{`^-MQmhk)of4i0^fz;R)@(yJCDy#
z<<3JdnlSPYa+8w8L=ON$q5-xa7t!b+ya0fo2>=%vX!Lm@8hud&78~;b@ZRUI{ySzc
z9t8ko^3qX|toK*F$2|C7F7yfzs}=4E)-MJIfFSsa0KkP%0hp==g6Ww;n7}?K1_ppD
z5avIyF@*o`F<@PD-xG{We~rQP!7&%6Z;YAq*I%pxtluNBISR0U!;l@!Q1l$=$FLv}
z%s<dmVJ>W3Y|Mp+gM*EWj|VpXz|J5(0Wl#y0TBTn9w8|q5iv0d2?;(SDH$mV83+<%
z7QxKL{xuhum;jFe?B)GGywL9fN&?6ZHU~E35`aYs!KQ?uy8(8P5?rtm3tkv>F&6|2
z8wVG}2*d*%P)7lxkByB5B8!UyG6Hf7d=KDI;!<%+sN+!^IpSZsNh5hX;{^eiM)e0;
z;}JNwlv7|FArT!t10xd;FCV{vptOvvoV<df=4CBy9bLUECO1sY%)u74vx}>nyN9P&
zP;f|SSa?L_oxAtq?>|UL%*=ZDC_Crzlib3hm&GNeugYG(tEsK4Z)j|4?(FLB>FxXY
z>GSB=_{8MY^vvwa>e~9o=GNEkZwH4zejXj4AWqLPbV0zp;`jBBbWwtIVSzHh!N<@A
z!3x6=PKkrdDS=0&ZiMf6llqe6Z2}sNj2G1(2)U$;;j~VHBSduE(kna%7}9=G_J5DC
zxc^s_{UPjMbj<=JV6}}!iA@PWfeU0|B0o@=kx$D!m|7Cc!^i3=muB_)L_KQUHwIr*
zjlLnx3VblAn7);(S(XTlEvk4ds(4GCUyT~MC{g)}Z5V!36n^w(Xis8a=lJnS0jbK`
zWXjrP4YanejeXX6F;@EI*9rruF}9yD&$P(@vxL?E;l=;|dhwx{DgCH`RAg;3N8vSb
z47rIh&#>Q5h+kp??@(lhy);m3qy^BVPSe!U3?%}omN#!y`iE}iiur|N4?29CtsMBF
zMlX64@MN=G<>zSS*Yu2?44cZbRU?Xr-#45?*}4T}ETgrBFQqE++;*O>h)-ZSEXcE<
ziX6r_5jpCOSwZ$_%-(y?@&XOC-$zWzM%!Ev)D2xk>7aq`5i~&PjRr!e&;X<m4Xk=#
z7okS-&+`%RqH}H7ci38IQwKudg2lIv57mYl;0aq14UE~SLSbX3598}x6hTj*2P-<q
z$!K664fNd$%7<q+DT{z3w0>_u-8s7)b}ns?GysBOvr=dv2o12&z&wU7hLGXritR#=
zzECMS-KucLY@n0K!*^lZfx`N01I_=wL09+T+Mf}luuda^t<Mc;;JpPJK;!~nJ8Iog
zTPS7zzX_=f56?3}1HyYh(12Yv8aR-Kb()BU@1X%W6%@rAtH{2`hz6R_KpGMBubD#6
z(ZJn88`$eVi$YiUbIMYeKqg^O^uR9suT0uUTyfo}{Tt~~cA9=Ppj^>+(cJfoNm~D%
zh7S0{{`@1eE!4uV6~PTl>`yoR(Lihl21Uro-`p|!d#cR|lKU{V+8PZk3&W5G90$rR
z9TRhZ-vPn)|Bb6kpkyz<T>BSe@Dq84B>txviqR&5<he@zy^|nYvQSigyY(FiQg$>z
zt;Wj!N4)I6ccT45PN(p#z6iDOOD~`+qK^65V}JDM<$q<-5JLai)_NT%Cl8FAG*_pv
zAN{)P0EM>wH|zfhEeJ(5H8lVGJ#<ARrdR~Z?135k6%G6s2?ro5&i4LoY=DBkCK~Vq
zl^erJH1L<A{bA)6lBeoo&K`-Ega#6dKthKWeoy{~#W9#byF5Y3{8|sx?v4}R2sBXo
zi;RE7d=mfrY!;|(BQT7z*=!+1U~r~ix(5Aky7mkdecfS<_21|egx3whXV<27F?0U`
z_vHictP_!N%=REJpew?m?4kc+`hPRtA;gs>_Rw)OFjos&ALoJh^7Hz91S$P5q4NEc
zP+^@GTZOZ*Wob~$@Ovu$@Tq_-?Qf5e_J@Wo@+5oqfB6no5x-(z)qFP$TmNx5s3WlN
zR-n>iTmd^gyFF&_6&h&x4^s6()cuIf{#ymFL|Y-wvs=-?7>1C4aw7_$!aJW>8~zb%
z!_Y!4M%(^bXF##`Df|4AJ4PMVS0{&rehC@F_tF1qeai>VX)ATm<2?-LbU^)?@%_&t
zeF}=S8kFJz8n}iLBRRd?i3k+VB!=-ehJU#C+uLA<Hyxb(ts@T+b@xsGp!Fa0k^KYc
zv}6BLFN=%OvHY{p|HyRm#HDkLA!9ICKk!alsom<BDf(w$-?jR0wg4(u^u?SVY<u<>
z;{Tw!sv^!vS<nIeS`9<=r$0OWN0;$dSp*D3zhsV|WP=89|EExLr>ANG!)OqJ^k0VY
zx9$MJ`M=%JpD==vzjtPgz8&-z!f6P7mQ=d`(KPf~NcL(mGG#~Xfu@lfI{Uv_-Z`Ta
zV;P_V{%<V<^jHBgd;b;$oyjJfpg(`<&wt<z=qbPu`bYHO3LyJ`yM=$SzD+a$#^P&K
zQ-AwhPs1ekbBw+GW!?Paq7o<M7eArB#ffLj`He6Mn<^wvvf+F!82d4ydEA^$HL)jd
z(Xd3#!iA9QHZi$T#vl+Ta7$YM$&K4P8D_pR0f@~;F@#>ujeDaTzKgsm`RfVP^2Ry?
z1#Dd}%B}1ZE*EmO@DypQuD_Coe662qIiHv=9t_OAR=(++yZEkY9$y;rIweEjNaM83
z1K^`I-i8Z~1<Pn(ysd?#lrQX>4Bk}bom4LN^Da5S?H%?WjP@?`G5=IR=HJ66cxb$}
zwM~+L1}T^HM!94FYme7hBcsdhJlCoy7*<=9n$^Wnu@f&*+&s>w2j{g6L+8Y5Z0fJ0
z9S~`2p30_`;bC?Yweq!5=TB|L4C<?Eb3cp{GKo*cTMUfS^XnZhs=QWXNzS)1OwI8<
zmlsR<lBYT!t#VO)OtIzvWPShe#}sqpP_g3@!d`uRy)|lwFzxt`e~WGvPdsx;AFoA5
zT$9R0)Mh<iHPLJYgzH>&NUVQW)~8o?Z#(&B+LhUtE8I;^&IH#)nxsAjFD0{6A{oG(
zC_Kr2BIM&y)VZ~<i9u6!ZIa>TJgwxXnlw%xpXqU<`?3OX*skf6#f;_C$t+=q%NgEZ
z=@+&tse9d1A~N#eiciL)g^e5jkMez7`2FO>xhcehc3Z^?JTqtN9z85NS7?~+6IriO
z_qyejF#VcxZmeEN$2PO8dp2rj2d)$0)2-Ue6Yx3k&6}6B4iO||>ZJ-}fd)G28niT4
zf#aL16i9=Em^%lRVkF^HW)n!wm)|07riK^1hOM<CJf(%7*iMf0rZE%Bf5v(l!f~(%
zo10Pb9t`dm5z`poXdQj=bT6y-QdCk>nP>^W!Ze%4mCA_sy@po9sHuFTOd$jQ?`>^Q
zM10?)fxOhvI|!HRV-q7|qlZ<rF1GxiC2F6~?BtV0i@2_l%HA^Rp&PMRm+ocOEj=x|
zp;?#juVH!O@S`(1M8>$khn+YC`rt&BdJO;G_qrWsOMlS{#}t;CK4x5)bSjsFMRX}X
z%akoNJ`;+g_u^}V)O4?~)o13%9h2&Zv{V8pIA7RgJ1?9aNd@asB}EM4RTYQ#UmL3(
zw;lVIJpw(h>(^y;H)Wh|>5^rf85#(bgjDH>d{~h%dUarN&!D)lCJe@n2C6jQ57j6S
ziIr(6#E?!V7kk$6_dSZ#t2mk}u9#rAMEtNoSi)PbzH38dLF0Zh8|X*W=AITMh-zrN
z2Ht%pZt)>75*H^AH`vUcTv_0?MOR3P$1KlaUAMQeWDizrU^z*=84HCv16M^r3_pT2
z>;*IqwxX6#=8+yQBet42WYmyr9cKO1pHDvFHjf1!2fT}G<BLxAHki{I8d!HN(r0PF
zb5gjf<3tp8E9!z9vQ_lBym=bvxVauo_PCJpr^vqh-kIJNaaioKB)Xso%g?cIJtMky
zO<-J4Ma<V+e`Y46L+jR0)w}iZ(mP_xI#DmJJgr!Av-5G}<YYUi{o@t%AI#i$=oJ9a
zK=8y0yrs(p_Oat7Cg<sF6*Ia>k(pb1Fd4%!9Boh%Zu~`r_?+@5E89fxbFWRMhxC&J
z?{yolUlcGTxrsA5e6-Be{T|J8kpf-8y04ehL(k+_6IQq_cPy@{(ldXYax)N4m+vf2
z!05p7%GiAHR>cnq_sIq53L5xyYv;@OoLK`>b_pJ{uYcB&pscW*M&M~~zQ{M$3U&5&
z^*b?Xt>%~Le!RfR8k(G(F8{HD3*ONMW^WlV-8Izndl7PbT<1JJ2W!2@k?Y1D^(WaV
ziU}momd%{*6kYXFTlo`*3<k+P*_JDC-2hFj*0mWFh@f0g2f25oXv>C&6<%>jly{Nl
z%^+Xe%>EFXuOkonqJT8!B1cwxoVCDrsTF(|V5la!k!jRCe{?EMj@2bw#FDMbOy!9u
z5uIn1UGsxR+DT2p_I;exIMWD}I9gVcx$8_9dh|_bsMP>&-))tjj10Q@(kqu+(J)2z
z{d#LqQa@i^3dKFaP{sBSU$qUbHf#N7*iGO(3yVeY6RWYJ3DJFr@e;YX?-o^j2FBkG
zl1m3gYI}k?uQw8LUB`P*W3ZS@8CIDO4^erH6opR@A$6tG@h_B!peyDGe{5CuQ5D$Q
zw0R<u<03QKaGCr;JIMiiVzjIKYj$#vfNjOR=l<T(vQ`zNou5P0(u8Wmt_+M62!G}X
zH5XlB6-JaEn@)tZIrq>DMXfBTdB<?vv8M8(m}jgb4i>!jDEdbFWK!+!;XztXpxhU`
z`cPCu!$uX7l_+%k!t+8b-+Ai0Ds#BgBq49}aIMFS6n&*nSg$!)G6%we$lTPe_iWTP
zwdY!sNrl`D_z?}pjq=!~WtZAx#$n5OOYlqtFB-UdklNu{HvcVG$itjoYHm=HSZ7T1
z&H8PpOfx*F<OcWbjPP5Iz-}zXDgx9181U~O9W^rL$NLC7jdF}SHH_|VHXIf`u-voj
zP%O6^jGNzkCW<%KMEbJAE%E^2xKg*$3VnGKOzirv+eSm-&tsF9JkDrTgOiB-@0mw6
zESL_Nsl={NLhr}Wcib<$NxEA7JX7zW<AP_>@>vdd)`_brTb{*UV#k5h`?3S64}o9J
z8`$0In!`~emwMUkMJ%W{B%sY%x9g2Qv+2l}a8AL<l%eI@a_sO2R@?PC&d~w3mMd3H
z1h{Y?F0aHh8a7^P{RXA)S7@*pmEU;8(EPb4y55*JEB2cD(1u+Oe5q3i{^P@>l`wU2
zw=AS6ULC8mSEaiWUP^+1N*y_8E9V}Pr`8)I^!pCm5~*2HGWsqocs{$0$+z@KkJ7K>
z4ILjXIlB&>2ZCAbr)VRUm%bvO=cI3@3~sdeVK)J<zNkpqup>om8C+D0SX@HP6V>{U
zn8T&>;dMX7V|=e+kvp?IJ4<W1O0L6%T6^fT^@4R9)}YH8QKbk!Nu0bT5i=<Egv4j0
zN0fl704fwTbd~)5#Mr9JXYmE4T(!`>Du-L&?Du}88U*aEDziV#0*glB29YHd59}tU
zlQ!Zihmg%i7((}*0<3K`4Waws>&>*@Sfx8vu)0M22a@yRGF`CFEAm^3MyrxtIXknl
zO8I-cM@|yDv)lL_$Cb<|Dh;wgwIdo>r(W7Bm+FNFcBA6)cVhRm;n`zDyGLDB399~2
zs#8lxABLx6#rUkoD&4Nk3>^GfbRM+`?yIN36$93Qcat_g`DARXv3Bk(L=35Tpq6^c
z_P;bbuU<_xG#ZmGUsaX&ajpc{wvF1{NL4Aj)(UI0kwbDr7Zipfp)1_j%Io0Du)W>j
z0MDhlrsdp~`w3DbZw1I7d<o~y1-@Tv%II>-I*+=OjZ_i35AK(y{2jWY8J?B#BLv)a
z==d1l3a?prrzZgP{+U=^<j;nq^<v3TxA;MFPRfeTVVlb++AcKEshO?dU$C#Mtdp*N
z4L=fGxh=0^@lMruXk?@70i7W}&d*}iOAB9+8K>9rgD%?gQcg!%Vfacr_f@&D_t})L
zE9?IVnEuoQgkjrpMEB;L2j#cf2pll>E%I&aAi1BcJU#;n$*5e5UCNKdYrFGoiX>XE
zZ&5ksAv<NtvvwuS%PJORX|Da=ZWxC9h7Xa5RZwmx4%usqu}VRpxOYuD8k*LZ!I?Vo
z4BT54d`NCh<?6L6X~;ax|6trW1qMV<U}({rnai5Jvnm|oL-r6d&l<&Q%~0Td3XPKK
zVy8+@W}7z#$LM_f37JO&{x0qzT;7fTZ8rP|oUD3SIVdV+7C+_lVf=uQ`8;dsQu|Mg
zGF@T`>U^U3ZGwobkroisw7oH;PA;_Jd@C1>G%MU+)O?1cb?)KF8rEUxKUGjTIVw7j
z-iqI`kqS>!(fh<Ir4JS$ybw+}$amYQi^5w1u!b6>X%{=i-u}M&0mp|ezBV8fti-$F
z75Tl-FWRzB%H!F%zr^^EjIvWcgX<j?kge}L3z&I{TKu@taW>JFMtMRKQ_D^jJrC}Q
zZ@0#{t$)#IcyQAOisX*{bl4sQa=kSzzsd{v4sCcBIV|&|@khSbO5cOXjWYZMNy+Y5
zs1@){+5P~c%(>#LW7?Ez{ov<ZSd&L#?<rPtdea(TU4&RdLH$KFlUzJw@F2NnuEpKv
z)Et&fFS4()tvKt2Rh$`bBk(JQ-gJzM)TO9KsaWw>`ubh(la`D#zM)L(K(2Z8I*+w_
zG@2tz>~8Rmfs81Fa)N)8=`@K;T(>)GFF*Ehv{3LY`F)=^wrg(H)pQ%_j@Lehu9J0v
zhJd0!Fn^Z41hsHR1H-sC4-i@YPa3x<KczxvWS%bDQ!rktJ#GF#kBY5@{4|dbNs}?p
z-K$M%`=(IE12-$)6b!O^v~r%Z99BS9KXE9y7<5C}TF5-7pa6o}bNAxom`u8u?H~Vw
zPXqZFo@XO;OXw4d!*<VnYqCwJ$M8`0me9wTOCLi&{gj5R=2M19a<+a#133|CC{3?3
z9#u%V-rll%bq7yDay}y0mh4r>&(U^!#3KbtJ2Ws=yL2W}zSE{@XF%PR5*1jZNBjK2
z^HGL@Ov#t(4=%IRP>|7t$kRX)&;Sv3Cl~aq9P$`7(ToPx9>Thy2;D#*|N9p`ejSL7
zXd}2eifAUH5@~rLmw*!W%%|3g`~D)ezY9eN<|#W%6u0hs)61DpO{O>Lmm1T&*EPkC
zz1h@0k1#*D(!YArHOSY!$WlA`MmXewGQ#)hmaMJf8P6w%+*t?igvRqXkX{uJEZ&QJ
zBzG4|Sq$t)I9gYs6m*bMpc?^$7@PT42lAdMh=|RBShqfmc(D(6Bd;oOl<!IN=)gd%
zOETR@#<gOnXc@$vs8`<tJ)2LPTcFD6wt7JP^@77JZF$Wh{Elm_4{_Jdp$HxJgEbf$
zxT6nlVa3LX&|B#s_;%pM#GAKz2y_a#H)k(*WyF~bIMHNeq)WwlRrL%d5W}lh%oCyw
zd1~y*$+pcEGa3xrZf;y2dK>l3sa>raVRWt@-mqL1-!2%=yn2!*g9aYtai5D;vBw90
zDArsN5{h`J&=4+4>5@sKS=;#V^Wc1-CiXsgU2xx()DK6u99^^2hxbMIGPUm-9zSrh
zBzj&^tArh^&iMWdDVPNAep9w|hO>8yBf}qlTC@1s*wMgJ>tppJOH3m3@uy`04id;{
z+m%}yzEaC{#VU74=LSl)d@>YtuFlJUe!I?Q$dwC}U*xQEp0vt^<)2;DgH4rfdi?{6
zot2gjB<ZhP|H`^FETmRL)37M%()}v;y0P!R`!b9rne-8MP)VME`AyxLAGhy0#sz5Q
z&(a^~j=<bLO1Gr3&3ci$zV3_Kn74jSV_8w*(oEs_n3}tcq?{=>u>VeS^1#c2XL()8
zHqSF|Y{zi%p|tvc?+B|=)*43m?Xw@9`=WuKDNNh?gDsNTb-5*tk{mA_<;zQs!%lZU
zb#!hh^QTo`aI~t(z^c*fQxmQ8?CVdT`XS?RJ094>&HQnqRY#DfW%?@}jNh7J_ghtE
z`UQe_EZqGmKT^$XR=-WwZ`Xf(@2GP5bHWqxH&;{#S(tK!mQd{9=MKLoBsYzEpUolB
zK)KWe8hD4)TIvdO0c~fm0S(aWT|8M8U1V+<x`0{34uZjsuD2LTN2ehZ;;YUpXuL8#
zPp8bf#G5Wt3r;=OJuHbIcqbm(0s6gNC4>k2<S|Qm+@tM+i2FK-B>0bBy2##&3QtA+
zd&<0{o)u9+(z7m8CsNFhzZ*1nrq6xZ9li3BIn2~dgdxJJMNF*EAyDrY8i?PjLIbXd
z2hZ|J7r?HMF9s|1G3CpKY|Je`!LxulKj^{PdOHhhi7uZZI-(#vY$Yr<+P~}@eXi5D
zTr}`lc+VN0$^1ze`Ls8Cnb4iudSO$^UumPkjT=8{V7ZkT>}(ms^U~nv-MJ?zqV5Mc
zcK8#V@XhM-X+0ldumR>*C*_KlmM<O=Ca`H$`{rA9cMYfe7kH_)81%#3kCCuQkt<ig
z>~swcVA~sns#Kkeb=&_Gwf&8&u5<?_Ssn}MRNl||qePqh<6#XcX}!$glw&kNrcAwh
zaTT!=!pQdo_f6;-i5b0~_f3(3%&UdE1DRsk!x8O)>7O1cRDdm`y2~&ERjzN%2EF;^
z;c<uRMV6jST6ZaQWHvT_Hh9sxXS>?q)P)6})6z+*2hM5udT#FCTj~$81`)ap``8eM
z25#3cA#M4N-5;bO`@_K2bQK1pcR%fCQw<Z@$)$;hfbE7^wwChnR|vO#gGrJ5v(ld`
zO4IGR-uM{R_xLL4Q9fai_A7oA?-ibNyfvaMP>JZjHZHAVx4GX*R~GK{uBo=!d)>RP
zj_5Y8s?E~{vQJl7#J{QoX>AQhg|IBv=X+Bq(hh0x@Wd@Vtt0;X>HhH!h(X$J2c`4B
ziPtiZ<)ZZE0W7VSlx|;lGFqZc?tx#eh`vEb9N|)QWRP8NXLyMV!N}uzNq>dU;wG6?
zea98`@EtpQq)w`Cu!{D%1(U(L_^R}sYig|AJnu%YI5lU8i+_H+liX0!ZjOvwfL3;_
zdx_?(ilUfX&TiF%hb>8O(&&-mtp|J0u7}rj(#z@lZR%QhiR*9+YZIF5VUwhiD^I2-
z9Y}SbrS0LblnZUu*TAO|kV3Mrn{P}i`R|H4MFm`LAQlpGv2k`#k1O5unY`a?&w$A4
zgi^<_^2OJYDvFTXOtR~b@A1BsoHuNq^)xEXAHWhRVN=&$XnEB`u5Vx7u;xFI>gqOS
z0K-88T(RsmBCl*<ovanN(SS1}7?pmq&ty(@+^OrzKYKic2G}ddR>k^`5fN+t6rZ9<
zrmV>CN$W>F{pjmJWox@+d(C)}Ai)9KH+kb4{(gEUAfst{QBoPg9&aahi(aR7xYd2-
z{A;j8iI;{za@dqUVV%;8^q19dn-Wmw+l?#~9#(r7-u^oiv{PqC3R&k8vuuWULJFg@
zR=L2#!)^TCF82&HK;u@|cX1Uw08E>*UuB<dFogSe?`d}C9zTf?nS5Si^Nrmz?%Sk#
zfXK4tGX^sgVWm41C0f_7<lXU9=%56hNqHK%fw%uMIgyv*-pYiuwbFx>ZgJlvBQw`v
z(PcWdMvjB5?Lp?*1uOfgchsJC7u2x87V$K2@3{}nQz#nD#-sT&@k0%FLaLDbX&_HZ
z5QfKNFv6Wh(FR0+@s5PYtaeppaeZ^O`mrWyTtZ57@4JYBRS`rG+oZ>|-xsO6S245R
zMV|X~b<1K5)`+_c+mmpQr*9TFxBZbH`~`LS4nyPPO#^Ib_=9>0>FOJ-W0a!NK*epP
zrO%*q+LS{|kv>KPPvoq?JoW*2j&){_a1&C7eSBKsjOxX(>KmwBXuyX#Ki&@SfUV^<
z!rS)X(zYr`j<&2ByK~$(g?jb%+0J+KkPxocIhr!u)IfkyDTei;`X@PMbR?8~_3e1!
z_^4S;rqhU`W@vVQ;DI7njw!)h^lH0hh#*6z<nBVn6f*1Lx@>00(ewsv<#7e{tHES7
zs52mk*M7pfBxYg5Pb*+6mtlwtgH<$;qAEF|%v!nwBM;H1X`6~Rkj+`yV?S4MV;Ug5
z`L;Hb9#5LWdg03`dGkva+2Ja=WT=;|eRm$@jx{2v&}&vTLoTuQIq#TxhjkEL1x|CT
zY#1K@<@g(B+F9PsmFgr)#%Zmi`=C2Sey(Zj04>b~WRz14@$Kb7u){)x;mKF_8rlLd
zjk_ynHFS~uONwH9rv(W8bEd8yBd^Hp7q6G>ifU!yb9Jqh-`-hp5kyaVUW3c01<_~+
zmY;ZSB|!Z&-N_S8)ZjV~US?@GOwnI!ZpxliGO*gY;#8yY`0>Yr<+q_)I9w#_z>R!i
zo4i>R=y7d37f-~j=k^6*UE(uYLw|Ip2*sE<#(v1VV~;RmM?vlSm-87G!>d;Oo>%Tz
z1<#7?9p~j_&V0Ib_4v)m_gPDZa_8x(yWcwM-Kr{(V(@h|Kwewnbhf#otRz}qagjGm
z?9KJcfKZ~X<?2vl_xjtka6=hY=Pv?1J%?@Ia|V}?Pgu75o)%Y~z`Anrj~#0IkO{ee
zEAueSO-MW(?pFt*BY{EX<x(ws{8+EMx@QRc9%b0ENXN{Nh#0rM4w&D(JEA7>M-^kt
z_-w}mBsN(cd`EMl_7<-_t*4?^NmWe!ridA1$OE5B<yV*EFPmxS{3RVD+JRA9Sk-uK
z)eA$A?jh(QuQ&7;-C(*&Te6#m_ct4Kq5gyTozUrHRly{a@j6m7)R~-z?@EJr_@xP#
zx7rk^Z(Nn$uc{0fF@COEC~xPwXiRw)Bao*4mq_l|*s6Zpw6@rj@op2&kQPWtP9!77
zce$=1{zVPXW!!n-cnZFRYzroinr{m|{|ti<$a<edGykoo92bu(=us{UzZGU@rj>k+
zd58`vG8VGnZ}3#Btz&HT&{}|7FK;4OWlo=q)+dSy{@mpF^Q6qsy+ziiD~pfb*e}eN
z-Y=ez>8P<*_jL;)T)CKgKPKhp@$5V0KH+BRKtzvx<ENhe;C4SWu>R5HnsUFl{dX`f
zOM^DFdk9-inQY!dY5&nz@Z1X2*Dn&FYsMJX(R29PanFRZ;kik8k?y3JFb7;EDalr3
zvqoI6tTkS~V)2VcPbIdEW?3JXFG2g&aOKS4Iv9dK@6JjEb5~BDFuWt7w&6gg#w)bG
z0dH=P_r0=2QU=p!{cO+PX>-X(W=c9hLXg!0tg5vvs-bZS;l>O-qn644%gq)0&!i5c
zfq^G~Gt7Sn4b)er71$s(^`s4)LJ^@OePK9(bHx3<VJQ?{KBEb;3R&wJoke>-O!}}n
z+I=yekqTwp)v1G&HsrDKS2owj&#8pMzh6bc^4A$=6<%PISx4X2#gXNyeKfs0KzS}c
zlXjZ*+sT3k6F=7R$9^gjI{bW@e04N^$-7hqIz~bs{ET=xk;%{1@YdEi$lvGPo6H2_
z1nsFCW`bmEJ(6q3hwzECyULbtzUAJ!c&17}<qThmi%JS^%01N2@@Hz*HkkZ8Sl4xp
zf?>hNg{d4mc4+^aYRZHU#TYllph`N~0WX9iV;-UgWZf}30+LSnOCme@_$ZN?XitQ*
z^D2zQ+E$D7+eh5ixyug@TDU})ue_bVPey2lBQ7tqzC;f5XQ)Ckdd^Puq!E2<XK$U5
zR%-JaWq6smsiL|2gIk+8)SP>u*Q373myi3WiB9@xb7R-Jgq1t$@*vntn(qdEDfY2b
z&HnPATQ4vB2D^-vl*m)%n=5J59%rQY_E6bp^ZD-C6Z^t@xtkWIT#rgN<x6Hau(FdY
z1I-m-#Av{modl@^mwiz==>6LB?RLY+bU%A`!@XP!Gmjaz`R2E?2zjWGkia_FC%KK-
z<pN_(yi={nzkF8#YQXFX*e3s10NPX5JU81GxAw?Dkn4cn{WT&H<*V9d*l^F+HRHwo
zFS**@*(p@gSE;%Wb+Nf8)X(ib>rui{2F_|zZ+?2n2uLd&H5{^iA=OX{QcjnA6Mt27
zGHr0~?MK<TKthA!a#Tn8#Tld@3@esf`FJ}zsLfv%0<EEava`J4k$=vB3B#|sj<@o)
z4@9f0!cWvEf3g#NSh*#2W2{09w`x{wqpdBIz=b4}onKr6&+^LddR}~WyJ*a!Rd!2J
zI426|JGS17IrFw&9~bU^>-n88${JQ@gHPGxE7NUU_~lKn8h$pjjF*^U%fZ{KsJiO0
zG|(2vPpLzy{1LA(o4;hQA<e%aYz7Ua=~qnt8m)Kk7apZvGkIj~D`qjSEbzkPt#=S2
zZs`-9adB_V5Q+M{?x+I$JW)a10EG758`J`2c+yH6_<aoGR*6+o!)^oD*8{%3FKa`p
zt$B#Xo-7)Xyt1<h#c>nM>iaw$zx#CWjMlg6t2ihOuw2cM`jZW)gNBm~>tU{NfsJEy
zMsH<k_H6$${HVn{GPG)S(CW~Z+@Rszm~X}2qILO#yiGQhzT^uH)9LJ)w>RVPydt2>
zFHjV9ldT4x5v4ow@QJqm8jVZOE8Xg|<y~((>&&ORJu)J>ZFW_{SZ&Z|b%hVV`2xB!
zA`v}e{B;k32D&6mF&PRbxY_)Lff(rJG0gcp;!K%(pI;7tf|5Z<bv8G2UFhrI@1Avg
z0Sgo9ec^Gq-QkwKKp)s6Bvej#7@GP1(fjl1Jyi~*MGYe2^^BF5Swm3U-t)b0wVb-9
zbqOv3fjYv>*h`gyuHXBf>{YFFtjp{xiGABj2N4mU0lP=P(-8b)r&{O_UT+IDQ2k3n
z3sX>Ut}>6vfjqilnH}$2a$RO9jvVt$p$OlKm=XFXBy5&Xtn}WJ-H0xVvv6^LH`(C<
zBMp!0q4Jo0+5DhA@y6{q&mW5ZzKy4ydwl~6U-)<Wr_MB*y|x~MifR?~Z;HxZ!}<a$
z_s4g=%s=j(Q09D%Xfc>lmZ|WfwpiFHf9XYf9PZ=K){7ljUv!e^fA&`WVadYh{+3In
zV^CjKx52!fJ~piJ+6&&X_nN(7Sz1xP(&-tkk7;o_WS8>=j-ax$Mqzp<=168_mOx1*
zat~2_TB`{jFLk*m!#bHO9R3mo#(}W^040M4ekq4jw8ce}vgQkmc{@*4$|<C(vM5K#
zq_3FIi;mnV&(F*b@w1^8-JeBsZYo%EnsRM2)*Ub(KRgh94ku%03D@k73~msM{^(Ot
zYu@^{R!rLN2K|)U=B)h6%}pCwJe!ZI*J;bN8vJ+8P%XrTZfT%i<eU7<Vlj>+{Fm-R
zPcW&60pj_&!y-cLco^Py=gs$MWo4Frwnvq<@2ZaPMiw8|=7!&mxO1ZJ5R$ddT{q6a
zfmfw#n3VZp&5&)d?2|uxd@H3h@Z|l)O7o%JW^{cxF|oCSb9tVZUsFW0Hv*==uUWSw
zxMbLOh9sAV){s6?M#x$IPNB(nd%y%gcX;Tp(qi&n>7Gg%g2k%uKy>oNXwntFnGqda
zq4<GvqkUYACl36gLrxr{sde}bwR`=~(pwfeFABD%z#?<#K@1nXqImPpDmng)SGs|B
zWJW*Fy`x%E4t!_nKrx9%j&x13Q>@$#gX4~s3$ZpF=RqFY$)(h#sj^R)6!CW7osef}
zU>ak%>|la&tMzw&5^QC@7v||*X}Nv2nN+EAH!M4s=eV7U(v_`9=Cut$y+75v)ypQA
zUZ{PiS7y-+J9i}(yJH-_e;w}D;<$1eXIQESgE@Ng7Wwsay?K>sgZ1<g&4W3z=$=!Z
z!8-kgr888Ah!%U~q<A05iBx6g3i9*E7{^u+GhpU$0LqN~FE9H>EXlsEDzO$u;jLI2
zOLD*S*p7KLTC=XUs&3GyfpYO9?Fg#{;Z=%WYrg(owJjO<-lf`;2X*W-ebxv2x9boh
zm3usS*0&_5G<>gGkPBGN5}%mi@$_<M+q{02e$R(@ljr;51+;1h#lX2gyI`OWR)OTF
zSu%f@S{Q8ZKo7KcETKmjjWKN(M9rGp;arp|Q?9f`b&#Zy7?8eX;|*)V+ZH{#<UH2i
z|08<jG(+`A?YaRaPLPFS+Fto8lq~wzLEh8XDz&rF_=>ug#@)GV9=`jW)pd!wJ(UI4
zJ}0V<kKFDCG2nBCx=v1=qUbs{<tyDXcl`VOKW_Jdwcyg9S`d>yYlBh9`|mnqhq*hy
z7M6-)L`YfP>19fN`ubaciHB8P-9&um)sJG8SLx~CR)mC&8M0CuPv%c&=N_E4IUnmI
z%A*eQmt*o*NkhLA&s6&PU$QhFpS|Lox~aQHPq!Q7A3#Yz@Zd15NtfZhr`=vKc$zu2
z8qr&PuDBg3a<{>%;jYZIuOo9wM#yG*cTqX5<)IqOv!KLB9q#)CWn8=T>v!f%!G_S<
zqwn^Vs{X)^-LVPmD_(2Rs$4>4wA}Kb-MP+T%#=5_w5pfC+WI}*hm?(2Grih3lZR!>
zB`Q%Q2x`Ne{ti4sfb^YhX!tbt@Jca0t!oT`P>bz%j#giHHf>U1D>!{N)t8UgPK8vv
zs7DGM==8Bs9mI4Lek$-fnZ<il>RIM8cr(nC`|`Y<{!QX1i>_`Aw$;6lO^xadBKwfk
z)@zkb2VpCs%1+WfS%z|SZ|bQSea*b1nnYfDo6DmCo%CMr%UtX88qbSOqrpUs<?0$O
z-NUS#w?>i8Pz2xXRy4Iech_Wv;K8%6*QCFFu!BF$^0Y12<1MCJE1t|rx_aDuk>7fW
zTvl#v>D&xV;Zlv+V^t|wl7!Fzl4${U@Yyh>o$F~A8o*PwhLw6TwLiM)TC`wD`#r1p
zxfyCOoA;8wH^&>lVq?j-_k4G;mbYk6*H&P&Iel_@Tw|O$$8i@G?o_t#t62MXXC2}l
zH${#03}PvZNXk{Uhr8nla3bA%*k2q*W5FK=T>IpDtH~if4Lm@&d6y3rY5oQ5%++0T
ztO36@(cj941~@BjS*r}o<|y<bqx#W6;cUAS!dpSY5;j!}JrnW3{t8wNCs7j$RTl7p
zCet(XlxW5DM`>S$rdkD0wa&mpx>6R1mC%W|n1KSzWZ}gu!2W&GuJpv)2({<>4Hg<J
zpGFJzU;T?C@Vot+_=cyd5LFk};K7F~*R4;g@v*8=h#b`G6I5F%8W{1lxB3vNRZ(pm
z7C{*V{_iHMQ=wIh0rN)a;T{x~<aO3g9?#ToWu3A5h%xRGbk&fa{Sx?P%qzfZEBU!<
zxc5qFZxv<u{`>sdX1lW0@*52k!oF3{rCXj*_Ft6l#_n3*$z)Q4a8-m2MStn8p>rP3
z%Jk|$3hueHAIgZK2*IxqgNGxXm6NcqUiL_8@at)P{8%5ynV`*J(8YGDiB>7J3b&io
z{W&Bv>n<kz?xRb#vEl#4-g`$iwQhZ*C?L{AKtQ?*h;9U=OOe=UA|fEYL<I$mA<|nQ
z2m;a-1Qdh_h$vM`2tCrJhK__DdQYf<g!nByd%tJ9&pz*a$9?Y~_Z#E<v4*a-$g`d`
zpE>6<=Wmuplv(QQN0N+jgTh2(Y2mGdeBNjSKt?Ogg*Oxmejhc!Zz7yJ;Gl3cBbBkM
zS=3N!`jy%7yU`PYni8`>9E7f=_g*RNn4>TkRdNBz%%=xLQJ)PhKCRDcQd(Qjs4{C@
zzB3nd{_Ihn0EvZH1oXks|8BzCVwPTpm!7dVrJdl=0jh`f#h;B;ESVM(m1_5|Uxz-Z
z*Q<UvqRBUzxO3s5y~#N<ZYwS|_E%$o6K0IVBDnq-mPi=1x^tL>rf~xjY1OO{(>L$I
zqSydm*;0wf7E#4L@N)dBudJnIiA&2&s~A)6APdihjCVqE78pTw9*Xk*2e?A!f-o<r
z$UO?AIRK#9>=ri$so;1&TbD$|o*4noQnS8zkOWK4;SWKLz~)#wcoo>70R;RU5kQ(+
zL6a6s)f5Z;{o1L6RY4z0f-UP1#C3YzB6L~BwRQcNn>|4sxvv+Cl;R4kbkyRk?OI}a
z^FQu)x8J*X=!)?nHA(Vu_))^6xCviDTAdzS6v-VgsNbl<q+TG3wCi(ccaxfZ(1Vl*
z4X^rZjYO1tJS$WLP#dN}>&tK}1VNwY2aP}ml`Fq;yb-gj1#D2!20cK+52nTMoAf?_
z-Oo~YMw06=g+N>bOGjbps^Rmp<o2f{P=h@u+o0Sab}PRmOVxOTb1Cq(@s{<#Vx5W`
z5888?Ib7Y4-y<fEy@IKQ<w6E6swz<V<w9uRDT%gflb&r{-%ztWk6|a4ZBMR+`ONX?
zB5htvU#D_lX2aGi_#V(I8;}eykokiq7?uxs@Z*$>W`Ix6Z^3eojSnnh*DTlwS<AtM
zxUWK|38guNy*={vzN+&drDC`m6T|Z};*3x{!j9~VqV0ObjrLgYxHZ3C?1ulgUf0ri
zA*@!PefY66_&OaV*Sy}*3yNCEYwrLW>Oh@zq75Q)d;{%5<{y}qF-_3WVkRvim`%kW
zG&4fdROPEAXg**95BE~v69M&RZM0ZGTH6U4L@W*q7KHi>d#TnBZhK;eca-+xqk_kh
z1y@!pdPhz=J&ZQL>Ox5&YL#qVxmd>4xrixNs%M4Ndn9>${yaXSdmoZ%Is918D}5Gv
zo4c1!vjn*kBl9-PNWSvpBm38?jLd;o+W}HQ4jzsJR_%Z`@8JrA43v&)#Ntm<rF~%5
zU)o!SQB+7G6X0NrtkB_FmFf~jAtAoV1-c#ltYzi!!VNS}+=%wfbbJ_)AA?k`4t5^9
zv>&N1xJcz5Sf;Sy88>~aA2CWQl~&4s8NRNtZqr_<G5d^HHm9g)@)hzFf!+~OhZ^)H
zp+P$g2fT7eogY$7u|$#&c)R(0fyV$9Q_yyGH1BqzCP`rebj+&WFa7c7eH7%=$P)Ww
zC5uYy+dFX<{MY3($9F34{T80L9*`4htH51A5SheA_#gAKtyNbq|1uz7z-(nUZpq!J
zmgt+TWzJzDQzq{ES?YQG)8$;ILIxy2jDM`e51Q9rKunc(va|v;3&h}B)esby6kNZz
zKfhm{51`a@Rz3N!&)~xOaEo4wqc@&8e!#8Gz65QyH5c9g0M29NB-{pVJRW;h*?2Q|
z-*@5%O(0wgHtDqm;#dUgR*u5Q9edw-r8}QWoaLWID9M!$y6;cI;$P&052WS?&2>jW
zG!7mbLo%sYSi<)L102jqGH;qc#c!}4#;~*pin^fYob!EgdrYZ{tTzGq5RBIdKbIb@
zq{&ia7Hn>Hyf#ea$R|e(eHCvS*m1*A=#*jCQVw45rf&6Bn3O`qYqY}|xegKT2HV!(
z7-(CrT$DH<03@Fi8-ZAlIba4rgi9-j8-dM*?x$YiP6i0ze`OoJ^||<yf9E)>g0#>W
zDcn!<VO5`#lho>IJ%5do1l@@H5ao-Eih{)7f|`x#?rj*CNDoC!CWe-%wn?zs8hTb&
z_O7L_BTiW9d&HRqbGOH-WxhP~$vT6n{`9k!P6S25&yyPRyKJ8OIi;zevU<P`=WyfF
z^{~qKxu}hOPx4+05KgNt2uUh2(#RE5Tpz=4+^I?8MF|r1#5SQ^om<i&rdsz)2y$P!
z^y?9a)cHwH4)!sIvD9_uVTqYa%;1NLve8G83E%9z8D*M8;o{e<-%Q6sXebJUI#`NW
z7IN<=3!Ve9x&td9_s60He;fmcj04#^1sGTRMsP8v9>(nzJ7`+b@06z?A$fbrJP;zy
zt_PhN9clQ|cJA&=sWr*NpGBtWOQ)PW-wCt8MKVZnMgwpWyv}B|?%haKZH$>D^m6m7
zY037|nQgVS!_&mF^tjkV`T7U!5VOm#Pi6e6$`1quH2()j#+RVCzI$F~s7vK1pr2PM
zPwFYQSp+ms9_8lO<O|SOI(}03W?JFd>)iErPRfh)t`(kN^+WlrQH^=2Sr>cH_TL}K
z=#6<Hrs$DqU?aI$b$mDZ!4bD(2L48|WjO6zHj)W$6*LW<8zdiSDJ_Zw^dIYTunxcF
zuXXh4YS^ZsNt}cwy}k?5YL~NhKa4r9xR>JFti9~sN;%<H9Ww9zps9-NT%Ob)ZD9`3
z&M~A2l3;4ACwk4*^c6p=p6=IS!M(EeL?ScRo*aunCUUhRfX&PqNd5mO3;t6cz!aCv
zoSe&nJD!W~7V7bzyeyanh3owl36)+pb?5R7S+AX!+G2QiS3+Vmxv>1(w_|svB14)l
ziErN}-HCGq+f|pBqI*vDzK<Rd=D-S~n!g`aj8VI0U99Fs>l$cA!|!qAJg}Lf1_A3y
z<d3yJ5Wu;8*59`=W9zkz-SF0dU7=_y2g!wcnmQPFi(t@S^@9fGS2B#-&*<ocW99hK
zb16d|F593({sNArgNg|i@7g|EJ^r$!lO=ro=93kt^eW4KuhScf4XkwxzhTa|SV2Wi
z7=9rzz;meaJ^tUx@S(&pErmt+u)p8}E;x8D6s6;q({XvVb;KM}z!E3cF>Kv&B3F3l
z)!Wf`=gDtRKRx!_2!^3XK%ZGlZ9tzNn{6d4c=sjtGq;lW?w<Pg*ZJ~Y=WrlA0c=CS
z=J*PYB-0*jgun1PK<qeEy~`n60I^jR{~)&dAH=o|x)Tm4k_ls`*1<>1PA;;vuP;rV
zF6`u?$QIPSneEX_+3GLhQ&Vx1!PVl;r%I9J%Rv@uL`IKx;sk3a<2@Sa_mdy}`IfS%
zkA5mQpoC{en2_f_g825wUX)!qKDR-At7w95o3<(1PpIKGgJ0{e(uMk6tRbxQuZ+dB
z4^AuMTy31lHyhdBmWT$2eRs+BzJo%4h6@tt@g(<L1=C(Bxa2*z9R3_ZXx=J)8si($
zS76!GGMZ0^l&u0;UB(G{sIf80=HE@FpWFwmK5S|~=D>*gQ1Tr%=J_xtO1L;Qs77Kz
zUEB+PvkT%cT14&S8RV<PZZkhB565fg4YnUS)xk97NUzQB9BBenQWiJYhvk{&7y5F4
z-04~5c--w3eYY<&){MR~w44KGckzScmv@Kwj?<nK;Xlx_fXata4gO2U4<z6ZnYYw+
z6CCPi3;aRDD$<?S3+2~G7ow@H>{pL{G!Wr?QU|$mai6_Oo2nl5QqQ0dWIrBK(TAh#
zQQz+cuf6E_TvlB+XubNLd|}<n(wh@D$`f~?NQFz;YU&b=iSR#I4tVU(-Q|G(*#F|W
z4D8$nN4I6#cgx0Xpv#{moM#HjDk#K}+m_QTw!itI+)>VX`-8w7lj429X0A4faIw}i
zr#XUPJ~Dfu{ssZ`VumP*${St7r79;Wn_Rl*i5R_Bq>E{rW(_|=g9o(BpXBPm<{t)h
zdD?&3uxj<0VH9by9EoGR0Y}XuGMJ%=oDh|!jBJgEuAk-1EF!*95}BX$oM4+yj4Y!K
z6NuziUQ&}GV87Z36W(-fsV;%p9UZz$E<$iG`%Ty+Jx=MD$k{$7rdGF{EvqLCTZ1-!
z+FzjGHJdUJ#Q85dm`_Y6m$EIbjV!4d5j-agUTk)#jD20O5r&@GLh+y9l<4o7L#1TM
zsOEgVOX-e{Ja(Ohw#!%-7Jy;BPkg+%VH5F|z734Z-5YMR7aO+Rf4iD`B+m9$H%I2T
z>DY0v+442u?br5Mf9|Y+$;Vc2?Y2eyL*+zRNtt(p?AD&|osIbPoq4Hp*iY*=st3~x
z*K>9mNZ2lVn`bhb`rzKhZ=NC_PjcDZrU&80m(head})O9!>JC4Ax2N@R<dT_Lv^uu
zvHmC1FTdR@b9>3dG!xDq665+rqHGpPk+A-ClZEDQ6aU~q#jy#b)TgE1N$L6m(lr!_
zZA|~6d*%|KdugJl0Pd|vEWa0}>?wIi;<t%VI>jqbrXLl;&B@AeHDYHX1conQhnN~!
z)Ve>CW(dzeQ<Z?5F?fXb&WJZphe^qy)wt+f<IKT;+ySBvBv|~kv;fZgv$or+^t<X1
zYke%geqydZO3t9TqPVQYJQsGMU=oDOz1HUVc;Jfwtd^Pi_|=J2eYJkb+A|RA);Wq6
z)DuyuLo`j@3rSEwb4!boZxuBkg=?IC$W|^B+7>Azx`Fw}lK|lY0^SE6D{2ri4+VgU
z1J~0C+A{is2HgKr+Fi6lkgK^4dCU>};js-5(JHGURWN*3Qpup-{Vj};C<J~hSoiid
zmi=PGHSUw=j-HxRPy-VZwMo4nwO~YYqlz^pA;e+jAz^=|>BSNY@nlxGX7oamhWlk%
znP(%9iWusxpCa0SzWyJY@1NQ}Z7GBPV>5)UUZ2L2WP7(8Us1x%*Mx*-j%018wbjCS
z;yFUb<4<4uHoc{g_KBoASyPy&o|&`Yf3&hMRU>|NwiFfX;odYL%U<>cSEl^!>t=z<
zFShOPkNlnFKfSfQz3>(Z!PGPYdU7?#kE<!;a^wov=>EKEUyEk!_Sx_$m$h1xpSIMi
z@EJImtVEJ9Cb{}%c-b}-;cQwabuo;V)}s)8H~QSxTDrv^e{!q%^dr@PZ>%lZ;|GiV
zgXSNr{jaZ^`4EDzv|NY6TPuBk&{&Lb^bHdVmH{t*ss1A`3?;qdn;EN|m25DOv^=Wj
zF*_zL*X~+ws}=VkmFt5&t@r4iQU4A=Ij&Mp;pmb&_U6%a5lae0f%MA;GJG#q5#Dc)
zYtb15=<lJ1c61oT|KXPYmrZK~sDjII%L6_<n3)l@GRz@X%QTO|OLD|ZGFbO+A(mU>
z8hir!r5~w;Na=kAqHoGUuo(Ne<9D9ZAEjy3LJ)fE_hRZ1$Gv>!8a>+846=1UEh?Qg
z)9sAColk&D285h2lN)rvTFiog{kFR5=d%D?{+~SmkDZ2E4Qe?80ESy5%T)+M@#IcJ
zwc*}Qqp3-ZC&JP3QSbHaH#S_TGDx!Li;Ng4?OB(}L5BCrv|QJOfi$3Fcmir5+FfU?
z%`n11?~2lkhohfS>vUzY(_skT({~P6+BGq>l$K-vp?Cgp%74+ifF5G-blXeeqcD>m
zt3kNSx62~CN3VZUNE<L4((`0FJf`|qa%b7wM9g?ZOZ9H*6@}>WqO7{!G_wUr_Tu@h
z1-TZ*WG6L!^$r=kXtPv)#MtbmB;^l!K>;5Q1!Qm?fD(Yui==S=G&O`--D?4p`VW<J
z+4xODvLJUDL42|_WY0NpOX^56B+EQ|WJywGMC1N!vc?;^SJDZ+m4QQIfpT`A8hs0f
zHYS(HIIFu>6jpAw>Gkc1O`D8~C5X5)M&6JdYDj*r%lF*aP%&~MG6^tP|Ka8SS>8}%
zR7vc9?N2SBJ2t{oS=hUXq*Ff$5#l8Z#rr224SS^<Cv7#QmAczSpUYT(#8$&5c`w2~
z!PL<zl0#1;i^52PW|8vs3<^ZbO_Ej@E=akDB-JtIcV)JJcET1~7~79FfxJ)C@I3Gy
z2TW-|-2-Gl&@u=9ZAR9ClXbB0X-j32@|t<b<zYf=TRoc3=dmY;TG975uFaZLvAV;c
zLXLq5mX*_XX1a>~oyT@YE1j{|Cqbd9ECkKSQgwkr@j$ul!M8v@qMfX@t_Rg_qjk(4
zdmbL|+G-b!J0=nK$GiVwRUP0m6+WaAAP+GWFzYqR!ONaFvV#vO#Qjk(s$5#Uyq8m7
z`$Iq9oPVSHwZa5Y)dOIio|S)5;w-Vns%hMZ;;p52^!vNo9DQO=v<jp>RFBO1%{Ne)
zj@A$vQZc!N2Sj~D2-sI|0gtxM1;B+q4C(C87azV~xN)|C%tOM|S7b#<QklHSjY4eQ
zYIZAU3n1xW^Wp0`+HI&+A>|c2#omgPB6*hV8P7>wcAIjtJQceKTArDZ&=apK^%%G&
z;f^+weDg-q*3e8dxcuenBhR-r-hvSVtl8B7P7J`3=<wHw5uolEa9n-?DdStTXf>bj
ze-N?X=-I1u)2Uvu9dEycl<Rof#vGRCWv%qVC@y>^GE4Mz_RZfGrJVH6E^m2$o|5E+
z+fND_X(f??ww8BGV!I3Em*Sw_j|Fe;zPwe{d}i*qsh3Y7a{$!Jh{{~p*)EoD!r&g+
zLgbB}C*qBlnonz)FfID8r@WU<J;`zGs>0@dl64*@Harn<u7NUe0JAe$0&V^QOvVp*
z(G^=G3r7%xjEK!61+g`Ji0mT3;dB6PS`7C0!lefcI{^c}&hW!gG0-|g1Uc#ljh@7e
za7Yllx!v48AKN}RkaRCzk1QANGA$q(?OW^vsIkEQH)>!tq7Jz@2o#>wyaj+}|CNUe
zNDmaxY8QZMdlYSfDlK9FJlcp{a;U-U&tP*kq7eY37HqB(`B!y-ocoQrhJr0q%+^nE
znH)PzRf8gy#-#VTQH1e-bEkx6@mzWU)6XLt*Hq{@xpH<Es5mSSY;EmSO!5sI5q+8-
znea%BhQZL`aECL32jLJy52si0B30v=FS9Jx+%MtGK_h2Y#-p-*yu${`bv3v4%McS;
zDr<F!a0~xrvfLt-X>ilq?Uko1C~+Gf_m<aVE&9$0=pE<Coq{(QN6@f%6QV?HF2qUA
z(|K}1_*QAfx?yX3V~kARj#EPevP@=EVe2i35$`H(Z;_5V55C*Kmxp}2i{$cpn`oy#
z&aAQV;66m7$tr(A7k_h{xrRLNUq+H{@&PyKGcN3{1;QTmxkZ_<J3G2^d+77d*Pjw_
zws7A7Sdw#TN<SF2HiVqShOWT%-j9%8J7k~jO|QD{mS6d{IX<>tP<#0|^olY0sXkee
z;!Nm#j?=5&4pK<m4yja?V}5fg_CC|)GU4+wlhaQ}@7}vN7|K#nD$aR9N=V8O=o4-c
z4y7{gEyomnPMv(}?Wb1HuW(ddxBAJukq3#0a2@NF%A)d3J+AmkjNrV#tSlSDl7(jO
zgG0z=)56X>LeHN+(DYln3w*r*g1!7cy$lot^yokYQ&qewn{ndx!x80cRKBH%$(1L1
zPTdzgAC0L7h}cpK;eg}`wg~1_or-=Rxw-S6v&`Vi^n{Dv)A1696|Tvcp~N~Bk8<Jz
z-!@-XBlE(pdk~0e83JW<`^z=nyLM7LytZ|bae5N-&v7@GR~_C*$}pf$+?x^=5TcfZ
zoH%Hy^S8$p`sgD%@-zmT$K-<k_?s(qb2RVn9MU)e95i;smJ9~oQ&XA$9Ki7PL*9q?
zE;pWaph*urx_I;tKFm;?5&?$NI6-4@ll{#@;}=_pV}EDS_mM&_K)0)dj#uF(n))@l
z<y$A;)BWT8;2O<0QM+e@xZnRe)A+*E_i^(_91fj(Px$V1blHb`_xJgnGaPs0+&n?|
zh@9O#FL#AeL$&om0~A{SskY;^Cd(lcy3Lc*U55>BDY56KE5^#4o<9Bb<UWIi-_O}A
z0-bQ2FiT_LeeQn3cs*>(1iZDvK#i~<$NsxJG<$55*pY)U6XiTL&p&=z_?Z7R;;Id1
zQhy7w`Tp4WEi&p8#-nHxTWJxo<3NL`H1|P{=4p{piJyTO6kg4gnpXq-ioIqUdEEws
z$81423r>-uc0~91Xm&U7rh7T#d)ok7sDbip0l+9BMa<S34=^PX?BCy`aX(>jg&sI~
zspp6`$rE|pep-#5U(C!cKRcd{|B^v_Nhm9tW_qw*7_CG(v836rCh0n<AHp^{j6LRs
zt;++_PO>A~RF~xBba-Qy^^W^3W;1Hh%zSYM!;k#t@*!viEP|*t0omq(w}T05p;cf)
z3;YMoagtstZk2-<H>V#TpAvtU+av6?PKjOo#^FG1hQV*C?6!{kz9i2<Ur9k^MQ``;
zqnKp;_gTZ%9H6!UA=KL9GP+nE>tY!0q-4>EOri2aK^i@xWibsk0ub-6mq6!3mW|de
z>}8pxEW-AZ?h9Q+mRIt1uK^zP!{iRM`#xTAr64F~l-PVaXZQ(b0y!puCLuiWIg<Ky
zd&}H1{4ZAI%k3%?cD2UV!}Nj^^P70ZoNEhG-J|>&w<JPQVF9u->^DN$*Kdyqy;+Fv
zCsV;M>Sv2w>hBsxdV0hT&Ph<Y{Z`*nER$!x=L=??ocdA}tfSOgj^7{4L+Le+t-y8i
zMxONV^KV;`1{rE&A}c(j)wr@rx_2vk^rjKEeSE(1iJgYeSBEQUKb<=6x@HqZwA@ZF
z-$x@H1lew>WCfLUSa?}#N97qBJ+yz)E|vg!J2HF!<n>4>O$$19N?47=UpFR78p6+4
zT_zy4`xH7XTxd{V^c8O~faD8y?%!r>pV2B`0B2(ew+p^Ajc<bpC40?LAJKhqME=*p
zaeZ1IbnofTNyjJJbdl@p_jpep3qQe@fQLU~IF-~`+hjIuA?a#;HmSON#5is-WgArh
z>rn%>%Gq3ezmEHoqL$Z|q*G?0r=y#gJf!KgBC+18RynpHJ_q^&{wf@TphqD&NK-n*
zD0F0%)}*CG&Yc7wwIsdj5{Z+sCL!mKkW;??#)y_>IsRU-{~NVKm|h*IPpZ}NXLJPd
z!(D;OCGsSKBF>J0kaX*7I72$*_qiLtC%d|dh2ij;cPgp(RHhi{{DT%fUM;D>x0AAW
zw|8XZWt*m7&VS9J-J%O8`F;fhL9Ug{Wd3=jRGR%TianwEF6mxuD_lj*($RT8bMmC!
zgRyJgV6i^u*lXv90%)*YyJsaX7Q8h{5MfvC^XMPWf?lZR0DV{=NoII?-*MuLe7Qr@
zwn5Fx*y>6tW!T@oZM=AHg_dZ)4Ud@u1<GGG)s341K<Vghe`WyE2!Y%gNa$rfhBIFq
zU~ig&9@{eNPJZ_)Xbn+<u0=*-2zqRRds$6DtqZjad|drp{e(l)XFQhGt3p+&a9}w;
zpo}aX$DvS_rZcp`{<YIvybOqFU%7@Xf_OcU7J3XKl*WW(CP6}%6{kA+sEC1G07o$>
z-ch%4o!RMlNV%~eg>l3TYt?%o*)UKnA4Q?3=44ej@_5YAVJlYM#;!DmZ?00@J<2j0
z!Q;ys53xs9lhD>mn<{tD#%J>QN<h$CgNV06C_M57l3<9z6*v1ck?s@u8!(LO+;9nW
z@BKb0_@yuT#ducDy;g~t>+;|5=R`uhNXB&UHj<_>6CZ_H6xN1BsEor8kQ_B<NCo(8
z2VwRSJ*R;ko9I#LG!&3$ADk9@wC~b>FMLK9KDsnmqd;v0ov7jU@3Ba1gptHU!{FlS
zi$cHkt^hVOCkfn8+M}45!*9nvJkoptEH8KA=BL~Ir+Iq0l8J-cmq>GDYyXzxr0d)7
zi466CKg%&f8oxat7NdzO`%+lcJ(;SQ^j*7sO`$pAti&nyKyytV`fOX#cNULvKD+Uk
zZW_FMvWwbW2eLT<LSKsErudQ8$QP+CsZyjNBGxQ$1Mr@>-L1uM5Ws<Q{PX_IWcSwL
zp|yvzj))!(on&vL68csB6lx!zbR+nCZ-dZ@QWA`;LopyFlXXZ5Zb@vk$r7q5!p251
zGUBCXiOU}0UK}OiewG3;UIcpzCtHIdoDL|;Qo@f%YE}{wEF&PmJS>7_{Cw+*wWL!7
zpyeL2mN#Fi-H3blDu5<mbz2eu4}Ga!2*5gBq4&&NQa?k|$sUH_Vn;|BjXNf$p478M
zuI&8o$01sWyD#zxs|DC*8oo1v=~p6_)+pbeewsQtv|YWux)0VuCtfci?GriiSU_Sd
z7chsY$GvJ`&pmKF&!K9@Qz^dMArg7|er+YrLyqgW^7sO}bt^PAzct@--GbF2XszI~
zBuKg!!i0DPjjv1*>Xv*spb#3hwsqE^z4%SPk*_E2y${nmhTgv&w-bt(NcX=?D)w{D
zM6!~SYb#7cmnU=t#v~g{c4Tk%oE=S5Y=3h)Ok9n{brscNkjJs?(H&vcX*s$-dN}-C
zZbxAFx%a?-{&|$e;7ojTz(Z5bvJNnJ!DSz=sVf8ROS0e2KtIYNFFu*#_r~5_nP*@)
zHPQ8Tcf1+Hu6~-t)|e!=7M4!fdI!rmsowi=dw5v)MC@$8U1jC-U@2RpuM8kLjw^J1
zJi;ZW4XXQ0>pS(}?;Q0R3!X^<se0UVZG#O;fk%_rXOBFyyViWtMSG;&2BUpMBu#{v
z;fyuf?H-;Zjjv<2GGk3BAZCA$UB8`OBwlMpkf`)kUA(%>P@1trD#iH>>*MuKh%Wye
zSxrvs36JmY6Zjx~?SpIZZ0$2OaV7CtsIXb4{Q2D4+gC&nU%A|PQy@B0Yf9(VeH&Zy
zb+1n8L!{!#(u~}3tA)K={-@r;X0D!(XjAbU=sp)IkiY+CM5Yo3H_bB4c?~*!iY#Dw
z`)fZoNnsqf(WqFXFc=kSal%Hh#9sG=VzDklRPw|l=9z1EbvadIzrHrU6+7{n%cgBR
zjTDB5F^UZYs9mNXjpR8(D1CLg&PqEe33tQxum&!VGq>UJkih5K4nNSW(oXWm`%2C>
zr8ynRDohKIVj9%13fo823yBc58r07Zfb22C3o4BZdOm`>RQ4sPu6Ai`_mH@+yZMw}
zyFs@T|1689k+Q(EIxA8#9#IQ^5eqbo>Pssx8`!MP{JKOp=<_HBYVY$(@U}xnt!#$?
z-t;P3K*}RcVe2+tg>zvbpwWLpWZuET9J8d0c;klN0$kFzJ^Kz7?20szt4i6~Z<1e+
zgDR=mG&?_%a%NJbKSQ@4t^4M6&3wku4hiW_GtHX>SDR|GI%(XD^o+1WzTVU`kLG!>
z?q%pF`KDIwX1(ok|D}n^*Br8!6h>fA_Gc;cqUbTvUJD7(5_p06Q+y}I8fj5VGQ}&a
z3*@NRBt2Ql%BC^v__Bgyqc83fk_(^zlquGpbY4{+8{0b-oK-I#$Tl=vf2VJ@s;~sA
z-=H#(;p>sW|8YoqSn^SGy!yKLH-U{{15*W9B<T2B3HZ3pxL2`uPkzX&jKzz!_p@}I
zVSN1P=vfER3(TkP<cTwc&<4;7XM2|VZ@8{$;&1CH@AXnK6Lc2VD*lz!(9ZM3AfRCj
zI-I9g)&bw9Wvyl6EhXQU{0b;yZOHyon7ngy-YTFn;2ZAZF;D6-|1O`k24oa&EW+0{
zT`Oz;<E~V0Lf?n&wG%JC(7kKbt1II6w2Pz%Nx3L*6GaXmeMIM?ykG?jp&lk#*4fDL
ztp;bca8dMKMGxiMc|nCH(N^*@a?r?cBZaiFdgngoCJ$N8jjvLk@71jSpphCMbZwH?
z$4NK(pRFLwj1}aWI}U8yobkPEoLk~8R#+L9`!L~BMxwu6+qtVRBSr1#U1%KDg{Zx$
zN~Gk^*E1br9TLz=xRT@b-ik32-rO!jy2=};%%6(sJXpuBT@q)Jl>y&O6wi^NI7l_P
zv?KT=_x;9aNKw_G0?>x~UBcXoB#~3Mi^6NqiVfW|ciP-cTHP=X)V0S{ko6PAUf$DB
zly^|RBwC!+dV+812aWw&SOvBLz?DLl8quX3Z9Ji38y6(qaw0UlA40zJ4S0(^DArD6
zXs`6)jFcU$f!(L*VXNueSY$+fleiaZ5-Es+r8~*9)$s+eI_xI3gd<4fM1z-r(%wnH
zuJcxx8;3;TBm8WD^6(3KGo#hHrRnmDZI27t1)fcB&;_r1a^$Vk=XNjv`Nr6=iPE4O
z$ydv&`oww-z2mM`m{C*}8oR?Sb-Jg8++GBveErD8@l}Fp@49o7tn=3UN}=3lVkVc9
zP3t&_B%QOiaVr5`x<&vx<5ftLT<2IVr?3qxoH}2Urb#Z|sN~8~6?UPpr}W9gU@hoe
z*@nx~Z*n!*MA*qkv<mhOK<<=?7e^hQY)P%}Tgltf)6#axlh=Ko$Q?H8SFjJUlg)`a
z$6`+>Gw&ZVhNwcQD6x-F-3GU)wjMATP}(HynXK+vv;To|ACKYm$_59=&Bwg=@*i8>
z8!+Dtn^pPnwB(Sj=~$&M?2QxCNWhg#%Ad0+*N82oXYRs53e5b%CAIlFSqrAyaXQB`
z-04Ri9&cZNXq_P$3D2$!|178;C)J#zB((n<t6{A|lq|kyvt@epMpsMGwJ6jxqYyxM
zsYPo@8dWS0V#_4J2TcmLW}U&s<BfnB7o~nQxsj(7d9TME@)62CrhUtk*&+LL1w1an
z(Zul5N$U*W=^c0d`WoS4Lh3WyOp?c#svb!1nI!c6)%AM5bH)bCG+Zv9aeEvEeVKSg
zcfxG?y$hn;aa<C8!jgrNo*nR46Kp~q6ESooRWlNUGal+|9#mfgi&%ku?2~>1q_1e*
z(wD`?it9wf%U*b1JyrWvWcjA+&5o${W<go~6A6g`!VyG81ngz)11WDJbG|T~egj&`
zV;jvk7%J)Jfhj}l^C$+n4Df|~d*B|TijX@u^Whb|Zbtw0mECCCGy9+52KW_Ny^nYx
zSQp(7GnaG^laluh<I#IJRw6EwXrq>S;mGP_aS*oKav0=|QBf*9dExtJ2eaGv)Xp*c
z4xuyq88zZw`gH?JJ0AW*eU_%-%WM+5Wx?{#puU2YR_(VU?KCwV74Lfx+s>WMC+Sa(
zH~6{fdAf=}PsQq3GNeE+h?nW<iPyv)k-=6S{eB~R=31EvR?NE~9sR01c_YJDD0e(X
zkY{ToD{mQI@R{1DE=6*j4B}eNam<Hs@6CRYik;Jny;%BX{6&M%y*LT+*Rwa6a^YXt
zG%h$nK)h;}lTb@z<chObD*5K1`*ZYjvk|R*<df5y!J{IGag9QB_CzduAf;Jk;p?)B
zoWGlsNE#?b!VxA7Sc1|GPCDo;ORA5*I5r8~3=;A}-?3J$O-c+|y|3d=D}>p9_7tih
z8aSYQSL@K56K8Z-9-_ZMvjnEupaiK(rEoRQjK@BaXU3)s3Ik`&0#0eJ@fDxLs&N3h
z0fjC;al1X7aUHUfd%@oND;e(2_5?n>o{D)IYz2DZW;fQEW<6^8+Ld)n|1I0|Wiq!t
zW~(jY%|5rrvVD?w*YEIWv2Ox1)m&H_V;ndILmka{CDxNZD4ky2_vCaDUu3kDEyqfd
zLx#CXfc*30{*S~oAtgooxp3=j00LGypM0e^-`)M$l=tQkx1<fNuc)k*gs!aL%aa*w
z0?_Jr7~aD*Z)IhaFEk*1rr=NlPaWXUQ*`!o@NJAvQXkAXCM4TmHF|wfj%8PST>Fr{
z{6e_^hojc$j5Tr>gWbcm<ZLJmQW+NZojk<X1l&4KaK`Gab)0DOl3q!4&(;#_^Pz7l
zKCCmL&(85gEJ=}*)<NW<OsW{KU+5Z3>DbnskXk>*IP<apsV=I-C@FM#k3J?O??Zpy
zOj(GeMK{Vr+U4V6rknRv#fO7li&8$Ae!u!+UVD#^wrGFg{-%5{S~_tm2ay*H-5RGd
z><aTyH2ZI;<Ql+L`xTO7LdFR%ar;Sg#(gMlXie9X0@n6xvuY!#FZZ8}Hvqj^gf1$n
z`Q?r}CVm#L1C%_w{>1%E3rv`3QNrSaWPbn2A!c(ib#HTlQ)M)q#jTQ2Sg`4CL8a=j
zdb#okS(zsZPoj6zR4u1joxJSpF-(t>nj40Y7auDYkJjdmJ;r@Zk+oTU(NK8($*tqL
z;!o^UCL^3&*8|e_zdb##%S~=Te*W;`B7k%qLW77??f^s!u;F}ZK?s%qPcZaI;=jMy
z#n6TLGw1}sN3J^}drVtE$O(}H&ZP0!vmedV01&5-ez-nx<rUh4UN6*@$Dq;NYW>wN
z2KHZ2C*WsXe@=w%V!$FfF#SJUx%{93dbzCX!bn6E0FZlO0D!z6#A&6)y5O|E!Pco*
zU;!rmrc}4&a5~xuuh(7AC*T;>cZvang5C_ixwGvI>lXMP`H)4dx>|#O#Uq}&F~2A=
zCrt8z)s2HWfG9~JrYYu^Gt^#)IMuIh)m~}4la?BI8YsY%-cXNDuW<%krH>TJEuu7)
znV;hD>)G!=y1!o>@Pp?43&eyj1)K4ylZ|U5hH_bH5>^m~AefC$Y5j82Cj;781-r7X
zykpp>yZ(dbFnHFdIRa#lIO<hzn7X%f6C!wRJ|t=5Rz;$Is_o(mt<=Wq*QAZ5anjkC
zTBv;^Cq(@`0kJ)n=Hhv4FCop@CH9@WopcG+YT(!B{Q04lJsB}+h({j_a7*jT68Ivx
zadpYUO<c};weO-YG62Zc^_;W`sj#otW7g@C-&}xY;W8_PKi!e_>x4M{w={t8JZn_)
zybX3$NpMbVG&c>#G+^5IRKj<gsY1yF^k4&qbOA=p`148T7K=WGoH)|_E7=O(Ato0v
z%zkiP!21Ny3qH`Vr|M}y+zaVKeuH>20h&J}Oac~C?tfa>m`@K7b0amg!o!!?_Kt>9
z>Heq5Wh|aV?(RsJhyL&R;6E?)pB4HK%l+?k>3?MCKQi<m8T!9OhGhR;@Nx?Pz5_Gh
zQssdTcy-ZHQQ1?SZ$@t(S0xX|Qe>S)6*YV<>p<rQ3UjVyGW%+y{O1?yr_McCTmJ35
zrLX+Tj_@^#GWpd$y$_Il0_rd5sS5ff6#A;?e`|Pl0;VWv3b#frYXj^!zFnaWsyaV`
zYP{9ls88Ci{6Uj13)sp>YP2dDR#<CSC^-w45L6pD#%S`=Ak_*nJWh7xI#H$`5-EHg
ztPMZ@+Hhiz@1h?ojo9xOf$*>tTUrJ~7Z4HF4VrhT-IS;K&maAX1ZF*M<y+Mz18sW7
zzR4}IN8?lO$Q9GyF@M1%t0fws+ILbt1Vt70>YSTwj&@5yXa^3=E@_opeoC*1X%Erl
zJ?Xxx47whKiyOX{9tTOb1^Qc(PkODHkRpzR6*xrMGwD3qNfd^n%?6mmm~yU5sJB=>
zf0=z=d}g6n7AW)5k4_tq9<JxRtHh^f)CzTSQqa}5&Py<jvX8gWIQQWr^YJ5IYZevF
zE5muDkkx*`aXCr?83Z=2%%Ra$(fG+TsW?qv?|S*l$gt`Vow?{Y`MN+vr=+uzD5Bq=
zS9SG%#s#0wNH>X~6Vk5^RVXR*zo87b2uwp)QXzrTyyrDqL@Ty-*Dwp?S;d!TUOs<q
z^<mF#Evp`twB^TRUAgu>qFMK&nc~|IoiJ-__oFZ;DD+H8B34H8)wf>%9d7|4Wf7V{
zR&Vv<57u73W|h5LWj46&CVO;QFm=;VgzF*b8mkYs0XA&g2<9xI{YVPEMOe2?&arH7
zq)QGO9+7N7cz<i!v?9CJ&Q>)y)toOU4n`_i!%U;kt)hI(rO#?#WzVT}I(=1iDpghw
z8tM*|xNTLetfQB9Bv)OgOxURR%PU~>YrQR(w<^2M+Va*yK`dLC2pbU<{eTMtd;9ld
z=bL()nQ{#RtRueFUZIKp_~nZqs}Ij|FH!C$0NbRP8WN+5Y%E6Rl?E7LqO9_!9IXMO
zF2B9>kfGyz^~}=vbq3>2rWJ9RQ6lTnyE#YuJt7{j71b21N}E%GG(e7m%yMltm2%W8
zTQL;#y`qGxr)1D?!%k#4jeN+b<?vGIrCi<*bC<kcU$KvEAZ-b%ueL&%{Zu4@e;-zm
zjgE`6tV0tNXzm*XDSu-)^(+=>u7eH>cYJB#kjh=svzf>Y`=|jpeh;IEmqYq+_iEr7
z{7M;ibC>X+#{36VhKGmE=W*hp@}nZRlXc_td-Eoo=>r|ttG;LnS&Hd?YYdwvMxnk@
z(UO9(y{k3Vh<q}*FJ>F6&|aQg+`Z!KxNVZSxV+tKlBhvs-sT|crRG3*>Litn2lGsC
zg)gpKCI&L-hB#ggQ5d0B{9atB%buDQPKZ4!dht~BQ4u=6opQ`XnvG<2549!Rp@NPW
zEPBE>$3=8xTKz%1{-M@*aR!>L0{SPF97AGZqI&~x^m9e~eZ3K20?>ir9`eGMsHF;D
z$vhazL(E6Kjx7KUI$3oHAAx1o^7YJL;8En>R=o3?eZ((a)0`!^X5RSP&^KDTR0%Ag
z-h9};VsWY#B>E%8Ji*IuIV2P+%wBhXw9nf&^pKgI?6<|M%U-oyD1U#gWvV1d0r7RF
z&R6<LHKsOirKWS-wOG=^9|)PjP_FjS_cy>#^ab)h4NF!xCs(!|Z?_wg5SFCg6^+U|
zWyHUIofQ6MSeY;-jH+k~m%b+z9CSkVlwY?59W-}>w)s<mHHnt|h-9nN1#`o`DCMr<
z?S0aiR~nVIU;*#JEo>KtDeb>~oftk}l6xa-ritOCLcJ~-3Q+;Qu&W{54t)=#3pZAb
zEE)~Vfgy^enZYHdp&mWg1Z1u-s;7{u^JO{>3@j`yK^v5OA1rHv=DWu#(W^T;Iav#B
zz8=;2s9xJR{UKyS{Y2hi^qNL+Y24xKYBD<RCsS7$nPU`qJTzIJD6*Gho(u48EN%%4
z`1dK<s1S^ILY*iQlgW}o5M79+s;}`|L@{e+D^Z8tUiqGVT*$<<vkf?C!P?E*w0$uL
zl9e|5U@G*s#Ia$M{+j%?7Dou8KJ52hWnhk1EQ<n{o}%O|#RMaWD?rtO6_DZCMGud0
zV8ihQjqjQc3Nrz@@wi@U86Yz6nRaVV0gZJLpf2(lBM!3<Y;kDe8}R>bm))=*P5EDD
z7Y;Twu(8fNIm2Xt#BnHCQv=A8oFge+Mpea<ly!CJoSMlumtya5{-BZc(}OP&CH9Ti
z_I>q#*5K~|Ku`>`{@!*3kfN05cpG(7X*$j(x`~TW;;gvcWr%h|&Uzs!sxcGTea0LB
zxt73CRki+dZZoa{*=pCKP!h*F5zAFP6jCVlFy<SPjpQj@i`?Th1sV{TA}Ag)e>tzN
z30FU8E`*FFe@8r=z|1v(2wYUH7l`^YDhoj8Bn(LwAmLQWUoW6mHVuA%U_Duy{s)aZ
zfGh<RtgBt83N{n$sn7d?+?4q7A2fm)f4xuuOOMHa0GgYw*%lu1lHMh<QRoq`@WO;u
zP!MSIYyp)eA4qOr`Rlo_-w8ig_8&ALv7Il}wps)hK&2!oF~<Sm%9+9oRO2Wh2oF7h
z!mtA<>(?ug;rWcEH!-`r($%5cHq2Bw08SkOPkV*_g^GVeRbi_J1h&O*8B|07Z{USV
z0I!KOfF?%}M-cORU<xl#21LaD^?ZBp+}^AR)n9k*{(fR0KwV&xUrl#~01_RWBFX)r
zx%L=<>RQ);Fj)7$UK&JqYYoZ>Z>)oT+5Z2vl%K=^Yu5*UJn&jE$)ra~&=}<#EJBbo
ztrQB$^J3F3sYdsut`3ZuQoE98z2d{j)!+V(>~J#h&U++&fDDZ>)MHK{(v~n`t>77E
z^MV;bmRX>{E5@`>m=OIPfsN1F-vtvgsO-aRyX!zk3r2$aw_E@uCQpuoX%X{gg#h1m
z07i-sz;{~&C2DYlFhyVlL0sGm`ehVEo$7snYfX?lGl;ss;m36#3s!Y$0=Cc04I(K6
zi9}O<i29nEBY;p8+5%FT97DYfzVquSB&{c)xz=7PrGWIe!l4cZSkn*A3NY&fV2TV%
z!W17sA_u>Y?{Qy15L}%B?#)?b`|~h>MYa-3*|k87#{*#W-^nUq*#DJ!2LD1}zpK9v
z1ez550`R4TK6xE8`8V9Qi}(xmKz}7~!KYuxpoo+TZ_EJt+254%x7;r*4dgcbg@Ay-
z{X*jYErwsl0dm4T>Z$NN&{`|tA^n{!&H$?7R|0<eR~py6|I0vs=B>X`3~<c95b!@7
z`X3HGPy+wq&_8M7U$x)A?&<&6=+JgXz+l@U2}=Y=)NMa$n4lk!Vgv;w<^GG+vxYog
zqN@sH*52Mu__lPpoTc!b$PRJyl(7<dZs~9ID3BfU7mMpZ7TA9*uzz8z|F4bdNkH;y
zm8q<?P-jv9V|Ti1MLtt|Dkh$bBHF+PU}cKjm6t>GQ;Gy6B?Pqtv~u<W%-F#a3=o>0
z0Al@%xtJv!P?Lp<zu7NgnX0!}nR4P{$<x8@iv~5@I{sS!eX#tI)BhH<{7bZa%@<4}
z0JdL&!$GvXR`{1t`Y$)TXy<`KmvjFQ54P(T;A4oXHo#i?@_d{u`6xA{q(%TR!4fin
zFPAW4wk>GpKc$yR<07^r06AWcA*+#^@!-bmu7E8C7{VpxD9eV@qxNq_tX|-cwPub?
z-jzGo#`01*^ZYq+@h?+6XVcNDIEfB~9UBf=4=zP74^K*m3p1K*3o<uupIK-2?boO*
zeiH9xZ#ESFP|L*R&<i>tJs+JX?kmQkc${6+O-F?<C8nLo5)kEtJ&;Yp3^aqhER2t-
zZ73!Mr9p&bdnm&ExG{dO=Rk8QAFED*riM3S-m=M>vyu6xpZ3lP^w?~ACyWy~DM|d@
zLlGKh7iZK};D(741$AufUPW#7>f*%L74&gqQel(BGM?Fs4-qp_xni$%PA^x6_&M<D
zRf^=Mzwd=br)AZu)?Y49Re0I>8(w?;5U#$Ew^j(H?(qHf+9!j%l&b|pB+F~neUz)t
zf_Wh+v?C+f({=TH=N~=Vrr`whkT|K#y1?|W*C%O3PzC)v#!H+~gvth<Zi|H)nbPhH
zdZ^K=;unS#bA^d&%j;!2vv1VrIwFA<-@B%XQz$YxD`VNn#8iDG{iXT@n;O}m;u*6B
z?;iCoCs3mEs78zEN#QEi?e~}QDy~Hof$L!5NWnGuAvYkoi}SHMdud_B&F(cCmI34w
zOa(gHH<)2In)9?#{XL>q;+7K?IjgD)PTOkaYK60r07H>aonv18d<9`HOie_p+yO0}
zzO<bK{k)Lt`X>K@=0j7%qo?H9u0e9JCpc2Jm?Qwh6grM`lKzg})*%HE4L7voY(l^K
z$m8l47A`%@A2=Nwc<sY^ks4MvpgC=|{RG=HTvjxSY?=6_ds9cDEyC9&?|k$nmiDl+
z?1ZnU?4G6K(~U*w&+9C3c^-Vd`mA9DRBRAdPw5`$2D1R>HNmPwSdRq$NV!U?CWHLD
zYv@U~pUj%GK@nTRZ00r#1B$Vy+{#i_nTJ+6WOEr|;xi1A0jz#m69s$=z-K{EXOe=x
zTEwRorbA2$$IZYNH^l;18BeI_@JI8SYoCg-z}=l;-jGZ|#x0X&MJ}}t_%1D0=FeuH
zun%9C9%kPDtUm;*qq6nQcFhcGMX1?+Al=eTJVW~gwn}%{MO!tHyTyia8KSzF=n=aG
z6(bcT7rFR~4sYIEBWUG!>mc)_90LsQJhphvr<rnjEbF&gD1=|{LQGv#IO8MruZJP{
z7{I}<eT*kXO=_z-5|G=j`{`AtgzW8Ut%p;Rs@IDY2fMtJ)rVLk6Cpm^qh^<a#5Av^
z%1VNN8xe|lyX;r3A$$ILx5TG=CuswfdAG7=fqFMA?`+w42$*}86ooI~T}bplL9`Dw
zs^k08lTp>bJirX~zQwM$ox{L#tBdx0j5m{K^QmUuGlM`Yu|B=b@*xAAqzQzBewex}
z$#pVCMgLjNAte3?`tx{R;!t$Xu|!B#lfh`dQ@$um8^<#9i>X&_DwMJ|y3z2Pa|jJD
z%(5@px{a*YGL^^E<j;vAfTF0pkf19>p(tlh!DWM614OHO1yrAx`9uQal>38E^`f$$
z=}b$E6<|wcK-&I?BRmZ;yC)t2k(zBFcSv2O1ySRV$|H(UHFz;g)fj3_bP;$BnFmB<
z{!y@YP_*_x9V`H(6T^(z+Xmcb4HTT6FuZS^xbF-2i0K10JO9ni0QI0>Go!p2{#>+s
zjuzdkzVcWa$cmC%{eROT5>AT$Q-?@j9H5MYvwnU)7?{}6|K?_Z@XuPxgL=yU`JnOP
z>mdP3T*xA3|M}S;G(!;iO@&MX5aUA$laJ~FpAYI{&;TDo)IL`8E}+~Xg%Xq|JnKM5
z7eU9Rt90<%6lXk`?Yp%l&dSEY=fbPbyLv7Q9I$F%uHElP4kgxTjiXwd30ieBaN9UM
zhnJ@g;Czl*pLbInXr~!V=6cyGSv8gpx|o2w)Y2hg{c-y?P|BP`L{akPms8NFntkC(
zU+?b}IFY9j%SG+P6ltv#5YSCEd_<)>-sQO<Jo>qtM;{*2A)?b)@Ia}BtK)g5N251u
z-*e5m2P5Z1?U=~G$ES!UNTMs1=^=r+&d2k`YJr+E9us17G4W1Oufp4VmY?jbB_F)o
z<v7gGCY>nFQi;4TFxUq=4tf+53PcR6EYDUFC2FZcgYMoXx=2=CcfUt*RTU3gj^JB%
zSmZgl47=Y2UfIl-p3tXodQK=UH%=wPIQ_90#wxZ+Hg*fk7W-paA05M3N1p0L5gD~Q
zX5O*IT@nn)B5GWN=voeHagkicJNH{7N0pT&orVW9m)Dm3AJtgD-PO;ccBr51LQI6=
zJklnUF`QRFlai;-MolgaBT3pYDT^_F7=MIUBzud57EI+meWr%FV1WGv$T$K({aBVT
z1YHbHq-h&dsEMAcoL3kh0zOHVdcm66YOsK!b)sS{Mj_CAv`$(qK_fn4``%(CT`2vt
zQ+(uzo4|hVMLFKJs-|%^g3w&27}{7-U4zLLHMuI%r*KqCy_a?5RZvNL9CcG&t}+!h
z?^93*Vp&46FT=sP4n9z97|?WQN*mSp;kiNsw<jAv_Hf~XKorZZwyrmWJ?W1P!*!PO
z0OfrQj0HEloX<S6T8UUNr2tk<fd2zh;v_a02*XG}2N#2zq=$T`q+{R)L}9#mWR={<
zF+IeTZne`eUa~aHnd!0i9z0I|C<m{2*^#kJ6r@N|AR8MV5vuYWM7R|*tTbhlHiZdO
zs*xwGqKLE_gtZhrq|kn{@^0U#$I#bkE=!s79Ex+djhV9Az?n#9(8Rm(!|F#Vch!|h
zT7=}Use;5uyVH7x%{t-dCmo|7I($1BSx#=eB3|vbMi!?i#sQyCt74%t5r~A)$kqHc
z_YRTeh;2O+-_L4oZ^dIWO7eAOKwh!>7N7IoB^>=B(lZ#Th!*qh(S_>8cjXr{^9!L{
z@T%dx4QUF4XC_7&Gy&LJ^uV{9__yDY90^9-&;hu22HcXA!Ic%E2F2?sHSML8*c>D5
z=ibqhUwSO{+@Q_H;B*xCMP{Ctfx1q0q)9?fGol0uSV(yNx=K3q09=xgRbL^P_#CeK
z32r+;VZEG}TiV|9m{^(ulUs}t4Y##VsnIOG46lQ1GT?y^Gn2P{NrglXfK$df{MksH
zmPE}@uNpnGM;F4xX6i&8IYe6hALIx)f8zaml;JUkC_!axBS=gMy_)nD4hJ#8IrA+^
zXWPh1SIH(xF=yi-CDO0xkbWXKn(xPCaLG4YM~BI)iJ9?vi=$ly5NXkZ`CbHKI<~m4
zWk0fp-wUk)u%53Mqz-|0!laR~4ct^=<Sn999>jkz!RH-q`?VF9?k2mltZ5_Zv9&SP
zaC2fHwi!dvWE(mH4jV57H}7-eJ--$(STwsrCZq-Rpw20370ak@RL;GkRmQX5dmbWB
z-(hjF+-&{|d|?7;I@LRw5)-5@Jg;IBHF;SUOIGRCE-5w3U0ETRwrU69IO!tYW~)@|
zFa#~c5Uf`HY_EF^GyDk2-u{!rAOvx5DZRn4^J#0HS;ndKi+0yvs(jkaex3aJd{%Xh
zPj&y+xSm_(>aEM)n<T9z7O47Jqr-(8pb&o{k}Z|#Jo&zVchEM5xD)LrN`j~-+E2pR
z9BX8%2|Zp29puf@YHGg>PLDlFM@p>hx_oe#U-CU#R;2L$+kE#m(m9?+(2&x#{R}nt
zsZrZ2{c4<3pI7rYt35Vus4JB8DzvFW71x(>ExfNDq1R`{oG}RN+}80-L<t*(lRSZ3
zF~wU#?YARI;0Y}6<AH?n2hkfwy|zg(k*6>*B(K8`jfbKsu96=dpw9G#hzzZ|o<#!R
zKo3-jebmcvKtILhx;T0m?mp7>QVifwTz}B|EasIT{jDbzj>FSiTb`A>yL537Ki_?v
zk0VK1Zo_h7e3|(J#i(jOyGjy}W$C6Aqw6HW0^KyPBd4c2ZjZrOYtP0!%;Dy2lx=Z8
zmAaf=-FDODQvZ<?U(}T+f6#;r^8n#b1cyH@$r68gB`fTLv_Gwb`o++zed^+mk!-d^
zsn71Bug1W6vu~jn28-%W2j3F@O&nP@{iS(1HHu(bmnu|2wA&MU_R*qasxr<K&k%k*
zFQ@&UE=<;y0-bIY@CMa|tC})Sjg!QiYXMGXg`b~Tdx2oC;>jUFzJ7W|@~E5Bi^}Nc
z;(5$$6x9_#L+dC=FXpF=BEe?+?2@;fbjCe;7UPWl#!V6BB`Z4;-e6QO(B@+z3Bg1?
z3qP~}iXj-|D9quQDl)j)VPq7fTUk6PHb8Cr_;zH-QqND`pvCzDyX=h~l~r3I9nsk;
zSL)I8ME-hp?)?}A{Se&#%*QyQ_+)c9s#2fdF|p`{bTB39`3C>c8JCk<Ph&598_6G_
z5nv+oPb7Xt9-(%OAA3@Dn!s7FBK=%VCQCjBnz>+-1BEba&y2>Ou)VO{u5YL#9%seS
zj3tS)eMR8nnlgaC>f%5xCaJhV_z{`^vFYA}%Ofvc$yu*yI+1d$x!TkHN^8oVCKS}h
zu+0wU8gzAicYK44-d7uJ2b$r?cQ9|`0qM;irCcPfOjY}1C!0fS_=mib>u^HP@V+S=
z!Y9V8Y({H+JqAsTw8XGOhRk;CIV;znnm-fM-Ysgz&!X_(s-y|x4Pc(C2bjZ7AO~x$
z$xR!%7@GuEebXMv63v<*9VpaHdy0JH@~gK3|A)Qz0BWjh*M?C<kRmEgYE+6yRjLXS
zkq#oD(o0l8N(fPEs6nJx0RaUeN|hSvQX^eJq=eo==$(WbAjEG!?=xqPZ$0Om@Bh#D
z&p+=tOoBTMo3-~|>t5G=740Twv1(WgB^j|uIfEsL&KNhxGLTf-A@qvOc?fvpjq=+x
zK`9o`#JS`y+Eji!EqLk8y*JF><AWG$=Ag0twSA5zKPbNEwQ~bkBhO0>{Ck<t=J%rw
zUJH%Lt<#vCX1qoFVIe~IVU6SJ_WnRIx!<DRxNFjF-1$hsZ)#H_)qTGPx|nwWluk6K
z3A?dtJ=3w{w9}j4kQWijEg)tIC0f0idL7llimsv;2n|DMa)@li%8Hgiu=6v<DP_OR
z?-Th_u7_Gjx^ePk7IeG%1s-toYJc{F=~3+X#dfnn(#s=SUrv%5p|+I|@GBy8HKu3;
zE5a54>lo!6<s6MUsK29A!updyyNRs4DZSG*7$#q80{k_FUYRi4ti*#ABQwBqc)7&S
zUjZx%b*=<6eO38ICAJq|>vyx*LYLMmSX*mVcnh~EkIsnK>EzFrv@??Sx$5Kl5yQcL
z4Eb?THr>9iOlaTp1Fq^l5;NrZW1T5JO|-cN-fSrgZ=GLL)#hrF*-|wx<FCE0eDPGt
zlN%|d<~?STmLKt|+HrzEwf}JXWg;q2@iLqczu3mE#8xqgmN`RKLGF=;go~YFb1@Ia
zVL2*$_s9qM_YZ!8l^a0FMt<;fP_UKcmthJYpl3GBS~asthh@+4@m8^zH{7VcnAg~-
zIGp9*iz<aT>y2Slv2L4V8s8|~#O$1CH%YghL8o|+k`Ih$p1N+UkKF8h1Ffl7Gpk#z
zAj++;Wbco5$Yu;FdAs75eHaz5FO#o{?)Kwc9AtLA!Tek8#-z-Al7=?X?pqHt*_s$n
zK39JHu^dB%iNu*F`RQr&OO(4cptQKKH{M>u*p{=%glM)LQ3syB1EtWLA4xBPN>FPR
z_~s+-G3b;S@e~lIS9jS5_6cew(=hmOVS_u7omg0v&<ShFVrn^Gx8?Exx={q$lO*W?
zbKK|(Bna?pi9KybmPwb7&|_@Rz9-W`UE(=;da}?o{8@Xv*H0+zHzeT!=oOezhCjy_
zOnNk3B+^&`<#lU5{oy0`s+eEQbb9Udx2+z+6Kl5Ul&ZRoY+8SGV$(j*ay2(!*&SM6
zHyd;_&~oW8H@_-)2f1aFR+P~{CU{^w3%D%{l46e}ec2lTe5ZxU+JGntwB;f=ydkYQ
zLv_YJ)1*RKb93`}MG=Yheg_$IL~f93!#(!Y&WEPtneJXnFOG^L=idP?;b<Fi*JB3<
zDvB1brql3o_1E1Yf*%n>a`8H&vP+lh)5Uf4D<j+@5GfO3slGn(%H<(2+-HBW<50>u
z(grhk^Q>M7g?aD^DNaUSNjPLxH^!u5^pk#xj!O_MUQM6MMV`^U5DtJ&jq*y=2!?Oo
ziy?}<1XLrJ|En4ERE2J%PH|bqdUfb6b{&mW#p>WbPAUI~nHO6f&Is3zb*`$7x=ebO
zRwlzYYptD^i#&0Iwd*kFgg(C^oeYxXkqpUr&x3T;2hSw3YB}g;URhH!P+X^6(33Yg
zRo`Ydqg8y>!@5@N1)U*}Fwi$g0WgC6tRzVQv}Wx`1iT5CkCd0d=apzkO6^Bh?cc2A
zzg9Ms`$>Dg6PK}kKJL`nCO>|m^C~Uf?RdQv_rXHXp;Bcpt}e#!27Muh15xKRUa0ww
z<8dVZ(6ti$9q*opgw1byA#%yy?lUXwwKAG@1wO%-3iHl$vo#tvGK?6(lu}?MFQ;`Z
zg>JCO0gBo68-7pFi!D?VL^f(*oY7Hx#zYk_2Rxlj7+L%y#P`{d;)$2|T81JC2F$v!
zxJ;K8xSVq_#oZz2MZowes;AMOC|a-`GZ%0<tBeEvc_<U$^JIgf354~udUzfpM)C|P
ze*>#Ue2|q=(Ih@lsyr_faBw+X8T9^ZDC5Ty`>1v5BWg0oaX#QKWq6!H;Y7%{apfdZ
zkBwP5nmOvcJSB0RDE5wN{>%4kAI@pE%l47M$L}b7K$wMGY9U#c01qt}f22Vm^Rbpx
zmy~JpVYPzyTdn!}w!TH_h*<~NM?Fiys^aDa8oYDJ!=JQa>QIk<t#!Ef1!Rz!RYUGP
z;5SO$X1fa-d5lPIrEW7uT{OB_;XY7o{0P{1p0!ww_K@&AW5~vCd0i9zW<|+~{0RWL
z{I8J$d^Jg}(?za8pgIBm%GdlzXNkfv?4GLo&|av|&B6DU-SzUS>d92W>S~i|iC|56
zMrB4<$mi%I1rjIaHo9ejkRIrNSt#*1L{Vi=mD0zqK<+8?8kwBmJgD61wp+!OLYl#>
zB%ii1z3@5)e6+@WQk?r9j@8W4M4)%I>_F>W()`8q{9!ZEDtvd<c38#P^AAN2#vbEl
zK5i~vt?7MW>^vq8n;T0ifIW&Y#cF15cm1)UeKx!&PJ$9}-*6?H;dRPc2;|IW3$KD2
zF{oy^Wzy)PT8+uXo%+1NIq3VHthyxO42KNMe(4h(PQw7Lq)`!U2Z@4|hDK6EdJ5%3
z*2rvr_%0}pnRL@vf1u8B%)bOQrr7cGQ@(k#4Ez3>y{F|RYW5>hHVHc#uaVOqASWmw
zvJ6rFwJ(T}{H@ZTofzLzvyde7d1~D7ywLZcrEi<((VYRueONYYJc!JKn~wbkVM1hT
zkZuub8`F8QzR+hi&+BQDK7`fO=ePA0a?lpW<!i2-`#{w~bs}feVRU5=xwm4pn&G(W
zUfi*HLu)IiFbP0@SUi^t^eihY)&L}^Q3(Ko&C#Rd(+N{#%>foGQX=u}D&+!-2P$Hi
zY%pjSO`RpEb#m;K$@(XK^YiyUlyrgI3vsjv6&;cvUR+X{pc`D7oM~SfXEI`Hen}H{
zDg2}ctK&^WLqmN9DpBox*exZ)Ts^@)-?;0#l0N<oXiuyMU~Z+Q{%<VG2iUItk7H44
zY_rIUtLyH}YlA?&N#y|lq*r`3QdZ?`fugY%9bw~LfI!OI{AMZjWR}r;1}|{S+@W*>
z?mC#=V~>g3@*{iNqFn&_0wx(U28r2?Wm>ViVlS(ES|?1hYI*qH6z9iEj)&hQe9?kA
z>}x_>iCu5IXfE-%@JStG6mK6&B!4CgrVKx>NLsN+1IFR7O_|EdFo!CRFWr?UzC9w!
zCua<!2j5mswmgemMrv&NfYl{zafjw8Wdkc?_aj@x**2_ciutkG0yA@3^1j?{w&VGH
zO*+#H*Jc8;+N56K8JwD(+ptl#$2E$A#fZ{HZNlSdFQz&(wl(jHmPgH55HrV8wh$d?
zYj|c{B~zyq^@Y>(C*E6P^xB^^MDH0>8g_hOY;!OCCqazP<>skJ@N<@m=X4$DPh?pg
zRAp>f)08Kbcqwc=OEMIWZ{a;d5py+{2UY03f;F%&r%NT6yj!~6x`c(<SSrmI3)F7&
z@jJtU{9UvKVpN5{{{e}g*FJ>IZ&Th)rSOHSA&LR>N*X2-xR{{=s2QT34iv-gbHl{e
zB#Pk@Lk@y5*Tjov!#Z5K@6><WzGAFA*Aag*UVaBRHv7$rpFm3%NM|R~R7|}WuSomB
zQZB8*lR=zPc=W?3Aa2%nIWFqWHMyi&t@>D<j5--)qlyy8(wHHdER-%#RX#8&-tXgM
zuF&<Bf))H&cfIja0B7fT!VUV`AQc~xh;=0ne=Gozjt#F9V$Jo=k1h8Kwj|g1m19RW
zi?}pT8H=Pp?k?3Fe<m$=@#W*e;(IBHh5HICqCjmO03jHF8A-V5&`@7<V#FN6f3}su
z6$y7Z8~Yh3i)tDr6thwY9cP~^zh!!Xzbsx0eX3QEe*U-`HrzIKsf>i8DNf6ANa%q+
z-@86xWr_Pylh*pdp!Jk?kLc}h=nB?!ljFXW7+bem9ATnbLMIoivZO8g!woln6`!6X
zcHc@IJ45MDZyOq4KO<P3<TEN1F~+0$F`UcXVOIFXcVgm`+=xXO2966Y8K1OTF~hvi
z(GpF&t*fAi!K5$Hty_Ohad;Xt?j{l`<hp%Lx2Seu>{=~gpkl0wGe?@OA4pFKqwn-1
z9pTigfHK*MEdI%HdupZT^?}j)X_TvARw=_v7i*4ZV17h!{JqqDs;;>2g%FZ6CfL9N
z5$w*)u42s*jBh~c*VLC*SCp%jCUn-GpU~oJmA*$ZHW_{IB6W+^{fi}EwHhL=hs+Ab
zvlXZ9g%IzTI<au#LpAG@W_mi~Z_aU?%MzRx*}iw<(nH^YHc!SX<Ku<~zRJ|R+~A5>
zdE+k;a}0iZdJWi*=AZeuZOT*ZDwPbI+K-w~oYqGvHP!V>*wmy?s(C%eROU9nD_?d_
zuuPv}9efbVV(yUa8hJFoUDxHK8waYm?Uyq9BGLnQt;(A1bmoyALb8d&_>Hg1V9}aj
z70~`_&EhaFfWc3Nb6Z$RDMzX@T?z5J!IiN8^DL`P)>=A-fLmy|pL5`j90Jm0dn_{Q
zQ2NJJ4V(^KNwx4o(wh-<=#_?~!<9w7nvia_BwPjEhSg=(ZuVWVk}@8i057x}0UlXM
z_QV%hnk#cW>nG}{OB4xKyrt4S$VfCCe&hWry`D*Cqc{Ky=(Pb?!hiZj%`l@uj*vzU
z`yh`&yfzpd*ldUt_lxRE6mEA4pp|O0n@aBY3<X^H-PP#7cz+t`a<>QLj(vb;BoKZ@
zM}krEyD0TQ&#w;(@tOSR2k(NE|CLVX?TPU}T}g+m{xm72V*ZOMX$A23{Kcg7E{{gU
zFRH;RK;JVXKasEm9VY*7T6h<v<O=}MhCYCF9s3vQdi^?bwh2qA&-lx!o%&Zt?=t_3
zQT)3RzQY96bwKk+T!YfYf?TUe`P){AJ#_|Jh}3<=>Z^48$=9I35y!dXPGoA!{e*0~
zLq8exG<!VRGp_LGWN#OLxl{k?pHD(Bj#`ze2_<mBoP5jV*J$z~<7BnkVY20nu92U)
ze#3wwIBRm{Mw*0ZxXim9lJoP&uWT;(mexw_#rj5HvK$$&&p|dS%D{9Q**#F_>malB
zt`_D#P@ibCmBY#6s2e8Tc6(1APFio3xW70Ut^0ly>4DA=&h4KvfRN6Hb&YCNA<6G2
z)0t<$Bh1P~rWzA;B-zvMli5lsl-*25zH<Gk!%LCxW&RsF9^0Al+ji%F*r<BRe^h^b
z4X%0|RCgoOzQ#G}a5w@klLpr5+es?_S{<CUa!10*M?Ee`xe7lfFY@^IF6TkPxP7*5
zRW812!f|e{5SQG!PwwF$gsv&$HyLmy77$Ws+wF-I=@FnH&h+C!jV28};`~$*X`@qf
zr{%QWq-g#nI|XPlxNIYA?0Kra-9VHXBrJz0qw&+C;zy|-e<p8Td+PhsQ)jPBx8E6L
z1x%V@=%33J2k>JZtx6n(B)SFTqs3!LS1}>JoY~8J4GhGqk>$uW?(*v1#WLu{4H-iN
zk&D&|YgyggYSJxg?H@c~jg0a}^34DR>1uRhRbaU&n2S`<cBAJh6l(X`+}zQi3tm{1
zIN#cuRVAdU!};o~;FL7qcEBk8jh!OaxBT3uuw(yVxv4+QU0j=i0^$jXwg=zE4cN*P
zY0}!>e=g3p^A@Q3nncTf!{oM?YZLLd;<=n@A}V#^6c5lCh8~G7gP4@WCrO=MrbHS_
zwreiZwotn6+*tcrYv*TGAvZ*+F9dsezH4;9m)`=?>t@UF@H7Xu?N#%ic;c$Wf#%3-
zWY42!H0BA4Q3o$Bs@exM#5o=0*v%x#{K*9lNUq9?T(2U@(T(>RSE)LLnK_d1wr@@^
zhFJPHD)I1%C7bsuYRvM29-3E67G{@MR{{BEPCW`g?q8mM@|d%j1-eNiWP1s(eU#1F
zt(%BlrFc`kldt|9Plk}-T`G$Z9%SQ<23}v)zIE|BJ)c?HuayK!!N-a<vsyKG1xIPI
zZAfi?fTVSDH^NT8K`Y%d;Pkh3U)du*z}ZDf2=?f1f^ndVgJ67<1Zy)7+z$5qF1KqO
z?*~;I)Vq?!n|uXoXGOGffIkxGxXI~O=vD0=f`olVk7E@*38{Nu;TI4dn>wjYE{-BL
z=0`cznr?IbndQn3PUm$ij&x3miygfeh((MsFxBz_ypTXIQ)mNd7)AkL8G#||feKy^
zAKn}8blo9QHNk5MVng5V6$?GS7JDO$&g^a`qw7vRt0~}G2hfBrj{{MvxI>L-6H3bz
zPpnP~lbs3i^e5TY{L!u#YS{%f;uFS>9_Hrle4A3N+?8{Am$qDuDVO}))7eQ0S&&gg
z;HtTaJFnxSWpYQgp_1=jwEfB%m7wz_m)x0t`WP1&=sHy8cGP0p_06m%J&%eG>=Cr#
znCWzX9wLM+sPTws98FF7)>gG}%V|*YD|zM>|B+nl8?W`qG>rWL|MBK`k-e&;QzYw0
z99=nx(6*Y#-alN;Rv8@fgxph2ElrDx`7}rO$c3lEx`Z!uY?CK^qFKdxTRSTi8@BiK
zdj)!#LXtm2J?N`a5_cY|2}sFYfY4qDh;Lc?o}o@3Rd}P>xj1y%xY193nzk9L$B1~a
z`MAEcJjLgg#HW{w+GY;vcGOg2FGJ!2RU`7af*%{|)41>G*ALpxlbj?B>oGa31}VbA
z|B7+c^bc08iUtAX_e}X?PvDO1BM#{tZ}0wY)%#Bu#s8SjPb4FWcu!!p=>N-V5vcUL
z(aF^QKR@_CZFKTi?5zK3>XwYbUA{9%vSfEsHxMxVk<^Sw#X`<}BtV)s>88wEr!g!-
zIaN$EpDpCyEnIR*^~iLif{%ARbih<mGF@|kAnAB>#IOpX=*#eluU`fg_2fgY5QW*d
zrACYMs2s#cq{0dLjV&}6VFIy!vx-JnTbMZ!p5M~>Zilw=8mss1e7d3v$SvO$O;5Gc
z*JfY#WckLcwfsoXeV++*(f1ng$VMYV))nvMkgpI*9r-vb`-<!;LR%WHNRc92;;P1i
z5=`~@6TBl}*ses?w&`22j;*8}OaP{0zeO(!RECN4H9Z|VZTZNwcU@eTf#D8^F^85n
z*Lm62%=~Km=Xd#JJVomx%G3kc(3x&b=9<Kq*rx>uv(*QKZb$EeDvguk1qfZ-XSuF%
zT*~7en8_q+ymkVxZe3%Iy6vJO_eckrGhe?7TyB)LfHm%V=ZJL(&+G5G3dKIodl+Rk
zp_$EG$m-#?k_JE)2~2f7Tzp*!xJKPnyqZO_ZZWfI;3t%OlRZ7gLL&<mcS5Gdh9o#8
z7CI6fjBGjBJD&+uTjF>D977epw);*|VfrFj5FCXp-xXKd*RD@Dkb8T1045GgpAk?P
zQ1r~Ze6#sw+3S=;Kz?x^t0;)?mewL1XR(iYM8kQD-d<KVN6g+0D@cE*Ph)Y!$mgp0
zEb@o1Gb~d)=KY<O@(1HZ$Z5Z>%`L(0J08do+#>n_CFS3XtemPRfM@G-U*|NCyq%x)
zxfN-ZuXZ?J9#qtk9o!z%IsN|JGwPF{jXmFQYvzwUw6QX8K@s#JJS4pb=|`<Md~fz=
z+*px6v`p-p^2=<w2Fug3N%70Hajt*KB~4>YH+=p|RzNby$Q<|}Oz8>)k#o~xl`A;9
z0VNiF*>>xrm(}&ph(|SEQW{tJ@6b3^WJ$5&cwqCDbDgit4`WpxagRcLYRThOlev=%
z8>W-1IZ0&j^f5(~d`QGZ)M?=*8GLO9e2oilrM9F?5LtEHX^wZRvEoHC+4hNvx%PW4
zVM>op`b-qxN$40?`gfx$^&%T?l1+(cqYLe)E|m1jjL52);D?ll3ay3^GgZ>#Hf7l@
z53pXT&(6O-2f3-q>mNy!40DS;v)s1W>Y2pO{=?LB;``^~anp#X<At%p7gCzE{W*OS
zVzQA8ej4}Wu;aLI@y&{NpV_}xz6ThVUy2a-*{f*qC`F<dT~g~Nrq*%uei$_WJp2`a
zA;`B#vXhX?J`4~>wU3-TMHiI4#Mg&%1nT<xr!BZceRWD5_#YO^-`)@$450l1ehwd7
zZN;6y*z^P^HC(GBL{C-cBSiIxmcx4=fb65T<m6#)+j4AOhiP>0^M?mh@)J!N!oBnU
zJ70(0x|qDN+SOkxBlR01bO5s5U9X2%UQKGe$kA-PQ$?>UYSK?ud+E-XAX_w0Bim7t
z_J|QCM2G(Ji^{!HGjyrxgH`eI=2j)n57lwGb*tZP>JYk!UPx;&p4bA973>wpPUBwr
zO6HT~EeUGDm@r=hP)P1z#ZeNa8*3S~GG(p0`u<dJSS5!+-MUykw8IGli{<jwj#S0O
z>Jio(UOUzBu3=54ti)0ZlRb?~#43MeE0?;L#n@bMmJ+Bny?Y{dz<a;RlDb9mQ)-t$
zxZ<6>O0*phZD*84sdm&xLGuR3g?MHor`_VvHDbW&mT%vd6x{N(Mpw~N(EcvHh6R^M
zxJGu-_Auo80gKvk8AW^);c~~dZOphir@zow0l&$*!thLz(kI6CVM|54P^4u&{>1q>
zTZOvGM#ay>x?z$#fOaqvJ==I){21_c{-;q78-`?7{Uo*)6oR6~(Bkmt7c54zx<z!j
zM^6d&a9<$VhD8~Vq^sIIxnfP_#!IVhW9D{FY3XS=x4^tU^@m05z+h*O?J%Ln<0uim
z=+|{5w+e3?!gQ~aoP0+K!+TRiyB1Io0Cy@Hz^Cn`$Ws03o!dHRUh=kXhOK8NZWdj7
zt~X^aBp!G_Vw~K@ui%9THfG+wh5(~avUrDA0e@$4M8;3A<=mv{N`lq+%Fs|!r7In>
zZ|<d?sFu5!*YnhQ&H2&oi^;3ZAz+4`*dQxTzpIULy1eC8$!0;_GTky|6Ba+WyZLJ`
zn3Ts??@&`cp%QiGRbsFag)?gA-l7knPOle{byzLX@>VMH-FtB8u)vU;a5Sv8?>ubm
z-`)xc9x>Bdd@>~JPf(AkYo!Fk_VAthJBljMlWMLsF_|_n-@S?>)%f6udGmRuqqaDI
zw}AB*^;M1N7<TX6bq8-nwZc|g2P8Dl)S<*;1ufvYA<O+D{chZs2ZH+NZ|Z+zq=x9~
zJY}5oBB~xeP@kivz1TCStKx-UWl{xdXM0mKfQM>?Q2d@)_nu>;X6{9E37hl8ik3Z^
zl!amLUb#QpefIG#mf%U&d#fZ5%)x3E=ujk=q5~d%3NTN9{Q6#>Y`9bZ!F*Xw?BkNk
z%JiFpmTTK8!e0~i!!JD1*y8jWx0`8SkDEn>Twn19#iEri+H(vY2JLmt+|ept-?0mG
zcsbQhtq$?^l<3zC@Cssm_2FcT8pKE`?NkCM-^HltsFJ%{-@YyK1z~f_BVMQyGXs?`
zzvYSR9deEQ;Pt2yHM~30FEx*nEno9R&Y;6iO9r9JK0w%gEejFgZ{8c>j5Tcq4tX89
zIiEfs$57i^yMHDM);&^8P+BLxw~4qJ$vY29C4`b$`AxC@yy5=5&AH3zT;+0y58}Y#
z8_w>vM@PfZJ)xNcXCt<%YftWbN<C0bcN9K|5JS1>I<R#E0eLs4u3R^G%f`Qi$f-=D
zR+%rqaglVO&G-@<<x!AS1t2#_$g6W&!ns&7=4TI~p~lw_ATc%Sxr^4qnV9VE0*$s7
zD`sGGrz7f9ugxHSnpaWF-}7E|`U3Y}$mlbD-XZ+O%VVUxY1}xj)#~OTS<<fnI(53Q
zyk4}mCOsI<fZ$qpf0x<UdR#Ty;>kR(-T01fa9*sBnEtTgr;f?2g$9=}RTK^N>!D0b
zp~3Tpuxa`%saIUn=X+xmJn|ECD-+QqpW$Cr{cgiWxcJXwat)Z`q@ztwq+0*x9Q+li
z3K!jQo0QXhkFc8?5ZyW)F^knb?3T`4*2`qlv|zBGbLF8tiN|$0c#vyH3aHO1iBNEu
zbBb4q8Z&ayc;s0GuXr6uu(cwsGPgj+>@8mWX%hGFE4_CFEwRE>{@5UhbobR8vBlHa
z>55C^Dy%kcV*%cW%&rIh^-)rK3mvR5p~>3LlOsDl*+LsTX6EDyGAOAbNM_6fIlOyd
zZaoj?pp4?q`!n~Tab(Lf!VSV=sG^2sh_i%DE%cx`*E*YlgjVHLFti+EucGNNlsaRq
zz|liiJ9@r?<5U!VLb-yv|E0R$-6vA_-lqCsmicAgVsz%a1w_9Czkz_fKzzSa-&aw#
z=jht>Nr6+hubrBkJBw)F`i#9_86y>bN+e1y@q7T?PTQSei78YpvS)KkB;%n`%xgEl
zXV?}l3yvDL9~?=ZngSsR3q_Z_rOxI+=FbH(VSzFX7wIztsJ^k5{~6HnM@WYn>xtmM
zqv}F^HGvpQb@<^X{1;W`Y+*7W9Rhq*{%hXqe{fr=B>*8>(<Y@p8`wU;Ag6rg0Px5b
z*bej}mnzWp8~@_yN9K=|-*a`WlnIL)8ar&O6xLr<Mi_0X^*>`appt*4ZUoT&8M86)
zXX?hsv;4p3>d3BAM1dc}X>T!y;av1SePl)fP1rv&jnDv7eaGB*3gCL-fwxwDf1Fw1
zzc~1jw(rjY`+e~K>3hDvRcdtq4X{;yqEFxcV+s{PZxlT(*#-{5RnWG9SbaT6mFcns
z+9*l!1p+)o{axi^Q`{x^4aL5$jfuz@<<YOxC2W~T_GE>GwlT>dw2U99?J%U|BUF7~
zua3~PjJ0sMz->As-39;rH4yP$z&>K#^R%HYL*VMVDWFFPT10OFM%6NFzPF}h=_uHg
zg^COu>D`JFZS`&460BR1&{$)+&KZt%D;u-7XIxZWwQ5GQwi>WJHYXT9+;SeC-VgE@
zCb{kz5hqX_iqKhcmKOFyCyt?H3ctA?DbaF#Jp5`xcU8KwU|oFsd)Bvivs)bV5r?(0
zdi@!7rLPUjlW_VW*QV37wRplf1s*jrGM@ses1^@YyJ7Il$8PtuT-6#-!(@5u8FBi}
zy#NvlU`kp^4Y~nbCR1p-Lf_eX>&zvy$rMwB%H!%Jp^%~DT;XB%FXIQMBE^MjeK$4`
z0V{Q0Fye5l|E0)gGxfAtKfbA+M*|I`Gu-0ZjpAr=y8)-EiE-z|Y#MQ^^}C3Wo@=2$
zwAl|Q4Gr$zr7{Shntn)JJ~R})nt_G1lPmQ$S?Vg_5J|n|L(~mlKN6DY4Ig7xfrQim
ztre#_4%?g&!4EaYqs0N$5zEnIE26HqWdiLLvzRL_GrMg^h59EJ-UCcbrC7YlCZ1^A
z5}D@M(==w4$rRmI4HuAxHZ7=lvIfPb%LS=MpI3Tt#^%J<;NFSGRr2Rqa)iM?Y}kl$
zMB!ShF=bjA-_qHrI`EgQCd!8@UM6m~-ChibDLP~#(tETAr`k3cbk@~}wuYLXrM&g*
zReph$DdN}^yY8Wy^&~^`r>M^iC5@O4KIwa@iX{CJ(X5`Vf-Q%p-8Y4paZ<N>K9_Vm
zs`dPO?u%TwOT!ZfjUP>S&=sqz4R^rWH+PP&HE!v=hXWUZz-GI(a#X+n%t6~?O4n~)
zo??aK$9LP|G40nVS60R<($k1auxC9QL-?<C3FiF`jjjtTNpK!Bf#<qI*!rl4S-K(_
zqQcu+$SJmde>z`yH31WziVq%cL7lOfkPnyT6^7Qd2JI)y+dA=Mb!S_)#3D--(AP}A
z8Y<uV>AKIshsx$b#+iyZ0QbPrE+&8JadvlZ8lc=U?<HZI{Mku3{3NugO231s(jpg`
zSEiHWxNl^1W2BMaJk-J2x;9B`>{8VQ0oOC}_vXPKC%-h+67<$N@(}!5SfkAuiTBnH
zeqKyJ^Jpfs4mUFSN1I^i=aoJstmoRnW31z?(rrJ_*OjoaL27_O5uU~F6!D^Vmno3g
z>@tHg+~F|!7gZ5_8xUgk`U@i9Gr18@NhP@mjB(#)R?wK^SlVE@t$>5jB$ug*Ld%;B
z5s=*Vs3ujTsM50GUYQTx{%@;+Csh1`WyA^&$n82tib$uN{>O<;|B=%4pRZ5<!IW)=
zy8xauNTt+{10W1(RgiLU2$*2~Z%krc7!m>4KBFCwz)aZ)V!{lXB8SUChvLvppMQ49
zo_Yx!3U&d1L_-L<hZToFYv-@5O#&4B{#0Ic{VBxwc!IKSyMpwn0BsCe<?h>4hY=x%
zm4E!0`cXV!bOW%Res4_JQ!n;}Lsrnp)iETH;Iv<lCL_#%lY#&zH68m;j@X~r`G>(*
z|2cfW4>RqjBFRuNaUST6jNF4CCza{_jSP><&G0*vy#P6rig&|akG@QQ>gOky!Ure6
zuniB3`T+JDMwyf~&>@394SY=psRcYXLJ*2X>~HUjhJRl7??bWs%aQF!;TirvfW+}T
zs9*}$%K4>7tAMtvmKnX0uIk#uRA|(3^!17<UPVEg<+3~7N!#Fp(%l1l^nQ7RJzvCP
zFLES_k^nGT?_<c8px@rVI5b|@nfAej8(W>JA<~rlOJIwhSJ#xt4buhPjTlx^?YS6(
z6!qRXUnUhOMdM1L0Z@`aG60y;tWBK*v`wQ$PBOO?bp;2u?i7_RzYLPXsmXMP%hvhZ
z_{>L@esX72z7kyAtW^bd^lsl1#AE>wJ_`WAb7=hjjnzX`RZo+tBIvlLLF`K7=4ljt
znh?oi>i#pS;Ht{&Uc=O#r*-=>h4oF|oXGKIInHKoiyZ^EnaKya^Ku&#)YI@_X6Tss
z`dgd&W?WaE*bglHGM4?tx@Cm^X2-1)4$8F$&;#Uq`8#$;7jXSZ@|omcRFUX6;OX)P
zg<%S(f7`i9vOJMCOcCq_5X<WmF=K9%4`=$3*NOz5$96|IuU(C=Zu4sOON5+5HhLoG
zz5~3Yk}aSep*e>}2I0Bh|GXe&{NN?I2Q|~tnXVi4mNz9=-1yT0V3NV)MYN_w#J2R1
zMP)%0um)Lnu{HKk1k3^^6b>Ls$6kXzn*f7!PZf)CVvb2z2A$i5q5$6v73|eP_o4^X
zT=j)d3SUz7i(W}iY!_puJ8nhlTieec_??-7K8%QZ1fPV=W8l&U91?BMM{|TOnz1d+
z3&roFtPa;|K7jxBw}A-5D0cADXEKlx*;EF|MQ3-bi8_0NL|lNP&rGyPm+II0GQwsQ
zM<WWl{Rv1*Y<JJ{(FtVilX*xT{qbf8ujsPm=q81(amK#Rl(4tC7hYPUE8UWuQWR5?
zH4ZUvbkEYFscReFCq7tsB=))beBQ{3vv+Tyr8(ZunTXKW>)Aa|)e@c@QykK%HL6&z
zu{1pX!EVq(nt0UII;bm?>Z~Q&m9)P1V83F|@BLQnf8+EA9U%axGCD=FMVGeeHYNZd
zcHplN0a4xFn?_HlY+Z>;x!&b!t@}3$omRMgiu+e?eedoD!Xguh7=2<}9)6x6IB+{A
z8p^bePt`BivA>l1<GkMD!8o7L^^WZ}b8fmzJa*YLE;7~COJl=R+*ZRo4au81ix--R
z(y4*bKDn^mdNi!6vT|x{?Irl{Mt29<Y~>4B!DM6-r2*5EZVjMeIgBRtP|m=KqOGWN
z@O7jekm8cDuUQt+$LKv&l-c}QtjB?M%Q;%&?zN*q+b2q^Ozkf&y-*Sco;zRiQ-WPn
zDux@8+Q_lj!2Kn-*jd7V7%C8VxA5`LCtCL#)RkL4$;E9`SEWSU{1H<covpnwX2nrE
zYF@iklk)7kqHd^5P2mhW|4~KK#@?v=nk(+_PI-5~hs=FUENDZr0Gn_$_qeY%F*MRw
z0}987EkrPxo7G?<t|^UhcnkDjH)`jk;xS%exu$;k>!s=8B@CH6@)y-r@!6guHh{O>
z-)E)A`{c_&sn}!ugKMLX@e~^$EAEANKlIMwmxqe3X-xH14mb6TXbWdx-s!DO|2Nvd
z|8A!LUu&ip8|_oni!_c$z&q^4`CrqJkS~38mi{UA>qP}xJYpH9_t?2jZ0w4ttk7va
zYm-FtX+VdB;#~!m;-cy<q;r#kKSz74suQ2bx_h|6v@#+%v&&M35M9b5O)*d3*l1e5
z##hDywPVn%8sL7`kP6tlU!%w%n_dFcfnErpW&HLQV0*I1tR6!8AugvAjDSt{Vc9$z
z@L>3pAJiXzlF{Qr<jzQjx@Y%Q_&r;mt1HL&bk*Lu*Kbdgj~-L%cC1{`+@s4l7y^IT
z5R68LK?wH?aN&^Cl#2)*Q=)UKy)O-+^ACF~`J_Vwc!h-?dwQNb>q7<MU>odf*}BxK
zP<_2l*WIh+t6Y-DG&?x*89l%>oh6!s5_kxwoXREjK_Bf|%KW10fWtgj+S0NXsys10
zt_zSTa7kz@D7GdxP*Ioos0GB}3_Qq`8AM^mYs~?CKfJIQ7B8CkMtnM*bH5GE-8OIN
z5`|719Hw;QN>3LY$&(*946fx63}Ztp;B*dV0*6AuITmKkwtjZ5KGNMzwuwD)!WgH_
z`DP(c-gZ6!FFDf&Jci1C04R3y(I0;Je?6o#2No%-nB6VGf-IEE!#_;s0)dToM;st9
zu$~X4#C1S`9r)i2I|)l+2w;u?KcmwNxnOx8#Agz>cQa-7m7UN7{!`Q5!@YzAgP$*=
z*Ly%e4k+T0={iwShU2-C-^q?>08z3<j+cOKVn<ioxWLVR^h1m7e3FCWzQ-y?r6Iql
z?(532{-V-{jW)}KsK*^}d-2Q}2P2#60p89MGtl!WUIda@`he+k-yFCxlz`58U@eLw
z4;i?*G+oAJ)mE1fjjh-((}i>{+avks^}AhwV$h`7z|q4&$$V^O*vi9h(z}Purh$jI
zaU*g_i_>UsmHh6{_DUiH5^fBs!baN`SmQ3S3&sktY_;eYFQ%!n^Nub65N1fZxPmz+
z17}~QoG1P;8xB^~n_+@zM+})W3qk$NIAYY&-tUWrS8I-Vq}7`TC;`g5U>`sn*$XlQ
ze%i9<7Zo=U`@B*0i|Vc)6u_T7!DQzKzZY%y6SQ?jWt}~3K6sg#Eq!p?89D6PtqsG8
zCUTc!F+xSH+oH?py767R0Z<u$|1mdV7{SkRXM9CTvG^jNhlCjtvPFr9C@|*!<GMx1
z+02)WeO=EizuIiQw-lr=!tmd093%n1l!lXFRdpmzLg8tf08J?=Wf*uNL@YOO5_X63
zT;bx=TN3GB^9{n|9$#%9$6UI%?i76L#FjBxbP`SpI2@+XZy-sNAOhMQb4U#&^@vsj
z1%vzWBf(C`p}no7x(NW?t^!LZ%cASYtx|a2-i!^ifB5*5&e|3v!OF^z+iKh=@2~*n
z{KsHu`k!4<x=u=-xntLaVwLG(0mukqzA~~!T#MQ<00|0<FAF(yVMr_MihN?fx?SUJ
zR~!8Rm=8IfUqjml4=`(Zo!v#$Xs*d#48b)s<d`)?9rDgyHj_!2A7k-gP`!)DaJN{5
zgKm&=|8~G*Nyas};}g4RG8=Hh#F_;Q`GoDZ%)|*Vn3vT=o<PNx&i2&WGK!7J`boqw
z`fWAZz8oiAJBT#G+C+JAyG5zL(BoW%WZ($SlH?CnvEa4Gz|*Cp=1cwex8x@<!MP`N
zb4PCs(vBS4yB(Zg6>LpE%pTuV=s$Ayggd9=ULk3dMLkC)B1$N=boF>Cve_5IrV{pI
zP^90%XRQ1eRU!&4W1xnV1P%QMNcOK@|E;P2zoV&F=3E8#$4|TsUM>IQ*Z+;(^FP>W
z{~K%lpTb)CScsOW&;<QZLk<UitBxz{<w<I`HyauAmB~xg<r!Zvc$;M~t^p_u&H!82
z2=HHjOEvlLPy9YS{~nM3EBA-e-;uDgiOErg?vpe{ZkWmr#e}<tx^FwL3*FNa3t*(u
zyIR4|Q}S<!@4o}}*#RCj3||jZ<Ux<L)Tkt8SL`SJbOl+dYGd;<U+&7h)jzqRloQ=P
z(EtDKkDb=q{NL!x{ZVlIyEFH9%d*Dsss%c%L5^hHw9j<5pm3aXV7mS6^A~<}cV9jj
z7J3vVn@}=nU~z@gZ^iQRZEXYpfJrBE&nyYM7eR0z4~9K`a+TuKC~((L%fg`Z==}Qf
zFDj{{pJNf|Y{$Kn`IL#J;p>)wv4w}`huf$Y!wB`NuYY$6|7TUjKW#$({|&!azPb8e
zI!FDTvy>eI)oP@~jMbgO+>DU&$aqzw^=?PipzFpCYq}&+hL4HRx{;T6@@Z+<_s8z8
zy~2m_w6j)7!qCsf)@4vc-Sehd{rXd58bb<nt^p-6Ewh3(DGm;<xAd$uH%tb1x}h^k
zNW4(`?7cqojpe<~$oK7qTg<hn4ao<)nIFlDeTvfOEIIC%g~iU^2zA|k-cghyTubxd
z+T=<LUH<j_kIasN`&#7#kE8DmjlDn|&uQa+7)D&<l68$Dso_iT;HU<{vOa0{q@fo*
zbFa5F_^U30UQ<rjKls`c;*vcarD!QK`y*z9?)G-YlSkyyg0kGJt|B)KV$yI6Kud#P
z|L>tU+wLD8FJ!9X1q?2ADSR=6<jGJSin5Q-XoR9Ad{Zr5wc;&i9Vdlc4~9B##!;)Q
zh`P|-qFu7T5TEqJOgQ6J@L!vE4G{0roC-cwLUndA+qK~aDLI#<)$lX@`KNr$VF3dq
z-BW4Wuk{y|!xzz{$i}KEc~>u@l~Lk{1#!7E?_n^G-gW*T@P~+<T;~PnoXVKOoeG6v
z7oJ#y?-_NA6gHzY8*0S!*++djkeWSDXWE%4ZB*yS>Ory(o<{unAv{7nnPj6^Ht}i~
zl9)Gkbmpf4DRUp#kDuBZqY@yTIi%l0C@GS14N}*J_~@$5GuvzvlVtY=K7S)Sq@Z7s
zjfp3M(r*%(_na(^dhXL0D52xN9&KxgS6v<7_C14X-oE1$$ozxuFhaD`4Hs&4iGX09
zMzi5GjZtMlqM^#wk`1MdN?>Of&952<YY;Wj`t<X`V2wqWt^C(Fez;5n=T?zQ(jZ2%
zZc{ja%&Nqp*gU)(THy2bosFUtE$vo;tWX~A$=_a}V%M46n4V_L>7LJx^b-@CnlSvc
zyGiOdsbjoth|89|UJJROW5Yl!Y_JlcWc;&H{{q=r#+R$}#Ypy?s1>=yq%|3IjA!`s
zQbcW&*?L%;nI=EW$Ng{3%$*f7v9WwCL$>GJ3zgyW<n0=xSD^#fFBVMCX4^rnF7%Vt
zv!G*sX;VHO=fn?obKNA&A{`*ZloLaykjA`w0@&P;87V2Qt7n;KM9j8QV_$LU)=`i_
z#j@h`(=L2J@qvqzdS+URUNfkmRvTiY-g$fF!1^^!{_3hz(;QaO6t9fo5vzWE(oot^
zZb6@6x!<#KNdI(wzo6-Q@f$6k$UcB}c}JvMt77AiUYyh>MG@eTtd2o|CLckg8NO=-
z*<GilM4BB<{nJBKhs=K!PBaJlJu>s-S=^tDk<vd2B=%H)GDeCt{v?o4%_#mZd9uR%
zRbnR9!S;;tVFB)N5A}y5o!=&KpYgGycGo$8b0YEo^J7$gtj3_39=-{jWBd|^xvpAr
zc4mVZvLrL@1KR9}2_MhPbg>oW?FMo9DpwH(J55bhB(e*B)Mk_hM2}E*q7c#GF>nZ!
z$*E4OkVUQ<-H|KpQh8{j$sajV7tz{-VY6%Y=cpuf*9G==$hJ1azgEAm>IOirDUZ#a
zB?Y5Ih4E)z78P;rmH^(b(G1Pullnrz^-H(zrkqN@@rz3L+)I={ZM_?XlQfKvWmnDB
z9bA9*W;X<1_n!4Agc4F@#8*YY-X(G;56MJwe%OL^(YF&X=DO`)O?pYP97Y|a$z{&g
zvuIXHt#~)QKLza&cR}?IOMmut^fS~ZOZB1M+m`o2LC-5d1o?T)iCFKvY%&+2E!IV-
ztgnbM!lmev6ztGhsK!=5f{lv4j_Nd3rm9T7jwf7?1fF|&!52m}4uS_^06zzMhx;$E
zBPDU4_;TZ!duQsUm50~J2H9$UA1yT8p*K4<L;08dm`e(C^jA~@R2a{xD;Gc9#Mh09
zlam2{z%FfX@w`G-fW(o)Ys!G-iG5c4mbc5hHDtZ}8FjtBCICG%q=yZmi3^_X!Csvx
z+WfMm^p<(dv1ww~2$0c+i<>vVR8Aa5+%oY&i0>TmC9A!-ja(PU>$IKRTG;xQj&Ue=
zGuVAXS6r)1bWWZLQz5w;lr}u-*?4ZuPgvE;sgjU=3Jy+T)ki4yX@1EF^vDzc#;f<#
z0uxS=L0C75brh_!hXD9&(slVXAwRiduS2Z%T&FhumYso`VV`W6qDtl%ZaK<qYD+Ll
zO8v~ko8Jo_M?5(EZ8{##m7y{)9cz!=K{H>wy_aom_lwHX&JY}TtB}+G4(Xmy``&uN
zQCsosHp7GNH!JG5<(v@PO$Lb7CiyYlfe^vESo=4O2TpV%FL7@~JIMSq1%SHggbXO6
zvfq5Pt<`ClZlI1v>t}y+Rqo3PPqbdIzX-{-Wjm}~913Km_Jif2sKzf)=e;&w_0j2p
zrx6I7i}rJOJ8}9BxiHQPfu9eicW)hWlVlYPQ4dl?!z^sA<QQ{_Y~o(YQNCPb8m*dc
z=-1aIBCo%4M(1d~8&@yXr0!5;X`e+Ed0U8d(4R^52|kf}apGl1yQ8j&+rpyTQ1j=E
z2=&|>cm)(mUFnviQTzv$83low$U6&>^H0Fjio==1$-Yl3zG4dj@c!J=cdO0j<SUEz
zD?~m4NM}7q^WiQ!e8(K7qW(q)=6Nw*jxV%ipZ4`mzIVYptZ(UCB_xu3VV>3Cq0@h|
z0}MB1eROX>*1fkfMw`4L7N5^?c+%^m<g->*>aQnn(SF*^2%z5rN1HvyUGNun@aKkx
zU&a=}n09+r_QRdd-ew7)>bak?`(ya6?q~RMZpFn={-Y~0yKNJo<COe6KSam0)Yis8
z0H%9{e*~YeL|vZcj@tZ6x%FARfn~*?(OR+zciw8$8dYjZIh;HWTR$-NRO9*K--J?w
z>z?&!pXJNMf8!?=WLTJq5a4U96Xx=@C$_JyT6%^mLbFH>AnE4Y(P>K?SKhLN3|GJ+
zxh7njO~=eF@_c@i5i0Hj7UnkspZIwSU9)d@XtzT`04hs>=Z<k|^G8HMGid7?B6hu3
zQU_)xDIcpWf)AZFdPZu@x3@qXHOqhbxayvJy*6~^@zc<GwOZPWs+JUm!-WPh(%3A1
zGth2Orq+IAA;u*0eC@fjdko{KrW`_hD=&2$Q`y}?aof~7i7AVMUG>I%6x(9hhy#1F
ziMUVxc+exV`I$GA$a`ihEGQZ7$Qx@);)pk9St*!6xYE;j@lAffY@)&Zl%L2PgsnpB
z+m<hP(dj#?$>%PC!X1YccQdm&wzz^Y?<t_U=T%XP27Z57YDy$OVJ2Eyy*ELA<F^1E
ztrYZRKyR<a&7^t1Wbs?|yM4nkbfiHC^}}e8)xtM<aw0ne;nLjv;^K~i2`ura$>)O)
zhh=;w$GVmo5o!WSVSu#iH0K}7c#eg6yC=1pCzlR)l+^7IBfe?u(#Nw`jYtd`6O*#-
zp;`5P5?Vi3uSG~8CxJ`+2v&DzwugQjzsaIppjv-v;2Gdd_U(XwyLcv|`1!LX75Chn
z5TRGZ6dm)WLVw|9^vB8j_cUJC{wPbUKZR=2%k+1jd>z;7%9Z{eUO1uy&2Q#yt!sw1
zUzs=Y6HWL+lm*av?(E9p?zT+4JnW0b*0#fY3hhS6l8^sevm;vRY@#E;?RmfA9$HMA
zx+ACcq;Flq9s2z%qNp>!&5uw0^5Y{HzXJYN)P>6f_!4Xb2xmS4f$|g*zP@yzI@&_1
z#IS;9lm=aOu}}M*tgF80#;M;tHJ2~}{Oh<HuPYw8u-Gs5vy?Oob?~mFC}H8`+gm&u
z;@_E_7b!Kl)WqVkGw~~I@uNv56SkIT=bx_7ty-*4W*P7GFzvkTW_-;U^C>a(t85qQ
zb&3;XSH=|7%(gsqv9i1Yfmiw{seoiO$h?Y+MNPXIgSZt%?TRNHs%i$aIE;!)$W4aw
zo+pUqak!LPPohe*hg=)9$Wz<o+t1DNJc@d$+vaJ9+qx0sCJvQa^ii<u1uVM)HYitp
zpgUIEtJEt<X~QahbFEziD5pEjQwN+WJ+0ihaGxDqP@bY3ddp%}s?Fev)yz4s=lko2
zL;E3h3NXAbI|Gv-eKXa{1JjW$(^wZhfx+(?Cj4hk=3j}TF$ho!Ow%f9V)yO$e5%I!
zP=+3lv`;e>Q{u9?w;nF}JcgBX{>ymm9D60%eFmnZ;-@s;blYXcJ0u(MUvQddV>1?8
z^EuIO_8CJhQ3uO62Uy1g{59uX`B2ZZfu_8^3AsCcF=|jl*EHDSRxVwUhJPn<BDbkR
z9^azpDQdp4@xdk*HeS##qM)N$C~h6tDHC$>@s%qQY^-in9<1Fuk1G2Lr)G`6h73*J
zNQyV6%OuLA)>dcVJh~}dRdR<H8aU8!-EwuK*H^fIZXo6bd_y^~`%WWR1{Kh1R7FUy
zEvQPJ)ni!^n_K*jErHVe(b2@ts?{c}do{2jzwanyQeJuf6Di=xY8K96$QV32w($8S
zT(Zlh<3;Ekd{Y9+58);Qcd(%?>R|8nAF)&Xs^gQOdw<O(`|B{uw~YT!Q-j;N{POP5
z{K+jthTEODTBP{p{)N$OG3nS(HW-Cj^EcybO)?`)`JWZ#-&C8(Z;m^sctMHyeR(k9
zn#=M4szphvj@a6g0&lL4u8+78vuVupDyC%o7nN5n$5O)rdWnlBH^lAh+KzpYzQ$&f
z>*TxL=XW{^<c9i2$Ft<Z;?yn#t11WU-=?C~_G5~;Ubf%^EcrkI@tZF}_MgyIN6{=0
z{{i7~u{-MIJ{XeABaGi0oZFTt@3KiP??opFAKrd4G|y`BK*T)r9nd=lghj@D=ZRKm
z$JbfLPn~D^zI~lM#6C!zeUEdR5-*RC^0F_V$Hlfstk~!N_;DQN4cUBt3e1eJIZ<bd
z%v+83<Zwla62f0#-pP9F(K$R?UbjDV537vxxY$B}nz`2~n$_~{C$`?7BxWUl?s2m+
zc0VbvwbVPtU5Np-gjNsPxr8Z446Wi*zdVOZ*Ohc0;9NI820S;{dKtK)@cMAr9gmEd
z;v)uKF4r~c%i3g&xsu5INxd;=a97=JA$~3?nwN=<dr~!S)9cw|aErx>gCU_ZqE7P|
z!`gr>RQkp;qvWFYR3nQ(N~*<Rhq$@?is&jyrb`3$Fhvx>&*>oWA|LY*8vB*>st6J6
zL6X#zdr_s+ZG0ojyO3d9o=jJy4?6p7aARn-y(*dOxHGM@3M5{xaU5nm4|<gFV6tP;
zg=C=giCA@HrT!Z4ocyx*`&q0TuDT59wp(&10Sjlu&(tO>0V1+{cJsV0oZ7v#KQ!(l
zU-adJlp0`WuznnDcwYVF=Wih82N}n~YZDFf$VQ&MXhLT57&pAUzsM#vFXiQ;re5Cj
zZfC)$^Pf$oU)^2f*9Rx+sBt(|(6y^ZA<rSG)rj{6WxM72opz97qUgTRD_=ei?dk=}
z)47XArdc<|G;+=>Y`FdSaMGMKOEDZ9@B}Q?&9#_j#7eZYc`w>rS3GC0SIv@>UedQO
zHC+=pJENW_UKlQ1|E0V-LiH9iXp`g8J}0Qi$vAE)Wb+%C-L3xo1)s1_QYuapCD3dB
zFPM*A-NCP9SKrPRibyX!ILZM^C9N-`&rD}*-m7E=7G~L8zoU#+{6g3ar<`>x!!(D@
z4#|jyO39%_*AZG2JotzEhQe@0pRNMu&y+OOW7j<-A5Zb5byK=f#aq95^Oqu&Q+$ri
zWM}n<Fkk7JypR`kr3|PaLv4CRy!JI~5&*eUe%f{YNOieVGWOgu-xaJe*dKbOQz=`k
z)!mAnI2Ai<uh>JsB3Jd%{V_7lKi><KXb6_VSJRd(K^e?Q4jItoD?X7I@ikUPGb8VW
z9<6X*x9<zi*T_eP?(Xxhvo)HVAX1x~xz5(|WzsF5EjYbL-FyEX{0EoY)GcB#rV9vK
z_?hqmhl@27$tBpFGI)BV<BVE7;2l}*(I)sw;vbPMh<uqd%zSz;_sk>TU+8CbVh=aT
z|L|em;w;tbQ2m9mqZaQKHX^sfp=E89jNJYH&e`715qhQ9O1s&o&cNt3oFV~ZUqi!-
z^t5-c<#v@w1r|Bme)?`ozTQBnQ&8d~r5a)N-2z>zuK%LKiAjO!O=Wt*9>}31%3G;P
z!C@0f?KR=d_n{@RI_T7!BXy#)ULg137=cGP+lccAFLm(DA<1L%F`Mq2ERJ3ImX^))
z&gZ=Bs&3L!2UDM{<q}@7er)Zwi|qzxorjKpse`Fsx3cP=)(i7JlS%rFZ23j?pyKPx
z{(Gr5kW5C<Pzg|KzxEijizq+VX3~3{B7U<ZWN5)!>hh)7#Mn!&<bsk6l(f3@TY-(C
zPk&hng@KCsAAM=@n_Al>8V-igfBDWo@v!eMXAS7}4u;7>Pcn2(+-a`5J*Dr`!x2jQ
zV740T8G&+T0NlR*+q6h6-@;xK-~+|ccbvqHO0&hh@GS^>8WJ5g?;4<THi+I2)57b3
zh4lpInrb|(B3>+8^PVLX>^!PIdwWt^Zqbma^yLQ2vbUIB&FR{AerLvBZ^=FYg?e0=
zD#C@OFPhaoijyU$+pADIUqq7Vr!pc#%k=#2Qstin6a*)F0f0A>`z26p8bfwBB`E=e
zMDXtr#<N+9VlifQ3UYj+U<Q!<{zsfi`H3CS?{4*?-<5us!rbNkKMaAywUoR=yZ)k5
z!u~~-U#@s3tN9bc^Fi4c{V(HV_adl(R1q)o0XpihWiaFH0KZ}$06eUS$R&om=AT#o
z(FOaP|6`oZwuSQ1^wr%xswfg^n#a@;iZ=mcgmQhMx8?Q=w2iS0p&fneJ+~U4iyl0$
zbVD*ZO!4W~umxuWi&M@GnyW;f!If*1rG_`#9|r;{117(N=FM=<uPhg_-3(s<rIdtg
z)NXr)(r+u`Z@0mJ7!v%y@p_^PM4WdAhGh#FP9_Ko`L9$?l@j3D&Q(hN|JqaFx*@53
z>c~g=(BQP55M$|D?Gts%nzz+2Twp(6k8%ag+wS@wpMdMD)>rKR!n(f8PF3*}YythZ
zz5D-E0vGaJ-xL3f=>jvbM@{tYG{BC}fUC_t{--jw{`wx^LZ)zFQG~QZ;ce&7&A@d{
z>nrQOumQa+weS=4&LChW6GzQtbuue&%U=jzUlEdIdVVPbmdk<8UU8SXHo0io=C7=G
zwlE&~vB+k1t@cSf#pwJ<i#ORfYuwqK3vcZ?d|XWW>W{Y$@@6&e8+4zqJRzif?8fW1
zpyhHuOs^gNU7ckodtq(D)i1qjzuw(bl$pHQmw%Q!W0!)~a)tsvEq?ioG`BkK6E(39
zn}BCG>%Vl6o4B(6p#S=unAQ)+I_kEE+yC)R^#(5g0yh3_DuNw>y~W+@|0(U!kNGe$
zJ!ft4bvquNx`zw+fot&}zKLr8%QcJtAM4%vk0SMlZ*1lNC2Au7hkMt5hDX}Z>VG)-
zfA^LD&@%tsEQVjn|KyIYsK2ms0dN~Z>~-J?WbS`#yMdjdg>WnO0f&-WRQ@xR09WgA
zc>a62fPb0&s1>6DHJYME^TlWZGFsA())zynVtou;X}>OuukypPR^Vog^7uclS(*Dk
z1i!xhoN<rgBA#EdF~Ih|>8CAnJX(jfvKL(VqY`?Z+d)3q8`OkRy0C7+C6ivYWA7d*
z%M`EnHSCzj%~BxR$N6ARam@6?-9r1EdL~M#WY60X%8-7aX-7TBkA&6gr+)#PSM1J)
zn`-t=VSM$Ufj@WKnwm1v*LC9kT>HH~uV=oI6Y_X#RegKHf%v5irBMZsyDr7=j{H^i
zHtItBZU?SPQLm5Y%;8y_mrWSYWS8x}^6}OVd(oG6S=-p7zWn|jd*I`&XQgZ9&$25u
z*zh0yCt<X?X5ZFl_mn?`&xn5V{AIl7>wO|ZlRsToU-d)8!!Ou`@w49A4?m{at7S{&
zx4YZFI{!4@^WGmzp5vS$DnBwff6rgaQ1cPE4*bP`hV#bmf3z3>XRtY2%MBE{P=DSY
zbW43$^FQFG!pB<}KVOGR%YRtc|L3#m7yUolz_ytU<l6Np{-3~Y4t>BTc|2GexbbC|
z{pT~+FYN!Ymi-TKf(3LLd~1gN^ZEa*9pr5xvcP5*#O8P>;F$Cl`Om-|2f$nEMS(4}
zdG$ZuGSqy9DHwIyXsC^*wb2|pT6hexBKKmAl|ujB`KPv-%x^zp@YC=|_%`*!juSuC
zO|3fp@I;uT7sKa%z6$Nr+MkNQtoQuT-p1pzGwR-@JzUDlPu6XA`mmy-e_Dgik6_PF
zQ;W3sT+}Voc)T?&W0(CjHrA4BV!It4HRwk!yP);rWq`wsl`j~Uo!BYz%IX5Eb%#0g
ztaE!WADMYJ*QRnsN^>bgQTQ#1qPnP4yFOe<{+_*S(h>8lCSL>dgbe2M=^rMjzpI<d
zTwx*q;IH;YY4`Ydm-)IlpKvjJzW>9S{ky%F{X-u4JAbt=?B6JUssD}Zmj(Q`z%G$N
zeesvY{{#;HJ%4F0_iw>kjeketfgT#wGa3e?>0mT3z{-P%4?fs8EpI>MAiwihc!@~>
zKSS_!U=eeHT{-*Vg5~e7t)12;(6ct*eHr5ou6fo1dsi^coi|T;t%SlYRyzx`D<|cw
zE-)S2A@WLN0Tbw4{U+mUT^fwb45}_kxY~6w^c>Lm#J*sq#sZE%jW0%-!zvsExF&Tm
Wq)*bU+32^Zfx+++^jZb}|2F}Cky`}-

literal 0
HcmV?d00001

diff --git a/components/engine/docs/sources/reference/api/docker_io_accounts_api.rst b/components/engine/docs/sources/reference/api/docker_io_accounts_api.rst
new file mode 100644
index 0000000000..7976f1fddf
--- /dev/null
+++ b/components/engine/docs/sources/reference/api/docker_io_accounts_api.rst
@@ -0,0 +1,308 @@
+:title: docker.io Accounts API
+:description: API Documentation for docker.io accounts.
+:keywords: API, Docker, accounts, REST, documentation
+
+
+======================
+docker.io Accounts API
+======================
+
+.. contents:: Table of Contents
+
+
+1. Endpoints
+============
+
+
+1.1 Get a single user
+^^^^^^^^^^^^^^^^^^^^^
+
+.. http:get:: /api/v1.1/users/:username/
+
+    Get profile info for the specified user.
+
+    :param username: username of the user whose profile info is being requested.
+
+    :reqheader Authorization: required authentication credentials of either type HTTP Basic or OAuth Bearer Token.
+
+    :statuscode 200: success, user data returned.
+    :statuscode 401: authentication error.
+    :statuscode 403: permission error, authenticated user must be the user whose data is being requested, OAuth access tokens must have ``profile_read`` scope.
+    :statuscode 404: the specified username does not exist.
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+        GET /api/v1.1/users/janedoe/ HTTP/1.1
+        Host: www.docker.io
+        Accept: application/json
+        Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Content-Type: application/json
+
+        {
+            "id": 2,
+            "username": "janedoe",
+            "url": "",
+            "date_joined": "2014-02-12T17:58:01.431312Z",
+            "type": "User",
+            "full_name": "Jane Doe",
+            "location": "San Francisco, CA",
+            "company": "Success, Inc.",
+            "profile_url": "https://docker.io/",
+            "gravatar_email": "jane.doe+gravatar@example.com",
+            "email": "jane.doe@example.com",
+            "is_active": true
+        }
+
+
+1.2 Update a single user
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. http:patch:: /api/v1.1/users/:username/
+
+    Update profile info for the specified user.
+
+    :param username: username of the user whose profile info is being updated.
+
+    :jsonparam string full_name: (optional) the new name of the user.
+    :jsonparam string location: (optional) the new location.
+    :jsonparam string company: (optional) the new company of the user.
+    :jsonparam string profile_url: (optional) the new profile url.
+    :jsonparam string gravatar_email: (optional) the new Gravatar email address.
+
+    :reqheader Authorization: required authentication credentials of either type HTTP Basic or OAuth Bearer Token.
+    :reqheader Content-Type: MIME Type of post data. JSON, url-encoded form data, etc.
+
+    :statuscode 200: success, user data updated.
+    :statuscode 400: post data validation error.
+    :statuscode 401: authentication error.
+    :statuscode 403: permission error, authenticated user must be the user whose data is being updated, OAuth access tokens must have ``profile_write`` scope.
+    :statuscode 404: the specified username does not exist.
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+        PATCH /api/v1.1/users/janedoe/ HTTP/1.1
+        Host: www.docker.io
+        Accept: application/json
+        Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
+
+        {
+            "location": "Private Island",
+            "profile_url": "http://janedoe.com/",
+            "company": "Retired",
+        }
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Content-Type: application/json
+
+        {
+            "id": 2,
+            "username": "janedoe",
+            "url": "",
+            "date_joined": "2014-02-12T17:58:01.431312Z",
+            "type": "User",
+            "full_name": "Jane Doe",
+            "location": "Private Island",
+            "company": "Retired",
+            "profile_url": "http://janedoe.com/",
+            "gravatar_email": "jane.doe+gravatar@example.com",
+            "email": "jane.doe@example.com",
+            "is_active": true
+        }
+
+
+1.3 List email addresses for a user
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. http:get:: /api/v1.1/users/:username/emails/
+
+    List email info for the specified user.
+
+    :param username: username of the user whose profile info is being updated.
+
+    :reqheader Authorization: required authentication credentials of either type HTTP Basic or OAuth Bearer Token
+
+    :statuscode 200: success, user data updated.
+    :statuscode 401: authentication error.
+    :statuscode 403: permission error, authenticated user must be the user whose data is being requested, OAuth access tokens must have ``email_read`` scope.
+    :statuscode 404: the specified username does not exist.
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+        GET /api/v1.1/users/janedoe/emails/ HTTP/1.1
+        Host: www.docker.io
+        Accept: application/json
+        Authorization: Bearer zAy0BxC1wDv2EuF3tGs4HrI6qJp6KoL7nM
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Content-Type: application/json
+
+        [
+            {
+                "email": "jane.doe@example.com",
+                "verified": true,
+                "primary": true
+            }
+        ]
+
+
+1.4 Add email address for a user
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. http:post:: /api/v1.1/users/:username/emails/
+
+    Add a new email address to the specified user's account. The email address
+    must be verified separately, a confirmation email is not automatically sent.
+
+    :jsonparam string email: email address to be added.
+
+    :reqheader Authorization: required authentication credentials of either type HTTP Basic or OAuth Bearer Token.
+    :reqheader Content-Type: MIME Type of post data. JSON, url-encoded form data, etc.
+
+    :statuscode 201: success, new email added.
+    :statuscode 400: data validation error.
+    :statuscode 401: authentication error.
+    :statuscode 403: permission error, authenticated user must be the user whose data is being requested, OAuth access tokens must have ``email_write`` scope.
+    :statuscode 404: the specified username does not exist.
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+        POST /api/v1.1/users/janedoe/emails/ HTTP/1.1
+        Host: www.docker.io
+        Accept: application/json
+        Content-Type: application/json
+        Authorization: Bearer zAy0BxC1wDv2EuF3tGs4HrI6qJp6KoL7nM
+
+        {
+            "email": "jane.doe+other@example.com"
+        }
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+        HTTP/1.1 201 Created
+        Content-Type: application/json
+
+        {
+            "email": "jane.doe+other@example.com",
+            "verified": false,
+            "primary": false
+        }
+
+
+1.5 Update an email address for a user
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. http:patch:: /api/v1.1/users/:username/emails/
+
+    Update an email address for the specified user to either verify an email
+    address or set it as the primary email for the user. You cannot use this
+    endpoint to un-verify an email address. You cannot use this endpoint to
+    unset the primary email, only set another as the primary.
+
+    :param username: username of the user whose email info is being updated.
+
+    :jsonparam string email: the email address to be updated.
+    :jsonparam boolean verified: (optional) whether the email address is verified, must be ``true`` or absent.
+    :jsonparam boolean primary: (optional) whether to set the email address as the primary email, must be ``true`` or absent.
+
+    :reqheader Authorization: required authentication credentials of either type HTTP Basic or OAuth Bearer Token.
+    :reqheader Content-Type: MIME Type of post data. JSON, url-encoded form data, etc.
+
+    :statuscode 200: success, user's email updated.
+    :statuscode 400: data validation error.
+    :statuscode 401: authentication error.
+    :statuscode 403: permission error, authenticated user must be the user whose data is being updated, OAuth access tokens must have ``email_write`` scope.
+    :statuscode 404: the specified username or email address does not exist.
+
+    **Example request**:
+
+    Once you have independently verified an email address.
+
+    .. sourcecode:: http
+
+        PATCH /api/v1.1/users/janedoe/emails/ HTTP/1.1
+        Host: www.docker.io
+        Accept: application/json
+        Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
+
+        {
+            "email": "jane.doe+other@example.com",
+            "verified": true,
+        }
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Content-Type: application/json
+
+        {
+            "email": "jane.doe+other@example.com",
+            "verified": true,
+            "primary": false
+        }
+
+
+1.6 Delete email address for a user
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. http:delete:: /api/v1.1/users/:username/emails/
+
+    Delete an email address from the specified user's account. You cannot
+    delete a user's primary email address.
+
+    :jsonparam string email: email address to be deleted.
+
+    :reqheader Authorization: required authentication credentials of either type HTTP Basic or OAuth Bearer Token.
+    :reqheader Content-Type: MIME Type of post data. JSON, url-encoded form data, etc.
+
+    :statuscode 204: success, email address removed.
+    :statuscode 400: validation error.
+    :statuscode 401: authentication error.
+    :statuscode 403: permission error, authenticated user must be the user whose data is being requested, OAuth access tokens must have ``email_write`` scope.
+    :statuscode 404: the specified username or email address does not exist.
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+        DELETE /api/v1.1/users/janedoe/emails/ HTTP/1.1
+        Host: www.docker.io
+        Accept: application/json
+        Content-Type: application/json
+        Authorization: Bearer zAy0BxC1wDv2EuF3tGs4HrI6qJp6KoL7nM
+
+        {
+            "email": "jane.doe+other@example.com"
+        }
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+        HTTP/1.1 204 NO CONTENT
+        Content-Length: 0
diff --git a/components/engine/docs/sources/reference/api/docker_io_oauth_api.rst b/components/engine/docs/sources/reference/api/docker_io_oauth_api.rst
new file mode 100644
index 0000000000..bed939f7d1
--- /dev/null
+++ b/components/engine/docs/sources/reference/api/docker_io_oauth_api.rst
@@ -0,0 +1,233 @@
+:title: docker.io OAuth API
+:description: API Documentation for docker.io's OAuth flow.
+:keywords: API, Docker, oauth, REST, documentation
+
+
+===================
+docker.io OAuth API
+===================
+
+.. contents:: Table of Contents
+
+
+1. Brief introduction
+=====================
+
+Some docker.io API requests will require an access token to authenticate. To
+get an access token for a user, that user must first grant your application
+access to their docker.io account. In order for them to grant your application
+access you must first register your application.
+
+Before continuing, we encourage you to familiarize yourself with
+`The OAuth 2.0 Authorization Framework <http://tools.ietf.org/html/rfc6749>`_.
+
+
+2. Register Your Application
+============================
+
+You will need to register your application with docker.io before users will
+be able to grant your application access to their account information. We
+are currently only allowing applications selectively. To request registration
+of your application send an email to support-accounts@docker.com with the
+following information:
+
+- The name of your application
+- A description of your application and the service it will provide
+  to docker.io users.
+- A list of one or more redirect URIs that we will use for redirecting
+  authorization requests to your application. These are used in the step
+  of getting an Authorization Code.
+
+When your application is approved you will receive a response from the
+docker.io team with your ``client_id`` and ``client_secret`` which your
+application will use in the steps of getting an Authorization Code and getting
+an Access Token.
+
+
+3. Endpoints
+============
+
+3.1 Get an Authorization Code
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Once You have registered you are ready to start integrating docker.io accounts
+into your application! The process is usually started by a user following a
+link in your application to an OAuth Authorization endpoint.
+
+.. http:get:: /api/v1.1/o/authorize/
+
+    Request that a docker.io user authorize your application. If the user is
+    not already logged in, they will be prompted to login. The user is then
+    presented with a form to authorize your application for the requested
+    access scope. On submission, the user will be redirected to the specified
+    ``redirect_uri`` with an Authorization Code.
+
+    :query client_id: The ``client_id`` given to your application at
+        registration.
+    :query response_type: MUST be set to ``code``. This specifies that you
+        would like an Authorization Code returned.
+    :query redirect_uri: The URI to redirect back to after the user has
+        authorized your application. If omitted, the first of your registered
+        ``response_uris`` is used. If included, it must be one of the URIs
+        which were submitted when registering your application.
+    :query scope: The extent of access permissions you are requesting.
+        Currently, the scope options are ``profile_read``, ``profile_write``,
+        ``email_read``, and ``email_write``. Scopes must be separated by a
+        space. If omitted, the default scopes ``profile_read email_read`` are
+        used.
+    :query state: (Recommended) Used by your application to maintain state
+        between the authorization request and callback to protect against CSRF
+        attacks.
+
+    **Example Request**
+
+    Asking the user for authorization.
+
+    .. sourcecode:: http
+
+        GET /api/v1.1/o/authorize/?client_id=TestClientID&response_type=code&redirect_uri=http%3A//my.app/auth_complete/&scope=profile_read%20email_read&state=abc123 HTTP/1.1
+        Host: www.docker.io
+
+    **Authorization Page**
+
+    When the user follows a link, making the above GET request, they will be
+    asked to login to their docker.io account if they are not already and then
+    be presented with the following authorization prompt which asks the user
+    to authorize your application with a description of the requested scopes.
+
+    .. image:: _static/io_oauth_authorization_page.jpg
+
+    Once the user allows or denies your Authorization Request the user will be
+    redirected back to your application. Included in that request will be the
+    following query parameters:
+
+    ``code``
+      The Authorization code generated by the docker.io authorization server.
+      Present it again to request an Access Token. This code expires in 60
+      seconds.
+
+    ``state``
+      If the ``state`` parameter was present in the authorization request this
+      will be the exact value received from that request.
+
+    ``error``
+      An error message in the event of the user denying the authorization or
+      some other kind of error with the request.
+
+
+3.2 Get an Access Token
+^^^^^^^^^^^^^^^^^^^^^^^
+
+Once the user has authorized your application, a request will be made to your
+application's specified ``redirect_uri`` which includes a ``code`` parameter
+that you must then use to get an Access Token.
+
+.. http:post:: /api/v1.1/o/token/
+
+    Submit your newly granted Authorization Code and your application's
+    credentials to receive an Access Token and Refresh Token. The code is valid
+    for 60 seconds and cannot be used more than once.
+
+    :reqheader Authorization: HTTP basic authentication using your
+        application's ``client_id`` and ``client_secret``
+
+    :form grant_type: MUST be set to ``authorization_code``
+    :form code: The authorization code received from the user's redirect
+        request.
+    :form redirect_uri: The same ``redirect_uri`` used in the authentication
+        request.
+
+    **Example Request**
+
+    Using an authorization code to get an access token.
+
+    .. sourcecode:: http
+
+        POST /api/v1.1/o/token/ HTTP/1.1
+        Host: www.docker.io
+        Authorization: Basic VGVzdENsaWVudElEOlRlc3RDbGllbnRTZWNyZXQ=
+        Accept: application/json
+        Content-Type: application/json
+
+        {
+            "grant_type": "code",
+            "code": "YXV0aG9yaXphdGlvbl9jb2Rl",
+            "redirect_uri": "http://my.app/auth_complete/"
+        }
+
+    **Example Response**
+
+    .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Content-Type: application/json;charset=UTF-8
+
+        {
+            "username": "janedoe",
+            "user_id": 42,
+            "access_token": "t6k2BqgRw59hphQBsbBoPPWLqu6FmS",
+            "expires_in": 15552000,
+            "token_type": "Bearer",
+            "scope": "profile_read email_read",
+            "refresh_token": "hJDhLH3cfsUrQlT4MxA6s8xAFEqdgc"
+        }
+
+    In the case of an error, there will be a non-200 HTTP Status and and data
+    detailing the error.
+
+
+3.3 Refresh a Token
+^^^^^^^^^^^^^^^^^^^
+
+Once the Access Token expires you can use your ``refresh_token`` to have
+docker.io issue your application a new Access Token, if the user has not
+revoked access from your application.
+
+.. http:post:: /api/v1.1/o/token/
+
+    Submit your ``refresh_token`` and application's credentials to receive a
+    new Access Token and Refresh Token. The ``refresh_token`` can be used
+    only once.
+
+    :reqheader Authorization: HTTP basic authentication using your
+        application's ``client_id`` and ``client_secret``
+
+    :form grant_type: MUST be set to ``refresh_token``
+    :form refresh_token: The ``refresh_token`` which was issued to your
+        application.
+    :form scope: (optional) The scope of the access token to be returned.
+        Must not include any scope not originally granted by the user and if
+        omitted is treated as equal to the scope originally granted.
+
+    **Example Response**
+
+    .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Content-Type: application/json;charset=UTF-8
+
+        {
+            "username": "janedoe",
+            "user_id": 42,
+            "access_token": "t6k2BqgRw59hphQBsbBoPPWLqu6FmS",
+            "expires_in": 15552000,
+            "token_type": "Bearer",
+            "scope": "profile_read email_read",
+            "refresh_token": "hJDhLH3cfsUrQlT4MxA6s8xAFEqdgc"
+        }
+
+    In the case of an error, there will be a non-200 HTTP Status and and data
+    detailing the error.
+
+
+4. Use an Access Token with the API
+===================================
+
+Many of the docker.io API requests will require a Authorization request header
+field. Simply ensure you add this header with "Bearer <``access_token``>":
+
+.. sourcecode:: http
+
+    GET /api/v1.1/resource HTTP/1.1
+    Host: docker.io
+    Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA
diff --git a/components/engine/docs/sources/reference/api/index.rst b/components/engine/docs/sources/reference/api/index.rst
index 017369143c..3c84a505c6 100644
--- a/components/engine/docs/sources/reference/api/index.rst
+++ b/components/engine/docs/sources/reference/api/index.rst
@@ -15,4 +15,6 @@ Your programs and scripts can access Docker's functionality via these interfaces
   index_api
   docker_remote_api
   remote_api_client_libraries
+  docker_io_oauth_api
+  docker_io_accounts_api
 

From 3e4914e9afaab3448aa7dd63c4d94b9961cd312e Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 13:52:56 -0800
Subject: [PATCH 255/403] Honor user passed on container in nsinit
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 1c79b747bb10a389249aba90ad217ca0128afb74 Component: engine

---
 .../engine/pkg/libcontainer/nsinit/init.go    | 34 ++++++++++++++-----
 components/engine/pkg/system/calls_linux.go   |  8 +++++
 2 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index cdedc14769..23303cd704 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -8,6 +8,7 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
+	"github.com/dotcloud/docker/pkg/user"
 	"log"
 	"os"
 	"os/exec"
@@ -110,15 +111,30 @@ func resolveRootfs(uncleanRootfs string) (string, error) {
 }
 
 func setupUser(container *libcontainer.Container) error {
-	// TODO: honor user passed on container
-	if err := system.Setgroups(nil); err != nil {
-		return err
-	}
-	if err := system.Setresgid(0, 0, 0); err != nil {
-		return err
-	}
-	if err := system.Setresuid(0, 0, 0); err != nil {
-		return err
+	if container.User != "" {
+		uid, gid, suppGids, err := user.GetUserGroupSupplementary(container.User, syscall.Getuid(), syscall.Getgid())
+		if err != nil {
+			return err
+		}
+		if err := system.Setgroups(suppGids); err != nil {
+			return err
+		}
+		if err := system.Setgid(gid); err != nil {
+			return err
+		}
+		if err := system.Setuid(uid); err != nil {
+			return err
+		}
+	} else {
+		if err := system.Setgroups(nil); err != nil {
+			return err
+		}
+		if err := system.Setresgid(0, 0, 0); err != nil {
+			return err
+		}
+		if err := system.Setresuid(0, 0, 0); err != nil {
+			return err
+		}
 	}
 	return nil
 }
diff --git a/components/engine/pkg/system/calls_linux.go b/components/engine/pkg/system/calls_linux.go
index 42afa349c2..0bf42e3c71 100644
--- a/components/engine/pkg/system/calls_linux.go
+++ b/components/engine/pkg/system/calls_linux.go
@@ -71,6 +71,14 @@ func Setresuid(ruid, euid, suid int) error {
 	return syscall.Setresuid(ruid, euid, suid)
 }
 
+func Setgid(gid int) error {
+	return syscall.Setgid(gid)
+}
+
+func Setuid(uid int) error {
+	return syscall.Setuid(uid)
+}
+
 func Sethostname(name string) error {
 	return syscall.Sethostname([]byte(name))
 }

From 5e82277ab62857cd54473179d0c9c6a6639c1277 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Mon, 24 Feb 2014 21:59:01 +0000
Subject: [PATCH 256/403] add --line-buffered

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 24ff3a3dc30e455674d28f552a0efb6108a411db
Component: engine
---
 components/engine/hack/make/test-integration | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/hack/make/test-integration b/components/engine/hack/make/test-integration
index fa8b8be719..a60efebfc3 100644
--- a/components/engine/hack/make/test-integration
+++ b/components/engine/hack/make/test-integration
@@ -12,5 +12,5 @@ bundle_test_integration() {
 # this "grep" hides some really irritating warnings that "go test -coverpkg"
 # spews when it is given packages that aren't used
 bundle_test_integration 2>&1 \
-	| grep -v '^warning: no packages being tested depend on ' \
+	| grep --line-buffered -v '^warning: no packages being tested depend on ' \
 	| tee $DEST/test.log

From 4c203f5a856076c5e63db568aba1c6ae9674a63b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 14:11:09 -0800
Subject: [PATCH 257/403] Add info for driver Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: cfd188e9251f5047e4fd677fe8f2921ae28b8bcc Component: engine

---
 .../engine/execdriver/namespaces/driver.go    | 25 ++++++++++++++++---
 .../engine/integration/container_test.go      |  2 +-
 components/engine/runtime.go                  |  2 +-
 3 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index 9f153bd3eb..7dbea4c5c8 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -55,10 +55,26 @@ func init() {
 }
 
 type driver struct {
+	root string
 }
 
-func NewDriver() (*driver, error) {
-	return &driver{}, nil
+type info struct {
+	ID     string
+	driver *driver
+}
+
+func (i *info) IsRunning() bool {
+	p := filepath.Join(i.driver.root, "containers", i.ID, "rootfs", ".nspid")
+	if _, err := os.Stat(p); err == nil {
+		return true
+	}
+	return false
+}
+
+func NewDriver(root string) (*driver, error) {
+	return &driver{
+		root: root,
+	}, nil
 }
 
 func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
@@ -98,7 +114,10 @@ func (d *driver) Restore(c *execdriver.Command) error {
 }
 
 func (d *driver) Info(id string) execdriver.Info {
-	return nil
+	return &info{
+		ID:     id,
+		driver: d,
+	}
 }
 
 func (d *driver) Name() string {
diff --git a/components/engine/integration/container_test.go b/components/engine/integration/container_test.go
index b961e1d147..ea0283260a 100644
--- a/components/engine/integration/container_test.go
+++ b/components/engine/integration/container_test.go
@@ -1044,7 +1044,7 @@ func TestEnv(t *testing.T) {
 	goodEnv := []string{
 		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
 		"HOME=/",
-		"container=lxc",
+		"container=docker",
 		"HOSTNAME=" + utils.TruncateID(container.ID),
 		"FALSE=true",
 		"TRUE=false",
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 9f16d6213b..739cc7ee56 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -704,7 +704,7 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 
 	sysInfo := sysinfo.New(false)
 
-	ed, err := namespaces.NewDriver()
+	ed, err := namespaces.NewDriver(config.Root)
 	if err != nil {
 		return nil, err
 	}

From 57d4919fc6852eac1be8ae7cf55727e5367e6f83 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 14:35:27 -0800
Subject: [PATCH 258/403] Fix kill signals and rootfs path for pid
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 a6e5e1851197ccc262c61190d5904dd410293466 Component: engine

---
 components/engine/execdriver/namespaces/driver.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index 7dbea4c5c8..6cb2e5b522 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -64,7 +64,7 @@ type info struct {
 }
 
 func (i *info) IsRunning() bool {
-	p := filepath.Join(i.driver.root, "containers", i.ID, "rootfs", ".nspid")
+	p := filepath.Join(i.driver.root, "containers", i.ID, "root", ".nspid")
 	if _, err := os.Stat(p); err == nil {
 		return true
 	}
@@ -106,7 +106,7 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 }
 
 func (d *driver) Kill(p *execdriver.Command, sig int) error {
-	return p.Process.Kill()
+	return syscall.Kill(p.Process.Pid, syscall.Signal(sig))
 }
 
 func (d *driver) Restore(c *execdriver.Command) error {

From 66f47449815b51d1bb1dd03fcb9527a62da30eac Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Wed, 19 Feb 2014 00:24:32 +0000
Subject: [PATCH 259/403] enable docker run -it

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 3839e3a0f63c8acc4cb11a87b862f159e5b2aedc
Component: engine
---
 .../engine/pkg/mflag/example/example.go       |  1 +
 components/engine/pkg/mflag/flag.go           | 48 ++++++++++++++-----
 2 files changed, 37 insertions(+), 12 deletions(-)

diff --git a/components/engine/pkg/mflag/example/example.go b/components/engine/pkg/mflag/example/example.go
index fa26c97e1b..b0d25fbfc6 100644
--- a/components/engine/pkg/mflag/example/example.go
+++ b/components/engine/pkg/mflag/example/example.go
@@ -27,4 +27,5 @@ func main() {
 	fmt.Printf("b: %b\n", b)
 	fmt.Printf("-bool: %b\n", b2)
 	fmt.Printf("s/#hidden/-string(via lookup): %s\n", flag.Lookup("s").Value.String())
+	fmt.Printf("ARGS: %v\n", flag.Args())
 }
diff --git a/components/engine/pkg/mflag/flag.go b/components/engine/pkg/mflag/flag.go
index f721e04557..7a0e8bfb79 100644
--- a/components/engine/pkg/mflag/flag.go
+++ b/components/engine/pkg/mflag/flag.go
@@ -77,6 +77,9 @@ import (
 // ErrHelp is the error returned if the flag -help is invoked but no such flag is defined.
 var ErrHelp = errors.New("flag: help requested")
 
+// ErrRetry is the error returned if you need to try letter by letter
+var ErrRetry = errors.New("flag: retry")
+
 // -- bool Value
 type boolValue bool
 
@@ -733,21 +736,21 @@ func (f *FlagSet) usage() {
 }
 
 // parseOne parses one flag. It reports whether a flag was seen.
-func (f *FlagSet) parseOne() (bool, error) {
+func (f *FlagSet) parseOne() (bool, string, error) {
 	if len(f.args) == 0 {
-		return false, nil
+		return false, "", nil
 	}
 	s := f.args[0]
 	if len(s) == 0 || s[0] != '-' || len(s) == 1 {
-		return false, nil
+		return false, "", nil
 	}
 	if s[1] == '-' && len(s) == 2 { // "--" terminates the flags
 		f.args = f.args[1:]
-		return false, nil
+		return false, "", nil
 	}
 	name := s[1:]
 	if len(name) == 0 || name[0] == '=' {
-		return false, f.failf("bad flag syntax: %s", s)
+		return false, "", f.failf("bad flag syntax: %s", s)
 	}
 
 	// it's a flag. does it have an argument?
@@ -767,14 +770,14 @@ func (f *FlagSet) parseOne() (bool, error) {
 	if !alreadythere {
 		if name == "-help" || name == "help" || name == "h" { // special case for nice help message.
 			f.usage()
-			return false, ErrHelp
+			return false, "", ErrHelp
 		}
-		return false, f.failf("flag provided but not defined: -%s", name)
+		return false, name, ErrRetry
 	}
 	if fv, ok := flag.Value.(boolFlag); ok && fv.IsBoolFlag() { // special case: doesn't need an arg
 		if has_value {
 			if err := fv.Set(value); err != nil {
-				return false, f.failf("invalid boolean value %q for  -%s: %v", value, name, err)
+				return false, "", f.failf("invalid boolean value %q for  -%s: %v", value, name, err)
 			}
 		} else {
 			fv.Set("true")
@@ -787,17 +790,17 @@ func (f *FlagSet) parseOne() (bool, error) {
 			value, f.args = f.args[0], f.args[1:]
 		}
 		if !has_value {
-			return false, f.failf("flag needs an argument: -%s", name)
+			return false, "", f.failf("flag needs an argument: -%s", name)
 		}
 		if err := flag.Value.Set(value); err != nil {
-			return false, f.failf("invalid value %q for flag -%s: %v", value, name, err)
+			return false, "", f.failf("invalid value %q for flag -%s: %v", value, name, err)
 		}
 	}
 	if f.actual == nil {
 		f.actual = make(map[string]*Flag)
 	}
 	f.actual[name] = flag
-	return true, nil
+	return true, "", nil
 }
 
 // Parse parses flag definitions from the argument list, which should not
@@ -808,13 +811,34 @@ func (f *FlagSet) Parse(arguments []string) error {
 	f.parsed = true
 	f.args = arguments
 	for {
-		seen, err := f.parseOne()
+		seen, name, err := f.parseOne()
 		if seen {
 			continue
 		}
 		if err == nil {
 			break
 		}
+		if err == ErrRetry {
+			if len(name) > 1 {
+				err = nil
+				for _, letter := range strings.Split(name, "") {
+					f.args = append([]string{"-" + letter}, f.args...)
+					seen2, _, err2 := f.parseOne()
+					if seen2 {
+						continue
+					}
+					if err2 != nil {
+						err = f.failf("flag provided but not defined: -%s", name)
+						break
+					}
+				}
+				if err == nil {
+					continue
+				}
+			} else {
+				err = f.failf("flag provided but not defined: -%s", name)
+			}
+		}
 		switch f.errorHandling {
 		case ContinueOnError:
 			return err

From f820af71102fd5a2f5571a0e9683322e82e35fe9 Mon Sep 17 00:00:00 2001
From: Tim Ruffles <oi@truffles.me.uk>
Date: Mon, 24 Feb 2014 23:07:40 +0000
Subject: [PATCH 260/403] help contributors be more productive

certainly saved me time after I found this in hack/make.sh :)

Docker-DCO-1.1-Signed-off-by: Tim Ruffles <oi@truffles.me.uk> (github: github_handle)
Upstream-commit: 9c4799b7e7627b21f2748458e46d697c3ee4981e
Component: engine
---
 components/engine/docs/sources/contributing/devenvironment.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/components/engine/docs/sources/contributing/devenvironment.rst b/components/engine/docs/sources/contributing/devenvironment.rst
index f0a1398d70..42e6f9be84 100644
--- a/components/engine/docs/sources/contributing/devenvironment.rst
+++ b/components/engine/docs/sources/contributing/devenvironment.rst
@@ -122,7 +122,10 @@ If the test are successful then the tail of the output should look something lik
 	PASS
 	ok  	github.com/dotcloud/docker/utils	0.017s
 
+If $TESTFLAGS is set in the environment, it is passed as extra arguments to 'go test'.
+You can use this to select certain tests to run, eg.
 
+    TESTFLAGS='-run ^TestBuild$' make test
 
 
 Step 6: Use Docker

From 1ab53bd0dfef2102e2e21035fbbf4e7a74aa6026 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Mon, 24 Feb 2014 23:10:45 +0000
Subject: [PATCH 261/403] fix gofmt

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 4434b63ff44c6994366afebeceb9b570bb9ee26c
Component: engine
---
 components/engine/api/common.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/components/engine/api/common.go b/components/engine/api/common.go
index 59e7d3d525..c79b16fda2 100644
--- a/components/engine/api/common.go
+++ b/components/engine/api/common.go
@@ -42,4 +42,3 @@ func MatchesContentType(contentType, expectedType string) bool {
 	}
 	return err == nil && mimetype == expectedType
 }
-

From aef5af9f3c933a96de3ae3f7af44183dc9e37cd4 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 15:47:23 -0800
Subject: [PATCH 262/403] Cgroups allow devices for privileged containers
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 a76407ac61dd57429a1350f840c323f45a97b27f Component: engine

---
 .../engine/execdriver/namespaces/driver.go    | 38 ++++++++++++++++++-
 .../engine/integration/container_test.go      |  4 +-
 .../engine/pkg/libcontainer/nsinit/init.go    |  9 +----
 3 files changed, 40 insertions(+), 11 deletions(-)

diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index 6cb2e5b522..cd5bb9f35e 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/execdriver/lxc"
+	"github.com/dotcloud/docker/pkg/cgroups"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
 	"io"
@@ -13,6 +14,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"syscall"
 )
@@ -125,7 +127,40 @@ func (d *driver) Name() string {
 }
 
 func (d *driver) GetPidsForContainer(id string) ([]int, error) {
-	return nil, ErrNotSupported
+	pids := []int{}
+
+	subsystem := "cpu"
+	cgroupRoot, err := cgroups.FindCgroupMountpoint(subsystem)
+	if err != nil {
+		return pids, err
+	}
+	cgroupRoot = filepath.Dir(cgroupRoot)
+
+	cgroupDir, err := cgroups.GetThisCgroupDir(subsystem)
+	if err != nil {
+		return pids, err
+	}
+
+	filename := filepath.Join(cgroupRoot, cgroupDir, id, "tasks")
+	if _, err := os.Stat(filename); os.IsNotExist(err) {
+		filename = filepath.Join(cgroupRoot, cgroupDir, "docker", id, "tasks")
+	}
+
+	output, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return pids, err
+	}
+	for _, p := range strings.Split(string(output), "\n") {
+		if len(p) == 0 {
+			continue
+		}
+		pid, err := strconv.Atoi(p)
+		if err != nil {
+			return pids, fmt.Errorf("Invalid pid '%s': %s", p, err)
+		}
+		pids = append(pids, pid)
+	}
+	return pids, nil
 }
 
 func writeContainerFile(container *libcontainer.Container, rootfs string) error {
@@ -219,6 +254,7 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 	}
 	if c.Privileged {
 		container.Capabilities = nil
+		container.Cgroups.DeviceAccess = true
 	}
 	if c.Resources != nil {
 		container.Cgroups.CpuShares = c.Resources.CpuShares
diff --git a/components/engine/integration/container_test.go b/components/engine/integration/container_test.go
index ea0283260a..8e4314f456 100644
--- a/components/engine/integration/container_test.go
+++ b/components/engine/integration/container_test.go
@@ -1581,8 +1581,8 @@ func TestPrivilegedCanMknod(t *testing.T) {
 	eng := NewTestEngine(t)
 	runtime := mkRuntimeFromEngine(eng, t)
 	defer runtime.Nuke()
-	if output, _ := runContainer(eng, runtime, []string{"-privileged", "_", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok"}, t); output != "ok\n" {
-		t.Fatal("Could not mknod into privileged container")
+	if output, err := runContainer(eng, runtime, []string{"-privileged", "_", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok"}, t); output != "ok\n" {
+		t.Fatalf("Could not mknod into privileged container %s %v", output, err)
 	}
 }
 
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 23303cd704..d6d7dc3347 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -9,7 +9,6 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
 	"github.com/dotcloud/docker/pkg/user"
-	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -23,7 +22,6 @@ func Init(container *libcontainer.Container, uncleanRootfs, console string, sync
 	if err != nil {
 		return err
 	}
-	log.Printf("initializing namespace at %s", rootfs)
 
 	// We always read this as it is a way to sync with the parent as well
 	context, err := syncPipe.ReadFromParent()
@@ -32,10 +30,8 @@ func Init(container *libcontainer.Container, uncleanRootfs, console string, sync
 		return err
 	}
 	syncPipe.Close()
-	log.Printf("received context from parent %v", context)
 
 	if console != "" {
-		log.Printf("setting up console for %s", console)
 		// close pipes so that we can replace it with the pty
 		closeStdPipes()
 		slave, err := openTerminal(console, syscall.O_RDWR)
@@ -66,11 +62,9 @@ func Init(container *libcontainer.Container, uncleanRootfs, console string, sync
 	if err := system.Sethostname(container.Hostname); err != nil {
 		return fmt.Errorf("sethostname %s", err)
 	}
-	log.Printf("dropping capabilities")
 	if err := capabilities.DropCapabilities(container); err != nil {
 		return fmt.Errorf("drop capabilities %s", err)
 	}
-	log.Printf("setting user in namespace")
 	if err := setupUser(container); err != nil {
 		return fmt.Errorf("setup user %s", err)
 	}
@@ -87,7 +81,6 @@ func execArgs(args []string, env []string) error {
 	if err != nil {
 		return err
 	}
-	log.Printf("execing %s goodbye", name)
 	if err := system.Exec(name, args[0:], env); err != nil {
 		return fmt.Errorf("exec %s", err)
 	}
@@ -111,7 +104,7 @@ func resolveRootfs(uncleanRootfs string) (string, error) {
 }
 
 func setupUser(container *libcontainer.Container) error {
-	if container.User != "" {
+	if container.User != "" && container.User != "root" {
 		uid, gid, suppGids, err := user.GetUserGroupSupplementary(container.User, syscall.Getuid(), syscall.Getgid())
 		if err != nil {
 			return err

From 471c8027dac889518c5fdfa397ee05a309ae85c4 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 16:26:06 -0800
Subject: [PATCH 263/403] Fix get pids for nsinit Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: 9bf6cb2692a9b14cac559b4b9c9403e7f6f13ecd Component: engine

---
 components/engine/execdriver/namespaces/default_template.go | 2 +-
 components/engine/execdriver/namespaces/driver.go           | 5 ++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/components/engine/execdriver/namespaces/default_template.go b/components/engine/execdriver/namespaces/default_template.go
index 79b6ac1c11..f84544adc9 100644
--- a/components/engine/execdriver/namespaces/default_template.go
+++ b/components/engine/execdriver/namespaces/default_template.go
@@ -34,7 +34,7 @@ func getDefaultTemplate() *libcontainer.Container {
 			libcontainer.CLONE_NEWUTS,
 		},
 		Cgroups: &cgroups.Cgroup{
-			Name:         "docker",
+			Parent:       "docker",
 			DeviceAccess: false,
 		},
 	}
diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index cd5bb9f35e..8143b39d90 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -129,13 +129,11 @@ func (d *driver) Name() string {
 func (d *driver) GetPidsForContainer(id string) ([]int, error) {
 	pids := []int{}
 
-	subsystem := "cpu"
+	subsystem := "devices"
 	cgroupRoot, err := cgroups.FindCgroupMountpoint(subsystem)
 	if err != nil {
 		return pids, err
 	}
-	cgroupRoot = filepath.Dir(cgroupRoot)
-
 	cgroupDir, err := cgroups.GetThisCgroupDir(subsystem)
 	if err != nil {
 		return pids, err
@@ -252,6 +250,7 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 			},
 		}
 	}
+	container.Cgroups.Name = c.ID
 	if c.Privileged {
 		container.Capabilities = nil
 		container.Cgroups.DeviceAccess = true

From b697db52c8336430584ff7744bf2d6c89af343dc Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 16:35:11 -0800
Subject: [PATCH 264/403] Fix restore container by nspid
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 9f03fd76b578f2d9d00b0a1bd76b776e20a7d681 Component: engine

---
 .../engine/execdriver/namespaces/driver.go    | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/namespaces/driver.go
index 8143b39d90..d948594059 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/namespaces/driver.go
@@ -112,7 +112,24 @@ func (d *driver) Kill(p *execdriver.Command, sig int) error {
 }
 
 func (d *driver) Restore(c *execdriver.Command) error {
-	return ErrNotSupported
+	var (
+		nspid int
+		p     = filepath.Join(d.root, "containers", c.ID, "root", ".nspid")
+	)
+	f, err := os.Open(p)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if _, err := fmt.Fscanf(f, "%d", &nspid); err != nil {
+		return err
+	}
+	proc, err := os.FindProcess(nspid)
+	if err != nil {
+		return err
+	}
+	_, err = proc.Wait()
+	return err
 }
 
 func (d *driver) Info(id string) execdriver.Info {

From f6bf4c8510385f3c75d10714ffb8e47edfe67510 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 16:42:30 -0800
Subject: [PATCH 265/403] Rename namespace driver to docker
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 77f68f74c7e6fc977fb2681c7ee60ac652be983e Component: engine

---
 .../execdriver/{namespaces => docker}/default_template.go     | 2 +-
 components/engine/execdriver/{namespaces => docker}/driver.go | 2 +-
 components/engine/execdriver/{namespaces => docker}/term.go   | 2 +-
 components/engine/runtime.go                                  | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)
 rename components/engine/execdriver/{namespaces => docker}/default_template.go (98%)
 rename components/engine/execdriver/{namespaces => docker}/driver.go (99%)
 rename components/engine/execdriver/{namespaces => docker}/term.go (96%)

diff --git a/components/engine/execdriver/namespaces/default_template.go b/components/engine/execdriver/docker/default_template.go
similarity index 98%
rename from components/engine/execdriver/namespaces/default_template.go
rename to components/engine/execdriver/docker/default_template.go
index f84544adc9..4d6dd954c0 100644
--- a/components/engine/execdriver/namespaces/default_template.go
+++ b/components/engine/execdriver/docker/default_template.go
@@ -1,4 +1,4 @@
-package namespaces
+package docker
 
 import (
 	"github.com/dotcloud/docker/pkg/cgroups"
diff --git a/components/engine/execdriver/namespaces/driver.go b/components/engine/execdriver/docker/driver.go
similarity index 99%
rename from components/engine/execdriver/namespaces/driver.go
rename to components/engine/execdriver/docker/driver.go
index d948594059..2cd03dd16c 100644
--- a/components/engine/execdriver/namespaces/driver.go
+++ b/components/engine/execdriver/docker/driver.go
@@ -1,4 +1,4 @@
-package namespaces
+package docker
 
 import (
 	"encoding/json"
diff --git a/components/engine/execdriver/namespaces/term.go b/components/engine/execdriver/docker/term.go
similarity index 96%
rename from components/engine/execdriver/namespaces/term.go
rename to components/engine/execdriver/docker/term.go
index 682c6a27b1..6705fc49e4 100644
--- a/components/engine/execdriver/namespaces/term.go
+++ b/components/engine/execdriver/docker/term.go
@@ -1,4 +1,4 @@
-package namespaces
+package docker
 
 import (
 	"github.com/dotcloud/docker/execdriver"
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 739cc7ee56..1924687451 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -7,8 +7,8 @@ import (
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/execdriver"
+	"github.com/dotcloud/docker/execdriver/docker"
 	_ "github.com/dotcloud/docker/execdriver/lxc"
-	"github.com/dotcloud/docker/execdriver/namespaces"
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/graphdriver/aufs"
 	_ "github.com/dotcloud/docker/graphdriver/btrfs"
@@ -704,7 +704,7 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 
 	sysInfo := sysinfo.New(false)
 
-	ed, err := namespaces.NewDriver(config.Root)
+	ed, err := docker.NewDriver(config.Root)
 	if err != nil {
 		return nil, err
 	}

From 79f89aac0afb030bbd50372d00473b0dcd1a3209 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Mon, 24 Feb 2014 17:02:46 -0800
Subject: [PATCH 266/403] Use the dockerenv file from the current dir instead
 of root

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: e84e344b1f887f06852953bc75912fc24a64d08a
Component: engine
---
 components/engine/sysinit/sysinit.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/sysinit/sysinit.go b/components/engine/sysinit/sysinit.go
index 6d604fcccc..67962e30c6 100644
--- a/components/engine/sysinit/sysinit.go
+++ b/components/engine/sysinit/sysinit.go
@@ -66,7 +66,7 @@ func SysInit() {
 
 	// Get env
 	var env []string
-	content, err := ioutil.ReadFile("/.dockerenv")
+	content, err := ioutil.ReadFile(".dockerenv")
 	if err != nil {
 		log.Fatalf("Unable to load environment variables: %v", err)
 	}

From 3dcdf3e0d6cc582909b3efa24eaca2da5cb95700 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 18:38:24 -0800
Subject: [PATCH 267/403] Improve logging for nsinit
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 9cb4573d33607bc32e7db19981b3e9d5eaf449a0 Component: engine

---
 components/engine/execdriver/docker/driver.go |  8 +++-
 .../engine/pkg/libcontainer/network/veth.go   |  4 --
 .../engine/pkg/libcontainer/nsinit/exec.go    | 43 +++++++++----------
 .../engine/pkg/libcontainer/nsinit/execin.go  |  2 +-
 .../engine/pkg/libcontainer/nsinit/init.go    |  2 +-
 .../engine/pkg/libcontainer/nsinit/nsinit.go  | 29 +++++++++++++
 .../pkg/libcontainer/nsinit/nsinit/main.go    | 36 +++++++++-------
 7 files changed, 78 insertions(+), 46 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/nsinit/nsinit.go

diff --git a/components/engine/execdriver/docker/driver.go b/components/engine/execdriver/docker/driver.go
index 2cd03dd16c..7b6d3474af 100644
--- a/components/engine/execdriver/docker/driver.go
+++ b/components/engine/execdriver/docker/driver.go
@@ -11,6 +11,7 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
 	"io"
 	"io/ioutil"
+	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -26,6 +27,7 @@ const (
 
 var (
 	ErrNotSupported = errors.New("not supported")
+	noOpLog         = log.New(ioutil.Discard, "[nsinit] ", log.LstdFlags)
 )
 
 func init() {
@@ -49,7 +51,8 @@ func init() {
 		if err != nil {
 			return err
 		}
-		if err := nsinit.Init(container, cwd, args.Console, syncPipe, args.Args); err != nil {
+		ns := nsinit.NewNsInit(noOpLog, "", &nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{})
+		if err := ns.Init(container, cwd, args.Console, syncPipe, args.Args); err != nil {
 			return err
 		}
 		return nil
@@ -90,6 +93,7 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 			dsw:      &nsinit.DefaultStateWriter{c.Rootfs},
 		}
 	)
+	ns := nsinit.NewNsInit(noOpLog, "", factory, stateWriter)
 	if c.Tty {
 		term = &dockerTtyTerm{
 			pipes: pipes,
@@ -104,7 +108,7 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 		return -1, err
 	}
 	args := append([]string{c.Entrypoint}, c.Arguments...)
-	return nsinit.Exec(container, factory, stateWriter, term, "", args)
+	return ns.Exec(container, term, args)
 }
 
 func (d *driver) Kill(p *execdriver.Command, sig int) error {
diff --git a/components/engine/pkg/libcontainer/network/veth.go b/components/engine/pkg/libcontainer/network/veth.go
index 61fec5500c..321c68eca4 100644
--- a/components/engine/pkg/libcontainer/network/veth.go
+++ b/components/engine/pkg/libcontainer/network/veth.go
@@ -4,14 +4,12 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/utils"
-	"log"
 )
 
 type Veth struct {
 }
 
 func (v *Veth) Create(n *libcontainer.Network, nspid int) (libcontainer.Context, error) {
-	log.Printf("creating veth network")
 	var (
 		bridge string
 		prefix string
@@ -31,7 +29,6 @@ func (v *Veth) Create(n *libcontainer.Network, nspid int) (libcontainer.Context,
 		"vethHost":  name1,
 		"vethChild": name2,
 	}
-	log.Printf("veth pair created %s <> %s", name1, name2)
 	if err := SetInterfaceMaster(name1, bridge); err != nil {
 		return context, err
 	}
@@ -41,7 +38,6 @@ func (v *Veth) Create(n *libcontainer.Network, nspid int) (libcontainer.Context,
 	if err := InterfaceUp(name1); err != nil {
 		return context, err
 	}
-	log.Printf("setting %s inside %d namespace", name2, nspid)
 	if err := SetInterfaceInNamespacePid(name2, nspid); err != nil {
 		return context, err
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index ee83f4f107..c4073235ef 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -6,7 +6,6 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/system"
-	"log"
 	"os"
 	"os/exec"
 	"syscall"
@@ -14,9 +13,7 @@ import (
 
 // Exec performes setup outside of a namespace so that a container can be
 // executed.  Exec is a high level function for working with container namespaces.
-func Exec(container *libcontainer.Container,
-	factory CommandFactory, state StateWriter, term Terminal,
-	logFile string, args []string) (int, error) {
+func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args []string) (int, error) {
 	var (
 		master  *os.File
 		console string
@@ -31,7 +28,7 @@ func Exec(container *libcontainer.Container,
 	}
 
 	if container.Tty {
-		log.Printf("setting up master and console")
+		ns.logger.Printf("setting up master and console")
 		master, console, err = CreateMasterAndConsole()
 		if err != nil {
 			return -1, err
@@ -39,54 +36,56 @@ func Exec(container *libcontainer.Container,
 		term.SetMaster(master)
 	}
 
-	command := factory.Create(container, console, logFile, syncPipe.child.Fd(), args)
+	command := ns.commandFactory.Create(container, console, ns.logFile, syncPipe.child.Fd(), args)
 	if err := term.Attach(command); err != nil {
 		return -1, err
 	}
 	defer term.Close()
 
-	log.Printf("staring init")
+	ns.logger.Printf("staring init")
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
-	log.Printf("writing state file")
-	if err := state.WritePid(command.Process.Pid); err != nil {
+	ns.logger.Printf("writing state file")
+	if err := ns.stateWriter.WritePid(command.Process.Pid); err != nil {
 		command.Process.Kill()
 		return -1, err
 	}
 	defer func() {
-		log.Printf("removing state file")
-		state.DeletePid()
+		ns.logger.Printf("removing state file")
+		ns.stateWriter.DeletePid()
 	}()
 
 	// Do this before syncing with child so that no children
 	// can escape the cgroup
-	if err := SetupCgroups(container, command.Process.Pid); err != nil {
+	if err := ns.SetupCgroups(container, command.Process.Pid); err != nil {
 		command.Process.Kill()
 		return -1, err
 	}
-	if err := InitializeNetworking(container, command.Process.Pid, syncPipe); err != nil {
+	if err := ns.InitializeNetworking(container, command.Process.Pid, syncPipe); err != nil {
 		command.Process.Kill()
 		return -1, err
 	}
 
 	// Sync with child
-	log.Printf("closing sync pipes")
+	ns.logger.Printf("closing sync pipes")
 	syncPipe.Close()
 
-	log.Printf("waiting on process")
+	ns.logger.Printf("waiting on process")
 	if err := command.Wait(); err != nil {
 		if _, ok := err.(*exec.ExitError); !ok {
 			return -1, err
 		}
 	}
-	log.Printf("process ended")
-	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
+
+	exitCode := command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus()
+	ns.logger.Printf("process ended with exit code %d", exitCode)
+	return exitCode, nil
 }
 
-func SetupCgroups(container *libcontainer.Container, nspid int) error {
+func (ns *linuxNs) SetupCgroups(container *libcontainer.Container, nspid int) error {
 	if container.Cgroups != nil {
-		log.Printf("setting up cgroups")
+		ns.logger.Printf("setting up cgroups")
 		if err := container.Cgroups.Apply(nspid); err != nil {
 			return err
 		}
@@ -94,9 +93,9 @@ func SetupCgroups(container *libcontainer.Container, nspid int) error {
 	return nil
 }
 
-func InitializeNetworking(container *libcontainer.Container, nspid int, pipe *SyncPipe) error {
+func (ns *linuxNs) InitializeNetworking(container *libcontainer.Container, nspid int, pipe *SyncPipe) error {
 	if container.Network != nil {
-		log.Printf("creating host network configuration type %s", container.Network.Type)
+		ns.logger.Printf("creating host network configuration type %s", container.Network.Type)
 		strategy, err := network.GetStrategy(container.Network.Type)
 		if err != nil {
 			return err
@@ -105,7 +104,7 @@ func InitializeNetworking(container *libcontainer.Container, nspid int, pipe *Sy
 		if err != nil {
 			return err
 		}
-		log.Printf("sending %v as network context", networkContext)
+		ns.logger.Printf("sending %v as network context", networkContext)
 		if err := pipe.SendToChild(networkContext); err != nil {
 			return err
 		}
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index 85a89905c1..9c33f69b4d 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -12,7 +12,7 @@ import (
 )
 
 // ExecIn uses an existing pid and joins the pid's namespaces with the new command.
-func ExecIn(container *libcontainer.Container, nspid int, args []string) (int, error) {
+func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []string) (int, error) {
 	for _, ns := range container.Namespaces {
 		if err := system.Unshare(namespaceMap[ns]); err != nil {
 			return -1, err
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index d6d7dc3347..5e33169b65 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -17,7 +17,7 @@ import (
 
 // Init is the init process that first runs inside a new namespace to setup mounts, users, networking,
 // and other options required for the new container.
-func Init(container *libcontainer.Container, uncleanRootfs, console string, syncPipe *SyncPipe, args []string) error {
+func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, console string, syncPipe *SyncPipe, args []string) error {
 	rootfs, err := resolveRootfs(uncleanRootfs)
 	if err != nil {
 		return err
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit.go b/components/engine/pkg/libcontainer/nsinit/nsinit.go
new file mode 100644
index 0000000000..599461e434
--- /dev/null
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit.go
@@ -0,0 +1,29 @@
+package nsinit
+
+import (
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"log"
+)
+
+type NsInit interface {
+	Exec(container *libcontainer.Container, term Terminal, args []string) (int, error)
+	ExecIn(container *libcontainer.Container, nspid int, args []string) (int, error)
+	Init(container *libcontainer.Container, uncleanRootfs, console string, syncPipe *SyncPipe, args []string) error
+}
+
+type linuxNs struct {
+	root           string
+	logFile        string
+	logger         *log.Logger
+	commandFactory CommandFactory
+	stateWriter    StateWriter
+}
+
+func NewNsInit(logger *log.Logger, logFile string, command CommandFactory, state StateWriter) NsInit {
+	return &linuxNs{
+		logger:         logger,
+		commandFactory: command,
+		stateWriter:    state,
+		logFile:        logFile,
+	}
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index 786c9c1ea6..c25037fa8b 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -42,13 +42,13 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	if err := setupLogging(); err != nil {
+	ns, err := newNsInit()
+	if err != nil {
 		log.Fatal(err)
 	}
+
 	switch flag.Arg(0) {
 	case "exec": // this is executed outside of the namespace in the cwd
-		log.SetPrefix("[nsinit exec] ")
-
 		var exitCode int
 		nspid, err := readPid()
 		if err != nil {
@@ -57,20 +57,16 @@ func main() {
 			}
 		}
 		if nspid > 0 {
-			exitCode, err = nsinit.ExecIn(container, nspid, flag.Args()[1:])
+			exitCode, err = ns.ExecIn(container, nspid, flag.Args()[1:])
 		} else {
 			term := nsinit.NewTerminal(os.Stdin, os.Stdout, os.Stderr, container.Tty)
-			exitCode, err = nsinit.Exec(container,
-				&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{},
-				term,
-				logFile, flag.Args()[1:])
+			exitCode, err = ns.Exec(container, term, flag.Args()[1:])
 		}
 		if err != nil {
 			log.Fatal(err)
 		}
 		os.Exit(exitCode)
 	case "init": // this is executed inside of the namespace to setup the container
-		log.SetPrefix("[nsinit init] ")
 		cwd, err := os.Getwd()
 		if err != nil {
 			log.Fatal(err)
@@ -82,7 +78,7 @@ func main() {
 		if err != nil {
 			log.Fatal(err)
 		}
-		if err := nsinit.Init(container, cwd, console, syncPipe, flag.Args()[1:]); err != nil {
+		if err := ns.Init(container, cwd, console, syncPipe, flag.Args()[1:]); err != nil {
 			log.Fatal(err)
 		}
 	default:
@@ -116,19 +112,27 @@ func readPid() (int, error) {
 	return pid, nil
 }
 
-func setupLogging() (err error) {
+func newNsInit() (nsinit.NsInit, error) {
+	logger, err := setupLogging()
+	if err != nil {
+		return nil, err
+	}
+	return nsinit.NewNsInit(logger, logFile, &nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{}), nil
+}
+
+func setupLogging() (logger *log.Logger, err error) {
 	var writer io.Writer
+
 	switch logFile {
 	case "stderr":
 		writer = os.Stderr
 	case "none", "":
 		writer = ioutil.Discard
 	default:
-		writer, err = os.OpenFile(logFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0755)
-		if err != nil {
-			return err
+		if writer, err = os.OpenFile(logFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0755); err != nil {
+			return
 		}
 	}
-	log.SetOutput(writer)
-	return nil
+	logger = log.New(writer, "", log.LstdFlags)
+	return
 }

From 4d05a259731a90f0bf95d9c3c88bc518d31e699c Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 18:52:48 -0800
Subject: [PATCH 268/403] Remove chroot driver, it's not needed
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 ca537a63a8a21eb4d5d31144c934ca18846bb856 Component: engine

---
 components/engine/execdriver/chroot/driver.go | 101 ------------------
 components/engine/sysinit/sysinit.go          |   1 -
 2 files changed, 102 deletions(-)
 delete mode 100644 components/engine/execdriver/chroot/driver.go

diff --git a/components/engine/execdriver/chroot/driver.go b/components/engine/execdriver/chroot/driver.go
deleted file mode 100644
index dfec680d84..0000000000
--- a/components/engine/execdriver/chroot/driver.go
+++ /dev/null
@@ -1,101 +0,0 @@
-package chroot
-
-import (
-	"fmt"
-	"github.com/dotcloud/docker/execdriver"
-	"github.com/dotcloud/docker/pkg/mount"
-	"os"
-	"os/exec"
-	"syscall"
-)
-
-const (
-	DriverName = "chroot"
-	Version    = "0.1"
-)
-
-func init() {
-	execdriver.RegisterInitFunc(DriverName, func(args *execdriver.InitArgs) error {
-		if err := mount.ForceMount("proc", "proc", "proc", ""); err != nil {
-			return err
-		}
-		defer mount.ForceUnmount("proc")
-		cmd := exec.Command(args.Args[0], args.Args[1:]...)
-
-		cmd.Stderr = os.Stderr
-		cmd.Stdout = os.Stdout
-		cmd.Stdin = os.Stdin
-
-		return cmd.Run()
-	})
-}
-
-type driver struct {
-}
-
-func NewDriver() (*driver, error) {
-	return &driver{}, nil
-}
-
-func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
-	params := []string{
-		"chroot",
-		c.Rootfs,
-		"/.dockerinit",
-		"-driver",
-		DriverName,
-	}
-	params = append(params, c.Entrypoint)
-	params = append(params, c.Arguments...)
-
-	var (
-		name = params[0]
-		arg  = params[1:]
-	)
-	aname, err := exec.LookPath(name)
-	if err != nil {
-		aname = name
-	}
-	c.Path = aname
-	c.Args = append([]string{name}, arg...)
-
-	if err := c.Start(); err != nil {
-		return -1, err
-	}
-
-	if startCallback != nil {
-		startCallback(c)
-	}
-
-	err = c.Wait()
-	return getExitCode(c), err
-}
-
-/// Return the exit code of the process
-// if the process has not exited -1 will be returned
-func getExitCode(c *execdriver.Command) int {
-	if c.ProcessState == nil {
-		return -1
-	}
-	return c.ProcessState.Sys().(syscall.WaitStatus).ExitStatus()
-}
-
-func (d *driver) Kill(p *execdriver.Command, sig int) error {
-	return p.Process.Kill()
-}
-
-func (d *driver) Restore(c *execdriver.Command) error {
-	panic("Not Implemented")
-}
-
-func (d *driver) Info(id string) execdriver.Info {
-	panic("Not implemented")
-}
-
-func (d *driver) Name() string {
-	return fmt.Sprintf("%s-%s", DriverName, Version)
-}
-
-func (d *driver) GetPidsForContainer(id string) ([]int, error) {
-	return nil, fmt.Errorf("Not supported")
-}
diff --git a/components/engine/sysinit/sysinit.go b/components/engine/sysinit/sysinit.go
index 67962e30c6..056f033295 100644
--- a/components/engine/sysinit/sysinit.go
+++ b/components/engine/sysinit/sysinit.go
@@ -5,7 +5,6 @@ import (
 	"flag"
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
-	_ "github.com/dotcloud/docker/execdriver/chroot"
 	_ "github.com/dotcloud/docker/execdriver/lxc"
 	"io"
 	"io/ioutil"

From 530d80759da58775ea9cb9567b2c05502df44248 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 20:41:09 -0800
Subject: [PATCH 269/403] Fix exec driver flag, rename new driver to 'native'
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 d59c05a37c3e964cdeef818afc2e7c3a3e8d0cf1 Component: engine

---
 components/engine/docker/docker.go            |  2 +-
 .../{docker => native}/default_template.go    |  2 +-
 .../execdriver/{docker => native}/driver.go   |  2 +-
 .../execdriver/{docker => native}/term.go     |  2 +-
 components/engine/runtime.go                  | 21 ++++++++++---------
 components/engine/sysinit/sysinit.go          |  1 +
 6 files changed, 16 insertions(+), 14 deletions(-)
 rename components/engine/execdriver/{docker => native}/default_template.go (98%)
 rename components/engine/execdriver/{docker => native}/driver.go (99%)
 rename components/engine/execdriver/{docker => native}/term.go (97%)

diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 17449210c7..a2d83bfa86 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -39,7 +39,7 @@ func main() {
 		flDefaultIp          = flag.String([]string{"#ip", "-ip"}, "0.0.0.0", "Default IP address to use when binding container ports")
 		flInterContainerComm = flag.Bool([]string{"#icc", "-icc"}, true, "Enable inter-container communication")
 		flGraphDriver        = flag.String([]string{"s", "-storage-driver"}, "", "Force the docker runtime to use a specific storage driver")
-		flExecDriver         = flag.String([]string{"e", "-exec-driver"}, "", "Force the docker runtime to use a specific exec driver")
+		flExecDriver         = flag.String([]string{"e", "-exec-driver"}, "native", "Force the docker runtime to use a specific exec driver")
 		flHosts              = opts.NewListOpts(api.ValidateHost)
 		flMtu                = flag.Int([]string{"#mtu", "-mtu"}, 0, "Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if no default route is available")
 	)
diff --git a/components/engine/execdriver/docker/default_template.go b/components/engine/execdriver/native/default_template.go
similarity index 98%
rename from components/engine/execdriver/docker/default_template.go
rename to components/engine/execdriver/native/default_template.go
index 4d6dd954c0..f202fd2529 100644
--- a/components/engine/execdriver/docker/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -1,4 +1,4 @@
-package docker
+package native
 
 import (
 	"github.com/dotcloud/docker/pkg/cgroups"
diff --git a/components/engine/execdriver/docker/driver.go b/components/engine/execdriver/native/driver.go
similarity index 99%
rename from components/engine/execdriver/docker/driver.go
rename to components/engine/execdriver/native/driver.go
index 7b6d3474af..59cbe67402 100644
--- a/components/engine/execdriver/docker/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -1,4 +1,4 @@
-package docker
+package native
 
 import (
 	"encoding/json"
diff --git a/components/engine/execdriver/docker/term.go b/components/engine/execdriver/native/term.go
similarity index 97%
rename from components/engine/execdriver/docker/term.go
rename to components/engine/execdriver/native/term.go
index 6705fc49e4..b32a80e4df 100644
--- a/components/engine/execdriver/docker/term.go
+++ b/components/engine/execdriver/native/term.go
@@ -1,4 +1,4 @@
-package docker
+package native
 
 import (
 	"github.com/dotcloud/docker/execdriver"
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 6dc4476b87..1003c35d5d 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -7,8 +7,8 @@ import (
 	"github.com/dotcloud/docker/dockerversion"
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/execdriver"
-	"github.com/dotcloud/docker/execdriver/docker"
 	"github.com/dotcloud/docker/execdriver/lxc"
+	"github.com/dotcloud/docker/execdriver/native"
 	"github.com/dotcloud/docker/graphdriver"
 	"github.com/dotcloud/docker/graphdriver/aufs"
 	_ "github.com/dotcloud/docker/graphdriver/btrfs"
@@ -702,17 +702,18 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 		sysInitPath = localCopy
 	}
 
-	sysInfo := sysinfo.New(false)
+	var (
+		ed      execdriver.Driver
+		sysInfo = sysinfo.New(false)
+	)
 
-	var ed execdriver.Driver
-	utils.Debugf("execDriver: provided %s", config.ExecDriver)
-	if config.ExecDriver == "chroot" && false {
-		// chroot is presently a noop driver https://github.com/dotcloud/docker/pull/4189#issuecomment-35330655
-		ed, err = chroot.NewDriver()
-		utils.Debugf("execDriver: using chroot")
-	} else {
+	switch config.ExecDriver {
+	case "lxc":
 		ed, err = lxc.NewDriver(config.Root, sysInfo.AppArmor)
-		utils.Debugf("execDriver: using lxc")
+	case "native":
+		ed, err = native.NewDriver(config.Root)
+	default:
+		return nil, fmt.Errorf("unknow exec driver %s", config.ExecDriver)
 	}
 	if err != nil {
 		return nil, err
diff --git a/components/engine/sysinit/sysinit.go b/components/engine/sysinit/sysinit.go
index 056f033295..cd74e0c88e 100644
--- a/components/engine/sysinit/sysinit.go
+++ b/components/engine/sysinit/sysinit.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
 	_ "github.com/dotcloud/docker/execdriver/lxc"
+	_ "github.com/dotcloud/docker/execdriver/native"
 	"io"
 	"io/ioutil"
 	"log"

From 0460b2181fb2dbfa7e47dcb28608269733492a1d Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 21:11:52 -0800
Subject: [PATCH 270/403] Refactor and improve libcontainer and driver

Remove logging for now because it is complicating things
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: f8453cd0499a51f5d3ffd2c2a6012972aef7f69f
Component: engine
---
 components/engine/execdriver/native/driver.go | 27 ++++----
 .../engine/pkg/libcontainer/network/veth.go   |  3 +
 .../engine/pkg/libcontainer/nsinit/command.go |  8 ++-
 .../engine/pkg/libcontainer/nsinit/exec.go    | 35 +---------
 .../engine/pkg/libcontainer/nsinit/execin.go  |  6 +-
 .../engine/pkg/libcontainer/nsinit/init.go    | 64 +++++--------------
 .../engine/pkg/libcontainer/nsinit/nsinit.go  |  9 +--
 .../pkg/libcontainer/nsinit/nsinit/main.go    | 26 +-------
 .../engine/pkg/libcontainer/nsinit/state.go   |  2 +
 .../engine/pkg/libcontainer/utils/utils.go    | 11 ++++
 components/engine/pkg/system/calls_linux.go   |  9 +++
 components/engine/pkg/system/pty_linux.go     | 27 ++++++++
 12 files changed, 96 insertions(+), 131 deletions(-)

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index 59cbe67402..e0ed5685e4 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -11,7 +11,6 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
 	"io"
 	"io/ioutil"
-	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -27,7 +26,6 @@ const (
 
 var (
 	ErrNotSupported = errors.New("not supported")
-	noOpLog         = log.New(ioutil.Discard, "[nsinit] ", log.LstdFlags)
 )
 
 func init() {
@@ -51,7 +49,7 @@ func init() {
 		if err != nil {
 			return err
 		}
-		ns := nsinit.NewNsInit(noOpLog, "", &nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{})
+		ns := nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{})
 		if err := ns.Init(container, cwd, args.Console, syncPipe, args.Args); err != nil {
 			return err
 		}
@@ -93,7 +91,7 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 			dsw:      &nsinit.DefaultStateWriter{c.Rootfs},
 		}
 	)
-	ns := nsinit.NewNsInit(noOpLog, "", factory, stateWriter)
+	ns := nsinit.NewNsInit(factory, stateWriter)
 	if c.Tty {
 		term = &dockerTtyTerm{
 			pipes: pipes,
@@ -147,6 +145,8 @@ func (d *driver) Name() string {
 	return fmt.Sprintf("%s-%s", DriverName, Version)
 }
 
+// TODO: this can be improved with our driver
+// there has to be a better way to do this
 func (d *driver) GetPidsForContainer(id string) ([]int, error) {
 	pids := []int{}
 
@@ -207,27 +207,24 @@ type dockerCommandFactory struct {
 // createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
-func (d *dockerCommandFactory) Create(container *libcontainer.Container,
-	console, logFile string, syncFd uintptr, args []string) *exec.Cmd {
-	c := d.c
+func (d *dockerCommandFactory) Create(container *libcontainer.Container, console string, syncFd uintptr, args []string) *exec.Cmd {
 	// we need to join the rootfs because nsinit will setup the rootfs and chroot
-	initPath := filepath.Join(c.Rootfs, c.InitPath)
+	initPath := filepath.Join(d.c.Rootfs, d.c.InitPath)
 
-	c.Path = initPath
-	c.Args = append([]string{
+	d.c.Path = initPath
+	d.c.Args = append([]string{
 		initPath,
 		"-driver", DriverName,
 		"-console", console,
 		"-pipe", fmt.Sprint(syncFd),
-		"-log", logFile,
 	}, args...)
-	c.SysProcAttr = &syscall.SysProcAttr{
+	d.c.SysProcAttr = &syscall.SysProcAttr{
 		Cloneflags: uintptr(nsinit.GetNamespaceFlags(container.Namespaces)),
 	}
-	c.Env = container.Env
-	c.Dir = c.Rootfs
+	d.c.Env = container.Env
+	d.c.Dir = d.c.Rootfs
 
-	return &c.Cmd
+	return &d.c.Cmd
 }
 
 type dockerStateWriter struct {
diff --git a/components/engine/pkg/libcontainer/network/veth.go b/components/engine/pkg/libcontainer/network/veth.go
index 321c68eca4..49e63f0779 100644
--- a/components/engine/pkg/libcontainer/network/veth.go
+++ b/components/engine/pkg/libcontainer/network/veth.go
@@ -6,6 +6,9 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 )
 
+// Veth is a network strategy that uses a bridge and creates
+// a veth pair, one that stays outside on the host and the other
+// is placed inside the container's namespace
 type Veth struct {
 }
 
diff --git a/components/engine/pkg/libcontainer/nsinit/command.go b/components/engine/pkg/libcontainer/nsinit/command.go
index b1c5631b4b..5eb378ac23 100644
--- a/components/engine/pkg/libcontainer/nsinit/command.go
+++ b/components/engine/pkg/libcontainer/nsinit/command.go
@@ -8,8 +8,11 @@ import (
 	"syscall"
 )
 
+// CommandFactory takes the container's configuration and options passed by the
+// parent processes and creates an *exec.Cmd that will be used to fork/exec the
+// namespaced init process
 type CommandFactory interface {
-	Create(container *libcontainer.Container, console, logFile string, syncFd uintptr, args []string) *exec.Cmd
+	Create(container *libcontainer.Container, console string, syncFd uintptr, args []string) *exec.Cmd
 }
 
 type DefaultCommandFactory struct{}
@@ -17,13 +20,12 @@ type DefaultCommandFactory struct{}
 // Create will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
-func (c *DefaultCommandFactory) Create(container *libcontainer.Container, console, logFile string, pipe uintptr, args []string) *exec.Cmd {
+func (c *DefaultCommandFactory) Create(container *libcontainer.Container, console string, pipe uintptr, args []string) *exec.Cmd {
 	// get our binary name so we can always reexec ourself
 	name := os.Args[0]
 	command := exec.Command(name, append([]string{
 		"-console", console,
 		"-pipe", fmt.Sprint(pipe),
-		"-log", logFile,
 		"init"}, args...)...)
 
 	command.SysProcAttr = &syscall.SysProcAttr{
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index c4073235ef..b13326ba7e 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -28,31 +28,27 @@ func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args [
 	}
 
 	if container.Tty {
-		ns.logger.Printf("setting up master and console")
-		master, console, err = CreateMasterAndConsole()
+		master, console, err = system.CreateMasterAndConsole()
 		if err != nil {
 			return -1, err
 		}
 		term.SetMaster(master)
 	}
 
-	command := ns.commandFactory.Create(container, console, ns.logFile, syncPipe.child.Fd(), args)
+	command := ns.commandFactory.Create(container, console, syncPipe.child.Fd(), args)
 	if err := term.Attach(command); err != nil {
 		return -1, err
 	}
 	defer term.Close()
 
-	ns.logger.Printf("staring init")
 	if err := command.Start(); err != nil {
 		return -1, err
 	}
-	ns.logger.Printf("writing state file")
 	if err := ns.stateWriter.WritePid(command.Process.Pid); err != nil {
 		command.Process.Kill()
 		return -1, err
 	}
 	defer func() {
-		ns.logger.Printf("removing state file")
 		ns.stateWriter.DeletePid()
 	}()
 
@@ -68,24 +64,18 @@ func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args [
 	}
 
 	// Sync with child
-	ns.logger.Printf("closing sync pipes")
 	syncPipe.Close()
 
-	ns.logger.Printf("waiting on process")
 	if err := command.Wait(); err != nil {
 		if _, ok := err.(*exec.ExitError); !ok {
 			return -1, err
 		}
 	}
-
-	exitCode := command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus()
-	ns.logger.Printf("process ended with exit code %d", exitCode)
-	return exitCode, nil
+	return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil
 }
 
 func (ns *linuxNs) SetupCgroups(container *libcontainer.Container, nspid int) error {
 	if container.Cgroups != nil {
-		ns.logger.Printf("setting up cgroups")
 		if err := container.Cgroups.Apply(nspid); err != nil {
 			return err
 		}
@@ -95,7 +85,6 @@ func (ns *linuxNs) SetupCgroups(container *libcontainer.Container, nspid int) er
 
 func (ns *linuxNs) InitializeNetworking(container *libcontainer.Container, nspid int, pipe *SyncPipe) error {
 	if container.Network != nil {
-		ns.logger.Printf("creating host network configuration type %s", container.Network.Type)
 		strategy, err := network.GetStrategy(container.Network.Type)
 		if err != nil {
 			return err
@@ -104,27 +93,9 @@ func (ns *linuxNs) InitializeNetworking(container *libcontainer.Container, nspid
 		if err != nil {
 			return err
 		}
-		ns.logger.Printf("sending %v as network context", networkContext)
 		if err := pipe.SendToChild(networkContext); err != nil {
 			return err
 		}
 	}
 	return nil
 }
-
-// CreateMasterAndConsole will open /dev/ptmx on the host and retreive the
-// pts name for use as the pty slave inside the container
-func CreateMasterAndConsole() (*os.File, string, error) {
-	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, "", err
-	}
-	console, err := system.Ptsname(master)
-	if err != nil {
-		return nil, "", err
-	}
-	if err := system.Unlockpt(master); err != nil {
-		return nil, "", err
-	}
-	return master, console, nil
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index 9c33f69b4d..463196c7c0 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -18,7 +18,7 @@ func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []s
 			return -1, err
 		}
 	}
-	fds, err := getNsFds(nspid, container)
+	fds, err := ns.getNsFds(nspid, container)
 	closeFds := func() {
 		for _, f := range fds {
 			system.Closefd(f)
@@ -75,13 +75,13 @@ dropAndExec:
 	if err := capabilities.DropCapabilities(container); err != nil {
 		return -1, fmt.Errorf("drop capabilities %s", err)
 	}
-	if err := system.Exec(args[0], args[0:], container.Env); err != nil {
+	if err := system.Execv(args[0], args[0:], container.Env); err != nil {
 		return -1, err
 	}
 	panic("unreachable")
 }
 
-func getNsFds(pid int, container *libcontainer.Container) ([]uintptr, error) {
+func (ns *linuxNs) getNsFds(pid int, container *libcontainer.Container) ([]uintptr, error) {
 	fds := make([]uintptr, len(container.Namespaces))
 	for i, ns := range container.Namespaces {
 		f, err := os.OpenFile(filepath.Join("/proc/", strconv.Itoa(pid), "ns", namespaceFileMap[ns]), os.O_RDONLY, 0)
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 5e33169b65..1229560b5e 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -7,18 +7,17 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
+	"github.com/dotcloud/docker/pkg/libcontainer/utils"
 	"github.com/dotcloud/docker/pkg/system"
 	"github.com/dotcloud/docker/pkg/user"
 	"os"
-	"os/exec"
-	"path/filepath"
 	"syscall"
 )
 
 // Init is the init process that first runs inside a new namespace to setup mounts, users, networking,
 // and other options required for the new container.
 func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, console string, syncPipe *SyncPipe, args []string) error {
-	rootfs, err := resolveRootfs(uncleanRootfs)
+	rootfs, err := utils.ResolveRootfs(uncleanRootfs)
 	if err != nil {
 		return err
 	}
@@ -34,7 +33,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 	if console != "" {
 		// close pipes so that we can replace it with the pty
 		closeStdPipes()
-		slave, err := openTerminal(console, syscall.O_RDWR)
+		slave, err := system.OpenTerminal(console, syscall.O_RDWR)
 		if err != nil {
 			return fmt.Errorf("open terminal %s", err)
 		}
@@ -50,6 +49,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 			return fmt.Errorf("setctty %s", err)
 		}
 	}
+
 	if err := system.ParentDeathSignal(); err != nil {
 		return fmt.Errorf("parent deth signal %s", err)
 	}
@@ -73,18 +73,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
 		}
 	}
-	return execArgs(args, container.Env)
-}
-
-func execArgs(args []string, env []string) error {
-	name, err := exec.LookPath(args[0])
-	if err != nil {
-		return err
-	}
-	if err := system.Exec(name, args[0:], env); err != nil {
-		return fmt.Errorf("exec %s", err)
-	}
-	panic("unreachable")
+	return system.Execv(args[0], args[0:], container.Env)
 }
 
 func closeStdPipes() {
@@ -93,18 +82,19 @@ func closeStdPipes() {
 	os.Stderr.Close()
 }
 
-// resolveRootfs ensures that the current working directory is
-// not a symlink and returns the absolute path to the rootfs
-func resolveRootfs(uncleanRootfs string) (string, error) {
-	rootfs, err := filepath.Abs(uncleanRootfs)
-	if err != nil {
-		return "", err
-	}
-	return filepath.EvalSymlinks(rootfs)
-}
-
 func setupUser(container *libcontainer.Container) error {
-	if container.User != "" && container.User != "root" {
+	switch container.User {
+	case "root", "":
+		if err := system.Setgroups(nil); err != nil {
+			return err
+		}
+		if err := system.Setresgid(0, 0, 0); err != nil {
+			return err
+		}
+		if err := system.Setresuid(0, 0, 0); err != nil {
+			return err
+		}
+	default:
 		uid, gid, suppGids, err := user.GetUserGroupSupplementary(container.User, syscall.Getuid(), syscall.Getgid())
 		if err != nil {
 			return err
@@ -118,16 +108,6 @@ func setupUser(container *libcontainer.Container) error {
 		if err := system.Setuid(uid); err != nil {
 			return err
 		}
-	} else {
-		if err := system.Setgroups(nil); err != nil {
-			return err
-		}
-		if err := system.Setresgid(0, 0, 0); err != nil {
-			return err
-		}
-		if err := system.Setresuid(0, 0, 0); err != nil {
-			return err
-		}
 	}
 	return nil
 }
@@ -147,16 +127,6 @@ func dupSlave(slave *os.File) error {
 	return nil
 }
 
-// openTerminal is a clone of os.OpenFile without the O_CLOEXEC
-// used to open the pty slave inside the container namespace
-func openTerminal(name string, flag int) (*os.File, error) {
-	r, e := syscall.Open(name, flag, 0)
-	if e != nil {
-		return nil, &os.PathError{"open", name, e}
-	}
-	return os.NewFile(uintptr(r), name), nil
-}
-
 // setupVethNetwork uses the Network config if it is not nil to initialize
 // the new veth interface inside the container for use by changing the name to eth0
 // setting the MTU and IP address along with the default gateway
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit.go b/components/engine/pkg/libcontainer/nsinit/nsinit.go
index 599461e434..f09a130aa2 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit.go
@@ -2,9 +2,10 @@ package nsinit
 
 import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"log"
 )
 
+// NsInit is an interface with the public facing methods to provide high level
+// exec operations on a container
 type NsInit interface {
 	Exec(container *libcontainer.Container, term Terminal, args []string) (int, error)
 	ExecIn(container *libcontainer.Container, nspid int, args []string) (int, error)
@@ -13,17 +14,13 @@ type NsInit interface {
 
 type linuxNs struct {
 	root           string
-	logFile        string
-	logger         *log.Logger
 	commandFactory CommandFactory
 	stateWriter    StateWriter
 }
 
-func NewNsInit(logger *log.Logger, logFile string, command CommandFactory, state StateWriter) NsInit {
+func NewNsInit(command CommandFactory, state StateWriter) NsInit {
 	return &linuxNs{
-		logger:         logger,
 		commandFactory: command,
 		stateWriter:    state,
-		logFile:        logFile,
 	}
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index c25037fa8b..e385e7fb70 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -6,7 +6,6 @@ import (
 	"flag"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
-	"io"
 	"io/ioutil"
 	"log"
 	"os"
@@ -16,7 +15,6 @@ import (
 var (
 	console string
 	pipeFd  int
-	logFile string
 )
 
 var (
@@ -26,7 +24,6 @@ var (
 
 func registerFlags() {
 	flag.StringVar(&console, "console", "", "console (pty slave) path")
-	flag.StringVar(&logFile, "log", "none", "log options (none, stderr, or a file path)")
 	flag.IntVar(&pipeFd, "pipe", 0, "sync pipe fd")
 
 	flag.Parse()
@@ -113,26 +110,5 @@ func readPid() (int, error) {
 }
 
 func newNsInit() (nsinit.NsInit, error) {
-	logger, err := setupLogging()
-	if err != nil {
-		return nil, err
-	}
-	return nsinit.NewNsInit(logger, logFile, &nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{}), nil
-}
-
-func setupLogging() (logger *log.Logger, err error) {
-	var writer io.Writer
-
-	switch logFile {
-	case "stderr":
-		writer = os.Stderr
-	case "none", "":
-		writer = ioutil.Discard
-	default:
-		if writer, err = os.OpenFile(logFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0755); err != nil {
-			return
-		}
-	}
-	logger = log.New(writer, "", log.LstdFlags)
-	return
+	return nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{}), nil
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/state.go b/components/engine/pkg/libcontainer/nsinit/state.go
index 2dbaaa5977..5c719e1c54 100644
--- a/components/engine/pkg/libcontainer/nsinit/state.go
+++ b/components/engine/pkg/libcontainer/nsinit/state.go
@@ -7,6 +7,8 @@ import (
 	"path/filepath"
 )
 
+// StateWriter handles writing and deleting the pid file
+// on disk
 type StateWriter interface {
 	WritePid(pid int) error
 	DeletePid() error
diff --git a/components/engine/pkg/libcontainer/utils/utils.go b/components/engine/pkg/libcontainer/utils/utils.go
index 5050997ffd..0d919bc43d 100644
--- a/components/engine/pkg/libcontainer/utils/utils.go
+++ b/components/engine/pkg/libcontainer/utils/utils.go
@@ -4,6 +4,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"io"
+	"path/filepath"
 )
 
 // GenerateRandomName returns a new name joined with a prefix.  This size
@@ -15,3 +16,13 @@ func GenerateRandomName(prefix string, size int) (string, error) {
 	}
 	return prefix + hex.EncodeToString(id)[:size], nil
 }
+
+// ResolveRootfs ensures that the current working directory is
+// not a symlink and returns the absolute path to the rootfs
+func ResolveRootfs(uncleanRootfs string) (string, error) {
+	rootfs, err := filepath.Abs(uncleanRootfs)
+	if err != nil {
+		return "", err
+	}
+	return filepath.EvalSymlinks(rootfs)
+}
diff --git a/components/engine/pkg/system/calls_linux.go b/components/engine/pkg/system/calls_linux.go
index 0bf42e3c71..b7a8f140ba 100644
--- a/components/engine/pkg/system/calls_linux.go
+++ b/components/engine/pkg/system/calls_linux.go
@@ -1,6 +1,7 @@
 package system
 
 import (
+	"os/exec"
 	"syscall"
 )
 
@@ -16,6 +17,14 @@ func Exec(cmd string, args []string, env []string) error {
 	return syscall.Exec(cmd, args, env)
 }
 
+func Execv(cmd string, args []string, env []string) error {
+	name, err := exec.LookPath(cmd)
+	if err != nil {
+		return err
+	}
+	return Exec(name, args, env)
+}
+
 func Fork() (int, error) {
 	syscall.ForkLock.Lock()
 	pid, _, err := syscall.Syscall(syscall.SYS_FORK, 0, 0, 0)
diff --git a/components/engine/pkg/system/pty_linux.go b/components/engine/pkg/system/pty_linux.go
index b281b719fb..ca588d8ce9 100644
--- a/components/engine/pkg/system/pty_linux.go
+++ b/components/engine/pkg/system/pty_linux.go
@@ -24,8 +24,35 @@ func Ptsname(f *os.File) (string, error) {
 	return fmt.Sprintf("/dev/pts/%d", n), nil
 }
 
+// CreateMasterAndConsole will open /dev/ptmx on the host and retreive the
+// pts name for use as the pty slave inside the container
+func CreateMasterAndConsole() (*os.File, string, error) {
+	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, "", err
+	}
+	console, err := Ptsname(master)
+	if err != nil {
+		return nil, "", err
+	}
+	if err := Unlockpt(master); err != nil {
+		return nil, "", err
+	}
+	return master, console, nil
+}
+
 // OpenPtmx opens /dev/ptmx, i.e. the PTY master.
 func OpenPtmx() (*os.File, error) {
 	// O_NOCTTY and O_CLOEXEC are not present in os package so we use the syscall's one for all.
 	return os.OpenFile("/dev/ptmx", syscall.O_RDONLY|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
 }
+
+// OpenTerminal is a clone of os.OpenFile without the O_CLOEXEC
+// used to open the pty slave inside the container namespace
+func OpenTerminal(name string, flag int) (*os.File, error) {
+	r, e := syscall.Open(name, flag, 0)
+	if e != nil {
+		return nil, &os.PathError{"open", name, e}
+	}
+	return os.NewFile(uintptr(r), name), nil
+}

From cd79f65fb0919d529744b163ab7235b2416ed77d Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 21:21:35 -0800
Subject: [PATCH 271/403] Move types around in native driver
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 8db740a38e333158e613bc5b3a7acc2605131581 Component: engine

---
 components/engine/execdriver/native/driver.go | 55 ++-----------------
 components/engine/execdriver/native/info.go   | 22 ++++++++
 components/engine/execdriver/native/term.go   | 37 +++++++++----
 3 files changed, 55 insertions(+), 59 deletions(-)
 create mode 100644 components/engine/execdriver/native/info.go

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index e0ed5685e4..31b5ae290c 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -5,11 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
-	"github.com/dotcloud/docker/execdriver/lxc"
 	"github.com/dotcloud/docker/pkg/cgroups"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
-	"io"
 	"io/ioutil"
 	"os"
 	"os/exec"
@@ -20,7 +18,7 @@ import (
 )
 
 const (
-	DriverName = "namespaces"
+	DriverName = "native"
 	Version    = "0.1"
 )
 
@@ -30,7 +28,10 @@ var (
 
 func init() {
 	execdriver.RegisterInitFunc(DriverName, func(args *execdriver.InitArgs) error {
-		var container *libcontainer.Container
+		var (
+			container *libcontainer.Container
+			ns        = nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{})
+		)
 		f, err := os.Open("container.json")
 		if err != nil {
 			return err
@@ -49,7 +50,6 @@ func init() {
 		if err != nil {
 			return err
 		}
-		ns := nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{})
 		if err := ns.Init(container, cwd, args.Console, syncPipe, args.Args); err != nil {
 			return err
 		}
@@ -61,19 +61,6 @@ type driver struct {
 	root string
 }
 
-type info struct {
-	ID     string
-	driver *driver
-}
-
-func (i *info) IsRunning() bool {
-	p := filepath.Join(i.driver.root, "containers", i.ID, "root", ".nspid")
-	if _, err := os.Stat(p); err == nil {
-		return true
-	}
-	return false
-}
-
 func NewDriver(root string) (*driver, error) {
 	return &driver{
 		root: root,
@@ -90,8 +77,8 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 			c:        c,
 			dsw:      &nsinit.DefaultStateWriter{c.Rootfs},
 		}
+		ns = nsinit.NewNsInit(factory, stateWriter)
 	)
-	ns := nsinit.NewNsInit(factory, stateWriter)
 	if c.Tty {
 		term = &dockerTtyTerm{
 			pipes: pipes,
@@ -280,33 +267,3 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 	}
 	return container
 }
-
-type dockerStdTerm struct {
-	lxc.StdConsole
-	pipes *execdriver.Pipes
-}
-
-func (d *dockerStdTerm) Attach(cmd *exec.Cmd) error {
-	return d.AttachPipes(cmd, d.pipes)
-}
-
-func (d *dockerStdTerm) SetMaster(master *os.File) {
-	// do nothing
-}
-
-type dockerTtyTerm struct {
-	lxc.TtyConsole
-	pipes *execdriver.Pipes
-}
-
-func (t *dockerTtyTerm) Attach(cmd *exec.Cmd) error {
-	go io.Copy(t.pipes.Stdout, t.MasterPty)
-	if t.pipes.Stdin != nil {
-		go io.Copy(t.MasterPty, t.pipes.Stdin)
-	}
-	return nil
-}
-
-func (t *dockerTtyTerm) SetMaster(master *os.File) {
-	t.MasterPty = master
-}
diff --git a/components/engine/execdriver/native/info.go b/components/engine/execdriver/native/info.go
new file mode 100644
index 0000000000..a2ab7f2a0a
--- /dev/null
+++ b/components/engine/execdriver/native/info.go
@@ -0,0 +1,22 @@
+package native
+
+import (
+	"os"
+	"path/filepath"
+)
+
+type info struct {
+	ID     string
+	driver *driver
+}
+
+// IsRunning is determined by looking for the
+// .nspid file for a container.  If the file exists then the
+// container is currently running
+func (i *info) IsRunning() bool {
+	p := filepath.Join(i.driver.root, "containers", i.ID, "root", ".nspid")
+	if _, err := os.Stat(p); err == nil {
+		return true
+	}
+	return false
+}
diff --git a/components/engine/execdriver/native/term.go b/components/engine/execdriver/native/term.go
index b32a80e4df..9b8e813aab 100644
--- a/components/engine/execdriver/native/term.go
+++ b/components/engine/execdriver/native/term.go
@@ -1,26 +1,43 @@
+/*
+   These types are wrappers around the libcontainer Terminal interface so that
+   we can resuse the docker implementations where possible.
+*/
 package native
 
 import (
 	"github.com/dotcloud/docker/execdriver"
-	"github.com/dotcloud/docker/pkg/term"
+	"github.com/dotcloud/docker/execdriver/lxc"
+	"io"
 	"os"
+	"os/exec"
 )
 
-type NsinitTerm struct {
-	master *os.File
+type dockerStdTerm struct {
+	lxc.StdConsole
+	pipes *execdriver.Pipes
 }
 
-func NewTerm(pipes *execdriver.Pipes, master *os.File) *NsinitTerm {
-	return &NsinitTerm{master}
+func (d *dockerStdTerm) Attach(cmd *exec.Cmd) error {
+	return d.AttachPipes(cmd, d.pipes)
 }
 
-func (t *NsinitTerm) Close() error {
-	return t.master.Close()
+func (d *dockerStdTerm) SetMaster(master *os.File) {
+	// do nothing
 }
 
-func (t *NsinitTerm) Resize(h, w int) error {
-	if t.master != nil {
-		return term.SetWinsize(t.master.Fd(), &term.Winsize{Height: uint16(h), Width: uint16(w)})
+type dockerTtyTerm struct {
+	lxc.TtyConsole
+	pipes *execdriver.Pipes
+}
+
+func (t *dockerTtyTerm) Attach(cmd *exec.Cmd) error {
+	go io.Copy(t.pipes.Stdout, t.MasterPty)
+	if t.pipes.Stdin != nil {
+		go io.Copy(t.MasterPty, t.pipes.Stdin)
 	}
 	return nil
 }
+
+func (t *dockerTtyTerm) SetMaster(master *os.File) {
+	t.MasterPty = master
+}

From 9649d5107a575cf191bb72306a423637d91d7b43 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 21:51:00 -0800
Subject: [PATCH 272/403] Remove container env var from libcontainer

Update tests to use native driver
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 431d510cae85bc1265c861028dd9751ae95088b2
Component: engine
---
 .../execdriver/native/default_template.go     | 38 +++++++++++++++++++
 components/engine/execdriver/native/driver.go | 36 ------------------
 .../engine/integration/container_test.go      |  1 -
 components/engine/integration/utils_test.go   |  1 +
 components/engine/runtime.go                  |  2 +-
 5 files changed, 40 insertions(+), 38 deletions(-)

diff --git a/components/engine/execdriver/native/default_template.go b/components/engine/execdriver/native/default_template.go
index f202fd2529..7426e678e8 100644
--- a/components/engine/execdriver/native/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -1,10 +1,48 @@
 package native
 
 import (
+	"fmt"
+	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/pkg/cgroups"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 )
 
+// createContainer populates and configrues the container type with the
+// data provided by the execdriver.Command
+func createContainer(c *execdriver.Command) *libcontainer.Container {
+	container := getDefaultTemplate()
+
+	container.Hostname = getEnv("HOSTNAME", c.Env)
+	container.Tty = c.Tty
+	container.User = c.User
+	container.WorkingDir = c.WorkingDir
+	container.Env = c.Env
+
+	if c.Network != nil {
+		container.Network = &libcontainer.Network{
+			Mtu:     c.Network.Mtu,
+			Address: fmt.Sprintf("%s/%d", c.Network.IPAddress, c.Network.IPPrefixLen),
+			Gateway: c.Network.Gateway,
+			Type:    "veth",
+			Context: libcontainer.Context{
+				"prefix": "dock",
+				"bridge": c.Network.Bridge,
+			},
+		}
+	}
+	container.Cgroups.Name = c.ID
+	if c.Privileged {
+		container.Capabilities = nil
+		container.Cgroups.DeviceAccess = true
+	}
+	if c.Resources != nil {
+		container.Cgroups.CpuShares = c.Resources.CpuShares
+		container.Cgroups.Memory = c.Resources.Memory
+		container.Cgroups.MemorySwap = c.Resources.MemorySwap
+	}
+	return container
+}
+
 // getDefaultTemplate returns the docker default for
 // the libcontainer configuration file
 func getDefaultTemplate() *libcontainer.Container {
diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index 31b5ae290c..a10125c120 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -231,39 +231,3 @@ func (d *dockerStateWriter) WritePid(pid int) error {
 func (d *dockerStateWriter) DeletePid() error {
 	return d.dsw.DeletePid()
 }
-
-func createContainer(c *execdriver.Command) *libcontainer.Container {
-	container := getDefaultTemplate()
-
-	container.Hostname = getEnv("HOSTNAME", c.Env)
-	container.Tty = c.Tty
-	container.User = c.User
-	container.WorkingDir = c.WorkingDir
-	container.Env = c.Env
-
-	container.Env = append(container.Env, "container=docker")
-
-	if c.Network != nil {
-		container.Network = &libcontainer.Network{
-			Mtu:     c.Network.Mtu,
-			Address: fmt.Sprintf("%s/%d", c.Network.IPAddress, c.Network.IPPrefixLen),
-			Gateway: c.Network.Gateway,
-			Type:    "veth",
-			Context: libcontainer.Context{
-				"prefix": "dock",
-				"bridge": c.Network.Bridge,
-			},
-		}
-	}
-	container.Cgroups.Name = c.ID
-	if c.Privileged {
-		container.Capabilities = nil
-		container.Cgroups.DeviceAccess = true
-	}
-	if c.Resources != nil {
-		container.Cgroups.CpuShares = c.Resources.CpuShares
-		container.Cgroups.Memory = c.Resources.Memory
-		container.Cgroups.MemorySwap = c.Resources.MemorySwap
-	}
-	return container
-}
diff --git a/components/engine/integration/container_test.go b/components/engine/integration/container_test.go
index 8e4314f456..4efb95a2a1 100644
--- a/components/engine/integration/container_test.go
+++ b/components/engine/integration/container_test.go
@@ -1044,7 +1044,6 @@ func TestEnv(t *testing.T) {
 	goodEnv := []string{
 		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
 		"HOME=/",
-		"container=docker",
 		"HOSTNAME=" + utils.TruncateID(container.ID),
 		"FALSE=true",
 		"TRUE=false",
diff --git a/components/engine/integration/utils_test.go b/components/engine/integration/utils_test.go
index fc66e8bcbd..2d8a3e709e 100644
--- a/components/engine/integration/utils_test.go
+++ b/components/engine/integration/utils_test.go
@@ -190,6 +190,7 @@ func newTestEngine(t utils.Fataler, autorestart bool, root string) *engine.Engin
 	job := eng.Job("initserver")
 	job.Setenv("Root", root)
 	job.SetenvBool("AutoRestart", autorestart)
+	job.Setenv("ExecDriver", "native")
 	// TestGetEnabledCors and TestOptionsRoute require EnableCors=true
 	job.SetenvBool("EnableCors", true)
 	if err := job.Run(); err != nil {
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 1003c35d5d..1a95ad6270 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -713,7 +713,7 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 	case "native":
 		ed, err = native.NewDriver(config.Root)
 	default:
-		return nil, fmt.Errorf("unknow exec driver %s", config.ExecDriver)
+		return nil, fmt.Errorf("unknown exec driver %s", config.ExecDriver)
 	}
 	if err != nil {
 		return nil, err

From a70a6bdd530198ba592f8ccb073998f1b49c1911 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Mon, 24 Feb 2014 21:52:29 -0800
Subject: [PATCH 273/403] Better capability/namespace management

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 91bf120c51dec3bae98a1974929e2ae8107340c0
Component: engine
---
 .../execdriver/native/default_template.go     |  41 ++---
 .../libcontainer/capabilities/capabilities.go |  20 +--
 .../engine/pkg/libcontainer/nsinit/execin.go  |   7 +-
 .../pkg/libcontainer/nsinit/ns_linux.go       |  24 +--
 components/engine/pkg/libcontainer/types.go   | 155 +++++++++++++-----
 5 files changed, 140 insertions(+), 107 deletions(-)

diff --git a/components/engine/execdriver/native/default_template.go b/components/engine/execdriver/native/default_template.go
index 7426e678e8..cc464631cd 100644
--- a/components/engine/execdriver/native/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -48,28 +48,29 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 func getDefaultTemplate() *libcontainer.Container {
 	return &libcontainer.Container{
 		Capabilities: libcontainer.Capabilities{
-			libcontainer.CAP_SETPCAP,
-			libcontainer.CAP_SYS_MODULE,
-			libcontainer.CAP_SYS_RAWIO,
-			libcontainer.CAP_SYS_PACCT,
-			libcontainer.CAP_SYS_ADMIN,
-			libcontainer.CAP_SYS_NICE,
-			libcontainer.CAP_SYS_RESOURCE,
-			libcontainer.CAP_SYS_TIME,
-			libcontainer.CAP_SYS_TTY_CONFIG,
-			libcontainer.CAP_MKNOD,
-			libcontainer.CAP_AUDIT_WRITE,
-			libcontainer.CAP_AUDIT_CONTROL,
-			libcontainer.CAP_MAC_ADMIN,
-			libcontainer.CAP_MAC_OVERRIDE,
-			libcontainer.CAP_NET_ADMIN,
+			libcontainer.GetCapability("SETPCAP"),
+			libcontainer.GetCapability("SYS_MODULE"),
+			libcontainer.GetCapability("SYS_RAWIO"),
+			libcontainer.GetCapability("SYS_PACCT"),
+			libcontainer.GetCapability("SYS_ADMIN"),
+			libcontainer.GetCapability("SYS_NICE"),
+			libcontainer.GetCapability("SYS_RESOURCE"),
+			libcontainer.GetCapability("SYS_TIME"),
+			libcontainer.GetCapability("SYS_TTY_CONFIG"),
+			libcontainer.GetCapability("MKNOD"),
+			libcontainer.GetCapability("AUDIT_WRITE"),
+			libcontainer.GetCapability("AUDIT_CONTROL"),
+			libcontainer.GetCapability("MAC_OVERRIDE"),
+			libcontainer.GetCapability("MAC_ADMIN"),
+			libcontainer.GetCapability("NET_ADMIN"),
 		},
 		Namespaces: libcontainer.Namespaces{
-			libcontainer.CLONE_NEWIPC,
-			libcontainer.CLONE_NEWNET,
-			libcontainer.CLONE_NEWNS,
-			libcontainer.CLONE_NEWPID,
-			libcontainer.CLONE_NEWUTS,
+			libcontainer.GetNamespace("NEWNS"),
+			libcontainer.GetNamespace("NEWUTS"),
+			libcontainer.GetNamespace("NEWIPC"),
+			libcontainer.GetNamespace("NEWUSER"),
+			libcontainer.GetNamespace("NEWPID"),
+			libcontainer.GetNamespace("NEWNET"),
 		},
 		Cgroups: &cgroups.Cgroup{
 			Parent:       "docker",
diff --git a/components/engine/pkg/libcontainer/capabilities/capabilities.go b/components/engine/pkg/libcontainer/capabilities/capabilities.go
index 65fd455c26..3c6d752496 100644
--- a/components/engine/pkg/libcontainer/capabilities/capabilities.go
+++ b/components/engine/pkg/libcontainer/capabilities/capabilities.go
@@ -6,24 +6,6 @@ import (
 	"os"
 )
 
-var capMap = map[libcontainer.Capability]capability.Cap{
-	libcontainer.CAP_SETPCAP:        capability.CAP_SETPCAP,
-	libcontainer.CAP_SYS_MODULE:     capability.CAP_SYS_MODULE,
-	libcontainer.CAP_SYS_RAWIO:      capability.CAP_SYS_RAWIO,
-	libcontainer.CAP_SYS_PACCT:      capability.CAP_SYS_PACCT,
-	libcontainer.CAP_SYS_ADMIN:      capability.CAP_SYS_ADMIN,
-	libcontainer.CAP_SYS_NICE:       capability.CAP_SYS_NICE,
-	libcontainer.CAP_SYS_RESOURCE:   capability.CAP_SYS_RESOURCE,
-	libcontainer.CAP_SYS_TIME:       capability.CAP_SYS_TIME,
-	libcontainer.CAP_SYS_TTY_CONFIG: capability.CAP_SYS_TTY_CONFIG,
-	libcontainer.CAP_MKNOD:          capability.CAP_MKNOD,
-	libcontainer.CAP_AUDIT_WRITE:    capability.CAP_AUDIT_WRITE,
-	libcontainer.CAP_AUDIT_CONTROL:  capability.CAP_AUDIT_CONTROL,
-	libcontainer.CAP_MAC_OVERRIDE:   capability.CAP_MAC_OVERRIDE,
-	libcontainer.CAP_MAC_ADMIN:      capability.CAP_MAC_ADMIN,
-	libcontainer.CAP_NET_ADMIN:      capability.CAP_NET_ADMIN,
-}
-
 // DropCapabilities drops capabilities for the current process based
 // on the container's configuration.
 func DropCapabilities(container *libcontainer.Container) error {
@@ -45,7 +27,7 @@ func DropCapabilities(container *libcontainer.Container) error {
 func getCapabilities(container *libcontainer.Container) []capability.Cap {
 	drop := []capability.Cap{}
 	for _, c := range container.Capabilities {
-		drop = append(drop, capMap[c])
+		drop = append(drop, c.Value)
 	}
 	return drop
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index 463196c7c0..306250cf9b 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -14,7 +14,7 @@ import (
 // ExecIn uses an existing pid and joins the pid's namespaces with the new command.
 func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []string) (int, error) {
 	for _, ns := range container.Namespaces {
-		if err := system.Unshare(namespaceMap[ns]); err != nil {
+		if err := system.Unshare(ns.Value); err != nil {
 			return -1, err
 		}
 	}
@@ -42,8 +42,7 @@ func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []s
 
 	// if the container has a new pid and mount namespace we need to
 	// remount proc and sys to pick up the changes
-	if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
-		container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
+	if container.Namespaces.Contains("CLONE_NEWNS") && container.Namespaces.Contains("CLONE_NEWPID") {
 		pid, err := system.Fork()
 		if err != nil {
 			return -1, err
@@ -84,7 +83,7 @@ dropAndExec:
 func (ns *linuxNs) getNsFds(pid int, container *libcontainer.Container) ([]uintptr, error) {
 	fds := make([]uintptr, len(container.Namespaces))
 	for i, ns := range container.Namespaces {
-		f, err := os.OpenFile(filepath.Join("/proc/", strconv.Itoa(pid), "ns", namespaceFileMap[ns]), os.O_RDONLY, 0)
+		f, err := os.OpenFile(filepath.Join("/proc/", strconv.Itoa(pid), "ns", ns.File), os.O_RDONLY, 0)
 		if err != nil {
 			return fds, err
 		}
diff --git a/components/engine/pkg/libcontainer/nsinit/ns_linux.go b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
index 58af24798f..ab6322e75c 100644
--- a/components/engine/pkg/libcontainer/nsinit/ns_linux.go
+++ b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
@@ -2,35 +2,13 @@ package nsinit
 
 import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"syscall"
 )
 
-var namespaceMap = map[libcontainer.Namespace]int{
-	libcontainer.CLONE_NEWNS:   syscall.CLONE_NEWNS,
-	libcontainer.CLONE_NEWUTS:  syscall.CLONE_NEWUTS,
-	libcontainer.CLONE_NEWIPC:  syscall.CLONE_NEWIPC,
-	libcontainer.CLONE_NEWUSER: syscall.CLONE_NEWUSER,
-	libcontainer.CLONE_NEWPID:  syscall.CLONE_NEWPID,
-	libcontainer.CLONE_NEWNET:  syscall.CLONE_NEWNET,
-}
-
-// namespaceFileMap is used to convert the libcontainer types
-// into the names of the files located in /proc/<pid>/ns/* for
-// each namespace
-var namespaceFileMap = map[libcontainer.Namespace]string{
-	libcontainer.CLONE_NEWNS:   "mnt",
-	libcontainer.CLONE_NEWUTS:  "uts",
-	libcontainer.CLONE_NEWIPC:  "ipc",
-	libcontainer.CLONE_NEWUSER: "user",
-	libcontainer.CLONE_NEWPID:  "pid",
-	libcontainer.CLONE_NEWNET:  "net",
-}
-
 // getNamespaceFlags parses the container's Namespaces options to set the correct
 // flags on clone, unshare, and setns
 func GetNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
 	for _, ns := range namespaces {
-		flag |= namespaceMap[ns]
+		flag |= ns.Value
 	}
 	return flag
 }
diff --git a/components/engine/pkg/libcontainer/types.go b/components/engine/pkg/libcontainer/types.go
index bb54ff5130..cb64db1f29 100644
--- a/components/engine/pkg/libcontainer/types.go
+++ b/components/engine/pkg/libcontainer/types.go
@@ -1,58 +1,131 @@
 package libcontainer
 
-// These constants are defined as string types so that
-// it is clear when adding the configuration in config files
-// instead of using ints or other types
-const (
-	CAP_SETPCAP        Capability = "SETPCAP"
-	CAP_SYS_MODULE     Capability = "SYS_MODULE"
-	CAP_SYS_RAWIO      Capability = "SYS_RAWIO"
-	CAP_SYS_PACCT      Capability = "SYS_PACCT"
-	CAP_SYS_ADMIN      Capability = "SYS_ADMIN"
-	CAP_SYS_NICE       Capability = "SYS_NICE"
-	CAP_SYS_RESOURCE   Capability = "SYS_RESOURCE"
-	CAP_SYS_TIME       Capability = "SYS_TIME"
-	CAP_SYS_TTY_CONFIG Capability = "SYS_TTY_CONFIG"
-	CAP_MKNOD          Capability = "MKNOD"
-	CAP_AUDIT_WRITE    Capability = "AUDIT_WRITE"
-	CAP_AUDIT_CONTROL  Capability = "AUDIT_CONTROL"
-	CAP_MAC_OVERRIDE   Capability = "MAC_OVERRIDE"
-	CAP_MAC_ADMIN      Capability = "MAC_ADMIN"
-	CAP_NET_ADMIN      Capability = "NET_ADMIN"
+import (
+	"encoding/json"
+	"errors"
+	"github.com/syndtr/gocapability/capability"
+	"os"
+	"syscall"
+)
 
-	CLONE_NEWNS   Namespace = "NEWNS"   // mount
-	CLONE_NEWUTS  Namespace = "NEWUTS"  // utsname
-	CLONE_NEWIPC  Namespace = "NEWIPC"  // ipc
-	CLONE_NEWUSER Namespace = "NEWUSER" // user
-	CLONE_NEWPID  Namespace = "NEWPID"  // pid
-	CLONE_NEWNET  Namespace = "NEWNET"  // network
+var (
+	ErrUnkownNamespace error = errors.New("Unkown namespace")
+)
+
+// namespaceList is used to convert the libcontainer types
+// into the names of the files located in /proc/<pid>/ns/* for
+// each namespace
+var (
+	namespaceList = Namespaces{
+		{Key: "NEWNS", Value: syscall.CLONE_NEWNS, File: "mnt"},
+		{Key: "NEWUTS", Value: syscall.CLONE_NEWUTS, File: "uts"},
+		{Key: "NEWIPC", Value: syscall.CLONE_NEWIPC, File: "ipc"},
+		{Key: "NEWUSER", Value: syscall.CLONE_NEWUSER, File: "user"},
+		{Key: "NEWPID", Value: syscall.CLONE_NEWPID, File: "pid"},
+		{Key: "NEWNET", Value: syscall.CLONE_NEWNET, File: "net"},
+	}
+	capabilityList = Capabilities{
+		{Key: "SETPCAP", Value: capability.CAP_SETPCAP},
+		{Key: "SYS_MODULE", Value: capability.CAP_SYS_MODULE},
+		{Key: "SYS_RAWIO", Value: capability.CAP_SYS_RAWIO},
+		{Key: "SYS_PACCT", Value: capability.CAP_SYS_PACCT},
+		{Key: "SYS_ADMIN", Value: capability.CAP_SYS_ADMIN},
+		{Key: "SYS_NICE", Value: capability.CAP_SYS_NICE},
+		{Key: "SYS_RESOURCE", Value: capability.CAP_SYS_RESOURCE},
+		{Key: "SYS_TIME", Value: capability.CAP_SYS_TIME},
+		{Key: "SYS_TTY_CONFIG", Value: capability.CAP_SYS_TTY_CONFIG},
+		{Key: "MKNOD", Value: capability.CAP_MKNOD},
+		{Key: "AUDIT_WRITE", Value: capability.CAP_AUDIT_WRITE},
+		{Key: "AUDIT_CONTROL", Value: capability.CAP_AUDIT_CONTROL},
+		{Key: "MAC_OVERRIDE", Value: capability.CAP_MAC_OVERRIDE},
+		{Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN},
+		{Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN},
+	}
 )
 
 type (
-	Namespace    string
-	Namespaces   []Namespace
-	Capability   string
-	Capabilities []Capability
+	Namespace struct {
+		Key   string
+		Value int
+		File  string
+	}
+	Namespaces []*Namespace
 )
 
+func (ns *Namespace) MarshalJSON() ([]byte, error) {
+	return json.Marshal(ns.Key)
+}
+
+func (ns *Namespace) UnmarshalJSON(src []byte) error {
+	var nsName string
+	if err := json.Unmarshal(src, &nsName); err != nil {
+		return err
+	}
+	ret := GetNamespace(nsName)
+	if ret == nil {
+		return ErrUnkownNamespace
+	}
+	*ns = *ret
+	return nil
+}
+
+func GetNamespace(key string) *Namespace {
+	for _, ns := range namespaceList {
+		if ns.Key == key {
+			return ns
+		}
+	}
+	if os.Getenv("DEBUG") != "" {
+		panic("Unreachable: Namespace not found")
+	}
+	return nil
+}
+
 // Contains returns true if the specified Namespace is
 // in the slice
-func (n Namespaces) Contains(ns Namespace) bool {
-	for _, nns := range n {
-		if nns == ns {
-			return true
+func (n Namespaces) Contains(ns string) bool {
+	return GetNamespace(ns) != nil
+}
+
+type (
+	Capability struct {
+		Key   string
+		Value capability.Cap
+	}
+	Capabilities []*Capability
+)
+
+func (ns *Capability) MarshalJSON() ([]byte, error) {
+	return json.Marshal(ns.Key)
+}
+
+func (ns *Capability) UnmarshalJSON(src []byte) error {
+	var capName string
+	if err := json.Unmarshal(src, &capName); err != nil {
+		return err
+	}
+	ret := GetCapability(capName)
+	if ret == nil {
+		return ErrUnkownNamespace
+	}
+	*ns = *ret
+	return nil
+}
+
+func GetCapability(key string) *Capability {
+	for _, capp := range capabilityList {
+		if capp.Key == key {
+			return capp
 		}
 	}
-	return false
+	if os.Getenv("DEBUG") != "" {
+		panic("Unreachable: Namespace not found")
+	}
+	return nil
 }
 
 // Contains returns true if the specified Capability is
 // in the slice
-func (c Capabilities) Contains(capp Capability) bool {
-	for _, cc := range c {
-		if cc == capp {
-			return true
-		}
-	}
-	return false
+func (c Capabilities) Contains(capp string) bool {
+	return GetCapability(capp) != nil
 }

From 084de3d8695158719493f8208d0ec3dbda6ba7be Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 24 Feb 2014 21:54:37 -0800
Subject: [PATCH 274/403] Remove setup logging from sysinit
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 a64ebabdfaca66709d664cb87a35d689e35cfd0d Component: engine

---
 components/engine/sysinit/sysinit.go | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/components/engine/sysinit/sysinit.go b/components/engine/sysinit/sysinit.go
index cd74e0c88e..3f2b0b6066 100644
--- a/components/engine/sysinit/sysinit.go
+++ b/components/engine/sysinit/sysinit.go
@@ -7,7 +7,6 @@ import (
 	"github.com/dotcloud/docker/execdriver"
 	_ "github.com/dotcloud/docker/execdriver/lxc"
 	_ "github.com/dotcloud/docker/execdriver/native"
-	"io"
 	"io/ioutil"
 	"log"
 	"os"
@@ -56,14 +55,9 @@ func SysInit() {
 		driver     = flag.String("driver", "", "exec driver")
 		pipe       = flag.Int("pipe", 0, "sync pipe fd")
 		console    = flag.String("console", "", "console (pty slave) path")
-		logFile    = flag.String("log", "", "log file path")
 	)
 	flag.Parse()
 
-	if err := setupLogging(*logFile); err != nil {
-		log.Fatalf("setup logging %s", err)
-	}
-
 	// Get env
 	var env []string
 	content, err := ioutil.ReadFile(".dockerenv")
@@ -94,20 +88,3 @@ func SysInit() {
 		log.Fatal(err)
 	}
 }
-
-func setupLogging(logFile string) (err error) {
-	var writer io.Writer
-	switch logFile {
-	case "stderr":
-		writer = os.Stderr
-	case "none", "":
-		writer = ioutil.Discard
-	default:
-		writer, err = os.OpenFile(logFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0755)
-		if err != nil {
-			return err
-		}
-	}
-	log.SetOutput(writer)
-	return nil
-}

From 61c173dbcd07ab26bb967c3a745a8b08986bc3d9 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Tue, 25 Feb 2014 08:01:46 +0000
Subject: [PATCH 275/403] fix divide by zero error

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: b7a0f62f0f9079d0d628a284a77af0c474eb9375
Component: engine
---
 components/engine/utils/jsonmessage.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/utils/jsonmessage.go b/components/engine/utils/jsonmessage.go
index 3e4e0f86ad..9050dda746 100644
--- a/components/engine/utils/jsonmessage.go
+++ b/components/engine/utils/jsonmessage.go
@@ -52,7 +52,7 @@ func (p *JSONProgress) String() string {
 	}
 	numbersBox = fmt.Sprintf("%8v/%v", current, total)
 
-	if p.Start > 0 && percentage < 50 {
+	if p.Current > 0 && p.Start > 0 && percentage < 50 {
 		fromStart := time.Now().UTC().Sub(time.Unix(int64(p.Start), 0))
 		perEntry := fromStart / time.Duration(p.Current)
 		left := time.Duration(p.Total-p.Current) * perEntry

From fbca607ce0c1f0c22e6ae1550cb316dc00d2f2c1 Mon Sep 17 00:00:00 2001
From: Vincent Batts <vbatts@redhat.com>
Date: Tue, 25 Feb 2014 10:07:06 -0500
Subject: [PATCH 276/403] correcting the package name for the terminal setup

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Upstream-commit: c35853191ccd9ca8fe91b666d598eac3e4e12c67
Component: engine
---
 components/engine/execdriver/lxc/driver.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index 145965a383..c18b2e6ab4 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/pkg/cgroups"
-	"github.com/dotcloud/docker/pkg/term"
 	"github.com/dotcloud/docker/utils"
 	"io/ioutil"
 	"log"
@@ -78,7 +77,7 @@ func (d *driver) Name() string {
 }
 
 func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
-	if err := term.SetTerminal(c, pipes); err != nil {
+	if err := execdriver.SetTerminal(c, pipes); err != nil {
 		return -1, err
 	}
 	configPath, err := d.generateLXCConfig(c)

From 1bd3fbfadfc7be65ae801bcff19e5a99cda03db6 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 25 Feb 2014 10:54:41 -0800
Subject: [PATCH 277/403] Address initial feedback from pr
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 de083400b8d7c2074d71a30a92e4f3c8bcd8bad8 Component: engine

---
 components/engine/docker/docker.go            |  2 +-
 components/engine/execdriver/native/driver.go | 10 ++++-----
 components/engine/integration/runtime_test.go |  2 +-
 components/engine/pkg/system/setns_linux.go   | 21 ++++++++++++++++++-
 .../engine/pkg/system/setns_linux_amd64.go    |  8 -------
 5 files changed, 26 insertions(+), 17 deletions(-)
 delete mode 100644 components/engine/pkg/system/setns_linux_amd64.go

diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index a2d83bfa86..3ea3d63027 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -17,7 +17,7 @@ import (
 )
 
 func main() {
-	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || strings.Contains(selfPath, ".dockerinit") {
+	if selfPath := utils.SelfPath(); strings.Contains(selfPath, ".dockerinit") {
 		// Running in init mode
 		sysinit.SysInit()
 		return
diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index a10125c120..16e5ea1b49 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -2,7 +2,6 @@ package native
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/pkg/cgroups"
@@ -22,10 +21,6 @@ const (
 	Version    = "0.1"
 )
 
-var (
-	ErrNotSupported = errors.New("not supported")
-)
-
 func init() {
 	execdriver.RegisterInitFunc(DriverName, func(args *execdriver.InitArgs) error {
 		var (
@@ -109,10 +104,13 @@ func (d *driver) Restore(c *execdriver.Command) error {
 	if err != nil {
 		return err
 	}
-	defer f.Close()
 	if _, err := fmt.Fscanf(f, "%d", &nspid); err != nil {
+		f.Close()
 		return err
 	}
+	f.Close()
+	defer os.Remove(p)
+
 	proc, err := os.FindProcess(nspid)
 	if err != nil {
 		return err
diff --git a/components/engine/integration/runtime_test.go b/components/engine/integration/runtime_test.go
index 060980f4e1..6003c89b51 100644
--- a/components/engine/integration/runtime_test.go
+++ b/components/engine/integration/runtime_test.go
@@ -85,7 +85,7 @@ func init() {
 	os.Setenv("TEST", "1")
 
 	// Hack to run sys init during unit testing
-	if selfPath := utils.SelfPath(); selfPath == "/sbin/init" || strings.Contains(selfPath, ".dockerinit") {
+	if selfPath := utils.SelfPath(); strings.Contains(selfPath, ".dockerinit") {
 		sysinit.SysInit()
 		return
 	}
diff --git a/components/engine/pkg/system/setns_linux.go b/components/engine/pkg/system/setns_linux.go
index be6f3edb30..07b1c93b4a 100644
--- a/components/engine/pkg/system/setns_linux.go
+++ b/components/engine/pkg/system/setns_linux.go
@@ -1,11 +1,30 @@
 package system
 
 import (
+	"errors"
+	"fmt"
+	"runtime"
 	"syscall"
 )
 
+var (
+	ErrNotSupportedPlatform = errors.New("platform and architecture is not supported")
+)
+
+// Via http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b21fddd087678a70ad64afc0f632e0f1071b092
+//
+// We need different setns values for the different platforms and arch
+// We are declaring the macro here because the SETNS syscall does not exist in th stdlib
+var setNsMap = map[string]uintptr{
+	"linux/amd64": 308,
+}
+
 func Setns(fd uintptr, flags uintptr) error {
-	_, _, err := syscall.RawSyscall(SYS_SETNS, fd, flags, 0)
+	ns, exists := setNsMap[fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)]
+	if !exists {
+		return ErrNotSupportedPlatform
+	}
+	_, _, err := syscall.RawSyscall(ns, fd, flags, 0)
 	if err != 0 {
 		return err
 	}
diff --git a/components/engine/pkg/system/setns_linux_amd64.go b/components/engine/pkg/system/setns_linux_amd64.go
deleted file mode 100644
index 4e306253d9..0000000000
--- a/components/engine/pkg/system/setns_linux_amd64.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// +build linux,amd64
-
-package system
-
-// Via http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b21fddd087678a70ad64afc0f632e0f1071b092
-const (
-	SYS_SETNS = 308
-)

From 52e14d45175f7c633900e21e127bc545786bfda0 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 25 Feb 2014 13:07:19 -0700
Subject: [PATCH 278/403] Convert api/server.go to also use the handy user
 package

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 7bce5957a08ae31f4b83d1a13ad056e5b2af15e1
Component: engine
---
 components/engine/api/server.go | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index 4b10a2dae1..0dd9d966e6 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -12,6 +12,7 @@ import (
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/pkg/listenbuffer"
 	"github.com/dotcloud/docker/pkg/systemd"
+	"github.com/dotcloud/docker/pkg/user"
 	"github.com/dotcloud/docker/utils"
 	"github.com/gorilla/mux"
 	"io"
@@ -21,7 +22,6 @@ import (
 	"net/http"
 	"net/http/pprof"
 	"os"
-	"regexp"
 	"strconv"
 	"strings"
 	"syscall"
@@ -1142,18 +1142,15 @@ func ListenAndServe(proto, addr string, eng *engine.Engine, logging, enableCors
 			return err
 		}
 
-		groups, err := ioutil.ReadFile("/etc/group")
+		groups, err := user.ParseGroupFilter(func(g *user.Group) bool {
+			return g.Name == "docker"
+		})
 		if err != nil {
 			return err
 		}
-		re := regexp.MustCompile("(^|\n)docker:.*?:([0-9]+)")
-		if gidMatch := re.FindStringSubmatch(string(groups)); gidMatch != nil {
-			gid, err := strconv.Atoi(gidMatch[2])
-			if err != nil {
-				return err
-			}
-			utils.Debugf("docker group found. gid: %d", gid)
-			if err := os.Chown(addr, 0, gid); err != nil {
+		if len(groups) > 0 {
+			utils.Debugf("docker group found. gid: %d", groups[0].Gid)
+			if err := os.Chown(addr, 0, groups[0].Gid); err != nil {
 				return err
 			}
 		}

From 0cd1a2f6a4d1bbd8b7a3dbdbed782e7dcbb3cda9 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 25 Feb 2014 12:41:31 -0800
Subject: [PATCH 279/403] Move container.json and pid file into a root specific
 driver dir Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 96e33a7646b3669632f48ed1071aeb61b8016be1 Component: engine

---
 components/engine/execdriver/driver.go        |  1 +
 components/engine/execdriver/native/driver.go | 38 ++++++++++++-------
 components/engine/execdriver/native/info.go   |  3 +-
 .../engine/pkg/libcontainer/nsinit/execin.go  |  2 +-
 .../pkg/libcontainer/nsinit/nsinit/main.go    | 12 +++---
 .../engine/pkg/libcontainer/nsinit/state.go   |  6 +--
 components/engine/runtime.go                  |  2 +-
 components/engine/sysinit/sysinit.go          |  2 +
 8 files changed, 41 insertions(+), 25 deletions(-)

diff --git a/components/engine/execdriver/driver.go b/components/engine/execdriver/driver.go
index 8b5dd5ccc7..d64c08fa6c 100644
--- a/components/engine/execdriver/driver.go
+++ b/components/engine/execdriver/driver.go
@@ -53,6 +53,7 @@ type InitArgs struct {
 	Driver     string
 	Console    string
 	Pipe       int
+	Root       string
 }
 
 // Driver specific information based on
diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index 16e5ea1b49..6236950476 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -25,9 +25,9 @@ func init() {
 	execdriver.RegisterInitFunc(DriverName, func(args *execdriver.InitArgs) error {
 		var (
 			container *libcontainer.Container
-			ns        = nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{})
+			ns        = nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{args.Root})
 		)
-		f, err := os.Open("container.json")
+		f, err := os.Open(filepath.Join(args.Root, "container.json"))
 		if err != nil {
 			return err
 		}
@@ -57,6 +57,9 @@ type driver struct {
 }
 
 func NewDriver(root string) (*driver, error) {
+	if err := os.MkdirAll(root, 0655); err != nil {
+		return nil, err
+	}
 	return &driver{
 		root: root,
 	}, nil
@@ -66,14 +69,18 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 	var (
 		term        nsinit.Terminal
 		container   = createContainer(c)
-		factory     = &dockerCommandFactory{c}
+		factory     = &dockerCommandFactory{c: c, driver: d}
 		stateWriter = &dockerStateWriter{
 			callback: startCallback,
 			c:        c,
-			dsw:      &nsinit.DefaultStateWriter{c.Rootfs},
+			dsw:      &nsinit.DefaultStateWriter{filepath.Join(d.root, c.ID)},
 		}
-		ns = nsinit.NewNsInit(factory, stateWriter)
+		ns   = nsinit.NewNsInit(factory, stateWriter)
+		args = append([]string{c.Entrypoint}, c.Arguments...)
 	)
+	if err := d.createContainerRoot(c.ID); err != nil {
+		return -1, err
+	}
 	if c.Tty {
 		term = &dockerTtyTerm{
 			pipes: pipes,
@@ -84,10 +91,9 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 		}
 	}
 	c.Terminal = term
-	if err := writeContainerFile(container, c.Rootfs); err != nil {
+	if err := d.writeContainerFile(container, c.ID); err != nil {
 		return -1, err
 	}
-	args := append([]string{c.Entrypoint}, c.Arguments...)
 	return ns.Exec(container, term, args)
 }
 
@@ -98,9 +104,9 @@ func (d *driver) Kill(p *execdriver.Command, sig int) error {
 func (d *driver) Restore(c *execdriver.Command) error {
 	var (
 		nspid int
-		p     = filepath.Join(d.root, "containers", c.ID, "root", ".nspid")
+		path  = filepath.Join(d.root, c.ID, "pid")
 	)
-	f, err := os.Open(p)
+	f, err := os.Open(path)
 	if err != nil {
 		return err
 	}
@@ -109,7 +115,7 @@ func (d *driver) Restore(c *execdriver.Command) error {
 		return err
 	}
 	f.Close()
-	defer os.Remove(p)
+	defer os.Remove(path)
 
 	proc, err := os.FindProcess(nspid)
 	if err != nil {
@@ -167,12 +173,16 @@ func (d *driver) GetPidsForContainer(id string) ([]int, error) {
 	return pids, nil
 }
 
-func writeContainerFile(container *libcontainer.Container, rootfs string) error {
+func (d *driver) writeContainerFile(container *libcontainer.Container, id string) error {
 	data, err := json.Marshal(container)
 	if err != nil {
 		return err
 	}
-	return ioutil.WriteFile(filepath.Join(rootfs, "container.json"), data, 0755)
+	return ioutil.WriteFile(filepath.Join(d.root, id, "container.json"), data, 0655)
+}
+
+func (d *driver) createContainerRoot(id string) error {
+	return os.MkdirAll(filepath.Join(d.root, id), 0655)
 }
 
 func getEnv(key string, env []string) string {
@@ -186,7 +196,8 @@ func getEnv(key string, env []string) string {
 }
 
 type dockerCommandFactory struct {
-	c *execdriver.Command
+	c      *execdriver.Command
+	driver *driver
 }
 
 // createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
@@ -202,6 +213,7 @@ func (d *dockerCommandFactory) Create(container *libcontainer.Container, console
 		"-driver", DriverName,
 		"-console", console,
 		"-pipe", fmt.Sprint(syncFd),
+		"-root", filepath.Join(d.driver.root, d.c.ID),
 	}, args...)
 	d.c.SysProcAttr = &syscall.SysProcAttr{
 		Cloneflags: uintptr(nsinit.GetNamespaceFlags(container.Namespaces)),
diff --git a/components/engine/execdriver/native/info.go b/components/engine/execdriver/native/info.go
index a2ab7f2a0a..5223feee83 100644
--- a/components/engine/execdriver/native/info.go
+++ b/components/engine/execdriver/native/info.go
@@ -14,8 +14,7 @@ type info struct {
 // .nspid file for a container.  If the file exists then the
 // container is currently running
 func (i *info) IsRunning() bool {
-	p := filepath.Join(i.driver.root, "containers", i.ID, "root", ".nspid")
-	if _, err := os.Stat(p); err == nil {
+	if _, err := os.Stat(filepath.Join(i.driver.root, i.ID, "pid")); err == nil {
 		return true
 	}
 	return false
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index 306250cf9b..253fbdcea4 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -42,7 +42,7 @@ func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []s
 
 	// if the container has a new pid and mount namespace we need to
 	// remount proc and sys to pick up the changes
-	if container.Namespaces.Contains("CLONE_NEWNS") && container.Namespaces.Contains("CLONE_NEWPID") {
+	if container.Namespaces.Contains("NEWNS") && container.Namespaces.Contains("NEWPID") {
 		pid, err := system.Fork()
 		if err != nil {
 			return -1, err
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index e385e7fb70..e6b020b74b 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -9,12 +9,13 @@ import (
 	"io/ioutil"
 	"log"
 	"os"
+	"path/filepath"
 	"strconv"
 )
 
 var (
-	console string
-	pipeFd  int
+	root, console string
+	pipeFd        int
 )
 
 var (
@@ -25,6 +26,7 @@ var (
 func registerFlags() {
 	flag.StringVar(&console, "console", "", "console (pty slave) path")
 	flag.IntVar(&pipeFd, "pipe", 0, "sync pipe fd")
+	flag.StringVar(&root, "root", ".", "root for storing configuration data")
 
 	flag.Parse()
 }
@@ -84,7 +86,7 @@ func main() {
 }
 
 func loadContainer() (*libcontainer.Container, error) {
-	f, err := os.Open("container.json")
+	f, err := os.Open(filepath.Join(root, "container.json"))
 	if err != nil {
 		return nil, err
 	}
@@ -98,7 +100,7 @@ func loadContainer() (*libcontainer.Container, error) {
 }
 
 func readPid() (int, error) {
-	data, err := ioutil.ReadFile(".nspid")
+	data, err := ioutil.ReadFile(filepath.Join(root, "pid"))
 	if err != nil {
 		return -1, err
 	}
@@ -110,5 +112,5 @@ func readPid() (int, error) {
 }
 
 func newNsInit() (nsinit.NsInit, error) {
-	return nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{}), nil
+	return nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{root}), nil
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/state.go b/components/engine/pkg/libcontainer/nsinit/state.go
index 5c719e1c54..af38008c03 100644
--- a/components/engine/pkg/libcontainer/nsinit/state.go
+++ b/components/engine/pkg/libcontainer/nsinit/state.go
@@ -18,11 +18,11 @@ type DefaultStateWriter struct {
 	Root string
 }
 
-// writePidFile writes the namespaced processes pid to .nspid in the rootfs for the container
+// writePidFile writes the namespaced processes pid to pid in the rootfs for the container
 func (d *DefaultStateWriter) WritePid(pid int) error {
-	return ioutil.WriteFile(filepath.Join(d.Root, ".nspid"), []byte(fmt.Sprint(pid)), 0655)
+	return ioutil.WriteFile(filepath.Join(d.Root, "pid"), []byte(fmt.Sprint(pid)), 0655)
 }
 
 func (d *DefaultStateWriter) DeletePid() error {
-	return os.Remove(filepath.Join(d.Root, ".nspid"))
+	return os.Remove(filepath.Join(d.Root, "pid"))
 }
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 1a95ad6270..c062578a31 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -711,7 +711,7 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 	case "lxc":
 		ed, err = lxc.NewDriver(config.Root, sysInfo.AppArmor)
 	case "native":
-		ed, err = native.NewDriver(config.Root)
+		ed, err = native.NewDriver(path.Join(config.Root, "native"))
 	default:
 		return nil, fmt.Errorf("unknown exec driver %s", config.ExecDriver)
 	}
diff --git a/components/engine/sysinit/sysinit.go b/components/engine/sysinit/sysinit.go
index 3f2b0b6066..c84c05982c 100644
--- a/components/engine/sysinit/sysinit.go
+++ b/components/engine/sysinit/sysinit.go
@@ -55,6 +55,7 @@ func SysInit() {
 		driver     = flag.String("driver", "", "exec driver")
 		pipe       = flag.Int("pipe", 0, "sync pipe fd")
 		console    = flag.String("console", "", "console (pty slave) path")
+		root       = flag.String("root", ".", "root path for configuration files")
 	)
 	flag.Parse()
 
@@ -82,6 +83,7 @@ func SysInit() {
 		Driver:     *driver,
 		Console:    *console,
 		Pipe:       *pipe,
+		Root:       *root,
 	}
 
 	if err := executeProgram(args); err != nil {

From 0724fa65be92405b903f2e72d5e15344459e1f95 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Tue, 11 Feb 2014 02:44:17 +0000
Subject: [PATCH 280/403] Rewrite docker rmi

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 795ed6b1e511fa6713fbc9ea4e8569aab15b98ff
Component: engine
---
 components/engine/api/client.go               |   8 +-
 components/engine/api/server.go               |   2 +-
 components/engine/integration/api_test.go     |   2 +
 .../engine/integration/commands_test.go       |   5 +-
 components/engine/integration/server_test.go  |  13 +-
 components/engine/server.go                   | 138 +++++-------------
 6 files changed, 58 insertions(+), 110 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index eb345ae40b..7acf63f9ca 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -781,6 +781,7 @@ func (cli *DockerCli) CmdPort(args ...string) error {
 // 'docker rmi IMAGE' removes all images with the name IMAGE
 func (cli *DockerCli) CmdRmi(args ...string) error {
 	cmd := cli.Subcmd("rmi", "IMAGE [IMAGE...]", "Remove one or more images")
+	force := cmd.Bool([]string{"f", "-force"}, false, "Force")
 	if err := cmd.Parse(args); err != nil {
 		return nil
 	}
@@ -789,9 +790,14 @@ func (cli *DockerCli) CmdRmi(args ...string) error {
 		return nil
 	}
 
+	v := url.Values{}
+	if *force {
+		v.Set("force", "1")
+	}
+
 	var encounteredError error
 	for _, name := range cmd.Args() {
-		body, _, err := readBody(cli.call("DELETE", "/images/"+name, nil, false))
+		body, _, err := readBody(cli.call("DELETE", "/images/"+name+"?"+v.Encode(), nil, false))
 		if err != nil {
 			fmt.Fprintf(cli.err, "%s\n", err)
 			encounteredError = fmt.Errorf("Error: failed to remove one or more images")
diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index 0dd9d966e6..03f451fe8b 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -631,7 +631,7 @@ func deleteImages(eng *engine.Engine, version float64, w http.ResponseWriter, r
 	}
 	var job = eng.Job("image_delete", vars["name"])
 	streamJSON(job, w, false)
-	job.SetenvBool("autoPrune", version > 1.1)
+	job.Setenv("force", r.Form.Get("force"))
 
 	return job.Run()
 }
diff --git a/components/engine/integration/api_test.go b/components/engine/integration/api_test.go
index 5779e6b226..abbc1a1c59 100644
--- a/components/engine/integration/api_test.go
+++ b/components/engine/integration/api_test.go
@@ -1175,6 +1175,8 @@ func TestGetEnabledCors(t *testing.T) {
 
 func TestDeleteImages(t *testing.T) {
 	eng := NewTestEngine(t)
+	//we expect errors, so we disable stderr
+	eng.Stderr = ioutil.Discard
 	defer mkRuntimeFromEngine(eng, t).Nuke()
 
 	initialImages := getImages(eng, t, true, "")
diff --git a/components/engine/integration/commands_test.go b/components/engine/integration/commands_test.go
index a3359ec631..0cf7fda660 100644
--- a/components/engine/integration/commands_test.go
+++ b/components/engine/integration/commands_test.go
@@ -1031,7 +1031,10 @@ func TestContainerOrphaning(t *testing.T) {
 	buildSomething(template2, imageName)
 
 	// remove the second image by name
-	resp, err := srv.DeleteImage(imageName, true)
+	resp := engine.NewTable("", 0)
+	if err := srv.DeleteImage(imageName, resp, true, false); err == nil {
+		t.Fatal("Expected error, got none")
+	}
 
 	// see if we deleted the first image (and orphaned the container)
 	for _, i := range resp.Data {
diff --git a/components/engine/integration/server_test.go b/components/engine/integration/server_test.go
index 2234bcab08..8600e78573 100644
--- a/components/engine/integration/server_test.go
+++ b/components/engine/integration/server_test.go
@@ -35,7 +35,7 @@ func TestImageTagImageDelete(t *testing.T) {
 		t.Errorf("Expected %d images, %d found", nExpected, nActual)
 	}
 
-	if _, err := srv.DeleteImage("utest/docker:tag2", true); err != nil {
+	if err := srv.DeleteImage("utest/docker:tag2", engine.NewTable("", 0), true, false); err != nil {
 		t.Fatal(err)
 	}
 
@@ -47,7 +47,7 @@ func TestImageTagImageDelete(t *testing.T) {
 		t.Errorf("Expected %d images, %d found", nExpected, nActual)
 	}
 
-	if _, err := srv.DeleteImage("utest:5000/docker:tag3", true); err != nil {
+	if err := srv.DeleteImage("utest:5000/docker:tag3", engine.NewTable("", 0), true, false); err != nil {
 		t.Fatal(err)
 	}
 
@@ -56,7 +56,7 @@ func TestImageTagImageDelete(t *testing.T) {
 	nExpected = len(initialImages.Data[0].GetList("RepoTags")) + 1
 	nActual = len(images.Data[0].GetList("RepoTags"))
 
-	if _, err := srv.DeleteImage("utest:tag1", true); err != nil {
+	if err := srv.DeleteImage("utest:tag1", engine.NewTable("", 0), true, false); err != nil {
 		t.Fatal(err)
 	}
 
@@ -447,8 +447,7 @@ func TestRmi(t *testing.T) {
 		t.Fatalf("Expected 2 new images, found %d.", images.Len()-initialImages.Len())
 	}
 
-	_, err = srv.DeleteImage(imageID, true)
-	if err != nil {
+	if err = srv.DeleteImage(imageID, engine.NewTable("", 0), true, false); err != nil {
 		t.Fatal(err)
 	}
 
@@ -683,8 +682,8 @@ func TestDeleteTagWithExistingContainers(t *testing.T) {
 	}
 
 	// Try to remove the tag
-	imgs, err := srv.DeleteImage("utest:tag1", true)
-	if err != nil {
+	imgs := engine.NewTable("", 0)
+	if err := srv.DeleteImage("utest:tag1", imgs, true, false); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/components/engine/server.go b/components/engine/server.go
index 190ccbcc4b..91266c23b9 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -2,7 +2,6 @@ package docker
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"github.com/dotcloud/docker/archive"
 	"github.com/dotcloud/docker/auth"
@@ -1810,102 +1809,27 @@ func (srv *Server) ContainerDestroy(job *engine.Job) engine.Status {
 	return engine.StatusOK
 }
 
-var ErrImageReferenced = errors.New("Image referenced by a repository")
-
-func (srv *Server) deleteImageAndChildren(id string, imgs *engine.Table, byParents map[string][]*Image) error {
-	// If the image is referenced by a repo, do not delete
-	if len(srv.runtime.repositories.ByID()[id]) != 0 {
-		return ErrImageReferenced
-	}
-	// If the image is not referenced but has children, go recursive
-	referenced := false
-	for _, img := range byParents[id] {
-		if err := srv.deleteImageAndChildren(img.ID, imgs, byParents); err != nil {
-			if err != ErrImageReferenced {
-				return err
-			}
-			referenced = true
-		}
-	}
-	if referenced {
-		return ErrImageReferenced
-	}
-
-	// If the image is not referenced and has no children, remove it
-	byParents, err := srv.runtime.graph.ByParent()
-	if err != nil {
-		return err
-	}
-	if len(byParents[id]) == 0 && srv.canDeleteImage(id) == nil {
-		if err := srv.runtime.repositories.DeleteAll(id); err != nil {
-			return err
-		}
-		err := srv.runtime.graph.Delete(id)
-		if err != nil {
-			return err
-		}
-		out := &engine.Env{}
-		out.Set("Deleted", id)
-		imgs.Add(out)
-		srv.LogEvent("delete", id, "")
-		return nil
-	}
-	return nil
-}
-
-func (srv *Server) deleteImageParents(img *Image, imgs *engine.Table) error {
-	if img.Parent != "" {
-		parent, err := srv.runtime.graph.Get(img.Parent)
-		if err != nil {
-			return err
-		}
-		byParents, err := srv.runtime.graph.ByParent()
-		if err != nil {
-			return err
-		}
-		// Remove all children images
-		if err := srv.deleteImageAndChildren(img.Parent, imgs, byParents); err != nil {
-			return err
-		}
-		return srv.deleteImageParents(parent, imgs)
-	}
-	return nil
-}
-
-func (srv *Server) DeleteImage(name string, autoPrune bool) (*engine.Table, error) {
+func (srv *Server) DeleteImage(name string, imgs *engine.Table, first, force bool) error {
 	var (
 		repoName, tag string
 		img, err      = srv.runtime.repositories.LookupImage(name)
-		imgs          = engine.NewTable("", 0)
 		tags          = []string{}
 	)
 
 	if err != nil {
-		return nil, fmt.Errorf("No such image: %s", name)
-	}
-
-	// FIXME: What does autoPrune mean ?
-	if !autoPrune {
-		if err := srv.runtime.graph.Delete(img.ID); err != nil {
-			return nil, fmt.Errorf("Cannot delete image %s: %s", name, err)
-		}
-		return nil, nil
+		return fmt.Errorf("No such image: %s", name)
 	}
 
 	if !strings.Contains(img.ID, name) {
 		repoName, tag = utils.ParseRepositoryTag(name)
+		if tag == "" {
+			tag = DEFAULTTAG
+		}
 	}
 
-	// If we have a repo and the image is not referenced anywhere else
-	// then just perform an untag and do not validate.
-	//
-	// i.e. only validate if we are performing an actual delete and not
-	// an untag op
-	if repoName != "" && len(srv.runtime.repositories.ByID()[img.ID]) == 1 {
-		// Prevent deletion if image is used by a container
-		if err := srv.canDeleteImage(img.ID); err != nil {
-			return nil, err
-		}
+	byParents, err := srv.runtime.graph.ByParent()
+	if err != nil {
+		return err
 	}
 
 	//If delete by id, see if the id belong only to one repository
@@ -1917,10 +1841,10 @@ func (srv *Server) DeleteImage(name string, autoPrune bool) (*engine.Table, erro
 				if parsedTag != "" {
 					tags = append(tags, parsedTag)
 				}
-			} else if repoName != parsedRepo {
+			} else if repoName != parsedRepo && !force {
 				// the id belongs to multiple repos, like base:latest and user:test,
 				// in that case return conflict
-				return nil, fmt.Errorf("Conflict, cannot delete image %s because it is tagged in multiple repositories", utils.TruncateID(img.ID))
+				return fmt.Errorf("Conflict, cannot delete image %s because it is tagged in multiple repositories, use -f to force", name)
 			}
 		}
 	} else {
@@ -1931,37 +1855,51 @@ func (srv *Server) DeleteImage(name string, autoPrune bool) (*engine.Table, erro
 	for _, tag := range tags {
 		tagDeleted, err := srv.runtime.repositories.Delete(repoName, tag)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		if tagDeleted {
 			out := &engine.Env{}
-			out.Set("Untagged", img.ID)
+			out.Set("Untagged", repoName+":"+tag)
 			imgs.Add(out)
 			srv.LogEvent("untag", img.ID, "")
 		}
 	}
+	tags = srv.runtime.repositories.ByID()[img.ID]
+	if (len(tags) <= 1 && repoName == "") || len(tags) == 0 {
+		if len(byParents[img.ID]) == 0 {
+			if err := srv.canDeleteImage(img.ID); err != nil {
+				return err
+			}
+			if err := srv.runtime.repositories.DeleteAll(img.ID); err != nil {
+				return err
+			}
+			err := srv.runtime.graph.Delete(img.ID)
+			if err != nil {
+				return err
+			}
+			out := &engine.Env{}
+			out.Set("Deleted", img.ID)
+			imgs.Add(out)
+			srv.LogEvent("delete", img.ID, "")
+			if img.Parent != "" {
+				err := srv.DeleteImage(img.Parent, imgs, false, force)
+				if first {
+					return err
+				}
 
-	if len(srv.runtime.repositories.ByID()[img.ID]) == 0 {
-		if err := srv.deleteImageAndChildren(img.ID, imgs, nil); err != nil {
-			if err != ErrImageReferenced {
-				return imgs, err
-			}
-		} else if err := srv.deleteImageParents(img, imgs); err != nil {
-			if err != ErrImageReferenced {
-				return imgs, err
 			}
+
 		}
 	}
-	return imgs, nil
+	return nil
 }
 
 func (srv *Server) ImageDelete(job *engine.Job) engine.Status {
 	if n := len(job.Args); n != 1 {
 		return job.Errorf("Usage: %s IMAGE", job.Name)
 	}
-
-	imgs, err := srv.DeleteImage(job.Args[0], job.GetenvBool("autoPrune"))
-	if err != nil {
+	var imgs = engine.NewTable("", 0)
+	if err := srv.DeleteImage(job.Args[0], imgs, true, job.GetenvBool("force")); err != nil {
 		return job.Error(err)
 	}
 	if len(imgs.Data) == 0 {

From 0820020142dd0e9b25ef9ba1ddbdd6234ec08a9c Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Fri, 14 Feb 2014 22:53:53 +0000
Subject: [PATCH 281/403] bump API version

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: e7cc88c39f302c020f70a00bca54bddeecb608a4
Component: engine
---
 components/engine/api/client.go               |    6 +-
 components/engine/api/common.go               |    2 +-
 components/engine/api/server.go               |  128 +-
 .../reference/api/docker_remote_api.rst       |   20 +-
 .../reference/api/docker_remote_api_v1.10.rst | 1282 +++++++++++++++++
 components/engine/utils/utils.go              |   22 +
 components/engine/utils/utils_test.go         |   20 +
 7 files changed, 1405 insertions(+), 75 deletions(-)
 create mode 100644 components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index 7acf63f9ca..da2e7730f1 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -2038,7 +2038,7 @@ func (cli *DockerCli) call(method, path string, data interface{}, passAuthInfo b
 	re := regexp.MustCompile("/+")
 	path = re.ReplaceAllString(path, "/")
 
-	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", APIVERSION, path), params)
+	req, err := http.NewRequest(method, fmt.Sprintf("/v%s%s", APIVERSION, path), params)
 	if err != nil {
 		return nil, -1, err
 	}
@@ -2115,7 +2115,7 @@ func (cli *DockerCli) stream(method, path string, in io.Reader, out io.Writer, h
 	re := regexp.MustCompile("/+")
 	path = re.ReplaceAllString(path, "/")
 
-	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", APIVERSION, path), in)
+	req, err := http.NewRequest(method, fmt.Sprintf("/v%s%s", APIVERSION, path), in)
 	if err != nil {
 		return err
 	}
@@ -2179,7 +2179,7 @@ func (cli *DockerCli) hijack(method, path string, setRawTerminal bool, in io.Rea
 	re := regexp.MustCompile("/+")
 	path = re.ReplaceAllString(path, "/")
 
-	req, err := http.NewRequest(method, fmt.Sprintf("/v%g%s", APIVERSION, path), nil)
+	req, err := http.NewRequest(method, fmt.Sprintf("/v%s%s", APIVERSION, path), nil)
 	if err != nil {
 		return err
 	}
diff --git a/components/engine/api/common.go b/components/engine/api/common.go
index c79b16fda2..10e7ddb4ae 100644
--- a/components/engine/api/common.go
+++ b/components/engine/api/common.go
@@ -9,7 +9,7 @@ import (
 )
 
 const (
-	APIVERSION        = 1.9
+	APIVERSION        = "1.10"
 	DEFAULTHTTPHOST   = "127.0.0.1"
 	DEFAULTUNIXSOCKET = "/var/run/docker.sock"
 )
diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index 03f451fe8b..007c07ddb8 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -32,7 +32,7 @@ var (
 	activationLock chan struct{}
 )
 
-type HttpApiFunc func(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error
+type HttpApiFunc func(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error
 
 func hijackServer(w http.ResponseWriter) (io.ReadCloser, io.Writer, error) {
 	conn, _, err := w.(http.Hijacker).Hijack()
@@ -113,7 +113,7 @@ func getBoolParam(value string) (bool, error) {
 	return ret, nil
 }
 
-func postAuth(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postAuth(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	var (
 		authConfig, err = ioutil.ReadAll(r.Body)
 		job             = eng.Job("auth")
@@ -136,13 +136,13 @@ func postAuth(eng *engine.Engine, version float64, w http.ResponseWriter, r *htt
 	return nil
 }
 
-func getVersion(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getVersion(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	w.Header().Set("Content-Type", "application/json")
 	eng.ServeHTTP(w, r)
 	return nil
 }
 
-func postContainersKill(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersKill(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -160,7 +160,7 @@ func postContainersKill(eng *engine.Engine, version float64, w http.ResponseWrit
 	return nil
 }
 
-func getContainersExport(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getContainersExport(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -172,7 +172,7 @@ func getContainersExport(eng *engine.Engine, version float64, w http.ResponseWri
 	return nil
 }
 
-func getImagesJSON(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesJSON(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -186,7 +186,7 @@ func getImagesJSON(eng *engine.Engine, version float64, w http.ResponseWriter, r
 	job.Setenv("filter", r.Form.Get("filter"))
 	job.Setenv("all", r.Form.Get("all"))
 
-	if version >= 1.7 {
+	if utils.CompareVersion(version, "1.7") >= 0 {
 		streamJSON(job, w, false)
 	} else if outs, err = job.Stdout.AddListTable(); err != nil {
 		return err
@@ -196,7 +196,7 @@ func getImagesJSON(eng *engine.Engine, version float64, w http.ResponseWriter, r
 		return err
 	}
 
-	if version < 1.7 && outs != nil { // Convert to legacy format
+	if utils.CompareVersion(version, "1.7") < 0 && outs != nil { // Convert to legacy format
 		outsLegacy := engine.NewTable("Created", 0)
 		for _, out := range outs.Data {
 			for _, repoTag := range out.GetList("RepoTags") {
@@ -219,8 +219,8 @@ func getImagesJSON(eng *engine.Engine, version float64, w http.ResponseWriter, r
 	return nil
 }
 
-func getImagesViz(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
-	if version > 1.6 {
+func getImagesViz(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	if utils.CompareVersion(version, "1.6") > 0 {
 		w.WriteHeader(http.StatusNotFound)
 		return fmt.Errorf("This is now implemented in the client.")
 	}
@@ -228,13 +228,13 @@ func getImagesViz(eng *engine.Engine, version float64, w http.ResponseWriter, r
 	return nil
 }
 
-func getInfo(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getInfo(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	w.Header().Set("Content-Type", "application/json")
 	eng.ServeHTTP(w, r)
 	return nil
 }
 
-func getEvents(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getEvents(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -245,7 +245,7 @@ func getEvents(eng *engine.Engine, version float64, w http.ResponseWriter, r *ht
 	return job.Run()
 }
 
-func getImagesHistory(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesHistory(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -259,7 +259,7 @@ func getImagesHistory(eng *engine.Engine, version float64, w http.ResponseWriter
 	return nil
 }
 
-func getContainersChanges(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getContainersChanges(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -269,8 +269,8 @@ func getContainersChanges(eng *engine.Engine, version float64, w http.ResponseWr
 	return job.Run()
 }
 
-func getContainersTop(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
-	if version < 1.4 {
+func getContainersTop(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	if utils.CompareVersion(version, "1.4") < 0 {
 		return fmt.Errorf("top was improved a lot since 1.3, Please upgrade your docker client.")
 	}
 	if vars == nil {
@@ -285,7 +285,7 @@ func getContainersTop(eng *engine.Engine, version float64, w http.ResponseWriter
 	return job.Run()
 }
 
-func getContainersJSON(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getContainersJSON(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -301,7 +301,7 @@ func getContainersJSON(eng *engine.Engine, version float64, w http.ResponseWrite
 	job.Setenv("before", r.Form.Get("before"))
 	job.Setenv("limit", r.Form.Get("limit"))
 
-	if version >= 1.5 {
+	if utils.CompareVersion(version, "1.5") >= 0 {
 		streamJSON(job, w, false)
 	} else if outs, err = job.Stdout.AddTable(); err != nil {
 		return err
@@ -309,7 +309,7 @@ func getContainersJSON(eng *engine.Engine, version float64, w http.ResponseWrite
 	if err = job.Run(); err != nil {
 		return err
 	}
-	if version < 1.5 { // Convert to legacy format
+	if utils.CompareVersion(version, "1.5") < 0 { // Convert to legacy format
 		for _, out := range outs.Data {
 			ports := engine.NewTable("", 0)
 			ports.ReadListFrom([]byte(out.Get("Ports")))
@@ -323,7 +323,7 @@ func getContainersJSON(eng *engine.Engine, version float64, w http.ResponseWrite
 	return nil
 }
 
-func postImagesTag(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesTag(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -340,7 +340,7 @@ func postImagesTag(eng *engine.Engine, version float64, w http.ResponseWriter, r
 	return nil
 }
 
-func postCommit(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postCommit(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -369,7 +369,7 @@ func postCommit(eng *engine.Engine, version float64, w http.ResponseWriter, r *h
 }
 
 // Creates an image from Pull or from Import
-func postImagesCreate(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesCreate(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -389,9 +389,6 @@ func postImagesCreate(eng *engine.Engine, version float64, w http.ResponseWriter
 			authConfig = &auth.AuthConfig{}
 		}
 	}
-	if version > 1.0 {
-		w.Header().Set("Content-Type", "application/json")
-	}
 	if image != "" { //pull
 		metaHeaders := map[string][]string{}
 		for k, v := range r.Header {
@@ -400,7 +397,7 @@ func postImagesCreate(eng *engine.Engine, version float64, w http.ResponseWriter
 			}
 		}
 		job = eng.Job("pull", r.Form.Get("fromImage"), tag)
-		job.SetenvBool("parallel", version > 1.3)
+		job.SetenvBool("parallel", utils.CompareVersion(version, "1.3") > 0)
 		job.SetenvJson("metaHeaders", metaHeaders)
 		job.SetenvJson("authConfig", authConfig)
 	} else { //import
@@ -408,7 +405,7 @@ func postImagesCreate(eng *engine.Engine, version float64, w http.ResponseWriter
 		job.Stdin.Add(r.Body)
 	}
 
-	if version > 1.0 {
+	if utils.CompareVersion(version, "1.0") > 0 {
 		job.SetenvBool("json", true)
 		streamJSON(job, w, true)
 	} else {
@@ -418,14 +415,14 @@ func postImagesCreate(eng *engine.Engine, version float64, w http.ResponseWriter
 		if !job.Stdout.Used() {
 			return err
 		}
-		sf := utils.NewStreamFormatter(version > 1.0)
+		sf := utils.NewStreamFormatter(utils.CompareVersion(version, "1.0") > 0)
 		w.Write(sf.FormatError(err))
 	}
 
 	return nil
 }
 
-func getImagesSearch(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesSearch(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -457,19 +454,15 @@ func getImagesSearch(eng *engine.Engine, version float64, w http.ResponseWriter,
 	return job.Run()
 }
 
-func postImagesInsert(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesInsert(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
-	if version > 1.0 {
-		w.Header().Set("Content-Type", "application/json")
-	}
-
 	job := eng.Job("insert", vars["name"], r.Form.Get("url"), r.Form.Get("path"))
-	if version > 1.0 {
+	if utils.CompareVersion(version, "1.0") > 0 {
 		job.SetenvBool("json", true)
 		streamJSON(job, w, false)
 	} else {
@@ -479,14 +472,14 @@ func postImagesInsert(eng *engine.Engine, version float64, w http.ResponseWriter
 		if !job.Stdout.Used() {
 			return err
 		}
-		sf := utils.NewStreamFormatter(version > 1.0)
+		sf := utils.NewStreamFormatter(utils.CompareVersion(version, "1.0") > 0)
 		w.Write(sf.FormatError(err))
 	}
 
 	return nil
 }
 
-func postImagesPush(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesPush(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -517,13 +510,10 @@ func postImagesPush(eng *engine.Engine, version float64, w http.ResponseWriter,
 		}
 	}
 
-	if version > 1.0 {
-		w.Header().Set("Content-Type", "application/json")
-	}
 	job := eng.Job("push", vars["name"])
 	job.SetenvJson("metaHeaders", metaHeaders)
 	job.SetenvJson("authConfig", authConfig)
-	if version > 1.0 {
+	if utils.CompareVersion(version, "1.0") > 0 {
 		job.SetenvBool("json", true)
 		streamJSON(job, w, true)
 	} else {
@@ -534,17 +524,17 @@ func postImagesPush(eng *engine.Engine, version float64, w http.ResponseWriter,
 		if !job.Stdout.Used() {
 			return err
 		}
-		sf := utils.NewStreamFormatter(version > 1.0)
+		sf := utils.NewStreamFormatter(utils.CompareVersion(version, "1.0") > 0)
 		w.Write(sf.FormatError(err))
 	}
 	return nil
 }
 
-func getImagesGet(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesGet(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
-	if version > 1.0 {
+	if utils.CompareVersion(version, "1.0") > 0 {
 		w.Header().Set("Content-Type", "application/x-tar")
 	}
 	job := eng.Job("image_export", vars["name"])
@@ -552,13 +542,13 @@ func getImagesGet(eng *engine.Engine, version float64, w http.ResponseWriter, r
 	return job.Run()
 }
 
-func postImagesLoad(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesLoad(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	job := eng.Job("load")
 	job.Stdin.Add(r.Body)
 	return job.Run()
 }
 
-func postContainersCreate(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersCreate(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return nil
 	}
@@ -589,7 +579,7 @@ func postContainersCreate(eng *engine.Engine, version float64, w http.ResponseWr
 	return writeJSON(w, http.StatusCreated, out)
 }
 
-func postContainersRestart(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersRestart(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -605,7 +595,7 @@ func postContainersRestart(eng *engine.Engine, version float64, w http.ResponseW
 	return nil
 }
 
-func deleteContainers(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func deleteContainers(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -622,7 +612,7 @@ func deleteContainers(eng *engine.Engine, version float64, w http.ResponseWriter
 	return nil
 }
 
-func deleteImages(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func deleteImages(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -636,7 +626,7 @@ func deleteImages(eng *engine.Engine, version float64, w http.ResponseWriter, r
 	return job.Run()
 }
 
-func postContainersStart(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersStart(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -657,7 +647,7 @@ func postContainersStart(eng *engine.Engine, version float64, w http.ResponseWri
 	return nil
 }
 
-func postContainersStop(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersStop(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -673,7 +663,7 @@ func postContainersStop(eng *engine.Engine, version float64, w http.ResponseWrit
 	return nil
 }
 
-func postContainersWait(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersWait(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -695,7 +685,7 @@ func postContainersWait(eng *engine.Engine, version float64, w http.ResponseWrit
 	return writeJSON(w, http.StatusOK, env)
 }
 
-func postContainersResize(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersResize(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -708,7 +698,7 @@ func postContainersResize(eng *engine.Engine, version float64, w http.ResponseWr
 	return nil
 }
 
-func postContainersAttach(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersAttach(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -750,7 +740,7 @@ func postContainersAttach(eng *engine.Engine, version float64, w http.ResponseWr
 
 	fmt.Fprintf(outStream, "HTTP/1.1 200 OK\r\nContent-Type: application/vnd.docker.raw-stream\r\n\r\n")
 
-	if c.GetSubEnv("Config") != nil && !c.GetSubEnv("Config").GetBool("Tty") && version >= 1.6 {
+	if c.GetSubEnv("Config") != nil && !c.GetSubEnv("Config").GetBool("Tty") && utils.CompareVersion(version, "1.6") >= 0 {
 		errStream = utils.NewStdWriter(outStream, utils.Stderr)
 		outStream = utils.NewStdWriter(outStream, utils.Stdout)
 	} else {
@@ -773,7 +763,7 @@ func postContainersAttach(eng *engine.Engine, version float64, w http.ResponseWr
 	return nil
 }
 
-func wsContainersAttach(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func wsContainersAttach(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -805,7 +795,7 @@ func wsContainersAttach(eng *engine.Engine, version float64, w http.ResponseWrit
 	return nil
 }
 
-func getContainersByName(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getContainersByName(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -815,7 +805,7 @@ func getContainersByName(eng *engine.Engine, version float64, w http.ResponseWri
 	return job.Run()
 }
 
-func getImagesByName(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesByName(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -825,8 +815,8 @@ func getImagesByName(eng *engine.Engine, version float64, w http.ResponseWriter,
 	return job.Run()
 }
 
-func postBuild(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
-	if version < 1.3 {
+func postBuild(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	if utils.CompareVersion(version, "1.3") < 0 {
 		return fmt.Errorf("Multipart upload for build is no longer supported. Please upgrade your docker client.")
 	}
 	var (
@@ -841,7 +831,7 @@ func postBuild(eng *engine.Engine, version float64, w http.ResponseWriter, r *ht
 	// Both headers will be parsed and sent along to the daemon, but if a non-empty
 	// ConfigFile is present, any value provided as an AuthConfig directly will
 	// be overridden. See BuildFile::CmdFrom for details.
-	if version < 1.9 && authEncoded != "" {
+	if utils.CompareVersion(version, "1.9") < 0 && authEncoded != "" {
 		authJson := base64.NewDecoder(base64.URLEncoding, strings.NewReader(authEncoded))
 		if err := json.NewDecoder(authJson).Decode(authConfig); err != nil {
 			// for a pull it is not an error if no auth was given
@@ -859,7 +849,7 @@ func postBuild(eng *engine.Engine, version float64, w http.ResponseWriter, r *ht
 		}
 	}
 
-	if version >= 1.8 {
+	if utils.CompareVersion(version, "1.8") >= 0 {
 		job.SetenvBool("json", true)
 		streamJSON(job, w, true)
 	} else {
@@ -878,13 +868,13 @@ func postBuild(eng *engine.Engine, version float64, w http.ResponseWriter, r *ht
 		if !job.Stdout.Used() {
 			return err
 		}
-		sf := utils.NewStreamFormatter(version >= 1.8)
+		sf := utils.NewStreamFormatter(utils.CompareVersion(version, "1.8") >= 0)
 		w.Write(sf.FormatError(err))
 	}
 	return nil
 }
 
-func postContainersCopy(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersCopy(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -917,7 +907,7 @@ func postContainersCopy(eng *engine.Engine, version float64, w http.ResponseWrit
 	return nil
 }
 
-func optionsHandler(eng *engine.Engine, version float64, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func optionsHandler(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	w.WriteHeader(http.StatusOK)
 	return nil
 }
@@ -942,16 +932,16 @@ func makeHttpHandler(eng *engine.Engine, logging bool, localMethod string, local
 				utils.Debugf("Warning: client and server don't have the same version (client: %s, server: %s)", userAgent[1], dockerVersion)
 			}
 		}
-		version, err := strconv.ParseFloat(mux.Vars(r)["version"], 64)
-		if err != nil {
+		version := mux.Vars(r)["version"]
+		if version == "" {
 			version = APIVERSION
 		}
 		if enableCors {
 			writeCorsHeaders(w, r)
 		}
 
-		if version == 0 || version > APIVERSION {
-			http.Error(w, fmt.Errorf("client and server don't have same version (client : %g, server: %g)", version, APIVERSION).Error(), http.StatusNotFound)
+		if utils.CompareVersion(version, APIVERSION) == 1 {
+			http.Error(w, fmt.Errorf("client and server don't have same version (client : %s, server: %s)", version, APIVERSION).Error(), http.StatusNotFound)
 			return
 		}
 
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api.rst b/components/engine/docs/sources/reference/api/docker_remote_api.rst
index 69bbf71ec9..51c4a06c91 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api.rst
@@ -26,15 +26,31 @@ Docker Remote API
 2. Versions
 ===========
 
-The current version of the API is 1.9
+The current version of the API is 1.10
 
 Calling /images/<name>/insert is the same as calling
-/v1.9/images/<name>/insert
+/v1.10/images/<name>/insert
 
 You can still call an old version of the api using
 /v1.0/images/<name>/insert
 
 
+v1.10
+****
+
+Full Documentation
+------------------
+
+:doc:`docker_remote_api_v1.10`
+
+What's new
+----------
+
+.. http:delete:: /images/(name)
+
+   **New!** You can now use the force parameter to force delete of an image, even if it's
+   tagged in multiple repositories.
+
 v1.9
 ****
 
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst
new file mode 100644
index 0000000000..6ee3febc27
--- /dev/null
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst
@@ -0,0 +1,1282 @@
+:title: Remote API v1.9
+:description: API Documentation for Docker
+:keywords: API, Docker, rcli, REST, documentation
+
+:orphan:
+
+======================
+Docker Remote API v1.9
+======================
+
+.. contents:: Table of Contents
+
+1. Brief introduction
+=====================
+
+- The Remote API has replaced rcli
+- The daemon listens on ``unix:///var/run/docker.sock``, but you can
+  :ref:`bind_docker`.
+- The API tends to be REST, but for some complex commands, like
+  ``attach`` or ``pull``, the HTTP connection is hijacked to transport
+  ``stdout, stdin`` and ``stderr``
+
+2. Endpoints
+============
+
+2.1 Containers
+--------------
+
+List containers
+***************
+
+.. http:get:: /containers/json
+
+        List containers
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /containers/json?all=1&before=8dfafdbc3a40&size=1 HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           [
+                {
+                        "Id": "8dfafdbc3a40",
+                        "Image": "base:latest",
+                        "Command": "echo 1",
+                        "Created": 1367854155,
+                        "Status": "Exit 0",
+                        "Ports":[{"PrivatePort": 2222, "PublicPort": 3333, "Type": "tcp"}],
+                        "SizeRw":12288,
+                        "SizeRootFs":0
+                },
+                {
+                        "Id": "9cd87474be90",
+                        "Image": "base:latest",
+                        "Command": "echo 222222",
+                        "Created": 1367854155,
+                        "Status": "Exit 0",
+                        "Ports":[],
+                        "SizeRw":12288,
+                        "SizeRootFs":0
+                },
+                {
+                        "Id": "3176a2479c92",
+                        "Image": "base:latest",
+                        "Command": "echo 3333333333333333",
+                        "Created": 1367854154,
+                        "Status": "Exit 0",
+                        "Ports":[],
+                        "SizeRw":12288,
+                        "SizeRootFs":0
+                },
+                {
+                        "Id": "4cb07b47f9fb",
+                        "Image": "base:latest",
+                        "Command": "echo 444444444444444444444444444444444",
+                        "Created": 1367854152,
+                        "Status": "Exit 0",
+                        "Ports":[],
+                        "SizeRw":12288,
+                        "SizeRootFs":0
+                }
+           ]
+
+        :query all: 1/True/true or 0/False/false, Show all containers. Only running containers are shown by default
+        :query limit: Show ``limit`` last created containers, include non-running ones.
+        :query since: Show only containers created since Id, include non-running ones.
+        :query before: Show only containers created before Id, include non-running ones.
+        :query size: 1/True/true or 0/False/false, Show the containers sizes
+        :statuscode 200: no error
+        :statuscode 400: bad parameter
+        :statuscode 500: server error
+
+
+Create a container
+******************
+
+.. http:post:: /containers/create
+
+        Create a container
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /containers/create HTTP/1.1
+           Content-Type: application/json
+
+           {
+                "Hostname":"",
+                "User":"",
+                "Memory":0,
+                "MemorySwap":0,
+                "AttachStdin":false,
+                "AttachStdout":true,
+                "AttachStderr":true,
+                "PortSpecs":null,
+                "Tty":false,
+                "OpenStdin":false,
+                "StdinOnce":false,
+                "Env":null,
+                "Cmd":[
+                        "date"
+                ],
+                "Dns":null,
+                "Image":"base",
+                "Volumes":{
+                        "/tmp": {}
+                },
+                "VolumesFrom":"",
+                "WorkingDir":"",
+                "ExposedPorts":{
+                        "22/tcp": {}
+                }
+           }
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 201 OK
+           Content-Type: application/json
+
+           {
+                "Id":"e90e34656806"
+                "Warnings":[]
+           }
+
+        :jsonparam config: the container's configuration
+        :query name: Assign the specified name to the container. Must match ``/?[a-zA-Z0-9_-]+``.
+        :statuscode 201: no error
+        :statuscode 404: no such container
+        :statuscode 406: impossible to attach (container not running)
+        :statuscode 500: server error
+
+
+Inspect a container
+*******************
+
+.. http:get:: /containers/(id)/json
+
+        Return low-level information on the container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /containers/4fa6e0f0c678/json HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {
+                        "Id": "4fa6e0f0c6786287e131c3852c58a2e01cc697a68231826813597e4994f1d6e2",
+                        "Created": "2013-05-07T14:51:42.041847+02:00",
+                        "Path": "date",
+                        "Args": [],
+                        "Config": {
+                                "Hostname": "4fa6e0f0c678",
+                                "User": "",
+                                "Memory": 0,
+                                "MemorySwap": 0,
+                                "AttachStdin": false,
+                                "AttachStdout": true,
+                                "AttachStderr": true,
+                                "PortSpecs": null,
+                                "Tty": false,
+                                "OpenStdin": false,
+                                "StdinOnce": false,
+                                "Env": null,
+                                "Cmd": [
+                                        "date"
+                                ],
+                                "Dns": null,
+                                "Image": "base",
+                                "Volumes": {},
+                                "VolumesFrom": "",
+                                "WorkingDir":""
+
+                        },
+                        "State": {
+                                "Running": false,
+                                "Pid": 0,
+                                "ExitCode": 0,
+                                "StartedAt": "2013-05-07T14:51:42.087658+02:01360",
+                                "Ghost": false
+                        },
+                        "Image": "b750fe79269d2ec9a3c593ef05b4332b1d1a02a62b4accb2c21d589ff2f5f2dc",
+                        "NetworkSettings": {
+                                "IpAddress": "",
+                                "IpPrefixLen": 0,
+                                "Gateway": "",
+                                "Bridge": "",
+                                "PortMapping": null
+                        },
+                        "SysInitPath": "/home/kitty/go/src/github.com/dotcloud/docker/bin/docker",
+                        "ResolvConfPath": "/etc/resolv.conf",
+                        "Volumes": {},
+                        "HostConfig": {
+                            "Binds": null,
+                            "ContainerIDFile": "",
+                            "LxcConf": [],
+                            "Privileged": false,
+                            "PortBindings": {
+                               "80/tcp": [
+                                   {
+                                       "HostIp": "0.0.0.0",
+                                       "HostPort": "49153"
+                                   }
+                               ]
+                            },
+                            "Links": null,
+                            "PublishAllPorts": false
+                        }
+           }
+
+        :statuscode 200: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+List processes running inside a container
+*****************************************
+
+.. http:get:: /containers/(id)/top
+
+        List processes running inside the container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /containers/4fa6e0f0c678/top HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {
+                "Titles":[
+                        "USER",
+                        "PID",
+                        "%CPU",
+                        "%MEM",
+                        "VSZ",
+                        "RSS",
+                        "TTY",
+                        "STAT",
+                        "START",
+                        "TIME",
+                        "COMMAND"
+                        ],
+                "Processes":[
+                        ["root","20147","0.0","0.1","18060","1864","pts/4","S","10:06","0:00","bash"],
+                        ["root","20271","0.0","0.0","4312","352","pts/4","S+","10:07","0:00","sleep","10"]
+                ]
+           }
+
+        :query ps_args: ps arguments to use (eg. aux)
+        :statuscode 200: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Inspect changes on a container's filesystem
+*******************************************
+
+.. http:get:: /containers/(id)/changes
+
+        Inspect changes on container ``id`` 's filesystem
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /containers/4fa6e0f0c678/changes HTTP/1.1
+
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           [
+                {
+                        "Path":"/dev",
+                        "Kind":0
+                },
+                {
+                        "Path":"/dev/kmsg",
+                        "Kind":1
+                },
+                {
+                        "Path":"/test",
+                        "Kind":1
+                }
+           ]
+
+        :statuscode 200: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Export a container
+******************
+
+.. http:get:: /containers/(id)/export
+
+        Export the contents of container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /containers/4fa6e0f0c678/export HTTP/1.1
+
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/octet-stream
+
+           {{ STREAM }}
+
+        :statuscode 200: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Start a container
+*****************
+
+.. http:post:: /containers/(id)/start
+
+        Start the container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /containers/(id)/start HTTP/1.1
+           Content-Type: application/json
+
+           {
+                "Binds":["/tmp:/tmp"],
+                "LxcConf":{"lxc.utsname":"docker"},
+                "PortBindings":{ "22/tcp": [{ "HostPort": "11022" }] },
+                "PublishAllPorts":false,
+                "Privileged":false
+           }
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 204 No Content
+           Content-Type: text/plain
+
+        :jsonparam hostConfig: the container's host configuration (optional)
+        :statuscode 204: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Stop a container
+****************
+
+.. http:post:: /containers/(id)/stop
+
+        Stop the container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /containers/e90e34656806/stop?t=5 HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 204 OK
+
+        :query t: number of seconds to wait before killing the container
+        :statuscode 204: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Restart a container
+*******************
+
+.. http:post:: /containers/(id)/restart
+
+        Restart the container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /containers/e90e34656806/restart?t=5 HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 204 OK
+
+        :query t: number of seconds to wait before killing the container
+        :statuscode 204: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Kill a container
+****************
+
+.. http:post:: /containers/(id)/kill
+
+        Kill the container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /containers/e90e34656806/kill HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 204 OK
+
+        :statuscode 204: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Attach to a container
+*********************
+
+.. http:post:: /containers/(id)/attach
+
+        Attach to the container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /containers/16253994b7c4/attach?logs=1&stream=0&stdout=1 HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/vnd.docker.raw-stream
+
+           {{ STREAM }}
+
+        :query logs: 1/True/true or 0/False/false, return logs. Default false
+        :query stream: 1/True/true or 0/False/false, return stream. Default false
+        :query stdin: 1/True/true or 0/False/false, if stream=true, attach to stdin. Default false
+        :query stdout: 1/True/true or 0/False/false, if logs=true, return stdout log, if stream=true, attach to stdout. Default false
+        :query stderr: 1/True/true or 0/False/false, if logs=true, return stderr log, if stream=true, attach to stderr. Default false
+        :statuscode 200: no error
+        :statuscode 400: bad parameter
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+        **Stream details**:
+
+        When using the TTY setting is enabled in
+        :http:post:`/containers/create`, the stream is the raw data
+        from the process PTY and client's stdin.  When the TTY is
+        disabled, then the stream is multiplexed to separate stdout
+        and stderr.
+
+        The format is a **Header** and a **Payload** (frame).
+
+        **HEADER**
+
+        The header will contain the information on which stream write
+        the stream (stdout or stderr). It also contain the size of
+        the associated frame encoded on the last 4 bytes (uint32).
+
+        It is encoded on the first 8 bytes like this::
+
+            header := [8]byte{STREAM_TYPE, 0, 0, 0, SIZE1, SIZE2, SIZE3, SIZE4}
+
+        ``STREAM_TYPE`` can be:
+
+        - 0: stdin (will be writen on stdout)
+        - 1: stdout
+        - 2: stderr
+
+        ``SIZE1, SIZE2, SIZE3, SIZE4`` are the 4 bytes of the uint32 size encoded as big endian.
+
+        **PAYLOAD**
+
+        The payload is the raw stream.
+
+        **IMPLEMENTATION**
+
+        The simplest way to implement the Attach protocol is the following:
+
+        1) Read 8 bytes
+        2) chose stdout or stderr depending on the first byte
+        3) Extract the frame size from the last 4 byets
+        4) Read the extracted size and output it on the correct output
+        5) Goto 1)
+
+
+
+Wait a container
+****************
+
+.. http:post:: /containers/(id)/wait
+
+        Block until container ``id`` stops, then returns the exit code
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /containers/16253994b7c4/wait HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {"StatusCode":0}
+
+        :statuscode 200: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Remove a container
+*******************
+
+.. http:delete:: /containers/(id)
+
+        Remove the container ``id`` from the filesystem
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           DELETE /containers/16253994b7c4?v=1 HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 204 OK
+
+        :query v: 1/True/true or 0/False/false, Remove the volumes associated to the container. Default false
+        :statuscode 204: no error
+        :statuscode 400: bad parameter
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+Copy files or folders from a container
+**************************************
+
+.. http:post:: /containers/(id)/copy
+
+        Copy files or folders of container ``id``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /containers/4fa6e0f0c678/copy HTTP/1.1
+           Content-Type: application/json
+
+           {
+                "Resource":"test.txt"
+           }
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/octet-stream
+
+           {{ STREAM }}
+
+        :statuscode 200: no error
+        :statuscode 404: no such container
+        :statuscode 500: server error
+
+
+2.2 Images
+----------
+
+List Images
+***********
+
+.. http:get:: /images/json
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /images/json?all=0 HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           [
+             {
+                "RepoTags": [
+                  "ubuntu:12.04",
+                  "ubuntu:precise",
+                  "ubuntu:latest"
+                ],
+                "Id": "8dbd9e392a964056420e5d58ca5cc376ef18e2de93b5cc90e868a1bbc8318c1c",
+                "Created": 1365714795,
+                "Size": 131506275,
+                "VirtualSize": 131506275
+             },
+             {
+                "RepoTags": [
+                  "ubuntu:12.10",
+                  "ubuntu:quantal"
+                ],
+                "ParentId": "27cf784147099545",
+                "Id": "b750fe79269d2ec9a3c593ef05b4332b1d1a02a62b4accb2c21d589ff2f5f2dc",
+                "Created": 1364102658,
+                "Size": 24653,
+                "VirtualSize": 180116135
+             }
+           ]
+
+
+Create an image
+***************
+
+.. http:post:: /images/create
+
+        Create an image, either by pull it from the registry or by importing it
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /images/create?fromImage=base HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {"status":"Pulling..."}
+           {"status":"Pulling", "progress":"1 B/ 100 B", "progressDetail":{"current":1, "total":100}}
+           {"error":"Invalid..."}
+           ...
+
+        When using this endpoint to pull an image from the registry,
+        the ``X-Registry-Auth`` header can be used to include a
+        base64-encoded AuthConfig object.
+
+        :query fromImage: name of the image to pull
+        :query fromSrc: source to import, - means stdin
+        :query repo: repository
+        :query tag: tag
+        :query registry: the registry to pull from
+        :reqheader X-Registry-Auth: base64-encoded AuthConfig object
+        :statuscode 200: no error
+        :statuscode 500: server error
+
+
+
+Insert a file in an image
+*************************
+
+.. http:post:: /images/(name)/insert
+
+        Insert a file from ``url`` in the image ``name`` at ``path``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /images/test/insert?path=/usr&url=myurl HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {"status":"Inserting..."}
+           {"status":"Inserting", "progress":"1/? (n/a)", "progressDetail":{"current":1}}
+           {"error":"Invalid..."}
+           ...
+
+        :statuscode 200: no error
+        :statuscode 500: server error
+
+
+Inspect an image
+****************
+
+.. http:get:: /images/(name)/json
+
+        Return low-level information on the image ``name``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /images/base/json HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {
+                "id":"b750fe79269d2ec9a3c593ef05b4332b1d1a02a62b4accb2c21d589ff2f5f2dc",
+                "parent":"27cf784147099545",
+                "created":"2013-03-23T22:24:18.818426-07:00",
+                "container":"3d67245a8d72ecf13f33dffac9f79dcdf70f75acb84d308770391510e0c23ad0",
+                "container_config":
+                        {
+                                "Hostname":"",
+                                "User":"",
+                                "Memory":0,
+                                "MemorySwap":0,
+                                "AttachStdin":false,
+                                "AttachStdout":false,
+                                "AttachStderr":false,
+                                "PortSpecs":null,
+                                "Tty":true,
+                                "OpenStdin":true,
+                                "StdinOnce":false,
+                                "Env":null,
+                                "Cmd": ["/bin/bash"]
+                                ,"Dns":null,
+                                "Image":"base",
+                                "Volumes":null,
+                                "VolumesFrom":"",
+                                "WorkingDir":""
+                        },
+                "Size": 6824592
+           }
+
+        :statuscode 200: no error
+        :statuscode 404: no such image
+        :statuscode 500: server error
+
+
+Get the history of an image
+***************************
+
+.. http:get:: /images/(name)/history
+
+        Return the history of the image ``name``
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /images/base/history HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           [
+                {
+                        "Id":"b750fe79269d",
+                        "Created":1364102658,
+                        "CreatedBy":"/bin/bash"
+                },
+                {
+                        "Id":"27cf78414709",
+                        "Created":1364068391,
+                        "CreatedBy":""
+                }
+           ]
+
+        :statuscode 200: no error
+        :statuscode 404: no such image
+        :statuscode 500: server error
+
+
+Push an image on the registry
+*****************************
+
+.. http:post:: /images/(name)/push
+
+   Push the image ``name`` on the registry
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /images/test/push HTTP/1.1
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+    HTTP/1.1 200 OK
+    Content-Type: application/json
+
+    {"status":"Pushing..."}
+    {"status":"Pushing", "progress":"1/? (n/a)", "progressDetail":{"current":1}}}
+    {"error":"Invalid..."}
+    ...
+
+   :query registry: the registry you wan to push, optional
+   :reqheader X-Registry-Auth: include a base64-encoded AuthConfig object.
+   :statuscode 200: no error
+   :statuscode 404: no such image
+   :statuscode 500: server error
+
+
+Tag an image into a repository
+******************************
+
+.. http:post:: /images/(name)/tag
+
+        Tag the image ``name`` into a repository
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /images/test/tag?repo=myrepo&force=0 HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 201 OK
+
+        :query repo: The repository to tag in
+        :query force: 1/True/true or 0/False/false, default false
+        :statuscode 201: no error
+        :statuscode 400: bad parameter
+        :statuscode 404: no such image
+        :statuscode 409: conflict
+        :statuscode 500: server error
+
+
+Remove an image
+***************
+
+.. http:delete:: /images/(name)
+
+        Remove the image ``name`` from the filesystem
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           DELETE /images/test HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-type: application/json
+
+           [
+            {"Untagged":"3e2f21a89f"},
+            {"Deleted":"3e2f21a89f"},
+            {"Deleted":"53b4f83ac9"}
+           ]
+
+        :query force: 1/True/true or 0/False/false, default false
+        :statuscode 200: no error
+        :statuscode 404: no such image
+        :statuscode 409: conflict
+        :statuscode 500: server error
+
+
+Search images
+*************
+
+.. http:get:: /images/search
+
+        Search for an image in the docker index.
+
+        .. note::
+
+           The response keys have changed from API v1.6 to reflect the JSON
+           sent by the registry server to the docker daemon's request.
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /images/search?term=sshd HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           [
+                   {
+                       "description": "",
+                       "is_official": false,
+                       "is_trusted": false,
+                       "name": "wma55/u1210sshd",
+                       "star_count": 0
+                   },
+                   {
+                       "description": "",
+                       "is_official": false,
+                       "is_trusted": false,
+                       "name": "jdswinbank/sshd",
+                       "star_count": 0
+                   },
+                   {
+                       "description": "",
+                       "is_official": false,
+                       "is_trusted": false,
+                       "name": "vgauthier/sshd",
+                       "star_count": 0
+                   }
+           ...
+           ]
+
+        :query term: term to search
+        :statuscode 200: no error
+        :statuscode 500: server error
+
+
+2.3 Misc
+--------
+
+Build an image from Dockerfile via stdin
+****************************************
+
+.. http:post:: /build
+
+   Build an image from Dockerfile via stdin
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /build HTTP/1.1
+
+      {{ STREAM }}
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Content-Type: application/json
+
+      {"stream":"Step 1..."}
+      {"stream":"..."}
+      {"error":"Error...", "errorDetail":{"code": 123, "message": "Error..."}}
+
+
+   The stream must be a tar archive compressed with one of the
+   following algorithms: identity (no compression), gzip, bzip2,
+   xz.
+
+   The archive must include a file called ``Dockerfile`` at its
+   root. It may include any number of other files, which will be
+   accessible in the build context (See the :ref:`ADD build command
+   <dockerbuilder>`).
+
+   :query t: repository name (and optionally a tag) to be applied to the resulting image in case of success
+   :query q: suppress verbose build output
+   :query nocache: do not use the cache when building the image
+   :reqheader Content-type: should be set to ``"application/tar"``.
+   :reqheader X-Registry-Config: base64-encoded ConfigFile object
+   :statuscode 200: no error
+   :statuscode 500: server error
+
+
+
+Check auth configuration
+************************
+
+.. http:post:: /auth
+
+        Get the default username and email
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           POST /auth HTTP/1.1
+           Content-Type: application/json
+
+           {
+                "username":"hannibal",
+                "password:"xxxx",
+                "email":"hannibal@a-team.com",
+                "serveraddress":"https://index.docker.io/v1/"
+           }
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+
+        :statuscode 200: no error
+        :statuscode 204: no error
+        :statuscode 500: server error
+
+
+Display system-wide information
+*******************************
+
+.. http:get:: /info
+
+        Display system-wide information
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /info HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {
+                "Containers":11,
+                "Images":16,
+                "Debug":false,
+                "NFd": 11,
+                "NGoroutines":21,
+                "MemoryLimit":true,
+                "SwapLimit":false,
+                "IPv4Forwarding":true
+           }
+
+        :statuscode 200: no error
+        :statuscode 500: server error
+
+
+Show the docker version information
+***********************************
+
+.. http:get:: /version
+
+        Show the docker version information
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /version HTTP/1.1
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {
+                "Version":"0.2.2",
+                "GitCommit":"5a2a5cc+CHANGES",
+                "GoVersion":"go1.0.3"
+           }
+
+        :statuscode 200: no error
+        :statuscode 500: server error
+
+
+Create a new image from a container's changes
+*********************************************
+
+.. http:post:: /commit
+
+    Create a new image from a container's changes
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+        POST /commit?container=44c004db4b17&m=message&repo=myrepo HTTP/1.1
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+        HTTP/1.1 201 OK
+            Content-Type: application/vnd.docker.raw-stream
+
+        {"Id":"596069db4bf5"}
+
+    :query container: source container
+    :query repo: repository
+    :query tag: tag
+    :query m: commit message
+    :query author: author (eg. "John Hannibal Smith <hannibal@a-team.com>")
+    :query run: config automatically applied when the image is run. (ex: {"Cmd": ["cat", "/world"], "PortSpecs":["22"]})
+    :statuscode 201: no error
+    :statuscode 404: no such container
+    :statuscode 500: server error
+
+
+Monitor Docker's events
+***********************
+
+.. http:get:: /events
+
+        Get events from docker, either in real time via streaming, or via polling (using `since`)
+
+        **Example request**:
+
+        .. sourcecode:: http
+
+           GET /events?since=1374067924
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/json
+
+           {"status":"create","id":"dfdf82bd3881","from":"base:latest","time":1374067924}
+           {"status":"start","id":"dfdf82bd3881","from":"base:latest","time":1374067924}
+           {"status":"stop","id":"dfdf82bd3881","from":"base:latest","time":1374067966}
+           {"status":"destroy","id":"dfdf82bd3881","from":"base:latest","time":1374067970}
+
+        :query since: timestamp used for polling
+        :statuscode 200: no error
+        :statuscode 500: server error
+
+Get a tarball containing all images and tags in a repository
+************************************************************
+
+.. http:get:: /images/(name)/get
+
+        Get a tarball containing all images and metadata for the repository specified by ``name``.
+
+        **Example request**
+
+        .. sourcecode:: http
+
+           GET /images/ubuntu/get
+
+        **Example response**:
+
+        .. sourcecode:: http
+
+           HTTP/1.1 200 OK
+           Content-Type: application/x-tar
+
+           Binary data stream
+
+        :statuscode 200: no error
+        :statuscode 500: server error
+
+Load a tarball with a set of images and tags into docker
+********************************************************
+
+.. http:post:: /images/load
+
+   Load a set of images and tags into the docker repository.
+
+   **Example request**
+
+   .. sourcecode:: http
+
+      POST /images/load
+
+      Tarball in body
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+
+   :statuscode 200: no error
+   :statuscode 500: server error
+
+3. Going further
+================
+
+3.1 Inside 'docker run'
+-----------------------
+
+Here are the steps of 'docker run' :
+
+* Create the container
+* If the status code is 404, it means the image doesn't exists:
+        * Try to pull it
+        * Then retry to create the container
+* Start the container
+* If you are not in detached mode:
+        * Attach to the container, using logs=1 (to have stdout and stderr from the container's start) and stream=1
+* If in detached mode or only stdin is attached:
+        * Display the container's id
+
+
+3.2 Hijacking
+-------------
+
+In this version of the API, /attach, uses hijacking to transport stdin, stdout and stderr on the same socket. This might change in the future.
+
+3.3 CORS Requests
+-----------------
+
+To enable cross origin requests to the remote api add the flag "-api-enable-cors" when running docker in daemon mode.
+
+.. code-block:: bash
+
+   docker -d -H="192.168.1.9:4243" -api-enable-cors
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 1aba80ff41..8d15f85262 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -972,3 +972,25 @@ func NewReadCloserWrapper(r io.Reader, closer func() error) io.ReadCloser {
 		closer: closer,
 	}
 }
+
+func CompareVersion(a, b string) int {
+	aa := strings.Split(a, ".")
+	bb := strings.Split(b, ".")
+	for i, s := range aa {
+		var ai, bi int
+		ai, _ = strconv.Atoi(s)
+		if len(bb) > i {
+			bi, _ = strconv.Atoi(bb[i])
+		}
+		if ai > bi {
+			return 1
+		}
+		if bi > ai {
+			return -1
+		}
+	}
+	if len(bb) > len(aa) {
+		return -1
+	}
+	return 0
+}
diff --git a/components/engine/utils/utils_test.go b/components/engine/utils/utils_test.go
index 7e63a45cf7..41dba72aa7 100644
--- a/components/engine/utils/utils_test.go
+++ b/components/engine/utils/utils_test.go
@@ -479,3 +479,23 @@ func StrSlicesEqual(a, b []string) bool {
 
 	return true
 }
+
+func asserVersion(t *testing.T, a, b string, result int) {
+	if r := CompareVersion(a, b); r != result {
+		t.Fatalf("Unexpected version comparison result. Found %d, expected %d", r, result)
+	}
+}
+
+func TestCompareVersion(t *testing.T) {
+	asserVersion(t, "1.12", "1.12", 0)
+	asserVersion(t, "1.05.00.0156", "1.0.221.9289", 1)
+	asserVersion(t, "1", "1.0.1", -1)
+	asserVersion(t, "1.0.1", "1", 1)
+	asserVersion(t, "1.0.1", "1.0.2", -1)
+	asserVersion(t, "1.0.2", "1.0.3", -1)
+	asserVersion(t, "1.0.3", "1.1", -1)
+	asserVersion(t, "1.1", "1.1.1", -1)
+	asserVersion(t, "1.1.1", "1.1.2", -1)
+	asserVersion(t, "1.1.2", "1.2", -1)
+
+}

From a7de7303da58d90e3d2cce577c795b71aa0554a0 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Sat, 15 Feb 2014 00:10:57 +0000
Subject: [PATCH 282/403] := / var

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: c7f825c0f08e8b6e3cd9dcebc81c21002afcf133
Component: engine
---
 components/engine/api/client.go  | 6 ++++--
 components/engine/server.go      | 7 +++----
 components/engine/utils/utils.go | 6 ++++--
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index da2e7730f1..a6ad41a714 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -780,8 +780,10 @@ func (cli *DockerCli) CmdPort(args ...string) error {
 
 // 'docker rmi IMAGE' removes all images with the name IMAGE
 func (cli *DockerCli) CmdRmi(args ...string) error {
-	cmd := cli.Subcmd("rmi", "IMAGE [IMAGE...]", "Remove one or more images")
-	force := cmd.Bool([]string{"f", "-force"}, false, "Force")
+	var (
+		cmd   = cli.Subcmd("rmi", "IMAGE [IMAGE...]", "Remove one or more images")
+		force = cmd.Bool([]string{"f", "-force"}, false, "Force")
+	)
 	if err := cmd.Parse(args); err != nil {
 		return nil
 	}
diff --git a/components/engine/server.go b/components/engine/server.go
index 91266c23b9..7c3d482b86 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1812,10 +1812,10 @@ func (srv *Server) ContainerDestroy(job *engine.Job) engine.Status {
 func (srv *Server) DeleteImage(name string, imgs *engine.Table, first, force bool) error {
 	var (
 		repoName, tag string
-		img, err      = srv.runtime.repositories.LookupImage(name)
 		tags          = []string{}
 	)
 
+	img, err := srv.runtime.repositories.LookupImage(name)
 	if err != nil {
 		return fmt.Errorf("No such image: %s", name)
 	}
@@ -1873,8 +1873,7 @@ func (srv *Server) DeleteImage(name string, imgs *engine.Table, first, force boo
 			if err := srv.runtime.repositories.DeleteAll(img.ID); err != nil {
 				return err
 			}
-			err := srv.runtime.graph.Delete(img.ID)
-			if err != nil {
+			if err := srv.runtime.graph.Delete(img.ID); err != nil {
 				return err
 			}
 			out := &engine.Env{}
@@ -1898,7 +1897,7 @@ func (srv *Server) ImageDelete(job *engine.Job) engine.Status {
 	if n := len(job.Args); n != 1 {
 		return job.Errorf("Usage: %s IMAGE", job.Name)
 	}
-	var imgs = engine.NewTable("", 0)
+	imgs := engine.NewTable("", 0)
 	if err := srv.DeleteImage(job.Args[0], imgs, true, job.GetenvBool("force")); err != nil {
 		return job.Error(err)
 	}
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 8d15f85262..88f43c8bd5 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -974,8 +974,10 @@ func NewReadCloserWrapper(r io.Reader, closer func() error) io.ReadCloser {
 }
 
 func CompareVersion(a, b string) int {
-	aa := strings.Split(a, ".")
-	bb := strings.Split(b, ".")
+	var (
+		aa = strings.Split(a, ".")
+		bb = strings.Split(b, ".")
+	)
 	for i, s := range aa {
 		var ai, bi int
 		ai, _ = strconv.Atoi(s)

From fcbc1feb4a8370dac05957c97527bb8302008fee Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Tue, 18 Feb 2014 01:44:53 +0000
Subject: [PATCH 283/403] fix tests

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 964d82d00506c3005d102b9a1f94848182c5989d
Component: engine
---
 components/engine/api/server.go              | 4 ++--
 components/engine/integration/api_test.go    | 1 +
 components/engine/integration/server_test.go | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index 007c07ddb8..1019521e03 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -1057,13 +1057,13 @@ func createRouter(eng *engine.Engine, logging, enableCors bool, dockerVersion st
 // ServeRequest processes a single http request to the docker remote api.
 // FIXME: refactor this to be part of Server and not require re-creating a new
 // router each time. This requires first moving ListenAndServe into Server.
-func ServeRequest(eng *engine.Engine, apiversion float64, w http.ResponseWriter, req *http.Request) error {
+func ServeRequest(eng *engine.Engine, apiversion string, w http.ResponseWriter, req *http.Request) error {
 	router, err := createRouter(eng, false, true, "")
 	if err != nil {
 		return err
 	}
 	// Insert APIVERSION into the request as a convenience
-	req.URL.Path = fmt.Sprintf("/v%g%s", apiversion, req.URL.Path)
+	req.URL.Path = fmt.Sprintf("/v%s%s", apiversion, req.URL.Path)
 	router.ServeHTTP(w, req)
 	return nil
 }
diff --git a/components/engine/integration/api_test.go b/components/engine/integration/api_test.go
index abbc1a1c59..4c22d54b3d 100644
--- a/components/engine/integration/api_test.go
+++ b/components/engine/integration/api_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
diff --git a/components/engine/integration/server_test.go b/components/engine/integration/server_test.go
index 8600e78573..2fe16551dc 100644
--- a/components/engine/integration/server_test.go
+++ b/components/engine/integration/server_test.go
@@ -691,7 +691,7 @@ func TestDeleteTagWithExistingContainers(t *testing.T) {
 		t.Fatalf("Should only have deleted one untag %d", len(imgs.Data))
 	}
 
-	if untag := imgs.Data[0].Get("Untagged"); untag != unitTestImageID {
+	if untag := imgs.Data[0].Get("Untagged"); untag != "utest:tag1" {
 		t.Fatalf("Expected %s got %s", unitTestImageID, untag)
 	}
 }

From dde3a7b46761afcd7ab9a034eb0c0e56e8cf26d0 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Tue, 18 Feb 2014 03:03:19 +0000
Subject: [PATCH 284/403] fix message 'No such image: ubuntu' => 'No such
 image: ubuntu:latest'

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 626cee87f779dff2840b1a31cbe6912545758a9f
Component: engine
---
 components/engine/server.go | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/components/engine/server.go b/components/engine/server.go
index 7c3d482b86..9feca36e5b 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1815,16 +1815,22 @@ func (srv *Server) DeleteImage(name string, imgs *engine.Table, first, force boo
 		tags          = []string{}
 	)
 
+	repoName, tag = utils.ParseRepositoryTag(name)
+	if tag == "" {
+		tag = DEFAULTTAG
+	}
+
 	img, err := srv.runtime.repositories.LookupImage(name)
 	if err != nil {
+		if r, _ := srv.runtime.repositories.Get(repoName); r != nil {
+			return fmt.Errorf("No such image: %s:%s", repoName, tag)
+		}
 		return fmt.Errorf("No such image: %s", name)
 	}
 
-	if !strings.Contains(img.ID, name) {
-		repoName, tag = utils.ParseRepositoryTag(name)
-		if tag == "" {
-			tag = DEFAULTTAG
-		}
+	if strings.Contains(img.ID, name) {
+		repoName = ""
+		tag = ""
 	}
 
 	byParents, err := srv.runtime.graph.ByParent()

From 4637d495ffb5a0e70f7ac4533e36c7aa0caf2dff Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Wed, 19 Feb 2014 01:21:32 +0000
Subject: [PATCH 285/403] fix doc

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 21f56c04e4f4df4e171985896b54b243c6ef0fcb
Component: engine
---
 .../docs/sources/reference/api/docker_remote_api.rst      | 2 +-
 .../sources/reference/api/docker_remote_api_v1.10.rst     | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/components/engine/docs/sources/reference/api/docker_remote_api.rst b/components/engine/docs/sources/reference/api/docker_remote_api.rst
index 51c4a06c91..3733effaf8 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api.rst
@@ -36,7 +36,7 @@ You can still call an old version of the api using
 
 
 v1.10
-****
+*****
 
 Full Documentation
 ------------------
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst
index 6ee3febc27..a6eec3551f 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst
@@ -1,12 +1,12 @@
-:title: Remote API v1.9
+:title: Remote API v1.10
 :description: API Documentation for Docker
 :keywords: API, Docker, rcli, REST, documentation
 
 :orphan:
 
-======================
-Docker Remote API v1.9
-======================
+=======================
+Docker Remote API v1.10
+=======================
 
 .. contents:: Table of Contents
 

From 5892660f0af064425fbe7dd3392700fbd8d4ab35 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Wed, 19 Feb 2014 01:34:37 +0000
Subject: [PATCH 286/403] fix bad rebase

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 3f6324f0e8e1b4d117a5d22f752e1d5980eea939
Component: engine
---
 components/engine/server.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/components/engine/server.go b/components/engine/server.go
index 9feca36e5b..759739cdd4 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1857,6 +1857,10 @@ func (srv *Server) DeleteImage(name string, imgs *engine.Table, first, force boo
 		tags = append(tags, tag)
 	}
 
+	if !first && len(tags) > 0 {
+		return nil
+	}
+
 	//Untag the current image
 	for _, tag := range tags {
 		tagDeleted, err := srv.runtime.repositories.Delete(repoName, tag)

From cae176477e917303923fb2f06cd9e348504c9330 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Thu, 20 Feb 2014 00:13:37 +0000
Subject: [PATCH 287/403] add missing doc

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 10faefac3b88069f22283f3f2e018d100a66f2b9
Component: engine
---
 components/engine/docs/sources/reference/commandline/cli.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index b221f0de6b..84cf2c1d67 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -1023,6 +1023,8 @@ containers will not be deleted.
     Usage: docker rmi IMAGE [IMAGE...]
 
     Remove one or more images
+
+      -f, --force=false: Force
     
 Removing tagged images
 ~~~~~~~~~~~~~~~~~~~~~~

From af968e223121c9f27ad51e353274d8c7cff505fc Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Fri, 21 Feb 2014 23:15:28 +0000
Subject: [PATCH 288/403] add version pkg

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 8dad771daa6572ca15949d3e53e825f4837c0af9
Component: engine
---
 components/engine/api/server.go               | 123 +++++++++---------
 components/engine/integration/server_test.go  |   1 +
 components/engine/pkg/version/version.go      |  52 ++++++++
 components/engine/pkg/version/version_test.go |  25 ++++
 components/engine/utils/utils.go              |  24 ----
 components/engine/utils/utils_test.go         |  20 ---
 6 files changed, 140 insertions(+), 105 deletions(-)
 create mode 100644 components/engine/pkg/version/version.go
 create mode 100644 components/engine/pkg/version/version_test.go

diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index 1019521e03..fc4a5c2f04 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -13,6 +13,7 @@ import (
 	"github.com/dotcloud/docker/pkg/listenbuffer"
 	"github.com/dotcloud/docker/pkg/systemd"
 	"github.com/dotcloud/docker/pkg/user"
+	"github.com/dotcloud/docker/pkg/version"
 	"github.com/dotcloud/docker/utils"
 	"github.com/gorilla/mux"
 	"io"
@@ -32,7 +33,7 @@ var (
 	activationLock chan struct{}
 )
 
-type HttpApiFunc func(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error
+type HttpApiFunc func(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error
 
 func hijackServer(w http.ResponseWriter) (io.ReadCloser, io.Writer, error) {
 	conn, _, err := w.(http.Hijacker).Hijack()
@@ -113,7 +114,7 @@ func getBoolParam(value string) (bool, error) {
 	return ret, nil
 }
 
-func postAuth(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postAuth(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	var (
 		authConfig, err = ioutil.ReadAll(r.Body)
 		job             = eng.Job("auth")
@@ -136,13 +137,13 @@ func postAuth(eng *engine.Engine, version string, w http.ResponseWriter, r *http
 	return nil
 }
 
-func getVersion(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getVersion(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	w.Header().Set("Content-Type", "application/json")
 	eng.ServeHTTP(w, r)
 	return nil
 }
 
-func postContainersKill(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersKill(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -160,7 +161,7 @@ func postContainersKill(eng *engine.Engine, version string, w http.ResponseWrite
 	return nil
 }
 
-func getContainersExport(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getContainersExport(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -172,7 +173,7 @@ func getContainersExport(eng *engine.Engine, version string, w http.ResponseWrit
 	return nil
 }
 
-func getImagesJSON(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesJSON(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -186,7 +187,7 @@ func getImagesJSON(eng *engine.Engine, version string, w http.ResponseWriter, r
 	job.Setenv("filter", r.Form.Get("filter"))
 	job.Setenv("all", r.Form.Get("all"))
 
-	if utils.CompareVersion(version, "1.7") >= 0 {
+	if version.GreaterThanOrEqualTo("1.7") {
 		streamJSON(job, w, false)
 	} else if outs, err = job.Stdout.AddListTable(); err != nil {
 		return err
@@ -196,7 +197,7 @@ func getImagesJSON(eng *engine.Engine, version string, w http.ResponseWriter, r
 		return err
 	}
 
-	if utils.CompareVersion(version, "1.7") < 0 && outs != nil { // Convert to legacy format
+	if version.LessThan("1.7") && outs != nil { // Convert to legacy format
 		outsLegacy := engine.NewTable("Created", 0)
 		for _, out := range outs.Data {
 			for _, repoTag := range out.GetList("RepoTags") {
@@ -219,8 +220,8 @@ func getImagesJSON(eng *engine.Engine, version string, w http.ResponseWriter, r
 	return nil
 }
 
-func getImagesViz(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
-	if utils.CompareVersion(version, "1.6") > 0 {
+func getImagesViz(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	if version.GreaterThan("1.6") {
 		w.WriteHeader(http.StatusNotFound)
 		return fmt.Errorf("This is now implemented in the client.")
 	}
@@ -228,13 +229,13 @@ func getImagesViz(eng *engine.Engine, version string, w http.ResponseWriter, r *
 	return nil
 }
 
-func getInfo(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getInfo(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	w.Header().Set("Content-Type", "application/json")
 	eng.ServeHTTP(w, r)
 	return nil
 }
 
-func getEvents(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getEvents(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -245,7 +246,7 @@ func getEvents(eng *engine.Engine, version string, w http.ResponseWriter, r *htt
 	return job.Run()
 }
 
-func getImagesHistory(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesHistory(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -259,7 +260,7 @@ func getImagesHistory(eng *engine.Engine, version string, w http.ResponseWriter,
 	return nil
 }
 
-func getContainersChanges(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getContainersChanges(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -269,8 +270,8 @@ func getContainersChanges(eng *engine.Engine, version string, w http.ResponseWri
 	return job.Run()
 }
 
-func getContainersTop(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
-	if utils.CompareVersion(version, "1.4") < 0 {
+func getContainersTop(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	if version.LessThan("1.4") {
 		return fmt.Errorf("top was improved a lot since 1.3, Please upgrade your docker client.")
 	}
 	if vars == nil {
@@ -285,7 +286,7 @@ func getContainersTop(eng *engine.Engine, version string, w http.ResponseWriter,
 	return job.Run()
 }
 
-func getContainersJSON(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getContainersJSON(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -301,7 +302,7 @@ func getContainersJSON(eng *engine.Engine, version string, w http.ResponseWriter
 	job.Setenv("before", r.Form.Get("before"))
 	job.Setenv("limit", r.Form.Get("limit"))
 
-	if utils.CompareVersion(version, "1.5") >= 0 {
+	if version.GreaterThanOrEqualTo("1.5") {
 		streamJSON(job, w, false)
 	} else if outs, err = job.Stdout.AddTable(); err != nil {
 		return err
@@ -309,7 +310,7 @@ func getContainersJSON(eng *engine.Engine, version string, w http.ResponseWriter
 	if err = job.Run(); err != nil {
 		return err
 	}
-	if utils.CompareVersion(version, "1.5") < 0 { // Convert to legacy format
+	if version.LessThan("1.5") { // Convert to legacy format
 		for _, out := range outs.Data {
 			ports := engine.NewTable("", 0)
 			ports.ReadListFrom([]byte(out.Get("Ports")))
@@ -323,7 +324,7 @@ func getContainersJSON(eng *engine.Engine, version string, w http.ResponseWriter
 	return nil
 }
 
-func postImagesTag(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesTag(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -340,7 +341,7 @@ func postImagesTag(eng *engine.Engine, version string, w http.ResponseWriter, r
 	return nil
 }
 
-func postCommit(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postCommit(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -369,7 +370,7 @@ func postCommit(eng *engine.Engine, version string, w http.ResponseWriter, r *ht
 }
 
 // Creates an image from Pull or from Import
-func postImagesCreate(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesCreate(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -397,7 +398,7 @@ func postImagesCreate(eng *engine.Engine, version string, w http.ResponseWriter,
 			}
 		}
 		job = eng.Job("pull", r.Form.Get("fromImage"), tag)
-		job.SetenvBool("parallel", utils.CompareVersion(version, "1.3") > 0)
+		job.SetenvBool("parallel", version.GreaterThan("1.3"))
 		job.SetenvJson("metaHeaders", metaHeaders)
 		job.SetenvJson("authConfig", authConfig)
 	} else { //import
@@ -405,7 +406,7 @@ func postImagesCreate(eng *engine.Engine, version string, w http.ResponseWriter,
 		job.Stdin.Add(r.Body)
 	}
 
-	if utils.CompareVersion(version, "1.0") > 0 {
+	if version.GreaterThan("1.0") {
 		job.SetenvBool("json", true)
 		streamJSON(job, w, true)
 	} else {
@@ -415,14 +416,14 @@ func postImagesCreate(eng *engine.Engine, version string, w http.ResponseWriter,
 		if !job.Stdout.Used() {
 			return err
 		}
-		sf := utils.NewStreamFormatter(utils.CompareVersion(version, "1.0") > 0)
+		sf := utils.NewStreamFormatter(version.GreaterThan("1.0"))
 		w.Write(sf.FormatError(err))
 	}
 
 	return nil
 }
 
-func getImagesSearch(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesSearch(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -454,7 +455,7 @@ func getImagesSearch(eng *engine.Engine, version string, w http.ResponseWriter,
 	return job.Run()
 }
 
-func postImagesInsert(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesInsert(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -462,7 +463,7 @@ func postImagesInsert(eng *engine.Engine, version string, w http.ResponseWriter,
 		return fmt.Errorf("Missing parameter")
 	}
 	job := eng.Job("insert", vars["name"], r.Form.Get("url"), r.Form.Get("path"))
-	if utils.CompareVersion(version, "1.0") > 0 {
+	if version.GreaterThan("1.0") {
 		job.SetenvBool("json", true)
 		streamJSON(job, w, false)
 	} else {
@@ -472,14 +473,14 @@ func postImagesInsert(eng *engine.Engine, version string, w http.ResponseWriter,
 		if !job.Stdout.Used() {
 			return err
 		}
-		sf := utils.NewStreamFormatter(utils.CompareVersion(version, "1.0") > 0)
+		sf := utils.NewStreamFormatter(version.GreaterThan("1.0"))
 		w.Write(sf.FormatError(err))
 	}
 
 	return nil
 }
 
-func postImagesPush(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesPush(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -513,7 +514,7 @@ func postImagesPush(eng *engine.Engine, version string, w http.ResponseWriter, r
 	job := eng.Job("push", vars["name"])
 	job.SetenvJson("metaHeaders", metaHeaders)
 	job.SetenvJson("authConfig", authConfig)
-	if utils.CompareVersion(version, "1.0") > 0 {
+	if version.GreaterThan("1.0") {
 		job.SetenvBool("json", true)
 		streamJSON(job, w, true)
 	} else {
@@ -524,17 +525,17 @@ func postImagesPush(eng *engine.Engine, version string, w http.ResponseWriter, r
 		if !job.Stdout.Used() {
 			return err
 		}
-		sf := utils.NewStreamFormatter(utils.CompareVersion(version, "1.0") > 0)
+		sf := utils.NewStreamFormatter(version.GreaterThan("1.0"))
 		w.Write(sf.FormatError(err))
 	}
 	return nil
 }
 
-func getImagesGet(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesGet(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
-	if utils.CompareVersion(version, "1.0") > 0 {
+	if version.GreaterThan("1.0") {
 		w.Header().Set("Content-Type", "application/x-tar")
 	}
 	job := eng.Job("image_export", vars["name"])
@@ -542,13 +543,13 @@ func getImagesGet(eng *engine.Engine, version string, w http.ResponseWriter, r *
 	return job.Run()
 }
 
-func postImagesLoad(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postImagesLoad(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	job := eng.Job("load")
 	job.Stdin.Add(r.Body)
 	return job.Run()
 }
 
-func postContainersCreate(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersCreate(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return nil
 	}
@@ -579,7 +580,7 @@ func postContainersCreate(eng *engine.Engine, version string, w http.ResponseWri
 	return writeJSON(w, http.StatusCreated, out)
 }
 
-func postContainersRestart(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersRestart(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -595,7 +596,7 @@ func postContainersRestart(eng *engine.Engine, version string, w http.ResponseWr
 	return nil
 }
 
-func deleteContainers(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func deleteContainers(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -612,7 +613,7 @@ func deleteContainers(eng *engine.Engine, version string, w http.ResponseWriter,
 	return nil
 }
 
-func deleteImages(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func deleteImages(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -626,7 +627,7 @@ func deleteImages(eng *engine.Engine, version string, w http.ResponseWriter, r *
 	return job.Run()
 }
 
-func postContainersStart(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersStart(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -647,7 +648,7 @@ func postContainersStart(eng *engine.Engine, version string, w http.ResponseWrit
 	return nil
 }
 
-func postContainersStop(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersStop(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -663,7 +664,7 @@ func postContainersStop(eng *engine.Engine, version string, w http.ResponseWrite
 	return nil
 }
 
-func postContainersWait(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersWait(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -685,7 +686,7 @@ func postContainersWait(eng *engine.Engine, version string, w http.ResponseWrite
 	return writeJSON(w, http.StatusOK, env)
 }
 
-func postContainersResize(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersResize(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -698,7 +699,7 @@ func postContainersResize(eng *engine.Engine, version string, w http.ResponseWri
 	return nil
 }
 
-func postContainersAttach(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersAttach(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -740,7 +741,7 @@ func postContainersAttach(eng *engine.Engine, version string, w http.ResponseWri
 
 	fmt.Fprintf(outStream, "HTTP/1.1 200 OK\r\nContent-Type: application/vnd.docker.raw-stream\r\n\r\n")
 
-	if c.GetSubEnv("Config") != nil && !c.GetSubEnv("Config").GetBool("Tty") && utils.CompareVersion(version, "1.6") >= 0 {
+	if c.GetSubEnv("Config") != nil && !c.GetSubEnv("Config").GetBool("Tty") && version.GreaterThanOrEqualTo("1.6") {
 		errStream = utils.NewStdWriter(outStream, utils.Stderr)
 		outStream = utils.NewStdWriter(outStream, utils.Stdout)
 	} else {
@@ -763,7 +764,7 @@ func postContainersAttach(eng *engine.Engine, version string, w http.ResponseWri
 	return nil
 }
 
-func wsContainersAttach(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func wsContainersAttach(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if err := parseForm(r); err != nil {
 		return err
 	}
@@ -795,7 +796,7 @@ func wsContainersAttach(eng *engine.Engine, version string, w http.ResponseWrite
 	return nil
 }
 
-func getContainersByName(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getContainersByName(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -805,7 +806,7 @@ func getContainersByName(eng *engine.Engine, version string, w http.ResponseWrit
 	return job.Run()
 }
 
-func getImagesByName(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func getImagesByName(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -815,8 +816,8 @@ func getImagesByName(eng *engine.Engine, version string, w http.ResponseWriter,
 	return job.Run()
 }
 
-func postBuild(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
-	if utils.CompareVersion(version, "1.3") < 0 {
+func postBuild(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	if version.LessThan("1.3") {
 		return fmt.Errorf("Multipart upload for build is no longer supported. Please upgrade your docker client.")
 	}
 	var (
@@ -831,7 +832,7 @@ func postBuild(eng *engine.Engine, version string, w http.ResponseWriter, r *htt
 	// Both headers will be parsed and sent along to the daemon, but if a non-empty
 	// ConfigFile is present, any value provided as an AuthConfig directly will
 	// be overridden. See BuildFile::CmdFrom for details.
-	if utils.CompareVersion(version, "1.9") < 0 && authEncoded != "" {
+	if version.LessThan("1.9") && authEncoded != "" {
 		authJson := base64.NewDecoder(base64.URLEncoding, strings.NewReader(authEncoded))
 		if err := json.NewDecoder(authJson).Decode(authConfig); err != nil {
 			// for a pull it is not an error if no auth was given
@@ -849,7 +850,7 @@ func postBuild(eng *engine.Engine, version string, w http.ResponseWriter, r *htt
 		}
 	}
 
-	if utils.CompareVersion(version, "1.8") >= 0 {
+	if version.GreaterThanOrEqualTo("1.8") {
 		job.SetenvBool("json", true)
 		streamJSON(job, w, true)
 	} else {
@@ -868,13 +869,13 @@ func postBuild(eng *engine.Engine, version string, w http.ResponseWriter, r *htt
 		if !job.Stdout.Used() {
 			return err
 		}
-		sf := utils.NewStreamFormatter(utils.CompareVersion(version, "1.8") >= 0)
+		sf := utils.NewStreamFormatter(version.GreaterThanOrEqualTo("1.8"))
 		w.Write(sf.FormatError(err))
 	}
 	return nil
 }
 
-func postContainersCopy(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func postContainersCopy(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	if vars == nil {
 		return fmt.Errorf("Missing parameter")
 	}
@@ -907,7 +908,7 @@ func postContainersCopy(eng *engine.Engine, version string, w http.ResponseWrite
 	return nil
 }
 
-func optionsHandler(eng *engine.Engine, version string, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+func optionsHandler(eng *engine.Engine, version version.Version, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	w.WriteHeader(http.StatusOK)
 	return nil
 }
@@ -917,7 +918,7 @@ func writeCorsHeaders(w http.ResponseWriter, r *http.Request) {
 	w.Header().Add("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT, OPTIONS")
 }
 
-func makeHttpHandler(eng *engine.Engine, logging bool, localMethod string, localRoute string, handlerFunc HttpApiFunc, enableCors bool, dockerVersion string) http.HandlerFunc {
+func makeHttpHandler(eng *engine.Engine, logging bool, localMethod string, localRoute string, handlerFunc HttpApiFunc, enableCors bool, dockerVersion version.Version) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// log the request
 		utils.Debugf("Calling %s %s", localMethod, localRoute)
@@ -928,11 +929,11 @@ func makeHttpHandler(eng *engine.Engine, logging bool, localMethod string, local
 
 		if strings.Contains(r.Header.Get("User-Agent"), "Docker-Client/") {
 			userAgent := strings.Split(r.Header.Get("User-Agent"), "/")
-			if len(userAgent) == 2 && userAgent[1] != dockerVersion {
+			if len(userAgent) == 2 && !dockerVersion.Equal(userAgent[1]) {
 				utils.Debugf("Warning: client and server don't have the same version (client: %s, server: %s)", userAgent[1], dockerVersion)
 			}
 		}
-		version := mux.Vars(r)["version"]
+		version := version.Version(mux.Vars(r)["version"])
 		if version == "" {
 			version = APIVERSION
 		}
@@ -940,7 +941,7 @@ func makeHttpHandler(eng *engine.Engine, logging bool, localMethod string, local
 			writeCorsHeaders(w, r)
 		}
 
-		if utils.CompareVersion(version, APIVERSION) == 1 {
+		if version.GreaterThan(APIVERSION) {
 			http.Error(w, fmt.Errorf("client and server don't have same version (client : %s, server: %s)", version, APIVERSION).Error(), http.StatusNotFound)
 			return
 		}
@@ -1039,7 +1040,7 @@ func createRouter(eng *engine.Engine, logging, enableCors bool, dockerVersion st
 			localMethod := method
 
 			// build the handler function
-			f := makeHttpHandler(eng, logging, localMethod, localRoute, localFct, enableCors, dockerVersion)
+			f := makeHttpHandler(eng, logging, localMethod, localRoute, localFct, enableCors, version.Version(dockerVersion))
 
 			// add the new route
 			if localRoute == "" {
@@ -1057,7 +1058,7 @@ func createRouter(eng *engine.Engine, logging, enableCors bool, dockerVersion st
 // ServeRequest processes a single http request to the docker remote api.
 // FIXME: refactor this to be part of Server and not require re-creating a new
 // router each time. This requires first moving ListenAndServe into Server.
-func ServeRequest(eng *engine.Engine, apiversion string, w http.ResponseWriter, req *http.Request) error {
+func ServeRequest(eng *engine.Engine, apiversion version.Version, w http.ResponseWriter, req *http.Request) error {
 	router, err := createRouter(eng, false, true, "")
 	if err != nil {
 		return err
diff --git a/components/engine/integration/server_test.go b/components/engine/integration/server_test.go
index 2fe16551dc..1247e8d2d8 100644
--- a/components/engine/integration/server_test.go
+++ b/components/engine/integration/server_test.go
@@ -2,6 +2,7 @@ package docker
 
 import (
 	"github.com/dotcloud/docker"
+	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/runconfig"
 	"strings"
 	"testing"
diff --git a/components/engine/pkg/version/version.go b/components/engine/pkg/version/version.go
new file mode 100644
index 0000000000..3721d64aa8
--- /dev/null
+++ b/components/engine/pkg/version/version.go
@@ -0,0 +1,52 @@
+package version
+
+import (
+	"strconv"
+	"strings"
+)
+
+type Version string
+
+func (me Version) compareTo(other string) int {
+	var (
+		meTab    = strings.Split(string(me), ".")
+		otherTab = strings.Split(other, ".")
+	)
+	for i, s := range meTab {
+		var meInt, otherInt int
+		meInt, _ = strconv.Atoi(s)
+		if len(otherTab) > i {
+			otherInt, _ = strconv.Atoi(otherTab[i])
+		}
+		if meInt > otherInt {
+			return 1
+		}
+		if otherInt > meInt {
+			return -1
+		}
+	}
+	if len(otherTab) > len(meTab) {
+		return -1
+	}
+	return 0
+}
+
+func (me Version) LessThan(other string) bool {
+	return me.compareTo(other) == -1
+}
+
+func (me Version) LessThanOrEqualTo(other string) bool {
+	return me.compareTo(other) <= 0
+}
+
+func (me Version) GreaterThan(other string) bool {
+	return me.compareTo(other) == 1
+}
+
+func (me Version) GreaterThanOrEqualTo(other string) bool {
+	return me.compareTo(other) >= 0
+}
+
+func (me Version) Equal(other string) bool {
+	return me.compareTo(other) == 0
+}
diff --git a/components/engine/pkg/version/version_test.go b/components/engine/pkg/version/version_test.go
new file mode 100644
index 0000000000..4bebd0c434
--- /dev/null
+++ b/components/engine/pkg/version/version_test.go
@@ -0,0 +1,25 @@
+package version
+
+import (
+	"testing"
+)
+
+func assertVersion(t *testing.T, a, b string, result int) {
+	if r := Version(a).compareTo(b); r != result {
+		t.Fatalf("Unexpected version comparison result. Found %d, expected %d", r, result)
+	}
+}
+
+func TestCompareVersion(t *testing.T) {
+	assertVersion(t, "1.12", "1.12", 0)
+	assertVersion(t, "1.05.00.0156", "1.0.221.9289", 1)
+	assertVersion(t, "1", "1.0.1", -1)
+	assertVersion(t, "1.0.1", "1", 1)
+	assertVersion(t, "1.0.1", "1.0.2", -1)
+	assertVersion(t, "1.0.2", "1.0.3", -1)
+	assertVersion(t, "1.0.3", "1.1", -1)
+	assertVersion(t, "1.1", "1.1.1", -1)
+	assertVersion(t, "1.1.1", "1.1.2", -1)
+	assertVersion(t, "1.1.2", "1.2", -1)
+
+}
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 88f43c8bd5..1aba80ff41 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -972,27 +972,3 @@ func NewReadCloserWrapper(r io.Reader, closer func() error) io.ReadCloser {
 		closer: closer,
 	}
 }
-
-func CompareVersion(a, b string) int {
-	var (
-		aa = strings.Split(a, ".")
-		bb = strings.Split(b, ".")
-	)
-	for i, s := range aa {
-		var ai, bi int
-		ai, _ = strconv.Atoi(s)
-		if len(bb) > i {
-			bi, _ = strconv.Atoi(bb[i])
-		}
-		if ai > bi {
-			return 1
-		}
-		if bi > ai {
-			return -1
-		}
-	}
-	if len(bb) > len(aa) {
-		return -1
-	}
-	return 0
-}
diff --git a/components/engine/utils/utils_test.go b/components/engine/utils/utils_test.go
index 41dba72aa7..7e63a45cf7 100644
--- a/components/engine/utils/utils_test.go
+++ b/components/engine/utils/utils_test.go
@@ -479,23 +479,3 @@ func StrSlicesEqual(a, b []string) bool {
 
 	return true
 }
-
-func asserVersion(t *testing.T, a, b string, result int) {
-	if r := CompareVersion(a, b); r != result {
-		t.Fatalf("Unexpected version comparison result. Found %d, expected %d", r, result)
-	}
-}
-
-func TestCompareVersion(t *testing.T) {
-	asserVersion(t, "1.12", "1.12", 0)
-	asserVersion(t, "1.05.00.0156", "1.0.221.9289", 1)
-	asserVersion(t, "1", "1.0.1", -1)
-	asserVersion(t, "1.0.1", "1", 1)
-	asserVersion(t, "1.0.1", "1.0.2", -1)
-	asserVersion(t, "1.0.2", "1.0.3", -1)
-	asserVersion(t, "1.0.3", "1.1", -1)
-	asserVersion(t, "1.1", "1.1.1", -1)
-	asserVersion(t, "1.1.1", "1.1.2", -1)
-	asserVersion(t, "1.1.2", "1.2", -1)
-
-}

From 1361d66b6f141b0951475836e9b316e19d27e663 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Tue, 25 Feb 2014 22:49:19 +0000
Subject: [PATCH 289/403] fix content-type docker copy

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 386e7c80c0dad778f873bcd6eadfa94ecb1ac840
Component: engine
---
 components/engine/api/server.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index 0dd9d966e6..68e4114f13 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -907,7 +907,7 @@ func postContainersCopy(eng *engine.Engine, version float64, w http.ResponseWrit
 	}
 
 	job := eng.Job("container_copy", vars["name"], copyData.Get("Resource"))
-	streamJSON(job, w, false)
+	job.Stdout.Add(w)
 	if err := job.Run(); err != nil {
 		utils.Errorf("%s", err.Error())
 		if strings.Contains(err.Error(), "No such container") {

From 9248431c6adac5a88658394c543879a8cf83b16a Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 25 Feb 2014 15:19:13 -0800
Subject: [PATCH 290/403] Fix cross compile for make cross
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 93ed15075c43d521f05f4b8f96264efb7fe174e4 Component: engine

---
 components/engine/execdriver/native/driver.go |  9 +++--
 .../engine/pkg/libcontainer/nsinit/command.go | 25 ++++++++-----
 .../engine/pkg/libcontainer/nsinit/execin.go  |  2 ++
 .../pkg/libcontainer/nsinit/ns_linux.go       | 14 --------
 .../pkg/libcontainer/nsinit/nsinit/main.go    | 12 ++-----
 .../pkg/libcontainer/nsinit/unsupported.go    | 19 ++++++++++
 components/engine/pkg/libcontainer/types.go   | 35 ++++++++++---------
 .../engine/pkg/libcontainer/types_linux.go    | 16 +++++++++
 components/engine/pkg/system/calls_linux.go   |  7 ++++
 components/engine/pkg/system/errors.go        |  9 +++++
 components/engine/pkg/system/setns_linux.go   |  5 ---
 components/engine/pkg/system/unsupported.go   | 15 ++++++++
 components/engine/runtime.go                  |  5 ++-
 13 files changed, 117 insertions(+), 56 deletions(-)
 delete mode 100644 components/engine/pkg/libcontainer/nsinit/ns_linux.go
 create mode 100644 components/engine/pkg/libcontainer/nsinit/unsupported.go
 create mode 100644 components/engine/pkg/libcontainer/types_linux.go
 create mode 100644 components/engine/pkg/system/errors.go
 create mode 100644 components/engine/pkg/system/unsupported.go

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index 6236950476..0603b92400 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -7,6 +7,7 @@ import (
 	"github.com/dotcloud/docker/pkg/cgroups"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
+	"github.com/dotcloud/docker/pkg/system"
 	"io/ioutil"
 	"os"
 	"os/exec"
@@ -215,9 +216,11 @@ func (d *dockerCommandFactory) Create(container *libcontainer.Container, console
 		"-pipe", fmt.Sprint(syncFd),
 		"-root", filepath.Join(d.driver.root, d.c.ID),
 	}, args...)
-	d.c.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: uintptr(nsinit.GetNamespaceFlags(container.Namespaces)),
-	}
+
+	// set this to nil so that when we set the clone flags anything else is reset
+	d.c.SysProcAttr = nil
+	system.SetCloneFlags(&d.c.Cmd, uintptr(nsinit.GetNamespaceFlags(container.Namespaces)))
+
 	d.c.Env = container.Env
 	d.c.Dir = d.c.Rootfs
 
diff --git a/components/engine/pkg/libcontainer/nsinit/command.go b/components/engine/pkg/libcontainer/nsinit/command.go
index 5eb378ac23..8ddf1e7e71 100644
--- a/components/engine/pkg/libcontainer/nsinit/command.go
+++ b/components/engine/pkg/libcontainer/nsinit/command.go
@@ -3,9 +3,9 @@ package nsinit
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/system"
 	"os"
 	"os/exec"
-	"syscall"
 )
 
 // CommandFactory takes the container's configuration and options passed by the
@@ -15,22 +15,31 @@ type CommandFactory interface {
 	Create(container *libcontainer.Container, console string, syncFd uintptr, args []string) *exec.Cmd
 }
 
-type DefaultCommandFactory struct{}
+type DefaultCommandFactory struct {
+	Root string
+}
 
 // Create will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
 func (c *DefaultCommandFactory) Create(container *libcontainer.Container, console string, pipe uintptr, args []string) *exec.Cmd {
-	// get our binary name so we can always reexec ourself
-	name := os.Args[0]
-	command := exec.Command(name, append([]string{
+	// get our binary name from arg0 so we can always reexec ourself
+	command := exec.Command(os.Args[0], append([]string{
 		"-console", console,
 		"-pipe", fmt.Sprint(pipe),
+		"-root", c.Root,
 		"init"}, args...)...)
 
-	command.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: uintptr(GetNamespaceFlags(container.Namespaces)),
-	}
+	system.SetCloneFlags(command, uintptr(GetNamespaceFlags(container.Namespaces)))
 	command.Env = container.Env
 	return command
 }
+
+// GetNamespaceFlags parses the container's Namespaces options to set the correct
+// flags on clone, unshare, and setns
+func GetNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
+	for _, ns := range namespaces {
+		flag |= ns.Value
+	}
+	return flag
+}
diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index 253fbdcea4..55f7b9695b 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -1,3 +1,5 @@
+// +build linux
+
 package nsinit
 
 import (
diff --git a/components/engine/pkg/libcontainer/nsinit/ns_linux.go b/components/engine/pkg/libcontainer/nsinit/ns_linux.go
deleted file mode 100644
index ab6322e75c..0000000000
--- a/components/engine/pkg/libcontainer/nsinit/ns_linux.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package nsinit
-
-import (
-	"github.com/dotcloud/docker/pkg/libcontainer"
-)
-
-// getNamespaceFlags parses the container's Namespaces options to set the correct
-// flags on clone, unshare, and setns
-func GetNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
-	for _, ns := range namespaces {
-		flag |= ns.Value
-	}
-	return flag
-}
diff --git a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
index e6b020b74b..61921c59a3 100644
--- a/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
+++ b/components/engine/pkg/libcontainer/nsinit/nsinit/main.go
@@ -2,7 +2,6 @@ package main
 
 import (
 	"encoding/json"
-	"errors"
 	"flag"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
@@ -18,11 +17,6 @@ var (
 	pipeFd        int
 )
 
-var (
-	ErrUnsupported    = errors.New("Unsupported method")
-	ErrWrongArguments = errors.New("Wrong argument count")
-)
-
 func registerFlags() {
 	flag.StringVar(&console, "console", "", "console (pty slave) path")
 	flag.IntVar(&pipeFd, "pipe", 0, "sync pipe fd")
@@ -35,7 +29,7 @@ func main() {
 	registerFlags()
 
 	if flag.NArg() < 1 {
-		log.Fatal(ErrWrongArguments)
+		log.Fatalf("wrong number of argments %d", flag.NArg())
 	}
 	container, err := loadContainer()
 	if err != nil {
@@ -71,7 +65,7 @@ func main() {
 			log.Fatal(err)
 		}
 		if flag.NArg() < 2 {
-			log.Fatal(ErrWrongArguments)
+			log.Fatalf("wrong number of argments %d", flag.NArg())
 		}
 		syncPipe, err := nsinit.NewSyncPipeFromFd(0, uintptr(pipeFd))
 		if err != nil {
@@ -112,5 +106,5 @@ func readPid() (int, error) {
 }
 
 func newNsInit() (nsinit.NsInit, error) {
-	return nsinit.NewNsInit(&nsinit.DefaultCommandFactory{}, &nsinit.DefaultStateWriter{root}), nil
+	return nsinit.NewNsInit(&nsinit.DefaultCommandFactory{root}, &nsinit.DefaultStateWriter{root}), nil
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/unsupported.go b/components/engine/pkg/libcontainer/nsinit/unsupported.go
new file mode 100644
index 0000000000..2412223d28
--- /dev/null
+++ b/components/engine/pkg/libcontainer/nsinit/unsupported.go
@@ -0,0 +1,19 @@
+// +build !linux
+
+package nsinit
+
+import (
+	"github.com/dotcloud/docker/pkg/libcontainer"
+)
+
+func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args []string) (int, error) {
+	return -1, libcontainer.ErrUnsupported
+}
+
+func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []string) (int, error) {
+	return -1, libcontainer.ErrUnsupported
+}
+
+func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, console string, syncPipe *SyncPipe, args []string) error {
+	return libcontainer.ErrUnsupported
+}
diff --git a/components/engine/pkg/libcontainer/types.go b/components/engine/pkg/libcontainer/types.go
index cb64db1f29..8c28530140 100644
--- a/components/engine/pkg/libcontainer/types.go
+++ b/components/engine/pkg/libcontainer/types.go
@@ -5,25 +5,20 @@ import (
 	"errors"
 	"github.com/syndtr/gocapability/capability"
 	"os"
-	"syscall"
 )
 
 var (
-	ErrUnkownNamespace error = errors.New("Unkown namespace")
+	ErrUnkownNamespace  = errors.New("Unknown namespace")
+	ErrUnkownCapability = errors.New("Unknown capability")
+	ErrUnsupported      = errors.New("Unsupported method")
 )
 
 // namespaceList is used to convert the libcontainer types
 // into the names of the files located in /proc/<pid>/ns/* for
 // each namespace
 var (
-	namespaceList = Namespaces{
-		{Key: "NEWNS", Value: syscall.CLONE_NEWNS, File: "mnt"},
-		{Key: "NEWUTS", Value: syscall.CLONE_NEWUTS, File: "uts"},
-		{Key: "NEWIPC", Value: syscall.CLONE_NEWIPC, File: "ipc"},
-		{Key: "NEWUSER", Value: syscall.CLONE_NEWUSER, File: "user"},
-		{Key: "NEWPID", Value: syscall.CLONE_NEWPID, File: "pid"},
-		{Key: "NEWNET", Value: syscall.CLONE_NEWNET, File: "net"},
-	}
+	namespaceList = Namespaces{}
+
 	capabilityList = Capabilities{
 		{Key: "SETPCAP", Value: capability.CAP_SETPCAP},
 		{Key: "SYS_MODULE", Value: capability.CAP_SYS_MODULE},
@@ -52,6 +47,10 @@ type (
 	Namespaces []*Namespace
 )
 
+func (ns *Namespace) String() string {
+	return ns.Key
+}
+
 func (ns *Namespace) MarshalJSON() ([]byte, error) {
 	return json.Marshal(ns.Key)
 }
@@ -95,20 +94,24 @@ type (
 	Capabilities []*Capability
 )
 
-func (ns *Capability) MarshalJSON() ([]byte, error) {
-	return json.Marshal(ns.Key)
+func (c *Capability) String() string {
+	return c.Key
 }
 
-func (ns *Capability) UnmarshalJSON(src []byte) error {
+func (c *Capability) MarshalJSON() ([]byte, error) {
+	return json.Marshal(c.Key)
+}
+
+func (c *Capability) UnmarshalJSON(src []byte) error {
 	var capName string
 	if err := json.Unmarshal(src, &capName); err != nil {
 		return err
 	}
 	ret := GetCapability(capName)
 	if ret == nil {
-		return ErrUnkownNamespace
+		return ErrUnkownCapability
 	}
-	*ns = *ret
+	*c = *ret
 	return nil
 }
 
@@ -119,7 +122,7 @@ func GetCapability(key string) *Capability {
 		}
 	}
 	if os.Getenv("DEBUG") != "" {
-		panic("Unreachable: Namespace not found")
+		panic("Unreachable: Capability not found")
 	}
 	return nil
 }
diff --git a/components/engine/pkg/libcontainer/types_linux.go b/components/engine/pkg/libcontainer/types_linux.go
new file mode 100644
index 0000000000..c14531df20
--- /dev/null
+++ b/components/engine/pkg/libcontainer/types_linux.go
@@ -0,0 +1,16 @@
+package libcontainer
+
+import (
+	"syscall"
+)
+
+func init() {
+	namespaceList = Namespaces{
+		{Key: "NEWNS", Value: syscall.CLONE_NEWNS, File: "mnt"},
+		{Key: "NEWUTS", Value: syscall.CLONE_NEWUTS, File: "uts"},
+		{Key: "NEWIPC", Value: syscall.CLONE_NEWIPC, File: "ipc"},
+		{Key: "NEWUSER", Value: syscall.CLONE_NEWUSER, File: "user"},
+		{Key: "NEWPID", Value: syscall.CLONE_NEWPID, File: "pid"},
+		{Key: "NEWNET", Value: syscall.CLONE_NEWNET, File: "net"},
+	}
+}
diff --git a/components/engine/pkg/system/calls_linux.go b/components/engine/pkg/system/calls_linux.go
index b7a8f140ba..bf667c535b 100644
--- a/components/engine/pkg/system/calls_linux.go
+++ b/components/engine/pkg/system/calls_linux.go
@@ -136,3 +136,10 @@ func Mkfifo(name string, mode uint32) error {
 func Umask(mask int) int {
 	return syscall.Umask(mask)
 }
+
+func SetCloneFlags(cmd *exec.Cmd, flag uintptr) {
+	if cmd.SysProcAttr == nil {
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+	}
+	cmd.SysProcAttr.Cloneflags = flag
+}
diff --git a/components/engine/pkg/system/errors.go b/components/engine/pkg/system/errors.go
new file mode 100644
index 0000000000..63045186fe
--- /dev/null
+++ b/components/engine/pkg/system/errors.go
@@ -0,0 +1,9 @@
+package system
+
+import (
+	"errors"
+)
+
+var (
+	ErrNotSupportedPlatform = errors.New("platform and architecture is not supported")
+)
diff --git a/components/engine/pkg/system/setns_linux.go b/components/engine/pkg/system/setns_linux.go
index 07b1c93b4a..2b6f9e77ec 100644
--- a/components/engine/pkg/system/setns_linux.go
+++ b/components/engine/pkg/system/setns_linux.go
@@ -1,16 +1,11 @@
 package system
 
 import (
-	"errors"
 	"fmt"
 	"runtime"
 	"syscall"
 )
 
-var (
-	ErrNotSupportedPlatform = errors.New("platform and architecture is not supported")
-)
-
 // Via http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b21fddd087678a70ad64afc0f632e0f1071b092
 //
 // We need different setns values for the different platforms and arch
diff --git a/components/engine/pkg/system/unsupported.go b/components/engine/pkg/system/unsupported.go
new file mode 100644
index 0000000000..eb3ec7ee92
--- /dev/null
+++ b/components/engine/pkg/system/unsupported.go
@@ -0,0 +1,15 @@
+// +build !linux
+
+package system
+
+import (
+	"os/exec"
+)
+
+func SetCloneFlags(cmd *exec.Cmd, flag uintptr) {
+
+}
+
+func UsetCloseOnExec(fd uintptr) error {
+	return ErrNotSupportedPlatform
+}
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index c062578a31..0096f184e1 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -709,9 +709,12 @@ func NewRuntimeFromDirectory(config *DaemonConfig, eng *engine.Engine) (*Runtime
 
 	switch config.ExecDriver {
 	case "lxc":
+		// we want to five the lxc driver the full docker root because it needs
+		// to access and write config and template files in /var/lib/docker/containers/*
+		// to be backwards compatible
 		ed, err = lxc.NewDriver(config.Root, sysInfo.AppArmor)
 	case "native":
-		ed, err = native.NewDriver(path.Join(config.Root, "native"))
+		ed, err = native.NewDriver(path.Join(config.Root, "execdriver", "native"))
 	default:
 		return nil, fmt.Errorf("unknown exec driver %s", config.ExecDriver)
 	}

From b5a919751c3123de378d1668426204ea5a9f8400 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Tue, 25 Feb 2014 23:13:43 +0000
Subject: [PATCH 291/403] update api Maintainers file

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 2f468a498ab9e8ebc5c7a9316e0242f8d7c54f1a
Component: engine
---
 components/engine/MAINTAINERS     | 3 +--
 components/engine/api/MAINTAINERS | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)
 create mode 100644 components/engine/api/MAINTAINERS

diff --git a/components/engine/MAINTAINERS b/components/engine/MAINTAINERS
index a08f8f3140..49d14ba0bd 100644
--- a/components/engine/MAINTAINERS
+++ b/components/engine/MAINTAINERS
@@ -1,8 +1,7 @@
 Solomon Hykes <solomon@dotcloud.com> (@shykes)
 Guillaume Charmes <guillaume@dotcloud.com> (@creack)
-Victor Vieux <victor@dotcloud.com> (@vieux)
+Victor Vieux <vieux@docker.com> (@vieux)
 Michael Crosby <michael@crosbymichael.com> (@crosbymichael)
 .travis.yml: Tianon Gravi <admwiggin@gmail.com> (@tianon)
-api.go: Victor Vieux <victor@dotcloud.com> (@vieux)
 Dockerfile: Tianon Gravi <admwiggin@gmail.com> (@tianon)
 Makefile: Tianon Gravi <admwiggin@gmail.com> (@tianon)
diff --git a/components/engine/api/MAINTAINERS b/components/engine/api/MAINTAINERS
new file mode 100644
index 0000000000..e0f18f14f1
--- /dev/null
+++ b/components/engine/api/MAINTAINERS
@@ -0,0 +1 @@
+Victor Vieux <vieux@docker.com> (@vieux)

From 2c83e8f4640ec259f06bd75b08d93c034a832a28 Mon Sep 17 00:00:00 2001
From: Sam Alba <sam.alba@gmail.com>
Date: Tue, 25 Feb 2014 16:06:04 -0800
Subject: [PATCH 292/403] registry: Fixed unexported field

Docker-DCO-1.1-Signed-off-by: Sam Alba <sam.alba@gmail.com> (github: samalba)
Upstream-commit: a0251223cdd7a52d6ae246d37363b9d78a4d8cc3
Component: engine
---
 components/engine/registry/registry.go | 4 ++--
 components/engine/server.go            | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/components/engine/registry/registry.go b/components/engine/registry/registry.go
index d0ddedb7ba..c570e7b73e 100644
--- a/components/engine/registry/registry.go
+++ b/components/engine/registry/registry.go
@@ -389,7 +389,7 @@ func (r *Registry) PushImageChecksumRegistry(imgData *ImgData, registry string,
 	}
 	setTokenAuth(req, token)
 	req.Header.Set("X-Docker-Checksum", imgData.Checksum)
-	req.Header.Set("X-Docker-Checksum-Payload", imgData.checksumPayload)
+	req.Header.Set("X-Docker-Checksum-Payload", imgData.ChecksumPayload)
 
 	res, err := doWithCookies(r.client, req)
 	if err != nil {
@@ -679,8 +679,8 @@ type RepositoryData struct {
 type ImgData struct {
 	ID              string `json:"id"`
 	Checksum        string `json:"checksum,omitempty"`
+	ChecksumPayload string `json:"-"`
 	Tag             string `json:",omitempty"`
-	checksumPayload string
 }
 
 type Registry struct {
diff --git a/components/engine/server.go b/components/engine/server.go
index 01adcc30eb..b9fd92716a 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1509,7 +1509,7 @@ func (srv *Server) pushImage(r *registry.Registry, out io.Writer, remote, imgID,
 		return "", err
 	}
 	imgData.Checksum = checksum
-	imgData.checksumPayload = checksumPayload
+	imgData.ChecksumPayload = checksumPayload
 	// Send the checksum
 	if err := r.PushImageChecksumRegistry(imgData, ep, token); err != nil {
 		return "", err

From cdfec9fd8ac3569da229ef2c340fa6e05dd53f1f Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 25 Feb 2014 16:27:07 -0800
Subject: [PATCH 293/403] Ensure that the container's dir is remove from native
 driver on stop Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 5c67d2e6346d493e2b8b0469d453a64d41c22cb2 Component: engine

---
 components/engine/execdriver/native/driver.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index 0603b92400..1460b09e87 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -82,6 +82,8 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 	if err := d.createContainerRoot(c.ID); err != nil {
 		return -1, err
 	}
+	defer d.removeContainerRoot(c.ID)
+
 	if c.Tty {
 		term = &dockerTtyTerm{
 			pipes: pipes,
@@ -186,6 +188,10 @@ func (d *driver) createContainerRoot(id string) error {
 	return os.MkdirAll(filepath.Join(d.root, id), 0655)
 }
 
+func (d *driver) removeContainerRoot(id string) error {
+	return os.RemoveAll(filepath.Join(d.root, id))
+}
+
 func getEnv(key string, env []string) string {
 	for _, pair := range env {
 		parts := strings.Split(pair, "=")

From 01fcc83d7e2a0b294c595b5218674d3b2c7b64e6 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Tue, 25 Feb 2014 16:50:33 -0800
Subject: [PATCH 294/403] Fix exit code issue with TTY mode

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 3806ff61d1580ca22b3b72257789285aa9bd9486
Component: engine
---
 components/engine/container.go | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index 3a277fb1f9..7e15761c37 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -789,22 +789,8 @@ func (container *Container) monitor(callback execdriver.StartCallback) error {
 		utils.Errorf("Error running container: %s", err)
 	}
 
-	// Cleanup
-	container.cleanup()
-
-	// Re-create a brand new stdin pipe once the container exited
-	if container.Config.OpenStdin {
-		container.stdin, container.stdinPipe = io.Pipe()
-	}
-
 	container.State.SetStopped(exitCode)
 
-	if container.runtime != nil && container.runtime.srv != nil {
-		container.runtime.srv.LogEvent("die", container.ID, container.runtime.repositories.ImageName(container.Image))
-	}
-
-	close(container.waitLock)
-
 	// FIXME: there is a race condition here which causes this to fail during the unit tests.
 	// If another goroutine was waiting for Wait() to return before removing the container's root
 	// from the filesystem... At this point it may already have done so.
@@ -812,7 +798,23 @@ func (container *Container) monitor(callback execdriver.StartCallback) error {
 	// to return.
 	// FIXME: why are we serializing running state to disk in the first place?
 	//log.Printf("%s: Failed to dump configuration to the disk: %s", container.ID, err)
-	container.ToDisk()
+	if err := container.ToDisk(); err != nil {
+		utils.Errorf("Error dumping container state to disk: %s\n", err)
+	}
+
+	// Cleanup
+	container.cleanup()
+
+	// Re-create a brand new stdin pipe once the container exited
+	if container.Config.OpenStdin {
+		container.stdin, container.stdinPipe = io.Pipe()
+	}
+
+	if container.runtime != nil && container.runtime.srv != nil {
+		container.runtime.srv.LogEvent("die", container.ID, container.runtime.repositories.ImageName(container.Image))
+	}
+
+	close(container.waitLock)
 
 	return err
 }

From 514380823f0cb4e9adef8a1d30dda3f92a12f534 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 25 Feb 2014 17:13:00 -0800
Subject: [PATCH 295/403] Return error for lxc-conf when using native driver
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 bfdf07ac98e1a425892b787cf224109d5925a798 Component: engine

---
 components/engine/execdriver/native/driver.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index 1460b09e87..ba7e8a719f 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -67,6 +67,9 @@ func NewDriver(root string) (*driver, error) {
 }
 
 func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallback execdriver.StartCallback) (int, error) {
+	if err := d.validateCommand(c); err != nil {
+		return -1, err
+	}
 	var (
 		term        nsinit.Terminal
 		container   = createContainer(c)
@@ -192,6 +195,17 @@ func (d *driver) removeContainerRoot(id string) error {
 	return os.RemoveAll(filepath.Join(d.root, id))
 }
 
+func (d *driver) validateCommand(c *execdriver.Command) error {
+	// we need to check the Config of the command to make sure that we
+	// do not have any of the lxc-conf variables
+	for _, conf := range c.Config {
+		if strings.Contains(conf, "lxc") {
+			return fmt.Errorf("%s is not supported by the native driver", conf)
+		}
+	}
+	return nil
+}
+
 func getEnv(key string, env []string) string {
 	for _, pair := range env {
 		parts := strings.Split(pair, "=")

From f364b90f27d7470a89d1f07bd2de1fe75da669f0 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 25 Feb 2014 19:45:57 -0800
Subject: [PATCH 296/403] Fix cgroups swap issue when it is not supported
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 6016126c71272f7943458bbb8392dfd1f5877269 Component: engine

---
 components/engine/pkg/cgroups/cgroups.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/components/engine/pkg/cgroups/cgroups.go b/components/engine/pkg/cgroups/cgroups.go
index e260d67661..b40e1a31fa 100644
--- a/components/engine/pkg/cgroups/cgroups.go
+++ b/components/engine/pkg/cgroups/cgroups.go
@@ -223,8 +223,10 @@ func (c *Cgroup) setupMemory(cgroupRoot string, pid int) (err error) {
 				return err
 			}
 		}
-		if c.MemorySwap != 0 {
-			if err := writeFile(dir, "memory.memsw.limit_in_bytes", strconv.FormatInt(c.MemorySwap, 10)); err != nil {
+		// By default, MemorySwap is set to twice the size of RAM.
+		// If you want to omit MemorySwap, set it to `-1'.
+		if c.MemorySwap != -1 {
+			if err := writeFile(dir, "memory.memsw.limit_in_bytes", strconv.FormatInt(c.Memory*2, 10)); err != nil {
 				return err
 			}
 		}

From dbf416cb72e00d3147442c02bf2b5907ef9d4fb1 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Tue, 25 Feb 2014 20:16:17 -0800
Subject: [PATCH 297/403] Fix TestCmdKill by closing the pipe before waiting on
 the container

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 4039fbb1b01365273e99a3cba28db33b38197237
Component: engine
---
 components/engine/integration/commands_test.go | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/components/engine/integration/commands_test.go b/components/engine/integration/commands_test.go
index a3359ec631..33117d8794 100644
--- a/components/engine/integration/commands_test.go
+++ b/components/engine/integration/commands_test.go
@@ -1043,11 +1043,12 @@ func TestContainerOrphaning(t *testing.T) {
 }
 
 func TestCmdKill(t *testing.T) {
-	stdin, stdinPipe := io.Pipe()
-	stdout, stdoutPipe := io.Pipe()
-
-	cli := api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
-	cli2 := api.NewDockerCli(nil, ioutil.Discard, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	var (
+		stdin, stdinPipe   = io.Pipe()
+		stdout, stdoutPipe = io.Pipe()
+		cli                = api.NewDockerCli(stdin, stdoutPipe, ioutil.Discard, testDaemonProto, testDaemonAddr)
+		cli2               = api.NewDockerCli(nil, ioutil.Discard, ioutil.Discard, testDaemonProto, testDaemonAddr)
+	)
 	defer cleanup(globalEngine, t)
 
 	ch := make(chan struct{})
@@ -1086,6 +1087,7 @@ func TestCmdKill(t *testing.T) {
 		}
 	})
 
+	stdout.Close()
 	time.Sleep(500 * time.Millisecond)
 	if !container.State.IsRunning() {
 		t.Fatal("The container should be still running")

From 7413b7bf4df6e4d53ca98cd4f68ec00e67d9d04d Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 25 Feb 2014 23:35:59 -0700
Subject: [PATCH 298/403] Update mkimage-yum to not read /etc/redhat-release
 from the host

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: d29ee876ac7900730e1f48f4f30ed33210872238
Component: engine
---
 components/engine/contrib/mkimage-yum.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/contrib/mkimage-yum.sh b/components/engine/contrib/mkimage-yum.sh
index d7ffdc1902..5ff9d3f7d5 100755
--- a/components/engine/contrib/mkimage-yum.sh
+++ b/components/engine/contrib/mkimage-yum.sh
@@ -76,7 +76,7 @@ rm -rf "$target"/var/cache/ldconfig/*
 
 version=
 if [ -r "$target"/etc/redhat-release ]; then
-    version="$(sed 's/^[^0-9\]*\([0-9.]\+\).*$/\1/' /etc/redhat-release)"
+    version="$(sed 's/^[^0-9\]*\([0-9.]\+\).*$/\1/' "$target"/etc/redhat-release)"
 fi
 
 if [ -z "$version" ]; then

From 0eecb77d006c6ddca7edffd31192830d6a12e15e Mon Sep 17 00:00:00 2001
From: Brian Goff <cpuguy83@gmail.com>
Date: Sun, 23 Feb 2014 11:32:12 -0500
Subject: [PATCH 299/403] make docker build -rm=true default #4292

Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
Upstream-commit: 0b4aeb79d9e920f5a713a8ae57e3fdde011689e6
Component: engine
---
 components/engine/Makefile                          |  4 ++--
 components/engine/api/client.go                     |  2 +-
 .../docs/sources/reference/commandline/cli.rst      | 13 +++++--------
 3 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/components/engine/Makefile b/components/engine/Makefile
index e124d1d7e6..e15ed35fda 100644
--- a/components/engine/Makefile
+++ b/components/engine/Makefile
@@ -32,10 +32,10 @@ shell: build
 	$(DOCKER_RUN_DOCKER) bash
 
 build: bundles
-	docker build -rm -t "$(DOCKER_IMAGE)" .
+	docker build -t "$(DOCKER_IMAGE)" .
 
 docs-build:
-	docker build -rm -t "$(DOCKER_DOCS_IMAGE)" docs
+	docker build -t "$(DOCKER_DOCS_IMAGE)" docs
 
 bundles:
 	mkdir bundles
diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index eb345ae40b..ae9ae56a34 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -138,7 +138,7 @@ func (cli *DockerCli) CmdBuild(args ...string) error {
 	tag := cmd.String([]string{"t", "-tag"}, "", "Repository name (and optionally a tag) to be applied to the resulting image in case of success")
 	suppressOutput := cmd.Bool([]string{"q", "-quiet"}, false, "Suppress the verbose output generated by the containers")
 	noCache := cmd.Bool([]string{"#no-cache", "-no-cache"}, false, "Do not use cache when building the image")
-	rm := cmd.Bool([]string{"#rm", "-rm"}, false, "Remove intermediate containers after a successful build")
+	rm := cmd.Bool([]string{"#rm", "-rm"}, true, "Remove intermediate containers after a successful build")
 	if err := cmd.Parse(args); err != nil {
 		return nil
 	}
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 67794a41c5..f17e716e84 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -184,11 +184,11 @@ Examples:
 
     Usage: docker build [OPTIONS] PATH | URL | -
     Build a new container image from the source code at PATH
-      -t, --time="": Repository name (and optionally a tag) to be applied 
+      -t, --time="": Repository name (and optionally a tag) to be applied
              to the resulting image in case of success.
       -q, --quiet=false: Suppress the verbose output generated by the containers.
       --no-cache: Do not use the cache when building the image.
-      --rm: Remove intermediate containers after a successful build
+      --rm=true: Remove intermediate containers after a successful build
 
 The files at ``PATH`` or ``URL`` are called the "context" of the build. The
 build process may refer to any of the files in the context, for example when
@@ -197,8 +197,6 @@ is given as ``URL``, then no context is set.  When a Git repository is set as
 ``URL``, then the repository is used as the context. Git repositories are
 cloned with their submodules (`git clone --recursive`).
 
-.. note:: ``docker build --rm`` does not affect the image cache which is used to accelerate builds, it only removes the duplicate writeable container layers.
-
 .. _cli_build_examples:
 
 .. seealso:: :ref:`dockerbuilder`.
@@ -208,7 +206,7 @@ Examples:
 
 .. code-block:: bash
 
-    $ sudo docker build --rm .
+    $ sudo docker build .
     Uploading context 10240 bytes
     Step 1 : FROM busybox
     Pulling repository busybox
@@ -248,9 +246,8 @@ The transfer of context from the local machine to the Docker daemon is
 what the ``docker`` client means when you see the "Uploading context"
 message.
 
-The ``--rm`` option tells Docker to remove the intermediate containers and 
-layers that were used to create each image layer. Doing so has no impact on
-the image build cache.
+If you wish to keep the intermediate containers after the build is complete,
+you must use ``--rm=false``. This does not affect the build cache.
 
 
 .. code-block:: bash

From 3258d9a2a38fa161042a1964b57753b37c8c93cc Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 26 Feb 2014 14:19:39 -0800
Subject: [PATCH 300/403] Make network a slice to support multiple types
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 70820b69ec2b82ab150af9b8829e37843f67f75a Component: engine

---
 .../execdriver/native/default_template.go     | 19 ++++++++------
 components/engine/pkg/libcontainer/README.md  | 21 ++++++++-------
 .../engine/pkg/libcontainer/container.go      |  2 +-
 .../engine/pkg/libcontainer/container.json    | 21 ++++++++-------
 .../pkg/libcontainer/network/strategy.go      |  2 +-
 .../engine/pkg/libcontainer/network/veth.go   | 26 +++++++++----------
 .../engine/pkg/libcontainer/nsinit/exec.go    | 13 ++++------
 .../engine/pkg/libcontainer/nsinit/init.go    |  6 ++---
 8 files changed, 55 insertions(+), 55 deletions(-)

diff --git a/components/engine/execdriver/native/default_template.go b/components/engine/execdriver/native/default_template.go
index 4e1ec7057a..102967a489 100644
--- a/components/engine/execdriver/native/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -19,17 +19,20 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 	container.Env = c.Env
 
 	if c.Network != nil {
-		container.Network = &libcontainer.Network{
-			Mtu:     c.Network.Mtu,
-			Address: fmt.Sprintf("%s/%d", c.Network.IPAddress, c.Network.IPPrefixLen),
-			Gateway: c.Network.Gateway,
-			Type:    "veth",
-			Context: libcontainer.Context{
-				"prefix": "dock",
-				"bridge": c.Network.Bridge,
+		container.Networks = []*libcontainer.Network{
+			{
+				Mtu:     c.Network.Mtu,
+				Address: fmt.Sprintf("%s/%d", c.Network.IPAddress, c.Network.IPPrefixLen),
+				Gateway: c.Network.Gateway,
+				Type:    "veth",
+				Context: libcontainer.Context{
+					"prefix": "dock",
+					"bridge": c.Network.Bridge,
+				},
 			},
 		}
 	}
+
 	container.Cgroups.Name = c.ID
 	if c.Privileged {
 		container.Capabilities = nil
diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index 36553af5bc..4c8da8e925 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -48,16 +48,17 @@ Sample `container.json` file:
         "MAC_ADMIN",
         "NET_ADMIN"
     ],
-    "network": {
-        "type": "veth",
-        "context": {
-            "bridge": "docker0",
-            "prefix": "dock"
-        },
-        "address": "172.17.0.100/16",
-        "gateway": "172.17.42.1",
-        "mtu": 1500
-    },
+    "networks": [{
+            "type": "veth",
+            "context": {
+                "bridge": "docker0",
+                "prefix": "dock"
+            },
+            "address": "172.17.0.100/16",
+            "gateway": "172.17.42.1",
+            "mtu": 1500
+        }
+    ],
     "cgroups": {
         "name": "docker-koye",
         "parent": "docker",
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index 4a47977334..12a3d7ba8e 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -19,7 +19,7 @@ type Container struct {
 	Tty          bool            `json:"tty,omitempty"`          // setup a proper tty or not
 	Namespaces   Namespaces      `json:"namespaces,omitempty"`   // namespaces to apply
 	Capabilities Capabilities    `json:"capabilities,omitempty"` // capabilities to drop
-	Network      *Network        `json:"network,omitempty"`      // nil for host's network stack
+	Networks     []*Network      `json:"networks,omitempty"`     // nil for host's network stack
 	Cgroups      *cgroups.Cgroup `json:"cgroups,omitempty"`
 }
 
diff --git a/components/engine/pkg/libcontainer/container.json b/components/engine/pkg/libcontainer/container.json
index c2b21f8609..83e407467c 100644
--- a/components/engine/pkg/libcontainer/container.json
+++ b/components/engine/pkg/libcontainer/container.json
@@ -31,16 +31,17 @@
         "MAC_ADMIN",
         "NET_ADMIN"
     ],
-    "network": {
-        "type": "veth",
-        "context": {
-            "bridge": "docker0",
-            "prefix": "dock"
-        },
-        "address": "172.17.0.100/16",
-        "gateway": "172.17.42.1",
-        "mtu": 1500
-    },
+    "networks": [{
+            "type": "veth",
+            "context": {
+                "bridge": "docker0",
+                "prefix": "dock"
+            },
+            "address": "172.17.0.100/16",
+            "gateway": "172.17.42.1",
+            "mtu": 1500
+        }
+    ],
     "cgroups": {
         "name": "docker-koye",
         "parent": "docker",
diff --git a/components/engine/pkg/libcontainer/network/strategy.go b/components/engine/pkg/libcontainer/network/strategy.go
index 8ecc11a24d..a2f4f8f073 100644
--- a/components/engine/pkg/libcontainer/network/strategy.go
+++ b/components/engine/pkg/libcontainer/network/strategy.go
@@ -16,7 +16,7 @@ var strategies = map[string]NetworkStrategy{
 // NetworkStrategy represends a specific network configuration for
 // a containers networking stack
 type NetworkStrategy interface {
-	Create(*libcontainer.Network, int) (libcontainer.Context, error)
+	Create(*libcontainer.Network, int, libcontainer.Context) error
 	Initialize(*libcontainer.Network, libcontainer.Context) error
 }
 
diff --git a/components/engine/pkg/libcontainer/network/veth.go b/components/engine/pkg/libcontainer/network/veth.go
index 49e63f0779..3ab1b2393b 100644
--- a/components/engine/pkg/libcontainer/network/veth.go
+++ b/components/engine/pkg/libcontainer/network/veth.go
@@ -12,39 +12,37 @@ import (
 type Veth struct {
 }
 
-func (v *Veth) Create(n *libcontainer.Network, nspid int) (libcontainer.Context, error) {
+func (v *Veth) Create(n *libcontainer.Network, nspid int, context libcontainer.Context) error {
 	var (
 		bridge string
 		prefix string
 		exists bool
 	)
 	if bridge, exists = n.Context["bridge"]; !exists {
-		return nil, fmt.Errorf("bridge does not exist in network context")
+		return fmt.Errorf("bridge does not exist in network context")
 	}
 	if prefix, exists = n.Context["prefix"]; !exists {
-		return nil, fmt.Errorf("veth prefix does not exist in network context")
+		return fmt.Errorf("veth prefix does not exist in network context")
 	}
 	name1, name2, err := createVethPair(prefix)
 	if err != nil {
-		return nil, err
-	}
-	context := libcontainer.Context{
-		"vethHost":  name1,
-		"vethChild": name2,
+		return err
 	}
+	context["veth-host"] = name1
+	context["veth-child"] = name2
 	if err := SetInterfaceMaster(name1, bridge); err != nil {
-		return context, err
+		return err
 	}
 	if err := SetMtu(name1, n.Mtu); err != nil {
-		return context, err
+		return err
 	}
 	if err := InterfaceUp(name1); err != nil {
-		return context, err
+		return err
 	}
 	if err := SetInterfaceInNamespacePid(name2, nspid); err != nil {
-		return context, err
+		return err
 	}
-	return context, nil
+	return nil
 }
 
 func (v *Veth) Initialize(config *libcontainer.Network, context libcontainer.Context) error {
@@ -52,7 +50,7 @@ func (v *Veth) Initialize(config *libcontainer.Network, context libcontainer.Con
 		vethChild string
 		exists    bool
 	)
-	if vethChild, exists = context["vethChild"]; !exists {
+	if vethChild, exists = context["veth-child"]; !exists {
 		return fmt.Errorf("vethChild does not exist in network context")
 	}
 	if err := InterfaceDown(vethChild); err != nil {
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index b13326ba7e..f7a9c17d7f 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -84,18 +84,15 @@ func (ns *linuxNs) SetupCgroups(container *libcontainer.Container, nspid int) er
 }
 
 func (ns *linuxNs) InitializeNetworking(container *libcontainer.Container, nspid int, pipe *SyncPipe) error {
-	if container.Network != nil {
-		strategy, err := network.GetStrategy(container.Network.Type)
+	context := libcontainer.Context{}
+	for _, config := range container.Networks {
+		strategy, err := network.GetStrategy(config.Type)
 		if err != nil {
 			return err
 		}
-		networkContext, err := strategy.Create(container.Network, nspid)
-		if err != nil {
-			return err
-		}
-		if err := pipe.SendToChild(networkContext); err != nil {
+		if err := strategy.Create(config, nspid, context); err != nil {
 			return err
 		}
 	}
-	return nil
+	return pipe.SendToChild(context)
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 1229560b5e..cfc5058559 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -56,7 +56,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
-	if err := setupNetwork(container.Network, context); err != nil {
+	if err := setupNetwork(container, context); err != nil {
 		return fmt.Errorf("setup networking %s", err)
 	}
 	if err := system.Sethostname(container.Hostname); err != nil {
@@ -130,8 +130,8 @@ func dupSlave(slave *os.File) error {
 // setupVethNetwork uses the Network config if it is not nil to initialize
 // the new veth interface inside the container for use by changing the name to eth0
 // setting the MTU and IP address along with the default gateway
-func setupNetwork(config *libcontainer.Network, context libcontainer.Context) error {
-	if config != nil {
+func setupNetwork(container *libcontainer.Container, context libcontainer.Context) error {
+	for _, config := range container.Networks {
 		strategy, err := network.GetStrategy(config.Type)
 		if err != nil {
 			return err

From d011a4181c7310c5b029057825b571f6ae50c91f Mon Sep 17 00:00:00 2001
From: robpc <rpcann@gmail.com>
Date: Mon, 24 Feb 2014 15:49:31 -0500
Subject: [PATCH 301/403] Fixed typo in Dockerfile example

Docker-DCO-1.1-Signed-off-by: Rob Cannon <rpcann@gmail.com> (github: robpc)

The 'true' command is located in /bin not /usr/bin in the busybox image.
Upstream-commit: 1475dafd5204a6df2e69dec5214270020edf5e50
Component: engine
---
 components/engine/docs/sources/use/working_with_volumes.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/use/working_with_volumes.rst b/components/engine/docs/sources/use/working_with_volumes.rst
index 8ddd4196c7..9a27e4b929 100644
--- a/components/engine/docs/sources/use/working_with_volumes.rst
+++ b/components/engine/docs/sources/use/working_with_volumes.rst
@@ -50,7 +50,7 @@ volumes to any container created from that image::
   # RUN-USING:          docker run -name DATA data 
   FROM          busybox
   VOLUME        ["/var/volume1", "/var/volume2"]
-  CMD           ["/usr/bin/true"]
+  CMD           ["/bin/true"]
 
 Creating and mounting a Data Volume Container
 ---------------------------------------------

From 21edb8542efc156235dc0128707d2f17cf8064ca Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 26 Feb 2014 17:21:09 -0800
Subject: [PATCH 302/403] Ensure that loopback devices are mounted inside the
 conatiner Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 7cd224594733e5fa0560cb912e3cf2dcef168370 Component: engine

---
 .../engine/pkg/libcontainer/nsinit/mount.go   | 53 ++++++++++++++++---
 1 file changed, 46 insertions(+), 7 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index a73e97e375..55c2655ab0 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -37,6 +37,9 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := copyDevNodes(rootfs); err != nil {
 		return fmt.Errorf("copy dev nodes %s", err)
 	}
+	if err := setupLoopbackDevices(rootfs); err != nil {
+		return fmt.Errorf("setup loopback devices %s", err)
+	}
 	if err := setupDev(rootfs); err != nil {
 		return err
 	}
@@ -76,21 +79,57 @@ func copyDevNodes(rootfs string) error {
 		"urandom",
 		"tty",
 	} {
-		stat, err := os.Stat(filepath.Join("/dev", node))
+		if err := copyDevNode(rootfs, node); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func setupLoopbackDevices(rootfs string) error {
+	for i := 0; ; i++ {
+		var (
+			device = fmt.Sprintf("loop%d", i)
+			source = filepath.Join("/dev", device)
+			dest   = filepath.Join(rootfs, "dev", device)
+		)
+
+		if _, err := os.Stat(source); err != nil {
+			if !os.IsNotExist(err) {
+				return err
+			}
+			return nil
+		}
+		if _, err := os.Stat(dest); err == nil {
+			os.Remove(dest)
+		}
+		f, err := os.Create(dest)
 		if err != nil {
 			return err
 		}
-		var (
-			dest = filepath.Join(rootfs, "dev", node)
-			st   = stat.Sys().(*syscall.Stat_t)
-		)
-		if err := system.Mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) {
-			return fmt.Errorf("copy %s %s", node, err)
+		f.Close()
+		if err := system.Mount(source, dest, "none", syscall.MS_BIND, ""); err != nil {
+			return err
 		}
 	}
 	return nil
 }
 
+func copyDevNode(rootfs, node string) error {
+	stat, err := os.Stat(filepath.Join("/dev", node))
+	if err != nil {
+		return err
+	}
+	var (
+		dest = filepath.Join(rootfs, "dev", node)
+		st   = stat.Sys().(*syscall.Stat_t)
+	)
+	if err := system.Mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) {
+		return fmt.Errorf("copy %s %s", node, err)
+	}
+	return nil
+}
+
 // setupDev symlinks the current processes pipes into the
 // appropriate destination on the containers rootfs
 func setupDev(rootfs string) error {

From 02cbc6e6b426950ab9a113a1ac16b9f74e9f7ca5 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 26 Feb 2014 19:19:14 -0800
Subject: [PATCH 303/403] Code review updates Docker-DCO-1.1-Signed-off-by:
 Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 Upstream-commit: fb08b8b221a9a722910d63db678ffb5a8f91b517 Component: engine

---
 .../engine/execdriver/native/default_template.go     |  2 +-
 components/engine/execdriver/native/driver.go        |  2 +-
 components/engine/execdriver/native/info.go          |  2 +-
 components/engine/pkg/libcontainer/README.md         | 12 +++++++-----
 .../engine/pkg/libcontainer/network/strategy.go      |  4 ++--
 components/engine/pkg/libcontainer/nsinit/exec.go    |  4 +---
 6 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/components/engine/execdriver/native/default_template.go b/components/engine/execdriver/native/default_template.go
index 102967a489..91fd646c8e 100644
--- a/components/engine/execdriver/native/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -7,7 +7,7 @@ import (
 	"github.com/dotcloud/docker/pkg/libcontainer"
 )
 
-// createContainer populates and configrues the container type with the
+// createContainer populates and configures the container type with the
 // data provided by the execdriver.Command
 func createContainer(c *execdriver.Command) *libcontainer.Container {
 	container := getDefaultTemplate()
diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index ba7e8a719f..dc1c903f01 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -58,7 +58,7 @@ type driver struct {
 }
 
 func NewDriver(root string) (*driver, error) {
-	if err := os.MkdirAll(root, 0655); err != nil {
+	if err := os.MkdirAll(root, 0700); err != nil {
 		return nil, err
 	}
 	return &driver{
diff --git a/components/engine/execdriver/native/info.go b/components/engine/execdriver/native/info.go
index 5223feee83..aef2f85c6b 100644
--- a/components/engine/execdriver/native/info.go
+++ b/components/engine/execdriver/native/info.go
@@ -11,7 +11,7 @@ type info struct {
 }
 
 // IsRunning is determined by looking for the
-// .nspid file for a container.  If the file exists then the
+// pid file for a container.  If the file exists then the
 // container is currently running
 func (i *info) IsRunning() bool {
 	if _, err := os.Stat(filepath.Join(i.driver.root, i.ID, "pid")); err == nil {
diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index 4c8da8e925..b81401cd09 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -9,9 +9,9 @@ for using linux namespaces with no external dependencies.  libcontainer provides
 #### container
 A container is a self contained directory that is able to run one or more processes inside without 
 affecting the host system.  The directory is usually a full system tree.  Inside the directory
-a `container.json` file just be placed with the runtime configuration for how the process 
-should be contained and run.  Environment, networking, and different capabilities for the 
-process are specified in this file.
+a `container.json` file is placed with the runtime configuration for how the processes 
+should be contained and ran.  Environment, networking, and different capabilities for the 
+process are specified in this file.  The configuration is used for each process executed inside the container.
 
 Sample `container.json` file:
 ```json
@@ -67,10 +67,12 @@ Sample `container.json` file:
 }
 ```
 
-Using this configuration and the current directory holding the rootfs for a process to live, one can se libcontainer to exec the container. Running the life of the namespace a `.nspid` file 
-is written to the current directory with the pid of the namespace'd process to the external word.  A client can use this pid to wait, kill, or perform other operation with the container.  If a user tries to run an new process inside an existing container with a live namespace with namespace will be joined by the new process.
+Using this configuration and the current directory holding the rootfs for a process to live, one can use libcontainer to exec the container. Running the life of the namespace a `pid` file 
+is written to the current directory with the pid of the namespace'd process to the external world.  A client can use this pid to wait, kill, or perform other operation with the container.  If a user tries to run an new process inside an existing container with a live namespace with namespace will be joined by the new process.
 
 
+You may also specify an alternate root to to place the `container.json` file is read and where the `pid` file will be saved.
+
 #### nsinit
 
 `nsinit` is a cli application used as the reference implementation of libcontainer.  It is able to 
diff --git a/components/engine/pkg/libcontainer/network/strategy.go b/components/engine/pkg/libcontainer/network/strategy.go
index a2f4f8f073..234fcc0aa2 100644
--- a/components/engine/pkg/libcontainer/network/strategy.go
+++ b/components/engine/pkg/libcontainer/network/strategy.go
@@ -13,8 +13,8 @@ var strategies = map[string]NetworkStrategy{
 	"veth": &Veth{},
 }
 
-// NetworkStrategy represends a specific network configuration for
-// a containers networking stack
+// NetworkStrategy represents a specific network configuration for
+// a container's networking stack
 type NetworkStrategy interface {
 	Create(*libcontainer.Network, int, libcontainer.Context) error
 	Initialize(*libcontainer.Network, libcontainer.Context) error
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index f7a9c17d7f..f1a4e2477a 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -48,9 +48,7 @@ func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args [
 		command.Process.Kill()
 		return -1, err
 	}
-	defer func() {
-		ns.stateWriter.DeletePid()
-	}()
+	defer ns.stateWriter.DeletePid()
 
 	// Do this before syncing with child so that no children
 	// can escape the cgroup

From 906ee51aecae634fd406d0ebce1d52ea0c4de3ee Mon Sep 17 00:00:00 2001
From: Tim Bosse <taim@bosboot.org>
Date: Wed, 26 Feb 2014 22:34:42 -0500
Subject: [PATCH 304/403] Some distributions no longer include MAKEDEV script. 
 Stole this from mkimage-rinse.sh. Docker-DCO-1.1-Signed-off-by: Tim Bosse
 <taim@bosboot.org> (github: maztaim) Upstream-commit:
 1d82091756a7e5514619ecd676ceaa89acabedef Component: engine

---
 components/engine/contrib/mkimage-yum.sh | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/components/engine/contrib/mkimage-yum.sh b/components/engine/contrib/mkimage-yum.sh
index 5ff9d3f7d5..0e4e8ea1d7 100755
--- a/components/engine/contrib/mkimage-yum.sh
+++ b/components/engine/contrib/mkimage-yum.sh
@@ -45,9 +45,16 @@ target=$(mktemp -d --tmpdir $(basename $0).XXXXXX)
 
 set -x
 
-for dev in console null zero urandom; do
-    /sbin/MAKEDEV -d "$target"/dev -x $dev
-done
+mknod -m 600 "$target"/dev/console c 5 1
+mknod -m 600 "$target"/dev/initctl p
+mknod -m 666 "$target"/dev/full c 1 7
+mknod -m 666 "$target"/dev/null c 1 3
+mknod -m 666 "$target"/dev/ptmx c 5 2
+mknod -m 666 "$target"/dev/random c 1 8
+mknod -m 666 "$target"/dev/tty c 5 0
+mknod -m 666 "$target"/dev/tty0 c 4 0
+mknod -m 666 "$target"/dev/urandom c 1 9
+mknod -m 666 "$target"/dev/zero c 1 5
 
 yum -c "$yum_config" --installroot="$target" --setopt=tsflags=nodocs \
     --setopt=group_package_types=mandatory -y groupinstall Core

From 9c9bdcb0ef57b00f0c2f449e23e10ce1fabcde1a Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 27 Feb 2014 08:28:02 -0800
Subject: [PATCH 305/403] Ensure that the container dir is remove on restore
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 a115ce797b80a14d268fcd96521cf05d1e1074c1 Component: engine

---
 components/engine/execdriver/native/driver.go | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index dc1c903f01..f2d7ed8ae2 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -108,20 +108,18 @@ func (d *driver) Kill(p *execdriver.Command, sig int) error {
 }
 
 func (d *driver) Restore(c *execdriver.Command) error {
-	var (
-		nspid int
-		path  = filepath.Join(d.root, c.ID, "pid")
-	)
-	f, err := os.Open(path)
+	var nspid int
+	f, err := os.Open(filepath.Join(d.root, c.ID, "pid"))
 	if err != nil {
 		return err
 	}
+	defer d.removeContainerRoot(c.ID)
+
 	if _, err := fmt.Fscanf(f, "%d", &nspid); err != nil {
 		f.Close()
 		return err
 	}
 	f.Close()
-	defer os.Remove(path)
 
 	proc, err := os.FindProcess(nspid)
 	if err != nil {

From e3db7f47ed4e6c39950a588f50703c04d3f95053 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Thu, 27 Feb 2014 09:43:44 -0700
Subject: [PATCH 306/403] Use a more defensive vendored archive/tar import path
 to make it clear this isn't upstream's released archive/tar

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 2ca4e0ea60851ff8e9c0a05dc13fa23436c529b6
Component: engine
---
 components/engine/archive/archive.go        | 2 +-
 components/engine/archive/archive_test.go   | 2 +-
 components/engine/archive/changes.go        | 2 +-
 components/engine/archive/diff.go           | 2 +-
 components/engine/archive/wrap.go           | 2 +-
 components/engine/integration/api_test.go   | 2 +-
 components/engine/integration/utils_test.go | 2 +-
 components/engine/utils/tarsum.go           | 2 +-
 components/engine/utils_test.go             | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index 8bb0a8ed1c..72bd31a281 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -2,12 +2,12 @@ package archive
 
 import (
 	"bytes"
-	"code.google.com/p/go/src/pkg/archive/tar"
 	"compress/bzip2"
 	"compress/gzip"
 	"errors"
 	"fmt"
 	"github.com/dotcloud/docker/utils"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 	"io/ioutil"
 	"os"
diff --git a/components/engine/archive/archive_test.go b/components/engine/archive/archive_test.go
index 8badd58bd7..412660139c 100644
--- a/components/engine/archive/archive_test.go
+++ b/components/engine/archive/archive_test.go
@@ -2,8 +2,8 @@ package archive
 
 import (
 	"bytes"
-	"code.google.com/p/go/src/pkg/archive/tar"
 	"fmt"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 	"io/ioutil"
 	"os"
diff --git a/components/engine/archive/changes.go b/components/engine/archive/changes.go
index a9eba8196f..a397a1cf8b 100644
--- a/components/engine/archive/changes.go
+++ b/components/engine/archive/changes.go
@@ -2,9 +2,9 @@ package archive
 
 import (
 	"bytes"
-	"code.google.com/p/go/src/pkg/archive/tar"
 	"fmt"
 	"github.com/dotcloud/docker/utils"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 	"os"
 	"path/filepath"
diff --git a/components/engine/archive/diff.go b/components/engine/archive/diff.go
index 6a778390bb..e20e4b1f02 100644
--- a/components/engine/archive/diff.go
+++ b/components/engine/archive/diff.go
@@ -1,8 +1,8 @@
 package archive
 
 import (
-	"code.google.com/p/go/src/pkg/archive/tar"
 	"fmt"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 	"io/ioutil"
 	"os"
diff --git a/components/engine/archive/wrap.go b/components/engine/archive/wrap.go
index 981420b3fe..03ea5083ac 100644
--- a/components/engine/archive/wrap.go
+++ b/components/engine/archive/wrap.go
@@ -2,7 +2,7 @@ package archive
 
 import (
 	"bytes"
-	"code.google.com/p/go/src/pkg/archive/tar"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io/ioutil"
 )
 
diff --git a/components/engine/integration/api_test.go b/components/engine/integration/api_test.go
index 4c22d54b3d..cb92d89858 100644
--- a/components/engine/integration/api_test.go
+++ b/components/engine/integration/api_test.go
@@ -3,7 +3,6 @@ package docker
 import (
 	"bufio"
 	"bytes"
-	"code.google.com/p/go/src/pkg/archive/tar"
 	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker"
@@ -12,6 +11,7 @@ import (
 	"github.com/dotcloud/docker/engine"
 	"github.com/dotcloud/docker/runconfig"
 	"github.com/dotcloud/docker/utils"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 	"io/ioutil"
 	"net"
diff --git a/components/engine/integration/utils_test.go b/components/engine/integration/utils_test.go
index fc66e8bcbd..50a4c9bf25 100644
--- a/components/engine/integration/utils_test.go
+++ b/components/engine/integration/utils_test.go
@@ -2,8 +2,8 @@ package docker
 
 import (
 	"bytes"
-	"code.google.com/p/go/src/pkg/archive/tar"
 	"fmt"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 	"io/ioutil"
 	"net/http"
diff --git a/components/engine/utils/tarsum.go b/components/engine/utils/tarsum.go
index ddeecfb450..67e94aaebc 100644
--- a/components/engine/utils/tarsum.go
+++ b/components/engine/utils/tarsum.go
@@ -2,10 +2,10 @@ package utils
 
 import (
 	"bytes"
-	"code.google.com/p/go/src/pkg/archive/tar"
 	"compress/gzip"
 	"crypto/sha256"
 	"encoding/hex"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"hash"
 	"io"
 	"sort"
diff --git a/components/engine/utils_test.go b/components/engine/utils_test.go
index 6917007575..31fa12b6ad 100644
--- a/components/engine/utils_test.go
+++ b/components/engine/utils_test.go
@@ -2,7 +2,7 @@ package docker
 
 import (
 	"bytes"
-	"code.google.com/p/go/src/pkg/archive/tar"
+	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
 )
 

From 49fbe66f4fa50013a07611d99a5cbaafae068e2c Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 27 Feb 2014 09:28:26 -0800
Subject: [PATCH 307/403] Allow child process to live if daemon dies
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 fdeea90fc806d8d2cccdc76a6ecb214dd03093ec Component: engine

---
 components/engine/execdriver/native/driver.go | 21 ++++++++++++++-----
 .../engine/pkg/libcontainer/nsinit/init.go    |  8 ++++---
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index f2d7ed8ae2..ff96510262 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -15,6 +15,7 @@ import (
 	"strconv"
 	"strings"
 	"syscall"
+	"time"
 )
 
 const (
@@ -121,12 +122,22 @@ func (d *driver) Restore(c *execdriver.Command) error {
 	}
 	f.Close()
 
-	proc, err := os.FindProcess(nspid)
-	if err != nil {
-		return err
+	if _, err := os.FindProcess(nspid); err != nil {
+		return fmt.Errorf("finding existing pid %d %s", nspid, err)
 	}
-	_, err = proc.Wait()
-	return err
+	c.Process = &os.Process{
+		Pid: nspid,
+	}
+
+	for _ = range time.Tick(500 * time.Millisecond) {
+		if err := syscall.Kill(nspid, 0); err != nil {
+			if strings.Contains(err.Error(), "no such process") {
+				return nil
+			}
+			return fmt.Errorf("signal error %s", err)
+		}
+	}
+	return nil
 }
 
 func (d *driver) Info(id string) execdriver.Info {
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index cfc5058559..cc481e2cc8 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -50,9 +50,11 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 		}
 	}
 
-	if err := system.ParentDeathSignal(); err != nil {
-		return fmt.Errorf("parent deth signal %s", err)
-	}
+	/*
+		if err := system.ParentDeathSignal(); err != nil {
+			return fmt.Errorf("parent death signal %s", err)
+		}
+	*/
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}

From 4bb07a86b51b0f41334c064f232352c3754b1749 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 27 Feb 2014 11:40:25 -0800
Subject: [PATCH 308/403] Ensure that ticker does not leak
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 44c3b7133218a66f44cb51b7563b7c0016583eda Component: engine

---
 components/engine/execdriver/native/driver.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index ff96510262..88253a5940 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -128,8 +128,10 @@ func (d *driver) Restore(c *execdriver.Command) error {
 	c.Process = &os.Process{
 		Pid: nspid,
 	}
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
 
-	for _ = range time.Tick(500 * time.Millisecond) {
+	for _ = range ticker.C {
 		if err := syscall.Kill(nspid, 0); err != nil {
 			if strings.Contains(err.Error(), "no such process") {
 				return nil

From f4bfb3c930209c0c11d70fdc9a29e51cba6568c9 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Fri, 28 Feb 2014 08:07:46 +1000
Subject: [PATCH 309/403] add a little bit mentioning commandline option
 combinations

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: cdec3297f7f06fb383c1be1aaec67417a2d4c7f9
Component: engine
---
 .../engine/docs/sources/reference/commandline/cli.rst     | 8 ++++++--
 components/engine/docs/sources/use/basics.rst             | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 67794a41c5..99f93dea4c 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -20,8 +20,12 @@ To list available commands, either run ``docker`` with no parameters or execute
 
 .. _cli_options:
 
-Types of Options
-----------------
+Options
+-------
+
+Single character commandline options can be combined, so rather than typing
+``docker run -t -i --name test busybox sh``, you can write
+``docker run -ti --name test busybox sh``.
 
 Boolean
 ~~~~~~~
diff --git a/components/engine/docs/sources/use/basics.rst b/components/engine/docs/sources/use/basics.rst
index 24c22bba39..a301e34a91 100644
--- a/components/engine/docs/sources/use/basics.rst
+++ b/components/engine/docs/sources/use/basics.rst
@@ -51,7 +51,7 @@ Running an interactive shell
   # To detach the tty without exiting the shell,
   # use the escape sequence Ctrl-p + Ctrl-q
   # note: This will continue to exist in a stopped state once exited (see "docker ps -a")
-  sudo docker run -i -t ubuntu /bin/bash
+  sudo docker run -it ubuntu /bin/bash
 
 .. _bind_docker:
 

From d41cda6cb264f2b5d05f14f27799fe1fd996af46 Mon Sep 17 00:00:00 2001
From: Josh Hawn <josh.hawn@docker.com>
Date: Wed, 26 Feb 2014 12:37:28 -0800
Subject: [PATCH 310/403] Updated OAuth docs per arothfusz's comments

Added emphasis of https for OAuth interactions.
Updated example URIs to use HTTPS
Included redirect hostname on authorization page.

Docker-DCO-1.1-Signed-off-by: Josh hawn <josh.hawn@docker.com> (github: jlhawn)
Upstream-commit: b6a5082bd1cfa297637b38aa6692239a679d97e8
Component: engine
---
 .../_static/io_oauth_authorization_page.jpg   | Bin 71954 -> 0 bytes
 .../_static/io_oauth_authorization_page.png   | Bin 0 -> 178773 bytes
 .../reference/api/docker_io_oauth_api.rst     |  32 ++++++++++++++----
 3 files changed, 26 insertions(+), 6 deletions(-)
 delete mode 100644 components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.jpg
 create mode 100644 components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.png

diff --git a/components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.jpg b/components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.jpg
deleted file mode 100644
index 5c331987c2afbcf1667bde09967596223a9ad308..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 71954
zcmeFYWmr^g+c3I@?(RmqyJH9`5fPB??vO4SL`CURP*gw=5D^gRR#F9|yITZgK!E{<
znZ3sQ*5~=&_kP}Q?|tm!*nhr-4Ch+winHq)(bMQ<fZ~d_o;Co1Kmc9v2SBef4CrZU
z+Fv&|)YiMI1-<|PhE~Ub03R$00Pyt-4m8%$;IOc?;=o@7AOImi0nh+Sj?O^=>esJd
z1^(l8JPD2luQ3tKTK{p_Kfj=KaSd_?0LXRlwUbMbvo8qOg1_&b0|J8q02}-TxWa-1
zFz{m#rU?WQ1mQOr*!?f~JqC9A3m*S9=7zB*IOZz=5Rf=J2D$?P@lWtMN2s$qxDE*o
z0N_#ixp?{k02Mz7t2%o)x`4d!0LKXX`ubzwhak-F^l$69{~PS+==5hzM@RQR@L#lm
zGr^57dj<vgI7a-s`Tz36*Czzz*RP8c{3P)R)HMeGa)Ug3=IyWl2ljKiX88NLCrHt6
z*ds*O^f&ArqzUr!uemOcm-T<cA>O9yzhTEf5c+$JXRzLl-*BM6@t^hme6C^i;};Gd
zu6lo9*B~vE-_PAVwe^0(ksde9f5V}kX4ihhLEa{RaESEK{PR38#P|=+Zh_i=X!H#N
zXa2pfv*W+^3ih}G>igexxn9=#4ZHf8{=p|8SmVz+0Y1O<`xpMMK01G%2ZfsanHwB<
z<Ii(1$150p{WU%y`1&8709OGm;4;7gXab&qAK(i30*>I_W$-Qt2mpM*yNF=d@L+H*
zpy?kF5$Nge5zL_uT8%4*o}aU*Fo&eLgfswPY!EXB0Dc(%vMmVR(7&GD1m`O%007qW
ze?4;)0)S>=&<x)E>lwE!sP|6+pk>WDBrx=^^>8qMZ~-EK9JFmlfDPaR_yG|>5|9Oy
z05uT%D}W(z1F!__0B67h#6J)S1EPW3Ks=BHqyvwDTp%AP0$u?Xz&oG;Xazn1y+A)O
z3`_uXz%sA_>;Q1!7&r%=4nBkwLJeVrutRttLJ&!aJVX_u1-S|_hFC%zAnp)9NC+ev
zatD$G$%N!WUO>tq)sQC02goPL2xJDb0@;QfLe8+Tu}H9JuvoEpvBa?CvDC5jv2I}5
zV!318#EQhai<OG?7^@KL4OTtY2dsXq39MzT9jqg40Gk+_4x1BO1X~_k6Wb8m3fm1k
z5IY7t5jz{Z5W5n)8M_aA40{=S7yA?k4~H6u14jf$2}c*l6vr9oCQb}aGEOeeE1Y_q
zZk#ck6&yGY3YQd@1y=}H5myh_0@ock3^yJ(8@B|v4z~w)0(S%V7!MDR4v!B{4o?@)
z63+`S3NIP&IbIdsd%O|6HM}Eye0)ZHA$%2lLwra4VElOeC-`shJMc&GH}DYz#02aF
zk_6fWRs?<oaRk`}uL;@-MhUhE&Iu_9c?cB=4GCQcBM8$7UlKMG4iRn;o)b|L@e!#I
z-5~NJx=r+$sFJ9MXrAZ?F){HaVg+I&Vo%~&;>W~qi9Zsr5TBAzkqDA#lGu=hkff57
zlDsFGA^AZ{O3F*BMruVGOqxnsM%qQXNQxk%CKDyoBXc2xkv%1=CmSXEPEJV9L#|G4
zM;=L@O<qGjM7~QwNWn{?N#RHlL-CZNiDHW4h?1I8g3^%Emol01HRUJDuT=O{yi{6L
zE>w4^im1A%)~K<mxu`X%ovH6ozohP=-k`yw;iJ)`@uEqhsi65n1E-~;m8LbL4X1rd
z+eW)ghfT*zr$^^Qmqz!FZj$bdo|Rsm-jzOqzLI{F{)B;<L5;zcA(5eqVS?d|k%Li-
z(VH=Yv4L@c35Q9L$%rY8DUYd#X_uLXS&7-1Ig$At^DGM%iy(_JOB72H%K*y}D;uj0
zYXIvL)-KjvHaa#nHZQh^Z0&5@?9}Y4?4Ilo**n<3anN$8bNFyP=IG{tbFy&ia)xle
z;QYdQeu?jr>7}?!RhJgHh`8jr+_)Zcb#lSE*|`n4qq)nuXL$&D<as=Ja(Mc9PI&ov
z&3W(hHt>GsW8l-{i{vZko98Fxhw|U#FXSH=z!Q)c@D_M3Ff52AC?n`0_*8I62uny-
z$W!RK(1<Xuu!69kaG~&&2#JWgNT^7;$ciYP=vC1;(FW1)V%%a@Vi{t6VkmJLaUb!Q
z;&T#I5?3VRB$_1-B?Tp&C7();OOZ-xOTnZXr4FQpq+O-+q^D)5WejBQ%XG?I$jZqE
z%2vv5%W=y&$UT#rlBbcsE}ty_Q2|#$Ljk7Hs&J|(s~D{KPH|sJM9Ev}wbEB*K4n+s
zm&$7@msA{8UZ^aqa;Q3}7N{;mIiZfwLg=a*mzs-OiQ1OBfV!9Z8};uR;u?V(bs8s{
ziki1H-(SYQtaCZ>@)s>CEmN&rtwrri+V0xr+Hf5iohY66y12Ufx*57tdaQcRdS!a>
zD{@zEUFp^*(Kpf0)nC0Tcs1~9vjLXD6@x5;`D;Aa{H`?^0)~2qS%wSO`L5r*-eQDj
zblvEw(WbG4akO!t3AKs6$!nA28yYv#Zp@kTn}(Qnnvt8?n3b8Gm|r%}G+(w5v$$o^
zZ^>loY1wFnZ)IjxVs&J#W&Ox{!$!s?-e%I4&o<ollO2<tk6oKRxxJ%(jRUTOxx;G*
zq@$r@q2rO0p3^fYxU;5nj`NO-n#)6%ZC4f7OxG<p6}L>cukI@DS?=2&P>*bnT~AHV
zT+ah9U9Wtv6K_NBQg5`6xlffZfv<yalOL6zw_mqEn}4|fNPtj4e8BQe#hZ_A!UOdK
zOM)Olwn2@-G+?qb5W*jFFJvWDHS}pHBFrqTCY&<dFMJ?EFd`vhD^feMI0`4qIjS?7
zGx~P)$}RO<FJd4uPBEP@F4$ezMyyWktJ_4ky>Ac3iN|He{k&s-r}-}H-PpTp_jK-+
z$CJee#!uZ>x}X05=Yi*gF9}i!PZCgxE{UI$#FMg<kjc);pHn1K9;cvF-BQ1#$)@F{
z<E8thPi8<fUS(2dMrN*M8D!Nz<an6)@aH4@N1w8#v-5L^azb*JA76dk_=NjO`V(ZX
zNAAQ^ji*)5Se_+3J9+N%d^ArjuQH!CKPmsLz_Vcbh0crmLf*pcBD|u|qRp3PFZ+t+
zi_1!wN|H)0O8rWgUm3sZE|V)Od(HAXtsJX7q<s60&70wh%N324B9$+y=&F+50&hd!
zeyet<o_weOuCqqIrm~i&_E{ZuU1B|?KB6Ap;L)($XxTW@bfu}YS*f|MMYN@~m9zC}
z8*N)!J5l@Hc63K%$I<(M_q!k5Kdg1ycg}TLbd7f#b${v6@A=rP-P_ft-q-O_<zwq7
z#ZOJ2<v%y{%l6j~$PCmC$_&<hk^NFXBsbJJtT5a>qCC<*3LX70c6qFKTyMO8;@ZT>
zr0L}Jl+D!gw9E9@8K0Sh+0fbZx!8H!`NRc^h3rL^#lj_lrK)Aw<+hc}D+8-0t8;74
zYdh;f>&T6}o1~lBTkKn9UnRe`ZfkE3f3yC!u@kU!z8k+sx%ccl|M%K`wfzCO1$^Tm
z@Bn?7{DbjF=}+mOok!P?7LR?8&rcE&jEGmK@~3@g=4V^yVMu)B;|qa{W|Tf^9_@=p
z2RH^g{>lZg!A~qVHvl*+1prb@0H7WQ03x!#a^znlz!Vw+jsamah$v(S>p8X^jsPw`
z?g8F5{uIFy;R?|S2`(uwnLc?iMFHg$H8G7UZ6sY4{T8DjlOuBu%Mcqby9|dbXX>SQ
zT%+9Id9nD&_{jx`LC<$8v?shGGA7z3Rww>aB3<&9l$W%bjGC;V9JL%$enVkEu~zAs
z@*Nc~Rb!~Cny@;%2Aw9wWkM|+tqbiF9k}jSz2z&@`d_a07_?riF|4@$+NjL<wMoT|
zD${DS8uJ>9TFY9i8tZp9)wWf3Rrc>38XZ444LHxZY`Xq*LwgW=(s^C-7V?qth5G6F
zn+CYv3=2#NDhcignGQV&Cyd~Tl#99+?R+adCJ~ksTX6eDT>hQMchm00$4A}2`M@o~
zD)Cy9da_Ike=18FRXTA7VJ2}F#Y2WioY_J-(vMZ1XyqC_HGO9N+&RxXKe!<FMS9_j
zqPmx#i<e4%z9J}Nc`a71@y4{my)wM&!Q1TW!gu90HMPxk9rZm8pBe|7Mw%yDrd#LQ
zmfF`lcHSR#Vt3JY^Y<wCUhi}M81^ag^Rxb{fe(WtUzUgVhL1+hMv-IZ<A{l)$%Cmq
zP}|mK7w4wuM;8VcKQ8qw_pW?i9bH>k-`+Udf_x>}X86XnBf6`wr}<rPUmt$?K=P3O
z@bE|9&nHLT$I2&UCrgN`)7UekbI$Vv<cEt4lml8Ejs9QcFN({7`va8!H-c5d17ac)
z9#Snb5ArmMPRbwDA~g22Pw2)ONEr>7?lHe-Ic5`Lx93Rati3eJ^^=F3mxYg)pHqNA
zkXR5Qv?}~Xq*=5`ELl8M!a-6`N?e*=`a))1_Oo1-{6mFEMLQ)8WnL8ml^xX)Xro$@
zdWJ@vX4qvPEhlX=9erI@J&7w^`m|T^uObY-U7I%?x&G0p)41KF<wm1vo!MLSa*Gnn
z7go8}4{cIx@7u-M!yI6aaZZWOSuW39OWoeOH+sDH{OC30J>fI&yY9E^kGP2!NFO8|
ztPx@n>KAq=JSXB!WJlC!^!lwM7*;INZL&C$J9u|ccYog7j$gPx@}MW7F|j-;FF8FW
zE;TI8H{CtMJ<}^I@L}YmJK0G&S&yGSDa<W<`u17f^VYo1{QiQ;7wd&bFY$^QN(4)l
zUtKG+e;rUB`zF1jpt7o}?d|94iFZpiUu)rYh<bD*UK43EO$$>iM;mXuaEH`;l@C`s
zExUZWVLe&BrG3pG2R|);J{-Uqr2E1<Br~ira&^>X%zWHx!e-KL%6{5m#$ncR&T-yx
z!Ew=X$$8mhC15prEpa_}qkOYvYvAj`_TD$-F3BF#ciw$bxYz+7r~&97D?dLR6&%N$
z*dP>78BUMS#?Id&Q!czv+Gwu-BLDwv|6izyXq0J#K>ObZ?cbUCDa$w;DZ4U<H)qbJ
zcCJ-!6fY$oC%>S8fFPd`r!bQUg(#sIAofFiOJZ8`qg1_giOeI}J90PWZ58wt<&?OT
z$&?W)YpTQ0_i8ojuQUoYpI&~Xm8yMTCssFHFW`#1zTMRu271?24P~#383`EknsDE^
zWXfsAZq8!CXh~;9Wlds(Zws-#usgLsaX>hpJ7c*JxRSfkxwCk1dh&V+dW-o;`pWnz
z_(KD9ZW;yJ2L%MjhGc}k2&)c%A2AfU5VaGHh{1vp#gg16jDvttbp7u5z0UZm`_CUF
zCWIt9CK)8lr*Nf`r(UG(rLShpXHI8LJ)C|tlRcd?{dnrhWbXLWv1cRChw=vVzZ8tT
zm@HfXBOSc>tQ6-JX&LQnwsPJ#q7~AWidE3Jn$?%zY1Le=)u>aeS7}gelxvb|7Hbh|
z<!!sv&ep;Fp7{e?CwG@fw_J}#uR)*rN2gCdpF{g$0}lo>zC0ev8-6iTI9f3FY&>To
zV=`&#?)0shuvz~(k9mg$%SDr=>&r$f=BrL?H`n7f9&NtbYWX_2z5MNP7iW*=JNLdM
zT;<^Mq4p2$pPEO|W2F;Wgv6=P8Sgm<lJSBXMT*A5$p5ci2_`1sfi>kzFix1>2Y{;?
z0Fb8y0K7zC8-fe~u9E`54Fv#8BMrckk^->Ai~ht92!QjepTq!g0z!ZsSRWe!_JBVC
z18d4cpbq#1EC4?sL=aAhBIE|dACd?uh4ex;u<)?>v95x(-ea)7+r?(Y*2Rv*uEPF`
z!wptyFLA!&ih{LRCmuPT16~b20lou%3jqT`IKeC-l&}=6lVXVWi0z3-NG_8!kP4FK
zk<pT+kQ0#Kqrj!OPf0?VMa4>0MlDC(M`KR2MH@j!OjkfJM?cKq!$`zf&UB6GC-XBF
z9hM)g1#AXvXY8dMrkuE(^_RT3IJsuIAMqITQu9vm<?=fS@Cob*)(AxiLq+gJhD4u=
zd5FtP5KAmc)=Q;J`^a3Cm6T(Xr&b_Sq)?()=2Q_=g+fi#ywvY%ywLn`c}*K%M^IN^
z&-2PX{er742GiG0t}_~`7`vLJ-Dol00d?8XGR~^jdc&5^PTM}rq1<uVnbF0>HN$Ph
zgWA)=tH68LSIIBcf9s}JU}-RENLc84_>G9ZD3$2?7)jXM+Y)i_?n>ROzAy5iB#|xY
zaSC;6MmlB2!z`wUh1nuGEl&(`*Pg-hxblZz+$&Nq#xD8vD)Y7d8}Ul)s@dw=nvA-e
z4Mt7kEyS&>?RD?tJ1x3}d$IcFKGpX>8Vnt>8qpXNpWvU8oH3nyyl}o8x{BPm|CRpR
zn?3FQ^~3u|Vkh%wsTY@j`H$c7r~f5?Sy2Ah!488ja0^HU3V<50hcE}g!HxkNL=JKt
z;th$16oH+9Wh@957nU}bH&!NA3)Ut!HMRzJ2=;62bsSC{N1S4uU0i8g815h*E1o}I
zH$Dq~DE=5&OFtwyC3GPCOe9BCLd-~<LV`^aNpe8yNxDL2O*TbtMm|MhO|eSpO?g6f
zkD89Uj7F7ajMkGDO_xJ2K|csepN#PxlLa#tb0v!nD=BLSTOd0R`!q))rwZrcrB_^z
z+^pPlJWqM;__+CY`0E5>1+NOx3#|!PibRNNi_wT}h&M{4O1es^NwY|w%Ph!tf${8x
zLayRdr9$OOl{V0yZK|O)m^BqI+i2a^F4Gy&J-x!F54~z{aO>K0!}jZ|#)Kx4H|$JP
z%-YR=SPED<SwFQIvm>%scL;Z^cG_{_cXf9wbKmon_KNZT?91rq?f?EJV_;~|RETou
z%W(3DTan+R9dAv;jA94luHG5EcRhaefpNk}(zWEzsk&)>8G4yt9-2N{%<+DFmYe*H
z^Lb0YWdW+N{H0w9ed&1FqjIYX&dS}lP45zG?dqi)Nt?D>I@%s~xPFlC0=fr#pMCWG
ztTsSD2p<|4DIZIn2%U1Dai5D^C|%lFRbMaMBH9kw+4yb+AN^r?G>kAiTe<)<PS9=q
zmj8dY|HWVSf9aR~`~9;29?<@AvG~A_PXJa9RtMHMu&1Mi9fn<wy^6z%V+HnT=5aZ}
zZp>R;B;FOgr+EALTKLbwj*2Nk9U(noG~pVN0Z}tCKk;J{0#E~XN$p9;$*z+1l53EE
zpwOV`rMyZxLFGubPaQ);MpHm5N!v?jL-&(DjX{`UfYFbMnyH1^m4%AsJ!=3P2iq|F
zZ4OC}P0pv6Ot{Fn`ni*M40tJdXZQ;FeFYQ*aRo<&o(p@5$cf^M&WKft-;=PDRFq<r
zI+I?M>65LKE0=$zP^s9WG@!hqat5VSlTo+Oh|w&)Jf@AUBc<!Cmwu&Lf7O8SnuMX%
z_4`H*#@jd8OwG+Q&4(>1tW2!4ZKmy*?5!Q1IW9VLxp=wOx<fp!dlq_~_!#<@`x6ED
z-kb>12!0pJ7gi9#68SWm<yIj~Ft#pE^UnA^k9g#R^hD02w<#*ApVG}THnYMXkz~Jo
ztomf`Y1DJJyzT=3LiVD`;zy-cWjwEs-h8age;e`6yjHHBxe=>rw`HpBLr3X{_%8b%
zi9X23;m-vFfnRin*+)*tCMW8ra%XPO`7Jmt*{`^-MQmhk)of4i0^fz;R)@(yJCDy#
z<<3JdnlSPYa+8w8L=ON$q5-xa7t!b+ya0fo2>=%vX!Lm@8hud&78~;b@ZRUI{ySzc
z9t8ko^3qX|toK*F$2|C7F7yfzs}=4E)-MJIfFSsa0KkP%0hp==g6Ww;n7}?K1_ppD
z5avIyF@*o`F<@PD-xG{We~rQP!7&%6Z;YAq*I%pxtluNBISR0U!;l@!Q1l$=$FLv}
z%s<dmVJ>W3Y|Mp+gM*EWj|VpXz|J5(0Wl#y0TBTn9w8|q5iv0d2?;(SDH$mV83+<%
z7QxKL{xuhum;jFe?B)GGywL9fN&?6ZHU~E35`aYs!KQ?uy8(8P5?rtm3tkv>F&6|2
z8wVG}2*d*%P)7lxkByB5B8!UyG6Hf7d=KDI;!<%+sN+!^IpSZsNh5hX;{^eiM)e0;
z;}JNwlv7|FArT!t10xd;FCV{vptOvvoV<df=4CBy9bLUECO1sY%)u74vx}>nyN9P&
zP;f|SSa?L_oxAtq?>|UL%*=ZDC_Crzlib3hm&GNeugYG(tEsK4Z)j|4?(FLB>FxXY
z>GSB=_{8MY^vvwa>e~9o=GNEkZwH4zejXj4AWqLPbV0zp;`jBBbWwtIVSzHh!N<@A
z!3x6=PKkrdDS=0&ZiMf6llqe6Z2}sNj2G1(2)U$;;j~VHBSduE(kna%7}9=G_J5DC
zxc^s_{UPjMbj<=JV6}}!iA@PWfeU0|B0o@=kx$D!m|7Cc!^i3=muB_)L_KQUHwIr*
zjlLnx3VblAn7);(S(XTlEvk4ds(4GCUyT~MC{g)}Z5V!36n^w(Xis8a=lJnS0jbK`
zWXjrP4YanejeXX6F;@EI*9rruF}9yD&$P(@vxL?E;l=;|dhwx{DgCH`RAg;3N8vSb
z47rIh&#>Q5h+kp??@(lhy);m3qy^BVPSe!U3?%}omN#!y`iE}iiur|N4?29CtsMBF
zMlX64@MN=G<>zSS*Yu2?44cZbRU?Xr-#45?*}4T}ETgrBFQqE++;*O>h)-ZSEXcE<
ziX6r_5jpCOSwZ$_%-(y?@&XOC-$zWzM%!Ev)D2xk>7aq`5i~&PjRr!e&;X<m4Xk=#
z7okS-&+`%RqH}H7ci38IQwKudg2lIv57mYl;0aq14UE~SLSbX3598}x6hTj*2P-<q
z$!K664fNd$%7<q+DT{z3w0>_u-8s7)b}ns?GysBOvr=dv2o12&z&wU7hLGXritR#=
zzECMS-KucLY@n0K!*^lZfx`N01I_=wL09+T+Mf}luuda^t<Mc;;JpPJK;!~nJ8Iog
zTPS7zzX_=f56?3}1HyYh(12Yv8aR-Kb()BU@1X%W6%@rAtH{2`hz6R_KpGMBubD#6
z(ZJn88`$eVi$YiUbIMYeKqg^O^uR9suT0uUTyfo}{Tt~~cA9=Ppj^>+(cJfoNm~D%
zh7S0{{`@1eE!4uV6~PTl>`yoR(Lihl21Uro-`p|!d#cR|lKU{V+8PZk3&W5G90$rR
z9TRhZ-vPn)|Bb6kpkyz<T>BSe@Dq84B>txviqR&5<he@zy^|nYvQSigyY(FiQg$>z
zt;Wj!N4)I6ccT45PN(p#z6iDOOD~`+qK^65V}JDM<$q<-5JLai)_NT%Cl8FAG*_pv
zAN{)P0EM>wH|zfhEeJ(5H8lVGJ#<ARrdR~Z?135k6%G6s2?ro5&i4LoY=DBkCK~Vq
zl^erJH1L<A{bA)6lBeoo&K`-Ega#6dKthKWeoy{~#W9#byF5Y3{8|sx?v4}R2sBXo
zi;RE7d=mfrY!;|(BQT7z*=!+1U~r~ix(5Aky7mkdecfS<_21|egx3whXV<27F?0U`
z_vHictP_!N%=REJpew?m?4kc+`hPRtA;gs>_Rw)OFjos&ALoJh^7Hz91S$P5q4NEc
zP+^@GTZOZ*Wob~$@Ovu$@Tq_-?Qf5e_J@Wo@+5oqfB6no5x-(z)qFP$TmNx5s3WlN
zR-n>iTmd^gyFF&_6&h&x4^s6()cuIf{#ymFL|Y-wvs=-?7>1C4aw7_$!aJW>8~zb%
z!_Y!4M%(^bXF##`Df|4AJ4PMVS0{&rehC@F_tF1qeai>VX)ATm<2?-LbU^)?@%_&t
zeF}=S8kFJz8n}iLBRRd?i3k+VB!=-ehJU#C+uLA<Hyxb(ts@T+b@xsGp!Fa0k^KYc
zv}6BLFN=%OvHY{p|HyRm#HDkLA!9ICKk!alsom<BDf(w$-?jR0wg4(u^u?SVY<u<>
z;{Tw!sv^!vS<nIeS`9<=r$0OWN0;$dSp*D3zhsV|WP=89|EExLr>ANG!)OqJ^k0VY
zx9$MJ`M=%JpD==vzjtPgz8&-z!f6P7mQ=d`(KPf~NcL(mGG#~Xfu@lfI{Uv_-Z`Ta
zV;P_V{%<V<^jHBgd;b;$oyjJfpg(`<&wt<z=qbPu`bYHO3LyJ`yM=$SzD+a$#^P&K
zQ-AwhPs1ekbBw+GW!?Paq7o<M7eArB#ffLj`He6Mn<^wvvf+F!82d4ydEA^$HL)jd
z(Xd3#!iA9QHZi$T#vl+Ta7$YM$&K4P8D_pR0f@~;F@#>ujeDaTzKgsm`RfVP^2Ry?
z1#Dd}%B}1ZE*EmO@DypQuD_Coe662qIiHv=9t_OAR=(++yZEkY9$y;rIweEjNaM83
z1K^`I-i8Z~1<Pn(ysd?#lrQX>4Bk}bom4LN^Da5S?H%?WjP@?`G5=IR=HJ66cxb$}
zwM~+L1}T^HM!94FYme7hBcsdhJlCoy7*<=9n$^Wnu@f&*+&s>w2j{g6L+8Y5Z0fJ0
z9S~`2p30_`;bC?Yweq!5=TB|L4C<?Eb3cp{GKo*cTMUfS^XnZhs=QWXNzS)1OwI8<
zmlsR<lBYT!t#VO)OtIzvWPShe#}sqpP_g3@!d`uRy)|lwFzxt`e~WGvPdsx;AFoA5
zT$9R0)Mh<iHPLJYgzH>&NUVQW)~8o?Z#(&B+LhUtE8I;^&IH#)nxsAjFD0{6A{oG(
zC_Kr2BIM&y)VZ~<i9u6!ZIa>TJgwxXnlw%xpXqU<`?3OX*skf6#f;_C$t+=q%NgEZ
z=@+&tse9d1A~N#eiciL)g^e5jkMez7`2FO>xhcehc3Z^?JTqtN9z85NS7?~+6IriO
z_qyejF#VcxZmeEN$2PO8dp2rj2d)$0)2-Ue6Yx3k&6}6B4iO||>ZJ-}fd)G28niT4
zf#aL16i9=Em^%lRVkF^HW)n!wm)|07riK^1hOM<CJf(%7*iMf0rZE%Bf5v(l!f~(%
zo10Pb9t`dm5z`poXdQj=bT6y-QdCk>nP>^W!Ze%4mCA_sy@po9sHuFTOd$jQ?`>^Q
zM10?)fxOhvI|!HRV-q7|qlZ<rF1GxiC2F6~?BtV0i@2_l%HA^Rp&PMRm+ocOEj=x|
zp;?#juVH!O@S`(1M8>$khn+YC`rt&BdJO;G_qrWsOMlS{#}t;CK4x5)bSjsFMRX}X
z%akoNJ`;+g_u^}V)O4?~)o13%9h2&Zv{V8pIA7RgJ1?9aNd@asB}EM4RTYQ#UmL3(
zw;lVIJpw(h>(^y;H)Wh|>5^rf85#(bgjDH>d{~h%dUarN&!D)lCJe@n2C6jQ57j6S
ziIr(6#E?!V7kk$6_dSZ#t2mk}u9#rAMEtNoSi)PbzH38dLF0Zh8|X*W=AITMh-zrN
z2Ht%pZt)>75*H^AH`vUcTv_0?MOR3P$1KlaUAMQeWDizrU^z*=84HCv16M^r3_pT2
z>;*IqwxX6#=8+yQBet42WYmyr9cKO1pHDvFHjf1!2fT}G<BLxAHki{I8d!HN(r0PF
zb5gjf<3tp8E9!z9vQ_lBym=bvxVauo_PCJpr^vqh-kIJNaaioKB)Xso%g?cIJtMky
zO<-J4Ma<V+e`Y46L+jR0)w}iZ(mP_xI#DmJJgr!Av-5G}<YYUi{o@t%AI#i$=oJ9a
zK=8y0yrs(p_Oat7Cg<sF6*Ia>k(pb1Fd4%!9Boh%Zu~`r_?+@5E89fxbFWRMhxC&J
z?{yolUlcGTxrsA5e6-Be{T|J8kpf-8y04ehL(k+_6IQq_cPy@{(ldXYax)N4m+vf2
z!05p7%GiAHR>cnq_sIq53L5xyYv;@OoLK`>b_pJ{uYcB&pscW*M&M~~zQ{M$3U&5&
z^*b?Xt>%~Le!RfR8k(G(F8{HD3*ONMW^WlV-8Izndl7PbT<1JJ2W!2@k?Y1D^(WaV
ziU}momd%{*6kYXFTlo`*3<k+P*_JDC-2hFj*0mWFh@f0g2f25oXv>C&6<%>jly{Nl
z%^+Xe%>EFXuOkonqJT8!B1cwxoVCDrsTF(|V5la!k!jRCe{?EMj@2bw#FDMbOy!9u
z5uIn1UGsxR+DT2p_I;exIMWD}I9gVcx$8_9dh|_bsMP>&-))tjj10Q@(kqu+(J)2z
z{d#LqQa@i^3dKFaP{sBSU$qUbHf#N7*iGO(3yVeY6RWYJ3DJFr@e;YX?-o^j2FBkG
zl1m3gYI}k?uQw8LUB`P*W3ZS@8CIDO4^erH6opR@A$6tG@h_B!peyDGe{5CuQ5D$Q
zw0R<u<03QKaGCr;JIMiiVzjIKYj$#vfNjOR=l<T(vQ`zNou5P0(u8Wmt_+M62!G}X
zH5XlB6-JaEn@)tZIrq>DMXfBTdB<?vv8M8(m}jgb4i>!jDEdbFWK!+!;XztXpxhU`
z`cPCu!$uX7l_+%k!t+8b-+Ai0Ds#BgBq49}aIMFS6n&*nSg$!)G6%we$lTPe_iWTP
zwdY!sNrl`D_z?}pjq=!~WtZAx#$n5OOYlqtFB-UdklNu{HvcVG$itjoYHm=HSZ7T1
z&H8PpOfx*F<OcWbjPP5Iz-}zXDgx9181U~O9W^rL$NLC7jdF}SHH_|VHXIf`u-voj
zP%O6^jGNzkCW<%KMEbJAE%E^2xKg*$3VnGKOzirv+eSm-&tsF9JkDrTgOiB-@0mw6
zESL_Nsl={NLhr}Wcib<$NxEA7JX7zW<AP_>@>vdd)`_brTb{*UV#k5h`?3S64}o9J
z8`$0In!`~emwMUkMJ%W{B%sY%x9g2Qv+2l}a8AL<l%eI@a_sO2R@?PC&d~w3mMd3H
z1h{Y?F0aHh8a7^P{RXA)S7@*pmEU;8(EPb4y55*JEB2cD(1u+Oe5q3i{^P@>l`wU2
zw=AS6ULC8mSEaiWUP^+1N*y_8E9V}Pr`8)I^!pCm5~*2HGWsqocs{$0$+z@KkJ7K>
z4ILjXIlB&>2ZCAbr)VRUm%bvO=cI3@3~sdeVK)J<zNkpqup>om8C+D0SX@HP6V>{U
zn8T&>;dMX7V|=e+kvp?IJ4<W1O0L6%T6^fT^@4R9)}YH8QKbk!Nu0bT5i=<Egv4j0
zN0fl704fwTbd~)5#Mr9JXYmE4T(!`>Du-L&?Du}88U*aEDziV#0*glB29YHd59}tU
zlQ!Zihmg%i7((}*0<3K`4Waws>&>*@Sfx8vu)0M22a@yRGF`CFEAm^3MyrxtIXknl
zO8I-cM@|yDv)lL_$Cb<|Dh;wgwIdo>r(W7Bm+FNFcBA6)cVhRm;n`zDyGLDB399~2
zs#8lxABLx6#rUkoD&4Nk3>^GfbRM+`?yIN36$93Qcat_g`DARXv3Bk(L=35Tpq6^c
z_P;bbuU<_xG#ZmGUsaX&ajpc{wvF1{NL4Aj)(UI0kwbDr7Zipfp)1_j%Io0Du)W>j
z0MDhlrsdp~`w3DbZw1I7d<o~y1-@Tv%II>-I*+=OjZ_i35AK(y{2jWY8J?B#BLv)a
z==d1l3a?prrzZgP{+U=^<j;nq^<v3TxA;MFPRfeTVVlb++AcKEshO?dU$C#Mtdp*N
z4L=fGxh=0^@lMruXk?@70i7W}&d*}iOAB9+8K>9rgD%?gQcg!%Vfacr_f@&D_t})L
zE9?IVnEuoQgkjrpMEB;L2j#cf2pll>E%I&aAi1BcJU#;n$*5e5UCNKdYrFGoiX>XE
zZ&5ksAv<NtvvwuS%PJORX|Da=ZWxC9h7Xa5RZwmx4%usqu}VRpxOYuD8k*LZ!I?Vo
z4BT54d`NCh<?6L6X~;ax|6trW1qMV<U}({rnai5Jvnm|oL-r6d&l<&Q%~0Td3XPKK
zVy8+@W}7z#$LM_f37JO&{x0qzT;7fTZ8rP|oUD3SIVdV+7C+_lVf=uQ`8;dsQu|Mg
zGF@T`>U^U3ZGwobkroisw7oH;PA;_Jd@C1>G%MU+)O?1cb?)KF8rEUxKUGjTIVw7j
z-iqI`kqS>!(fh<Ir4JS$ybw+}$amYQi^5w1u!b6>X%{=i-u}M&0mp|ezBV8fti-$F
z75Tl-FWRzB%H!F%zr^^EjIvWcgX<j?kge}L3z&I{TKu@taW>JFMtMRKQ_D^jJrC}Q
zZ@0#{t$)#IcyQAOisX*{bl4sQa=kSzzsd{v4sCcBIV|&|@khSbO5cOXjWYZMNy+Y5
zs1@){+5P~c%(>#LW7?Ez{ov<ZSd&L#?<rPtdea(TU4&RdLH$KFlUzJw@F2NnuEpKv
z)Et&fFS4()tvKt2Rh$`bBk(JQ-gJzM)TO9KsaWw>`ubh(la`D#zM)L(K(2Z8I*+w_
zG@2tz>~8Rmfs81Fa)N)8=`@K;T(>)GFF*Ehv{3LY`F)=^wrg(H)pQ%_j@Lehu9J0v
zhJd0!Fn^Z41hsHR1H-sC4-i@YPa3x<KczxvWS%bDQ!rktJ#GF#kBY5@{4|dbNs}?p
z-K$M%`=(IE12-$)6b!O^v~r%Z99BS9KXE9y7<5C}TF5-7pa6o}bNAxom`u8u?H~Vw
zPXqZFo@XO;OXw4d!*<VnYqCwJ$M8`0me9wTOCLi&{gj5R=2M19a<+a#133|CC{3?3
z9#u%V-rll%bq7yDay}y0mh4r>&(U^!#3KbtJ2Ws=yL2W}zSE{@XF%PR5*1jZNBjK2
z^HGL@Ov#t(4=%IRP>|7t$kRX)&;Sv3Cl~aq9P$`7(ToPx9>Thy2;D#*|N9p`ejSL7
zXd}2eifAUH5@~rLmw*!W%%|3g`~D)ezY9eN<|#W%6u0hs)61DpO{O>Lmm1T&*EPkC
zz1h@0k1#*D(!YArHOSY!$WlA`MmXewGQ#)hmaMJf8P6w%+*t?igvRqXkX{uJEZ&QJ
zBzG4|Sq$t)I9gYs6m*bMpc?^$7@PT42lAdMh=|RBShqfmc(D(6Bd;oOl<!IN=)gd%
zOETR@#<gOnXc@$vs8`<tJ)2LPTcFD6wt7JP^@77JZF$Wh{Elm_4{_Jdp$HxJgEbf$
zxT6nlVa3LX&|B#s_;%pM#GAKz2y_a#H)k(*WyF~bIMHNeq)WwlRrL%d5W}lh%oCyw
zd1~y*$+pcEGa3xrZf;y2dK>l3sa>raVRWt@-mqL1-!2%=yn2!*g9aYtai5D;vBw90
zDArsN5{h`J&=4+4>5@sKS=;#V^Wc1-CiXsgU2xx()DK6u99^^2hxbMIGPUm-9zSrh
zBzj&^tArh^&iMWdDVPNAep9w|hO>8yBf}qlTC@1s*wMgJ>tppJOH3m3@uy`04id;{
z+m%}yzEaC{#VU74=LSl)d@>YtuFlJUe!I?Q$dwC}U*xQEp0vt^<)2;DgH4rfdi?{6
zot2gjB<ZhP|H`^FETmRL)37M%()}v;y0P!R`!b9rne-8MP)VME`AyxLAGhy0#sz5Q
z&(a^~j=<bLO1Gr3&3ci$zV3_Kn74jSV_8w*(oEs_n3}tcq?{=>u>VeS^1#c2XL()8
zHqSF|Y{zi%p|tvc?+B|=)*43m?Xw@9`=WuKDNNh?gDsNTb-5*tk{mA_<;zQs!%lZU
zb#!hh^QTo`aI~t(z^c*fQxmQ8?CVdT`XS?RJ094>&HQnqRY#DfW%?@}jNh7J_ghtE
z`UQe_EZqGmKT^$XR=-WwZ`Xf(@2GP5bHWqxH&;{#S(tK!mQd{9=MKLoBsYzEpUolB
zK)KWe8hD4)TIvdO0c~fm0S(aWT|8M8U1V+<x`0{34uZjsuD2LTN2ehZ;;YUpXuL8#
zPp8bf#G5Wt3r;=OJuHbIcqbm(0s6gNC4>k2<S|Qm+@tM+i2FK-B>0bBy2##&3QtA+
zd&<0{o)u9+(z7m8CsNFhzZ*1nrq6xZ9li3BIn2~dgdxJJMNF*EAyDrY8i?PjLIbXd
z2hZ|J7r?HMF9s|1G3CpKY|Je`!LxulKj^{PdOHhhi7uZZI-(#vY$Yr<+P~}@eXi5D
zTr}`lc+VN0$^1ze`Ls8Cnb4iudSO$^UumPkjT=8{V7ZkT>}(ms^U~nv-MJ?zqV5Mc
zcK8#V@XhM-X+0ldumR>*C*_KlmM<O=Ca`H$`{rA9cMYfe7kH_)81%#3kCCuQkt<ig
z>~swcVA~sns#Kkeb=&_Gwf&8&u5<?_Ssn}MRNl||qePqh<6#XcX}!$glw&kNrcAwh
zaTT!=!pQdo_f6;-i5b0~_f3(3%&UdE1DRsk!x8O)>7O1cRDdm`y2~&ERjzN%2EF;^
z;c<uRMV6jST6ZaQWHvT_Hh9sxXS>?q)P)6})6z+*2hM5udT#FCTj~$81`)ap``8eM
z25#3cA#M4N-5;bO`@_K2bQK1pcR%fCQw<Z@$)$;hfbE7^wwChnR|vO#gGrJ5v(ld`
zO4IGR-uM{R_xLL4Q9fai_A7oA?-ibNyfvaMP>JZjHZHAVx4GX*R~GK{uBo=!d)>RP
zj_5Y8s?E~{vQJl7#J{QoX>AQhg|IBv=X+Bq(hh0x@Wd@Vtt0;X>HhH!h(X$J2c`4B
ziPtiZ<)ZZE0W7VSlx|;lGFqZc?tx#eh`vEb9N|)QWRP8NXLyMV!N}uzNq>dU;wG6?
zea98`@EtpQq)w`Cu!{D%1(U(L_^R}sYig|AJnu%YI5lU8i+_H+liX0!ZjOvwfL3;_
zdx_?(ilUfX&TiF%hb>8O(&&-mtp|J0u7}rj(#z@lZR%QhiR*9+YZIF5VUwhiD^I2-
z9Y}SbrS0LblnZUu*TAO|kV3Mrn{P}i`R|H4MFm`LAQlpGv2k`#k1O5unY`a?&w$A4
zgi^<_^2OJYDvFTXOtR~b@A1BsoHuNq^)xEXAHWhRVN=&$XnEB`u5Vx7u;xFI>gqOS
z0K-88T(RsmBCl*<ovanN(SS1}7?pmq&ty(@+^OrzKYKic2G}ddR>k^`5fN+t6rZ9<
zrmV>CN$W>F{pjmJWox@+d(C)}Ai)9KH+kb4{(gEUAfst{QBoPg9&aahi(aR7xYd2-
z{A;j8iI;{za@dqUVV%;8^q19dn-Wmw+l?#~9#(r7-u^oiv{PqC3R&k8vuuWULJFg@
zR=L2#!)^TCF82&HK;u@|cX1Uw08E>*UuB<dFogSe?`d}C9zTf?nS5Si^Nrmz?%Sk#
zfXK4tGX^sgVWm41C0f_7<lXU9=%56hNqHK%fw%uMIgyv*-pYiuwbFx>ZgJlvBQw`v
z(PcWdMvjB5?Lp?*1uOfgchsJC7u2x87V$K2@3{}nQz#nD#-sT&@k0%FLaLDbX&_HZ
z5QfKNFv6Wh(FR0+@s5PYtaeppaeZ^O`mrWyTtZ57@4JYBRS`rG+oZ>|-xsO6S245R
zMV|X~b<1K5)`+_c+mmpQr*9TFxBZbH`~`LS4nyPPO#^Ib_=9>0>FOJ-W0a!NK*epP
zrO%*q+LS{|kv>KPPvoq?JoW*2j&){_a1&C7eSBKsjOxX(>KmwBXuyX#Ki&@SfUV^<
z!rS)X(zYr`j<&2ByK~$(g?jb%+0J+KkPxocIhr!u)IfkyDTei;`X@PMbR?8~_3e1!
z_^4S;rqhU`W@vVQ;DI7njw!)h^lH0hh#*6z<nBVn6f*1Lx@>00(ewsv<#7e{tHES7
zs52mk*M7pfBxYg5Pb*+6mtlwtgH<$;qAEF|%v!nwBM;H1X`6~Rkj+`yV?S4MV;Ug5
z`L;Hb9#5LWdg03`dGkva+2Ja=WT=;|eRm$@jx{2v&}&vTLoTuQIq#TxhjkEL1x|CT
zY#1K@<@g(B+F9PsmFgr)#%Zmi`=C2Sey(Zj04>b~WRz14@$Kb7u){)x;mKF_8rlLd
zjk_ynHFS~uONwH9rv(W8bEd8yBd^Hp7q6G>ifU!yb9Jqh-`-hp5kyaVUW3c01<_~+
zmY;ZSB|!Z&-N_S8)ZjV~US?@GOwnI!ZpxliGO*gY;#8yY`0>Yr<+q_)I9w#_z>R!i
zo4i>R=y7d37f-~j=k^6*UE(uYLw|Ip2*sE<#(v1VV~;RmM?vlSm-87G!>d;Oo>%Tz
z1<#7?9p~j_&V0Ib_4v)m_gPDZa_8x(yWcwM-Kr{(V(@h|Kwewnbhf#otRz}qagjGm
z?9KJcfKZ~X<?2vl_xjtka6=hY=Pv?1J%?@Ia|V}?Pgu75o)%Y~z`Anrj~#0IkO{ee
zEAueSO-MW(?pFt*BY{EX<x(ws{8+EMx@QRc9%b0ENXN{Nh#0rM4w&D(JEA7>M-^kt
z_-w}mBsN(cd`EMl_7<-_t*4?^NmWe!ridA1$OE5B<yV*EFPmxS{3RVD+JRA9Sk-uK
z)eA$A?jh(QuQ&7;-C(*&Te6#m_ct4Kq5gyTozUrHRly{a@j6m7)R~-z?@EJr_@xP#
zx7rk^Z(Nn$uc{0fF@COEC~xPwXiRw)Bao*4mq_l|*s6Zpw6@rj@op2&kQPWtP9!77
zce$=1{zVPXW!!n-cnZFRYzroinr{m|{|ti<$a<edGykoo92bu(=us{UzZGU@rj>k+
zd58`vG8VGnZ}3#Btz&HT&{}|7FK;4OWlo=q)+dSy{@mpF^Q6qsy+ziiD~pfb*e}eN
z-Y=ez>8P<*_jL;)T)CKgKPKhp@$5V0KH+BRKtzvx<ENhe;C4SWu>R5HnsUFl{dX`f
zOM^DFdk9-inQY!dY5&nz@Z1X2*Dn&FYsMJX(R29PanFRZ;kik8k?y3JFb7;EDalr3
zvqoI6tTkS~V)2VcPbIdEW?3JXFG2g&aOKS4Iv9dK@6JjEb5~BDFuWt7w&6gg#w)bG
z0dH=P_r0=2QU=p!{cO+PX>-X(W=c9hLXg!0tg5vvs-bZS;l>O-qn644%gq)0&!i5c
zfq^G~Gt7Sn4b)er71$s(^`s4)LJ^@OePK9(bHx3<VJQ?{KBEb;3R&wJoke>-O!}}n
z+I=yekqTwp)v1G&HsrDKS2owj&#8pMzh6bc^4A$=6<%PISx4X2#gXNyeKfs0KzS}c
zlXjZ*+sT3k6F=7R$9^gjI{bW@e04N^$-7hqIz~bs{ET=xk;%{1@YdEi$lvGPo6H2_
z1nsFCW`bmEJ(6q3hwzECyULbtzUAJ!c&17}<qThmi%JS^%01N2@@Hz*HkkZ8Sl4xp
zf?>hNg{d4mc4+^aYRZHU#TYllph`N~0WX9iV;-UgWZf}30+LSnOCme@_$ZN?XitQ*
z^D2zQ+E$D7+eh5ixyug@TDU})ue_bVPey2lBQ7tqzC;f5XQ)Ckdd^Puq!E2<XK$U5
zR%-JaWq6smsiL|2gIk+8)SP>u*Q373myi3WiB9@xb7R-Jgq1t$@*vntn(qdEDfY2b
z&HnPATQ4vB2D^-vl*m)%n=5J59%rQY_E6bp^ZD-C6Z^t@xtkWIT#rgN<x6Hau(FdY
z1I-m-#Av{modl@^mwiz==>6LB?RLY+bU%A`!@XP!Gmjaz`R2E?2zjWGkia_FC%KK-
z<pN_(yi={nzkF8#YQXFX*e3s10NPX5JU81GxAw?Dkn4cn{WT&H<*V9d*l^F+HRHwo
zFS**@*(p@gSE;%Wb+Nf8)X(ib>rui{2F_|zZ+?2n2uLd&H5{^iA=OX{QcjnA6Mt27
zGHr0~?MK<TKthA!a#Tn8#Tld@3@esf`FJ}zsLfv%0<EEava`J4k$=vB3B#|sj<@o)
z4@9f0!cWvEf3g#NSh*#2W2{09w`x{wqpdBIz=b4}onKr6&+^LddR}~WyJ*a!Rd!2J
zI426|JGS17IrFw&9~bU^>-n88${JQ@gHPGxE7NUU_~lKn8h$pjjF*^U%fZ{KsJiO0
zG|(2vPpLzy{1LA(o4;hQA<e%aYz7Ua=~qnt8m)Kk7apZvGkIj~D`qjSEbzkPt#=S2
zZs`-9adB_V5Q+M{?x+I$JW)a10EG758`J`2c+yH6_<aoGR*6+o!)^oD*8{%3FKa`p
zt$B#Xo-7)Xyt1<h#c>nM>iaw$zx#CWjMlg6t2ihOuw2cM`jZW)gNBm~>tU{NfsJEy
zMsH<k_H6$${HVn{GPG)S(CW~Z+@Rszm~X}2qILO#yiGQhzT^uH)9LJ)w>RVPydt2>
zFHjV9ldT4x5v4ow@QJqm8jVZOE8Xg|<y~((>&&ORJu)J>ZFW_{SZ&Z|b%hVV`2xB!
zA`v}e{B;k32D&6mF&PRbxY_)Lff(rJG0gcp;!K%(pI;7tf|5Z<bv8G2UFhrI@1Avg
z0Sgo9ec^Gq-QkwKKp)s6Bvej#7@GP1(fjl1Jyi~*MGYe2^^BF5Swm3U-t)b0wVb-9
zbqOv3fjYv>*h`gyuHXBf>{YFFtjp{xiGABj2N4mU0lP=P(-8b)r&{O_UT+IDQ2k3n
z3sX>Ut}>6vfjqilnH}$2a$RO9jvVt$p$OlKm=XFXBy5&Xtn}WJ-H0xVvv6^LH`(C<
zBMp!0q4Jo0+5DhA@y6{q&mW5ZzKy4ydwl~6U-)<Wr_MB*y|x~MifR?~Z;HxZ!}<a$
z_s4g=%s=j(Q09D%Xfc>lmZ|WfwpiFHf9XYf9PZ=K){7ljUv!e^fA&`WVadYh{+3In
zV^CjKx52!fJ~piJ+6&&X_nN(7Sz1xP(&-tkk7;o_WS8>=j-ax$Mqzp<=168_mOx1*
zat~2_TB`{jFLk*m!#bHO9R3mo#(}W^040M4ekq4jw8ce}vgQkmc{@*4$|<C(vM5K#
zq_3FIi;mnV&(F*b@w1^8-JeBsZYo%EnsRM2)*Ub(KRgh94ku%03D@k73~msM{^(Ot
zYu@^{R!rLN2K|)U=B)h6%}pCwJe!ZI*J;bN8vJ+8P%XrTZfT%i<eU7<Vlj>+{Fm-R
zPcW&60pj_&!y-cLco^Py=gs$MWo4Frwnvq<@2ZaPMiw8|=7!&mxO1ZJ5R$ddT{q6a
zfmfw#n3VZp&5&)d?2|uxd@H3h@Z|l)O7o%JW^{cxF|oCSb9tVZUsFW0Hv*==uUWSw
zxMbLOh9sAV){s6?M#x$IPNB(nd%y%gcX;Tp(qi&n>7Gg%g2k%uKy>oNXwntFnGqda
zq4<GvqkUYACl36gLrxr{sde}bwR`=~(pwfeFABD%z#?<#K@1nXqImPpDmng)SGs|B
zWJW*Fy`x%E4t!_nKrx9%j&x13Q>@$#gX4~s3$ZpF=RqFY$)(h#sj^R)6!CW7osef}
zU>ak%>|la&tMzw&5^QC@7v||*X}Nv2nN+EAH!M4s=eV7U(v_`9=Cut$y+75v)ypQA
zUZ{PiS7y-+J9i}(yJH-_e;w}D;<$1eXIQESgE@Ng7Wwsay?K>sgZ1<g&4W3z=$=!Z
z!8-kgr888Ah!%U~q<A05iBx6g3i9*E7{^u+GhpU$0LqN~FE9H>EXlsEDzO$u;jLI2
zOLD*S*p7KLTC=XUs&3GyfpYO9?Fg#{;Z=%WYrg(owJjO<-lf`;2X*W-ebxv2x9boh
zm3usS*0&_5G<>gGkPBGN5}%mi@$_<M+q{02e$R(@ljr;51+;1h#lX2gyI`OWR)OTF
zSu%f@S{Q8ZKo7KcETKmjjWKN(M9rGp;arp|Q?9f`b&#Zy7?8eX;|*)V+ZH{#<UH2i
z|08<jG(+`A?YaRaPLPFS+Fto8lq~wzLEh8XDz&rF_=>ug#@)GV9=`jW)pd!wJ(UI4
zJ}0V<kKFDCG2nBCx=v1=qUbs{<tyDXcl`VOKW_Jdwcyg9S`d>yYlBh9`|mnqhq*hy
z7M6-)L`YfP>19fN`ubaciHB8P-9&um)sJG8SLx~CR)mC&8M0CuPv%c&=N_E4IUnmI
z%A*eQmt*o*NkhLA&s6&PU$QhFpS|Lox~aQHPq!Q7A3#Yz@Zd15NtfZhr`=vKc$zu2
z8qr&PuDBg3a<{>%;jYZIuOo9wM#yG*cTqX5<)IqOv!KLB9q#)CWn8=T>v!f%!G_S<
zqwn^Vs{X)^-LVPmD_(2Rs$4>4wA}Kb-MP+T%#=5_w5pfC+WI}*hm?(2Grih3lZR!>
zB`Q%Q2x`Ne{ti4sfb^YhX!tbt@Jca0t!oT`P>bz%j#giHHf>U1D>!{N)t8UgPK8vv
zs7DGM==8Bs9mI4Lek$-fnZ<il>RIM8cr(nC`|`Y<{!QX1i>_`Aw$;6lO^xadBKwfk
z)@zkb2VpCs%1+WfS%z|SZ|bQSea*b1nnYfDo6DmCo%CMr%UtX88qbSOqrpUs<?0$O
z-NUS#w?>i8Pz2xXRy4Iech_Wv;K8%6*QCFFu!BF$^0Y12<1MCJE1t|rx_aDuk>7fW
zTvl#v>D&xV;Zlv+V^t|wl7!Fzl4${U@Yyh>o$F~A8o*PwhLw6TwLiM)TC`wD`#r1p
zxfyCOoA;8wH^&>lVq?j-_k4G;mbYk6*H&P&Iel_@Tw|O$$8i@G?o_t#t62MXXC2}l
zH${#03}PvZNXk{Uhr8nla3bA%*k2q*W5FK=T>IpDtH~if4Lm@&d6y3rY5oQ5%++0T
ztO36@(cj941~@BjS*r}o<|y<bqx#W6;cUAS!dpSY5;j!}JrnW3{t8wNCs7j$RTl7p
zCet(XlxW5DM`>S$rdkD0wa&mpx>6R1mC%W|n1KSzWZ}gu!2W&GuJpv)2({<>4Hg<J
zpGFJzU;T?C@Vot+_=cyd5LFk};K7F~*R4;g@v*8=h#b`G6I5F%8W{1lxB3vNRZ(pm
z7C{*V{_iHMQ=wIh0rN)a;T{x~<aO3g9?#ToWu3A5h%xRGbk&fa{Sx?P%qzfZEBU!<
zxc5qFZxv<u{`>sdX1lW0@*52k!oF3{rCXj*_Ft6l#_n3*$z)Q4a8-m2MStn8p>rP3
z%Jk|$3hueHAIgZK2*IxqgNGxXm6NcqUiL_8@at)P{8%5ynV`*J(8YGDiB>7J3b&io
z{W&Bv>n<kz?xRb#vEl#4-g`$iwQhZ*C?L{AKtQ?*h;9U=OOe=UA|fEYL<I$mA<|nQ
z2m;a-1Qdh_h$vM`2tCrJhK__DdQYf<g!nByd%tJ9&pz*a$9?Y~_Z#E<v4*a-$g`d`
zpE>6<=Wmuplv(QQN0N+jgTh2(Y2mGdeBNjSKt?Ogg*Oxmejhc!Zz7yJ;Gl3cBbBkM
zS=3N!`jy%7yU`PYni8`>9E7f=_g*RNn4>TkRdNBz%%=xLQJ)PhKCRDcQd(Qjs4{C@
zzB3nd{_Ihn0EvZH1oXks|8BzCVwPTpm!7dVrJdl=0jh`f#h;B;ESVM(m1_5|Uxz-Z
z*Q<UvqRBUzxO3s5y~#N<ZYwS|_E%$o6K0IVBDnq-mPi=1x^tL>rf~xjY1OO{(>L$I
zqSydm*;0wf7E#4L@N)dBudJnIiA&2&s~A)6APdihjCVqE78pTw9*Xk*2e?A!f-o<r
z$UO?AIRK#9>=ri$so;1&TbD$|o*4noQnS8zkOWK4;SWKLz~)#wcoo>70R;RU5kQ(+
zL6a6s)f5Z;{o1L6RY4z0f-UP1#C3YzB6L~BwRQcNn>|4sxvv+Cl;R4kbkyRk?OI}a
z^FQu)x8J*X=!)?nHA(Vu_))^6xCviDTAdzS6v-VgsNbl<q+TG3wCi(ccaxfZ(1Vl*
z4X^rZjYO1tJS$WLP#dN}>&tK}1VNwY2aP}ml`Fq;yb-gj1#D2!20cK+52nTMoAf?_
z-Oo~YMw06=g+N>bOGjbps^Rmp<o2f{P=h@u+o0Sab}PRmOVxOTb1Cq(@s{<#Vx5W`
z5888?Ib7Y4-y<fEy@IKQ<w6E6swz<V<w9uRDT%gflb&r{-%ztWk6|a4ZBMR+`ONX?
zB5htvU#D_lX2aGi_#V(I8;}eykokiq7?uxs@Z*$>W`Ix6Z^3eojSnnh*DTlwS<AtM
zxUWK|38guNy*={vzN+&drDC`m6T|Z};*3x{!j9~VqV0ObjrLgYxHZ3C?1ulgUf0ri
zA*@!PefY66_&OaV*Sy}*3yNCEYwrLW>Oh@zq75Q)d;{%5<{y}qF-_3WVkRvim`%kW
zG&4fdROPEAXg**95BE~v69M&RZM0ZGTH6U4L@W*q7KHi>d#TnBZhK;eca-+xqk_kh
z1y@!pdPhz=J&ZQL>Ox5&YL#qVxmd>4xrixNs%M4Ndn9>${yaXSdmoZ%Is918D}5Gv
zo4c1!vjn*kBl9-PNWSvpBm38?jLd;o+W}HQ4jzsJR_%Z`@8JrA43v&)#Ntm<rF~%5
zU)o!SQB+7G6X0NrtkB_FmFf~jAtAoV1-c#ltYzi!!VNS}+=%wfbbJ_)AA?k`4t5^9
zv>&N1xJcz5Sf;Sy88>~aA2CWQl~&4s8NRNtZqr_<G5d^HHm9g)@)hzFf!+~OhZ^)H
zp+P$g2fT7eogY$7u|$#&c)R(0fyV$9Q_yyGH1BqzCP`rebj+&WFa7c7eH7%=$P)Ww
zC5uYy+dFX<{MY3($9F34{T80L9*`4htH51A5SheA_#gAKtyNbq|1uz7z-(nUZpq!J
zmgt+TWzJzDQzq{ES?YQG)8$;ILIxy2jDM`e51Q9rKunc(va|v;3&h}B)esby6kNZz
zKfhm{51`a@Rz3N!&)~xOaEo4wqc@&8e!#8Gz65QyH5c9g0M29NB-{pVJRW;h*?2Q|
z-*@5%O(0wgHtDqm;#dUgR*u5Q9edw-r8}QWoaLWID9M!$y6;cI;$P&052WS?&2>jW
zG!7mbLo%sYSi<)L102jqGH;qc#c!}4#;~*pin^fYob!EgdrYZ{tTzGq5RBIdKbIb@
zq{&ia7Hn>Hyf#ea$R|e(eHCvS*m1*A=#*jCQVw45rf&6Bn3O`qYqY}|xegKT2HV!(
z7-(CrT$DH<03@Fi8-ZAlIba4rgi9-j8-dM*?x$YiP6i0ze`OoJ^||<yf9E)>g0#>W
zDcn!<VO5`#lho>IJ%5do1l@@H5ao-Eih{)7f|`x#?rj*CNDoC!CWe-%wn?zs8hTb&
z_O7L_BTiW9d&HRqbGOH-WxhP~$vT6n{`9k!P6S25&yyPRyKJ8OIi;zevU<P`=WyfF
z^{~qKxu}hOPx4+05KgNt2uUh2(#RE5Tpz=4+^I?8MF|r1#5SQ^om<i&rdsz)2y$P!
z^y?9a)cHwH4)!sIvD9_uVTqYa%;1NLve8G83E%9z8D*M8;o{e<-%Q6sXebJUI#`NW
z7IN<=3!Ve9x&td9_s60He;fmcj04#^1sGTRMsP8v9>(nzJ7`+b@06z?A$fbrJP;zy
zt_PhN9clQ|cJA&=sWr*NpGBtWOQ)PW-wCt8MKVZnMgwpWyv}B|?%haKZH$>D^m6m7
zY037|nQgVS!_&mF^tjkV`T7U!5VOm#Pi6e6$`1quH2()j#+RVCzI$F~s7vK1pr2PM
zPwFYQSp+ms9_8lO<O|SOI(}03W?JFd>)iErPRfh)t`(kN^+WlrQH^=2Sr>cH_TL}K
z=#6<Hrs$DqU?aI$b$mDZ!4bD(2L48|WjO6zHj)W$6*LW<8zdiSDJ_Zw^dIYTunxcF
zuXXh4YS^ZsNt}cwy}k?5YL~NhKa4r9xR>JFti9~sN;%<H9Ww9zps9-NT%Ob)ZD9`3
z&M~A2l3;4ACwk4*^c6p=p6=IS!M(EeL?ScRo*aunCUUhRfX&PqNd5mO3;t6cz!aCv
zoSe&nJD!W~7V7bzyeyanh3owl36)+pb?5R7S+AX!+G2QiS3+Vmxv>1(w_|svB14)l
ziErN}-HCGq+f|pBqI*vDzK<Rd=D-S~n!g`aj8VI0U99Fs>l$cA!|!qAJg}Lf1_A3y
z<d3yJ5Wu;8*59`=W9zkz-SF0dU7=_y2g!wcnmQPFi(t@S^@9fGS2B#-&*<ocW99hK
zb16d|F593({sNArgNg|i@7g|EJ^r$!lO=ro=93kt^eW4KuhScf4XkwxzhTa|SV2Wi
z7=9rzz;meaJ^tUx@S(&pErmt+u)p8}E;x8D6s6;q({XvVb;KM}z!E3cF>Kv&B3F3l
z)!Wf`=gDtRKRx!_2!^3XK%ZGlZ9tzNn{6d4c=sjtGq;lW?w<Pg*ZJ~Y=WrlA0c=CS
z=J*PYB-0*jgun1PK<qeEy~`n60I^jR{~)&dAH=o|x)Tm4k_ls`*1<>1PA;;vuP;rV
zF6`u?$QIPSneEX_+3GLhQ&Vx1!PVl;r%I9J%Rv@uL`IKx;sk3a<2@Sa_mdy}`IfS%
zkA5mQpoC{en2_f_g825wUX)!qKDR-At7w95o3<(1PpIKGgJ0{e(uMk6tRbxQuZ+dB
z4^AuMTy31lHyhdBmWT$2eRs+BzJo%4h6@tt@g(<L1=C(Bxa2*z9R3_ZXx=J)8si($
zS76!GGMZ0^l&u0;UB(G{sIf80=HE@FpWFwmK5S|~=D>*gQ1Tr%=J_xtO1L;Qs77Kz
zUEB+PvkT%cT14&S8RV<PZZkhB565fg4YnUS)xk97NUzQB9BBenQWiJYhvk{&7y5F4
z-04~5c--w3eYY<&){MR~w44KGckzScmv@Kwj?<nK;Xlx_fXata4gO2U4<z6ZnYYw+
z6CCPi3;aRDD$<?S3+2~G7ow@H>{pL{G!Wr?QU|$mai6_Oo2nl5QqQ0dWIrBK(TAh#
zQQz+cuf6E_TvlB+XubNLd|}<n(wh@D$`f~?NQFz;YU&b=iSR#I4tVU(-Q|G(*#F|W
z4D8$nN4I6#cgx0Xpv#{moM#HjDk#K}+m_QTw!itI+)>VX`-8w7lj429X0A4faIw}i
zr#XUPJ~Dfu{ssZ`VumP*${St7r79;Wn_Rl*i5R_Bq>E{rW(_|=g9o(BpXBPm<{t)h
zdD?&3uxj<0VH9by9EoGR0Y}XuGMJ%=oDh|!jBJgEuAk-1EF!*95}BX$oM4+yj4Y!K
z6NuziUQ&}GV87Z36W(-fsV;%p9UZz$E<$iG`%Ty+Jx=MD$k{$7rdGF{EvqLCTZ1-!
z+FzjGHJdUJ#Q85dm`_Y6m$EIbjV!4d5j-agUTk)#jD20O5r&@GLh+y9l<4o7L#1TM
zsOEgVOX-e{Ja(Ohw#!%-7Jy;BPkg+%VH5F|z734Z-5YMR7aO+Rf4iD`B+m9$H%I2T
z>DY0v+442u?br5Mf9|Y+$;Vc2?Y2eyL*+zRNtt(p?AD&|osIbPoq4Hp*iY*=st3~x
z*K>9mNZ2lVn`bhb`rzKhZ=NC_PjcDZrU&80m(head})O9!>JC4Ax2N@R<dT_Lv^uu
zvHmC1FTdR@b9>3dG!xDq665+rqHGpPk+A-ClZEDQ6aU~q#jy#b)TgE1N$L6m(lr!_
zZA|~6d*%|KdugJl0Pd|vEWa0}>?wIi;<t%VI>jqbrXLl;&B@AeHDYHX1conQhnN~!
z)Ve>CW(dzeQ<Z?5F?fXb&WJZphe^qy)wt+f<IKT;+ySBvBv|~kv;fZgv$or+^t<X1
zYke%geqydZO3t9TqPVQYJQsGMU=oDOz1HUVc;Jfwtd^Pi_|=J2eYJkb+A|RA);Wq6
z)DuyuLo`j@3rSEwb4!boZxuBkg=?IC$W|^B+7>Azx`Fw}lK|lY0^SE6D{2ri4+VgU
z1J~0C+A{is2HgKr+Fi6lkgK^4dCU>};js-5(JHGURWN*3Qpup-{Vj};C<J~hSoiid
zmi=PGHSUw=j-HxRPy-VZwMo4nwO~YYqlz^pA;e+jAz^=|>BSNY@nlxGX7oamhWlk%
znP(%9iWusxpCa0SzWyJY@1NQ}Z7GBPV>5)UUZ2L2WP7(8Us1x%*Mx*-j%018wbjCS
z;yFUb<4<4uHoc{g_KBoASyPy&o|&`Yf3&hMRU>|NwiFfX;odYL%U<>cSEl^!>t=z<
zFShOPkNlnFKfSfQz3>(Z!PGPYdU7?#kE<!;a^wov=>EKEUyEk!_Sx_$m$h1xpSIMi
z@EJImtVEJ9Cb{}%c-b}-;cQwabuo;V)}s)8H~QSxTDrv^e{!q%^dr@PZ>%lZ;|GiV
zgXSNr{jaZ^`4EDzv|NY6TPuBk&{&Lb^bHdVmH{t*ss1A`3?;qdn;EN|m25DOv^=Wj
zF*_zL*X~+ws}=VkmFt5&t@r4iQU4A=Ij&Mp;pmb&_U6%a5lae0f%MA;GJG#q5#Dc)
zYtb15=<lJ1c61oT|KXPYmrZK~sDjII%L6_<n3)l@GRz@X%QTO|OLD|ZGFbO+A(mU>
z8hir!r5~w;Na=kAqHoGUuo(Ne<9D9ZAEjy3LJ)fE_hRZ1$Gv>!8a>+846=1UEh?Qg
z)9sAColk&D285h2lN)rvTFiog{kFR5=d%D?{+~SmkDZ2E4Qe?80ESy5%T)+M@#IcJ
zwc*}Qqp3-ZC&JP3QSbHaH#S_TGDx!Li;Ng4?OB(}L5BCrv|QJOfi$3Fcmir5+FfU?
z%`n11?~2lkhohfS>vUzY(_skT({~P6+BGq>l$K-vp?Cgp%74+ifF5G-blXeeqcD>m
zt3kNSx62~CN3VZUNE<L4((`0FJf`|qa%b7wM9g?ZOZ9H*6@}>WqO7{!G_wUr_Tu@h
z1-TZ*WG6L!^$r=kXtPv)#MtbmB;^l!K>;5Q1!Qm?fD(Yui==S=G&O`--D?4p`VW<J
z+4xODvLJUDL42|_WY0NpOX^56B+EQ|WJywGMC1N!vc?;^SJDZ+m4QQIfpT`A8hs0f
zHYS(HIIFu>6jpAw>Gkc1O`D8~C5X5)M&6JdYDj*r%lF*aP%&~MG6^tP|Ka8SS>8}%
zR7vc9?N2SBJ2t{oS=hUXq*Ff$5#l8Z#rr224SS^<Cv7#QmAczSpUYT(#8$&5c`w2~
z!PL<zl0#1;i^52PW|8vs3<^ZbO_Ej@E=akDB-JtIcV)JJcET1~7~79FfxJ)C@I3Gy
z2TW-|-2-Gl&@u=9ZAR9ClXbB0X-j32@|t<b<zYf=TRoc3=dmY;TG975uFaZLvAV;c
zLXLq5mX*_XX1a>~oyT@YE1j{|Cqbd9ECkKSQgwkr@j$ul!M8v@qMfX@t_Rg_qjk(4
zdmbL|+G-b!J0=nK$GiVwRUP0m6+WaAAP+GWFzYqR!ONaFvV#vO#Qjk(s$5#Uyq8m7
z`$Iq9oPVSHwZa5Y)dOIio|S)5;w-Vns%hMZ;;p52^!vNo9DQO=v<jp>RFBO1%{Ne)
zj@A$vQZc!N2Sj~D2-sI|0gtxM1;B+q4C(C87azV~xN)|C%tOM|S7b#<QklHSjY4eQ
zYIZAU3n1xW^Wp0`+HI&+A>|c2#omgPB6*hV8P7>wcAIjtJQceKTArDZ&=apK^%%G&
z;f^+weDg-q*3e8dxcuenBhR-r-hvSVtl8B7P7J`3=<wHw5uolEa9n-?DdStTXf>bj
ze-N?X=-I1u)2Uvu9dEycl<Rof#vGRCWv%qVC@y>^GE4Mz_RZfGrJVH6E^m2$o|5E+
z+fND_X(f??ww8BGV!I3Em*Sw_j|Fe;zPwe{d}i*qsh3Y7a{$!Jh{{~p*)EoD!r&g+
zLgbB}C*qBlnonz)FfID8r@WU<J;`zGs>0@dl64*@Harn<u7NUe0JAe$0&V^QOvVp*
z(G^=G3r7%xjEK!61+g`Ji0mT3;dB6PS`7C0!lefcI{^c}&hW!gG0-|g1Uc#ljh@7e
za7Yllx!v48AKN}RkaRCzk1QANGA$q(?OW^vsIkEQH)>!tq7Jz@2o#>wyaj+}|CNUe
zNDmaxY8QZMdlYSfDlK9FJlcp{a;U-U&tP*kq7eY37HqB(`B!y-ocoQrhJr0q%+^nE
znH)PzRf8gy#-#VTQH1e-bEkx6@mzWU)6XLt*Hq{@xpH<Es5mSSY;EmSO!5sI5q+8-
znea%BhQZL`aECL32jLJy52si0B30v=FS9Jx+%MtGK_h2Y#-p-*yu${`bv3v4%McS;
zDr<F!a0~xrvfLt-X>ilq?Uko1C~+Gf_m<aVE&9$0=pE<Coq{(QN6@f%6QV?HF2qUA
z(|K}1_*QAfx?yX3V~kARj#EPevP@=EVe2i35$`H(Z;_5V55C*Kmxp}2i{$cpn`oy#
z&aAQV;66m7$tr(A7k_h{xrRLNUq+H{@&PyKGcN3{1;QTmxkZ_<J3G2^d+77d*Pjw_
zws7A7Sdw#TN<SF2HiVqShOWT%-j9%8J7k~jO|QD{mS6d{IX<>tP<#0|^olY0sXkee
z;!Nm#j?=5&4pK<m4yja?V}5fg_CC|)GU4+wlhaQ}@7}vN7|K#nD$aR9N=V8O=o4-c
z4y7{gEyomnPMv(}?Wb1HuW(ddxBAJukq3#0a2@NF%A)d3J+AmkjNrV#tSlSDl7(jO
zgG0z=)56X>LeHN+(DYln3w*r*g1!7cy$lot^yokYQ&qewn{ndx!x80cRKBH%$(1L1
zPTdzgAC0L7h}cpK;eg}`wg~1_or-=Rxw-S6v&`Vi^n{Dv)A1696|Tvcp~N~Bk8<Jz
z-!@-XBlE(pdk~0e83JW<`^z=nyLM7LytZ|bae5N-&v7@GR~_C*$}pf$+?x^=5TcfZ
zoH%Hy^S8$p`sgD%@-zmT$K-<k_?s(qb2RVn9MU)e95i;smJ9~oQ&XA$9Ki7PL*9q?
zE;pWaph*urx_I;tKFm;?5&?$NI6-4@ll{#@;}=_pV}EDS_mM&_K)0)dj#uF(n))@l
z<y$A;)BWT8;2O<0QM+e@xZnRe)A+*E_i^(_91fj(Px$V1blHb`_xJgnGaPs0+&n?|
zh@9O#FL#AeL$&om0~A{SskY;^Cd(lcy3Lc*U55>BDY56KE5^#4o<9Bb<UWIi-_O}A
z0-bQ2FiT_LeeQn3cs*>(1iZDvK#i~<$NsxJG<$55*pY)U6XiTL&p&=z_?Z7R;;Id1
zQhy7w`Tp4WEi&p8#-nHxTWJxo<3NL`H1|P{=4p{piJyTO6kg4gnpXq-ioIqUdEEws
z$81423r>-uc0~91Xm&U7rh7T#d)ok7sDbip0l+9BMa<S34=^PX?BCy`aX(>jg&sI~
zspp6`$rE|pep-#5U(C!cKRcd{|B^v_Nhm9tW_qw*7_CG(v836rCh0n<AHp^{j6LRs
zt;++_PO>A~RF~xBba-Qy^^W^3W;1Hh%zSYM!;k#t@*!viEP|*t0omq(w}T05p;cf)
z3;YMoagtstZk2-<H>V#TpAvtU+av6?PKjOo#^FG1hQV*C?6!{kz9i2<Ur9k^MQ``;
zqnKp;_gTZ%9H6!UA=KL9GP+nE>tY!0q-4>EOri2aK^i@xWibsk0ub-6mq6!3mW|de
z>}8pxEW-AZ?h9Q+mRIt1uK^zP!{iRM`#xTAr64F~l-PVaXZQ(b0y!puCLuiWIg<Ky
zd&}H1{4ZAI%k3%?cD2UV!}Nj^^P70ZoNEhG-J|>&w<JPQVF9u->^DN$*Kdyqy;+Fv
zCsV;M>Sv2w>hBsxdV0hT&Ph<Y{Z`*nER$!x=L=??ocdA}tfSOgj^7{4L+Le+t-y8i
zMxONV^KV;`1{rE&A}c(j)wr@rx_2vk^rjKEeSE(1iJgYeSBEQUKb<=6x@HqZwA@ZF
z-$x@H1lew>WCfLUSa?}#N97qBJ+yz)E|vg!J2HF!<n>4>O$$19N?47=UpFR78p6+4
zT_zy4`xH7XTxd{V^c8O~faD8y?%!r>pV2B`0B2(ew+p^Ajc<bpC40?LAJKhqME=*p
zaeZ1IbnofTNyjJJbdl@p_jpep3qQe@fQLU~IF-~`+hjIuA?a#;HmSON#5is-WgArh
z>rn%>%Gq3ezmEHoqL$Z|q*G?0r=y#gJf!KgBC+18RynpHJ_q^&{wf@TphqD&NK-n*
zD0F0%)}*CG&Yc7wwIsdj5{Z+sCL!mKkW;??#)y_>IsRU-{~NVKm|h*IPpZ}NXLJPd
z!(D;OCGsSKBF>J0kaX*7I72$*_qiLtC%d|dh2ij;cPgp(RHhi{{DT%fUM;D>x0AAW
zw|8XZWt*m7&VS9J-J%O8`F;fhL9Ug{Wd3=jRGR%TianwEF6mxuD_lj*($RT8bMmC!
zgRyJgV6i^u*lXv90%)*YyJsaX7Q8h{5MfvC^XMPWf?lZR0DV{=NoII?-*MuLe7Qr@
zwn5Fx*y>6tW!T@oZM=AHg_dZ)4Ud@u1<GGG)s341K<Vghe`WyE2!Y%gNa$rfhBIFq
zU~ig&9@{eNPJZ_)Xbn+<u0=*-2zqRRds$6DtqZjad|drp{e(l)XFQhGt3p+&a9}w;
zpo}aX$DvS_rZcp`{<YIvybOqFU%7@Xf_OcU7J3XKl*WW(CP6}%6{kA+sEC1G07o$>
z-ch%4o!RMlNV%~eg>l3TYt?%o*)UKnA4Q?3=44ej@_5YAVJlYM#;!DmZ?00@J<2j0
z!Q;ys53xs9lhD>mn<{tD#%J>QN<h$CgNV06C_M57l3<9z6*v1ck?s@u8!(LO+;9nW
z@BKb0_@yuT#ducDy;g~t>+;|5=R`uhNXB&UHj<_>6CZ_H6xN1BsEor8kQ_B<NCo(8
z2VwRSJ*R;ko9I#LG!&3$ADk9@wC~b>FMLK9KDsnmqd;v0ov7jU@3Ba1gptHU!{FlS
zi$cHkt^hVOCkfn8+M}45!*9nvJkoptEH8KA=BL~Ir+Iq0l8J-cmq>GDYyXzxr0d)7
zi466CKg%&f8oxat7NdzO`%+lcJ(;SQ^j*7sO`$pAti&nyKyytV`fOX#cNULvKD+Uk
zZW_FMvWwbW2eLT<LSKsErudQ8$QP+CsZyjNBGxQ$1Mr@>-L1uM5Ws<Q{PX_IWcSwL
zp|yvzj))!(on&vL68csB6lx!zbR+nCZ-dZ@QWA`;LopyFlXXZ5Zb@vk$r7q5!p251
zGUBCXiOU}0UK}OiewG3;UIcpzCtHIdoDL|;Qo@f%YE}{wEF&PmJS>7_{Cw+*wWL!7
zpyeL2mN#Fi-H3blDu5<mbz2eu4}Ga!2*5gBq4&&NQa?k|$sUH_Vn;|BjXNf$p478M
zuI&8o$01sWyD#zxs|DC*8oo1v=~p6_)+pbeewsQtv|YWux)0VuCtfci?GriiSU_Sd
z7chsY$GvJ`&pmKF&!K9@Qz^dMArg7|er+YrLyqgW^7sO}bt^PAzct@--GbF2XszI~
zBuKg!!i0DPjjv1*>Xv*spb#3hwsqE^z4%SPk*_E2y${nmhTgv&w-bt(NcX=?D)w{D
zM6!~SYb#7cmnU=t#v~g{c4Tk%oE=S5Y=3h)Ok9n{brscNkjJs?(H&vcX*s$-dN}-C
zZbxAFx%a?-{&|$e;7ojTz(Z5bvJNnJ!DSz=sVf8ROS0e2KtIYNFFu*#_r~5_nP*@)
zHPQ8Tcf1+Hu6~-t)|e!=7M4!fdI!rmsowi=dw5v)MC@$8U1jC-U@2RpuM8kLjw^J1
zJi;ZW4XXQ0>pS(}?;Q0R3!X^<se0UVZG#O;fk%_rXOBFyyViWtMSG;&2BUpMBu#{v
z;fyuf?H-;Zjjv<2GGk3BAZCA$UB8`OBwlMpkf`)kUA(%>P@1trD#iH>>*MuKh%Wye
zSxrvs36JmY6Zjx~?SpIZZ0$2OaV7CtsIXb4{Q2D4+gC&nU%A|PQy@B0Yf9(VeH&Zy
zb+1n8L!{!#(u~}3tA)K={-@r;X0D!(XjAbU=sp)IkiY+CM5Yo3H_bB4c?~*!iY#Dw
z`)fZoNnsqf(WqFXFc=kSal%Hh#9sG=VzDklRPw|l=9z1EbvadIzrHrU6+7{n%cgBR
zjTDB5F^UZYs9mNXjpR8(D1CLg&PqEe33tQxum&!VGq>UJkih5K4nNSW(oXWm`%2C>
zr8ynRDohKIVj9%13fo823yBc58r07Zfb22C3o4BZdOm`>RQ4sPu6Ai`_mH@+yZMw}
zyFs@T|1689k+Q(EIxA8#9#IQ^5eqbo>Pssx8`!MP{JKOp=<_HBYVY$(@U}xnt!#$?
z-t;P3K*}RcVe2+tg>zvbpwWLpWZuET9J8d0c;klN0$kFzJ^Kz7?20szt4i6~Z<1e+
zgDR=mG&?_%a%NJbKSQ@4t^4M6&3wku4hiW_GtHX>SDR|GI%(XD^o+1WzTVU`kLG!>
z?q%pF`KDIwX1(ok|D}n^*Br8!6h>fA_Gc;cqUbTvUJD7(5_p06Q+y}I8fj5VGQ}&a
z3*@NRBt2Ql%BC^v__Bgyqc83fk_(^zlquGpbY4{+8{0b-oK-I#$Tl=vf2VJ@s;~sA
z-=H#(;p>sW|8YoqSn^SGy!yKLH-U{{15*W9B<T2B3HZ3pxL2`uPkzX&jKzz!_p@}I
zVSN1P=vfER3(TkP<cTwc&<4;7XM2|VZ@8{$;&1CH@AXnK6Lc2VD*lz!(9ZM3AfRCj
zI-I9g)&bw9Wvyl6EhXQU{0b;yZOHyon7ngy-YTFn;2ZAZF;D6-|1O`k24oa&EW+0{
zT`Oz;<E~V0Lf?n&wG%JC(7kKbt1II6w2Pz%Nx3L*6GaXmeMIM?ykG?jp&lk#*4fDL
ztp;bca8dMKMGxiMc|nCH(N^*@a?r?cBZaiFdgngoCJ$N8jjvLk@71jSpphCMbZwH?
z$4NK(pRFLwj1}aWI}U8yobkPEoLk~8R#+L9`!L~BMxwu6+qtVRBSr1#U1%KDg{Zx$
zN~Gk^*E1br9TLz=xRT@b-ik32-rO!jy2=};%%6(sJXpuBT@q)Jl>y&O6wi^NI7l_P
zv?KT=_x;9aNKw_G0?>x~UBcXoB#~3Mi^6NqiVfW|ciP-cTHP=X)V0S{ko6PAUf$DB
zly^|RBwC!+dV+812aWw&SOvBLz?DLl8quX3Z9Ji38y6(qaw0UlA40zJ4S0(^DArD6
zXs`6)jFcU$f!(L*VXNueSY$+fleiaZ5-Es+r8~*9)$s+eI_xI3gd<4fM1z-r(%wnH
zuJcxx8;3;TBm8WD^6(3KGo#hHrRnmDZI27t1)fcB&;_r1a^$Vk=XNjv`Nr6=iPE4O
z$ydv&`oww-z2mM`m{C*}8oR?Sb-Jg8++GBveErD8@l}Fp@49o7tn=3UN}=3lVkVc9
zP3t&_B%QOiaVr5`x<&vx<5ftLT<2IVr?3qxoH}2Urb#Z|sN~8~6?UPpr}W9gU@hoe
z*@nx~Z*n!*MA*qkv<mhOK<<=?7e^hQY)P%}Tgltf)6#axlh=Ko$Q?H8SFjJUlg)`a
z$6`+>Gw&ZVhNwcQD6x-F-3GU)wjMATP}(HynXK+vv;To|ACKYm$_59=&Bwg=@*i8>
z8!+Dtn^pPnwB(Sj=~$&M?2QxCNWhg#%Ad0+*N82oXYRs53e5b%CAIlFSqrAyaXQB`
z-04Ri9&cZNXq_P$3D2$!|178;C)J#zB((n<t6{A|lq|kyvt@epMpsMGwJ6jxqYyxM
zsYPo@8dWS0V#_4J2TcmLW}U&s<BfnB7o~nQxsj(7d9TME@)62CrhUtk*&+LL1w1an
z(Zul5N$U*W=^c0d`WoS4Lh3WyOp?c#svb!1nI!c6)%AM5bH)bCG+Zv9aeEvEeVKSg
zcfxG?y$hn;aa<C8!jgrNo*nR46Kp~q6ESooRWlNUGal+|9#mfgi&%ku?2~>1q_1e*
z(wD`?it9wf%U*b1JyrWvWcjA+&5o${W<go~6A6g`!VyG81ngz)11WDJbG|T~egj&`
zV;jvk7%J)Jfhj}l^C$+n4Df|~d*B|TijX@u^Whb|Zbtw0mECCCGy9+52KW_Ny^nYx
zSQp(7GnaG^laluh<I#IJRw6EwXrq>S;mGP_aS*oKav0=|QBf*9dExtJ2eaGv)Xp*c
z4xuyq88zZw`gH?JJ0AW*eU_%-%WM+5Wx?{#puU2YR_(VU?KCwV74Lfx+s>WMC+Sa(
zH~6{fdAf=}PsQq3GNeE+h?nW<iPyv)k-=6S{eB~R=31EvR?NE~9sR01c_YJDD0e(X
zkY{ToD{mQI@R{1DE=6*j4B}eNam<Hs@6CRYik;Jny;%BX{6&M%y*LT+*Rwa6a^YXt
zG%h$nK)h;}lTb@z<chObD*5K1`*ZYjvk|R*<df5y!J{IGag9QB_CzduAf;Jk;p?)B
zoWGlsNE#?b!VxA7Sc1|GPCDo;ORA5*I5r8~3=;A}-?3J$O-c+|y|3d=D}>p9_7tih
z8aSYQSL@K56K8Z-9-_ZMvjnEupaiK(rEoRQjK@BaXU3)s3Ik`&0#0eJ@fDxLs&N3h
z0fjC;al1X7aUHUfd%@oND;e(2_5?n>o{D)IYz2DZW;fQEW<6^8+Ld)n|1I0|Wiq!t
zW~(jY%|5rrvVD?w*YEIWv2Ox1)m&H_V;ndILmka{CDxNZD4ky2_vCaDUu3kDEyqfd
zLx#CXfc*30{*S~oAtgooxp3=j00LGypM0e^-`)M$l=tQkx1<fNuc)k*gs!aL%aa*w
z0?_Jr7~aD*Z)IhaFEk*1rr=NlPaWXUQ*`!o@NJAvQXkAXCM4TmHF|wfj%8PST>Fr{
z{6e_^hojc$j5Tr>gWbcm<ZLJmQW+NZojk<X1l&4KaK`Gab)0DOl3q!4&(;#_^Pz7l
zKCCmL&(85gEJ=}*)<NW<OsW{KU+5Z3>DbnskXk>*IP<apsV=I-C@FM#k3J?O??Zpy
zOj(GeMK{Vr+U4V6rknRv#fO7li&8$Ae!u!+UVD#^wrGFg{-%5{S~_tm2ay*H-5RGd
z><aTyH2ZI;<Ql+L`xTO7LdFR%ar;Sg#(gMlXie9X0@n6xvuY!#FZZ8}Hvqj^gf1$n
z`Q?r}CVm#L1C%_w{>1%E3rv`3QNrSaWPbn2A!c(ib#HTlQ)M)q#jTQ2Sg`4CL8a=j
zdb#okS(zsZPoj6zR4u1joxJSpF-(t>nj40Y7auDYkJjdmJ;r@Zk+oTU(NK8($*tqL
z;!o^UCL^3&*8|e_zdb##%S~=Te*W;`B7k%qLW77??f^s!u;F}ZK?s%qPcZaI;=jMy
z#n6TLGw1}sN3J^}drVtE$O(}H&ZP0!vmedV01&5-ez-nx<rUh4UN6*@$Dq;NYW>wN
z2KHZ2C*WsXe@=w%V!$FfF#SJUx%{93dbzCX!bn6E0FZlO0D!z6#A&6)y5O|E!Pco*
zU;!rmrc}4&a5~xuuh(7AC*T;>cZvang5C_ixwGvI>lXMP`H)4dx>|#O#Uq}&F~2A=
zCrt8z)s2HWfG9~JrYYu^Gt^#)IMuIh)m~}4la?BI8YsY%-cXNDuW<%krH>TJEuu7)
znV;hD>)G!=y1!o>@Pp?43&eyj1)K4ylZ|U5hH_bH5>^m~AefC$Y5j82Cj;781-r7X
zykpp>yZ(dbFnHFdIRa#lIO<hzn7X%f6C!wRJ|t=5Rz;$Is_o(mt<=Wq*QAZ5anjkC
zTBv;^Cq(@`0kJ)n=Hhv4FCop@CH9@WopcG+YT(!B{Q04lJsB}+h({j_a7*jT68Ivx
zadpYUO<c};weO-YG62Zc^_;W`sj#otW7g@C-&}xY;W8_PKi!e_>x4M{w={t8JZn_)
zybX3$NpMbVG&c>#G+^5IRKj<gsY1yF^k4&qbOA=p`148T7K=WGoH)|_E7=O(Ato0v
z%zkiP!21Ny3qH`Vr|M}y+zaVKeuH>20h&J}Oac~C?tfa>m`@K7b0amg!o!!?_Kt>9
z>Heq5Wh|aV?(RsJhyL&R;6E?)pB4HK%l+?k>3?MCKQi<m8T!9OhGhR;@Nx?Pz5_Gh
zQssdTcy-ZHQQ1?SZ$@t(S0xX|Qe>S)6*YV<>p<rQ3UjVyGW%+y{O1?yr_McCTmJ35
zrLX+Tj_@^#GWpd$y$_Il0_rd5sS5ff6#A;?e`|Pl0;VWv3b#frYXj^!zFnaWsyaV`
zYP{9ls88Ci{6Uj13)sp>YP2dDR#<CSC^-w45L6pD#%S`=Ak_*nJWh7xI#H$`5-EHg
ztPMZ@+Hhiz@1h?ojo9xOf$*>tTUrJ~7Z4HF4VrhT-IS;K&maAX1ZF*M<y+Mz18sW7
zzR4}IN8?lO$Q9GyF@M1%t0fws+ILbt1Vt70>YSTwj&@5yXa^3=E@_opeoC*1X%Erl
zJ?Xxx47whKiyOX{9tTOb1^Qc(PkODHkRpzR6*xrMGwD3qNfd^n%?6mmm~yU5sJB=>
zf0=z=d}g6n7AW)5k4_tq9<JxRtHh^f)CzTSQqa}5&Py<jvX8gWIQQWr^YJ5IYZevF
zE5muDkkx*`aXCr?83Z=2%%Ra$(fG+TsW?qv?|S*l$gt`Vow?{Y`MN+vr=+uzD5Bq=
zS9SG%#s#0wNH>X~6Vk5^RVXR*zo87b2uwp)QXzrTyyrDqL@Ty-*Dwp?S;d!TUOs<q
z^<mF#Evp`twB^TRUAgu>qFMK&nc~|IoiJ-__oFZ;DD+H8B34H8)wf>%9d7|4Wf7V{
zR&Vv<57u73W|h5LWj46&CVO;QFm=;VgzF*b8mkYs0XA&g2<9xI{YVPEMOe2?&arH7
zq)QGO9+7N7cz<i!v?9CJ&Q>)y)toOU4n`_i!%U;kt)hI(rO#?#WzVT}I(=1iDpghw
z8tM*|xNTLetfQB9Bv)OgOxURR%PU~>YrQR(w<^2M+Va*yK`dLC2pbU<{eTMtd;9ld
z=bL()nQ{#RtRueFUZIKp_~nZqs}Ij|FH!C$0NbRP8WN+5Y%E6Rl?E7LqO9_!9IXMO
zF2B9>kfGyz^~}=vbq3>2rWJ9RQ6lTnyE#YuJt7{j71b21N}E%GG(e7m%yMltm2%W8
zTQL;#y`qGxr)1D?!%k#4jeN+b<?vGIrCi<*bC<kcU$KvEAZ-b%ueL&%{Zu4@e;-zm
zjgE`6tV0tNXzm*XDSu-)^(+=>u7eH>cYJB#kjh=svzf>Y`=|jpeh;IEmqYq+_iEr7
z{7M;ibC>X+#{36VhKGmE=W*hp@}nZRlXc_td-Eoo=>r|ttG;LnS&Hd?YYdwvMxnk@
z(UO9(y{k3Vh<q}*FJ>F6&|aQg+`Z!KxNVZSxV+tKlBhvs-sT|crRG3*>Litn2lGsC
zg)gpKCI&L-hB#ggQ5d0B{9atB%buDQPKZ4!dht~BQ4u=6opQ`XnvG<2549!Rp@NPW
zEPBE>$3=8xTKz%1{-M@*aR!>L0{SPF97AGZqI&~x^m9e~eZ3K20?>ir9`eGMsHF;D
z$vhazL(E6Kjx7KUI$3oHAAx1o^7YJL;8En>R=o3?eZ((a)0`!^X5RSP&^KDTR0%Ag
z-h9};VsWY#B>E%8Ji*IuIV2P+%wBhXw9nf&^pKgI?6<|M%U-oyD1U#gWvV1d0r7RF
z&R6<LHKsOirKWS-wOG=^9|)PjP_FjS_cy>#^ab)h4NF!xCs(!|Z?_wg5SFCg6^+U|
zWyHUIofQ6MSeY;-jH+k~m%b+z9CSkVlwY?59W-}>w)s<mHHnt|h-9nN1#`o`DCMr<
z?S0aiR~nVIU;*#JEo>KtDeb>~oftk}l6xa-ritOCLcJ~-3Q+;Qu&W{54t)=#3pZAb
zEE)~Vfgy^enZYHdp&mWg1Z1u-s;7{u^JO{>3@j`yK^v5OA1rHv=DWu#(W^T;Iav#B
zz8=;2s9xJR{UKyS{Y2hi^qNL+Y24xKYBD<RCsS7$nPU`qJTzIJD6*Gho(u48EN%%4
z`1dK<s1S^ILY*iQlgW}o5M79+s;}`|L@{e+D^Z8tUiqGVT*$<<vkf?C!P?E*w0$uL
zl9e|5U@G*s#Ia$M{+j%?7Dou8KJ52hWnhk1EQ<n{o}%O|#RMaWD?rtO6_DZCMGud0
zV8ihQjqjQc3Nrz@@wi@U86Yz6nRaVV0gZJLpf2(lBM!3<Y;kDe8}R>bm))=*P5EDD
z7Y;Twu(8fNIm2Xt#BnHCQv=A8oFge+Mpea<ly!CJoSMlumtya5{-BZc(}OP&CH9Ti
z_I>q#*5K~|Ku`>`{@!*3kfN05cpG(7X*$j(x`~TW;;gvcWr%h|&Uzs!sxcGTea0LB
zxt73CRki+dZZoa{*=pCKP!h*F5zAFP6jCVlFy<SPjpQj@i`?Th1sV{TA}Ag)e>tzN
z30FU8E`*FFe@8r=z|1v(2wYUH7l`^YDhoj8Bn(LwAmLQWUoW6mHVuA%U_Duy{s)aZ
zfGh<RtgBt83N{n$sn7d?+?4q7A2fm)f4xuuOOMHa0GgYw*%lu1lHMh<QRoq`@WO;u
zP!MSIYyp)eA4qOr`Rlo_-w8ig_8&ALv7Il}wps)hK&2!oF~<Sm%9+9oRO2Wh2oF7h
z!mtA<>(?ug;rWcEH!-`r($%5cHq2Bw08SkOPkV*_g^GVeRbi_J1h&O*8B|07Z{USV
z0I!KOfF?%}M-cORU<xl#21LaD^?ZBp+}^AR)n9k*{(fR0KwV&xUrl#~01_RWBFX)r
zx%L=<>RQ);Fj)7$UK&JqYYoZ>Z>)oT+5Z2vl%K=^Yu5*UJn&jE$)ra~&=}<#EJBbo
ztrQB$^J3F3sYdsut`3ZuQoE98z2d{j)!+V(>~J#h&U++&fDDZ>)MHK{(v~n`t>77E
z^MV;bmRX>{E5@`>m=OIPfsN1F-vtvgsO-aRyX!zk3r2$aw_E@uCQpuoX%X{gg#h1m
z07i-sz;{~&C2DYlFhyVlL0sGm`ehVEo$7snYfX?lGl;ss;m36#3s!Y$0=Cc04I(K6
zi9}O<i29nEBY;p8+5%FT97DYfzVquSB&{c)xz=7PrGWIe!l4cZSkn*A3NY&fV2TV%
z!W17sA_u>Y?{Qy15L}%B?#)?b`|~h>MYa-3*|k87#{*#W-^nUq*#DJ!2LD1}zpK9v
z1ez550`R4TK6xE8`8V9Qi}(xmKz}7~!KYuxpoo+TZ_EJt+254%x7;r*4dgcbg@Ay-
z{X*jYErwsl0dm4T>Z$NN&{`|tA^n{!&H$?7R|0<eR~py6|I0vs=B>X`3~<c95b!@7
z`X3HGPy+wq&_8M7U$x)A?&<&6=+JgXz+l@U2}=Y=)NMa$n4lk!Vgv;w<^GG+vxYog
zqN@sH*52Mu__lPpoTc!b$PRJyl(7<dZs~9ID3BfU7mMpZ7TA9*uzz8z|F4bdNkH;y
zm8q<?P-jv9V|Ti1MLtt|Dkh$bBHF+PU}cKjm6t>GQ;Gy6B?Pqtv~u<W%-F#a3=o>0
z0Al@%xtJv!P?Lp<zu7NgnX0!}nR4P{$<x8@iv~5@I{sS!eX#tI)BhH<{7bZa%@<4}
z0JdL&!$GvXR`{1t`Y$)TXy<`KmvjFQ54P(T;A4oXHo#i?@_d{u`6xA{q(%TR!4fin
zFPAW4wk>GpKc$yR<07^r06AWcA*+#^@!-bmu7E8C7{VpxD9eV@qxNq_tX|-cwPub?
z-jzGo#`01*^ZYq+@h?+6XVcNDIEfB~9UBf=4=zP74^K*m3p1K*3o<uupIK-2?boO*
zeiH9xZ#ESFP|L*R&<i>tJs+JX?kmQkc${6+O-F?<C8nLo5)kEtJ&;Yp3^aqhER2t-
zZ73!Mr9p&bdnm&ExG{dO=Rk8QAFED*riM3S-m=M>vyu6xpZ3lP^w?~ACyWy~DM|d@
zLlGKh7iZK};D(741$AufUPW#7>f*%L74&gqQel(BGM?Fs4-qp_xni$%PA^x6_&M<D
zRf^=Mzwd=br)AZu)?Y49Re0I>8(w?;5U#$Ew^j(H?(qHf+9!j%l&b|pB+F~neUz)t
zf_Wh+v?C+f({=TH=N~=Vrr`whkT|K#y1?|W*C%O3PzC)v#!H+~gvth<Zi|H)nbPhH
zdZ^K=;unS#bA^d&%j;!2vv1VrIwFA<-@B%XQz$YxD`VNn#8iDG{iXT@n;O}m;u*6B
z?;iCoCs3mEs78zEN#QEi?e~}QDy~Hof$L!5NWnGuAvYkoi}SHMdud_B&F(cCmI34w
zOa(gHH<)2In)9?#{XL>q;+7K?IjgD)PTOkaYK60r07H>aonv18d<9`HOie_p+yO0}
zzO<bK{k)Lt`X>K@=0j7%qo?H9u0e9JCpc2Jm?Qwh6grM`lKzg})*%HE4L7voY(l^K
z$m8l47A`%@A2=Nwc<sY^ks4MvpgC=|{RG=HTvjxSY?=6_ds9cDEyC9&?|k$nmiDl+
z?1ZnU?4G6K(~U*w&+9C3c^-Vd`mA9DRBRAdPw5`$2D1R>HNmPwSdRq$NV!U?CWHLD
zYv@U~pUj%GK@nTRZ00r#1B$Vy+{#i_nTJ+6WOEr|;xi1A0jz#m69s$=z-K{EXOe=x
zTEwRorbA2$$IZYNH^l;18BeI_@JI8SYoCg-z}=l;-jGZ|#x0X&MJ}}t_%1D0=FeuH
zun%9C9%kPDtUm;*qq6nQcFhcGMX1?+Al=eTJVW~gwn}%{MO!tHyTyia8KSzF=n=aG
z6(bcT7rFR~4sYIEBWUG!>mc)_90LsQJhphvr<rnjEbF&gD1=|{LQGv#IO8MruZJP{
z7{I}<eT*kXO=_z-5|G=j`{`AtgzW8Ut%p;Rs@IDY2fMtJ)rVLk6Cpm^qh^<a#5Av^
z%1VNN8xe|lyX;r3A$$ILx5TG=CuswfdAG7=fqFMA?`+w42$*}86ooI~T}bplL9`Dw
zs^k08lTp>bJirX~zQwM$ox{L#tBdx0j5m{K^QmUuGlM`Yu|B=b@*xAAqzQzBewex}
z$#pVCMgLjNAte3?`tx{R;!t$Xu|!B#lfh`dQ@$um8^<#9i>X&_DwMJ|y3z2Pa|jJD
z%(5@px{a*YGL^^E<j;vAfTF0pkf19>p(tlh!DWM614OHO1yrAx`9uQal>38E^`f$$
z=}b$E6<|wcK-&I?BRmZ;yC)t2k(zBFcSv2O1ySRV$|H(UHFz;g)fj3_bP;$BnFmB<
z{!y@YP_*_x9V`H(6T^(z+Xmcb4HTT6FuZS^xbF-2i0K10JO9ni0QI0>Go!p2{#>+s
zjuzdkzVcWa$cmC%{eROT5>AT$Q-?@j9H5MYvwnU)7?{}6|K?_Z@XuPxgL=yU`JnOP
z>mdP3T*xA3|M}S;G(!;iO@&MX5aUA$laJ~FpAYI{&;TDo)IL`8E}+~Xg%Xq|JnKM5
z7eU9Rt90<%6lXk`?Yp%l&dSEY=fbPbyLv7Q9I$F%uHElP4kgxTjiXwd30ieBaN9UM
zhnJ@g;Czl*pLbInXr~!V=6cyGSv8gpx|o2w)Y2hg{c-y?P|BP`L{akPms8NFntkC(
zU+?b}IFY9j%SG+P6ltv#5YSCEd_<)>-sQO<Jo>qtM;{*2A)?b)@Ia}BtK)g5N251u
z-*e5m2P5Z1?U=~G$ES!UNTMs1=^=r+&d2k`YJr+E9us17G4W1Oufp4VmY?jbB_F)o
z<v7gGCY>nFQi;4TFxUq=4tf+53PcR6EYDUFC2FZcgYMoXx=2=CcfUt*RTU3gj^JB%
zSmZgl47=Y2UfIl-p3tXodQK=UH%=wPIQ_90#wxZ+Hg*fk7W-paA05M3N1p0L5gD~Q
zX5O*IT@nn)B5GWN=voeHagkicJNH{7N0pT&orVW9m)Dm3AJtgD-PO;ccBr51LQI6=
zJklnUF`QRFlai;-MolgaBT3pYDT^_F7=MIUBzud57EI+meWr%FV1WGv$T$K({aBVT
z1YHbHq-h&dsEMAcoL3kh0zOHVdcm66YOsK!b)sS{Mj_CAv`$(qK_fn4``%(CT`2vt
zQ+(uzo4|hVMLFKJs-|%^g3w&27}{7-U4zLLHMuI%r*KqCy_a?5RZvNL9CcG&t}+!h
z?^93*Vp&46FT=sP4n9z97|?WQN*mSp;kiNsw<jAv_Hf~XKorZZwyrmWJ?W1P!*!PO
z0OfrQj0HEloX<S6T8UUNr2tk<fd2zh;v_a02*XG}2N#2zq=$T`q+{R)L}9#mWR={<
zF+IeTZne`eUa~aHnd!0i9z0I|C<m{2*^#kJ6r@N|AR8MV5vuYWM7R|*tTbhlHiZdO
zs*xwGqKLE_gtZhrq|kn{@^0U#$I#bkE=!s79Ex+djhV9Az?n#9(8Rm(!|F#Vch!|h
zT7=}Use;5uyVH7x%{t-dCmo|7I($1BSx#=eB3|vbMi!?i#sQyCt74%t5r~A)$kqHc
z_YRTeh;2O+-_L4oZ^dIWO7eAOKwh!>7N7IoB^>=B(lZ#Th!*qh(S_>8cjXr{^9!L{
z@T%dx4QUF4XC_7&Gy&LJ^uV{9__yDY90^9-&;hu22HcXA!Ic%E2F2?sHSML8*c>D5
z=ibqhUwSO{+@Q_H;B*xCMP{Ctfx1q0q)9?fGol0uSV(yNx=K3q09=xgRbL^P_#CeK
z32r+;VZEG}TiV|9m{^(ulUs}t4Y##VsnIOG46lQ1GT?y^Gn2P{NrglXfK$df{MksH
zmPE}@uNpnGM;F4xX6i&8IYe6hALIx)f8zaml;JUkC_!axBS=gMy_)nD4hJ#8IrA+^
zXWPh1SIH(xF=yi-CDO0xkbWXKn(xPCaLG4YM~BI)iJ9?vi=$ly5NXkZ`CbHKI<~m4
zWk0fp-wUk)u%53Mqz-|0!laR~4ct^=<Sn999>jkz!RH-q`?VF9?k2mltZ5_Zv9&SP
zaC2fHwi!dvWE(mH4jV57H}7-eJ--$(STwsrCZq-Rpw20370ak@RL;GkRmQX5dmbWB
z-(hjF+-&{|d|?7;I@LRw5)-5@Jg;IBHF;SUOIGRCE-5w3U0ETRwrU69IO!tYW~)@|
zFa#~c5Uf`HY_EF^GyDk2-u{!rAOvx5DZRn4^J#0HS;ndKi+0yvs(jkaex3aJd{%Xh
zPj&y+xSm_(>aEM)n<T9z7O47Jqr-(8pb&o{k}Z|#Jo&zVchEM5xD)LrN`j~-+E2pR
z9BX8%2|Zp29puf@YHGg>PLDlFM@p>hx_oe#U-CU#R;2L$+kE#m(m9?+(2&x#{R}nt
zsZrZ2{c4<3pI7rYt35Vus4JB8DzvFW71x(>ExfNDq1R`{oG}RN+}80-L<t*(lRSZ3
zF~wU#?YARI;0Y}6<AH?n2hkfwy|zg(k*6>*B(K8`jfbKsu96=dpw9G#hzzZ|o<#!R
zKo3-jebmcvKtILhx;T0m?mp7>QVifwTz}B|EasIT{jDbzj>FSiTb`A>yL537Ki_?v
zk0VK1Zo_h7e3|(J#i(jOyGjy}W$C6Aqw6HW0^KyPBd4c2ZjZrOYtP0!%;Dy2lx=Z8
zmAaf=-FDODQvZ<?U(}T+f6#;r^8n#b1cyH@$r68gB`fTLv_Gwb`o++zed^+mk!-d^
zsn71Bug1W6vu~jn28-%W2j3F@O&nP@{iS(1HHu(bmnu|2wA&MU_R*qasxr<K&k%k*
zFQ@&UE=<;y0-bIY@CMa|tC})Sjg!QiYXMGXg`b~Tdx2oC;>jUFzJ7W|@~E5Bi^}Nc
z;(5$$6x9_#L+dC=FXpF=BEe?+?2@;fbjCe;7UPWl#!V6BB`Z4;-e6QO(B@+z3Bg1?
z3qP~}iXj-|D9quQDl)j)VPq7fTUk6PHb8Cr_;zH-QqND`pvCzDyX=h~l~r3I9nsk;
zSL)I8ME-hp?)?}A{Se&#%*QyQ_+)c9s#2fdF|p`{bTB39`3C>c8JCk<Ph&598_6G_
z5nv+oPb7Xt9-(%OAA3@Dn!s7FBK=%VCQCjBnz>+-1BEba&y2>Ou)VO{u5YL#9%seS
zj3tS)eMR8nnlgaC>f%5xCaJhV_z{`^vFYA}%Ofvc$yu*yI+1d$x!TkHN^8oVCKS}h
zu+0wU8gzAicYK44-d7uJ2b$r?cQ9|`0qM;irCcPfOjY}1C!0fS_=mib>u^HP@V+S=
z!Y9V8Y({H+JqAsTw8XGOhRk;CIV;znnm-fM-Ysgz&!X_(s-y|x4Pc(C2bjZ7AO~x$
z$xR!%7@GuEebXMv63v<*9VpaHdy0JH@~gK3|A)Qz0BWjh*M?C<kRmEgYE+6yRjLXS
zkq#oD(o0l8N(fPEs6nJx0RaUeN|hSvQX^eJq=eo==$(WbAjEG!?=xqPZ$0Om@Bh#D
z&p+=tOoBTMo3-~|>t5G=740Twv1(WgB^j|uIfEsL&KNhxGLTf-A@qvOc?fvpjq=+x
zK`9o`#JS`y+Eji!EqLk8y*JF><AWG$=Ag0twSA5zKPbNEwQ~bkBhO0>{Ck<t=J%rw
zUJH%Lt<#vCX1qoFVIe~IVU6SJ_WnRIx!<DRxNFjF-1$hsZ)#H_)qTGPx|nwWluk6K
z3A?dtJ=3w{w9}j4kQWijEg)tIC0f0idL7llimsv;2n|DMa)@li%8Hgiu=6v<DP_OR
z?-Th_u7_Gjx^ePk7IeG%1s-toYJc{F=~3+X#dfnn(#s=SUrv%5p|+I|@GBy8HKu3;
zE5a54>lo!6<s6MUsK29A!updyyNRs4DZSG*7$#q80{k_FUYRi4ti*#ABQwBqc)7&S
zUjZx%b*=<6eO38ICAJq|>vyx*LYLMmSX*mVcnh~EkIsnK>EzFrv@??Sx$5Kl5yQcL
z4Eb?THr>9iOlaTp1Fq^l5;NrZW1T5JO|-cN-fSrgZ=GLL)#hrF*-|wx<FCE0eDPGt
zlN%|d<~?STmLKt|+HrzEwf}JXWg;q2@iLqczu3mE#8xqgmN`RKLGF=;go~YFb1@Ia
zVL2*$_s9qM_YZ!8l^a0FMt<;fP_UKcmthJYpl3GBS~asthh@+4@m8^zH{7VcnAg~-
zIGp9*iz<aT>y2Slv2L4V8s8|~#O$1CH%YghL8o|+k`Ih$p1N+UkKF8h1Ffl7Gpk#z
zAj++;Wbco5$Yu;FdAs75eHaz5FO#o{?)Kwc9AtLA!Tek8#-z-Al7=?X?pqHt*_s$n
zK39JHu^dB%iNu*F`RQr&OO(4cptQKKH{M>u*p{=%glM)LQ3syB1EtWLA4xBPN>FPR
z_~s+-G3b;S@e~lIS9jS5_6cew(=hmOVS_u7omg0v&<ShFVrn^Gx8?Exx={q$lO*W?
zbKK|(Bna?pi9KybmPwb7&|_@Rz9-W`UE(=;da}?o{8@Xv*H0+zHzeT!=oOezhCjy_
zOnNk3B+^&`<#lU5{oy0`s+eEQbb9Udx2+z+6Kl5Ul&ZRoY+8SGV$(j*ay2(!*&SM6
zHyd;_&~oW8H@_-)2f1aFR+P~{CU{^w3%D%{l46e}ec2lTe5ZxU+JGntwB;f=ydkYQ
zLv_YJ)1*RKb93`}MG=Yheg_$IL~f93!#(!Y&WEPtneJXnFOG^L=idP?;b<Fi*JB3<
zDvB1brql3o_1E1Yf*%n>a`8H&vP+lh)5Uf4D<j+@5GfO3slGn(%H<(2+-HBW<50>u
z(grhk^Q>M7g?aD^DNaUSNjPLxH^!u5^pk#xj!O_MUQM6MMV`^U5DtJ&jq*y=2!?Oo
ziy?}<1XLrJ|En4ERE2J%PH|bqdUfb6b{&mW#p>WbPAUI~nHO6f&Is3zb*`$7x=ebO
zRwlzYYptD^i#&0Iwd*kFgg(C^oeYxXkqpUr&x3T;2hSw3YB}g;URhH!P+X^6(33Yg
zRo`Ydqg8y>!@5@N1)U*}Fwi$g0WgC6tRzVQv}Wx`1iT5CkCd0d=apzkO6^Bh?cc2A
zzg9Ms`$>Dg6PK}kKJL`nCO>|m^C~Uf?RdQv_rXHXp;Bcpt}e#!27Muh15xKRUa0ww
z<8dVZ(6ti$9q*opgw1byA#%yy?lUXwwKAG@1wO%-3iHl$vo#tvGK?6(lu}?MFQ;`Z
zg>JCO0gBo68-7pFi!D?VL^f(*oY7Hx#zYk_2Rxlj7+L%y#P`{d;)$2|T81JC2F$v!
zxJ;K8xSVq_#oZz2MZowes;AMOC|a-`GZ%0<tBeEvc_<U$^JIgf354~udUzfpM)C|P
ze*>#Ue2|q=(Ih@lsyr_faBw+X8T9^ZDC5Ty`>1v5BWg0oaX#QKWq6!H;Y7%{apfdZ
zkBwP5nmOvcJSB0RDE5wN{>%4kAI@pE%l47M$L}b7K$wMGY9U#c01qt}f22Vm^Rbpx
zmy~JpVYPzyTdn!}w!TH_h*<~NM?Fiys^aDa8oYDJ!=JQa>QIk<t#!Ef1!Rz!RYUGP
z;5SO$X1fa-d5lPIrEW7uT{OB_;XY7o{0P{1p0!ww_K@&AW5~vCd0i9zW<|+~{0RWL
z{I8J$d^Jg}(?za8pgIBm%GdlzXNkfv?4GLo&|av|&B6DU-SzUS>d92W>S~i|iC|56
zMrB4<$mi%I1rjIaHo9ejkRIrNSt#*1L{Vi=mD0zqK<+8?8kwBmJgD61wp+!OLYl#>
zB%ii1z3@5)e6+@WQk?r9j@8W4M4)%I>_F>W()`8q{9!ZEDtvd<c38#P^AAN2#vbEl
zK5i~vt?7MW>^vq8n;T0ifIW&Y#cF15cm1)UeKx!&PJ$9}-*6?H;dRPc2;|IW3$KD2
zF{oy^Wzy)PT8+uXo%+1NIq3VHthyxO42KNMe(4h(PQw7Lq)`!U2Z@4|hDK6EdJ5%3
z*2rvr_%0}pnRL@vf1u8B%)bOQrr7cGQ@(k#4Ez3>y{F|RYW5>hHVHc#uaVOqASWmw
zvJ6rFwJ(T}{H@ZTofzLzvyde7d1~D7ywLZcrEi<((VYRueONYYJc!JKn~wbkVM1hT
zkZuub8`F8QzR+hi&+BQDK7`fO=ePA0a?lpW<!i2-`#{w~bs}feVRU5=xwm4pn&G(W
zUfi*HLu)IiFbP0@SUi^t^eihY)&L}^Q3(Ko&C#Rd(+N{#%>foGQX=u}D&+!-2P$Hi
zY%pjSO`RpEb#m;K$@(XK^YiyUlyrgI3vsjv6&;cvUR+X{pc`D7oM~SfXEI`Hen}H{
zDg2}ctK&^WLqmN9DpBox*exZ)Ts^@)-?;0#l0N<oXiuyMU~Z+Q{%<VG2iUItk7H44
zY_rIUtLyH}YlA?&N#y|lq*r`3QdZ?`fugY%9bw~LfI!OI{AMZjWR}r;1}|{S+@W*>
z?mC#=V~>g3@*{iNqFn&_0wx(U28r2?Wm>ViVlS(ES|?1hYI*qH6z9iEj)&hQe9?kA
z>}x_>iCu5IXfE-%@JStG6mK6&B!4CgrVKx>NLsN+1IFR7O_|EdFo!CRFWr?UzC9w!
zCua<!2j5mswmgemMrv&NfYl{zafjw8Wdkc?_aj@x**2_ciutkG0yA@3^1j?{w&VGH
zO*+#H*Jc8;+N56K8JwD(+ptl#$2E$A#fZ{HZNlSdFQz&(wl(jHmPgH55HrV8wh$d?
zYj|c{B~zyq^@Y>(C*E6P^xB^^MDH0>8g_hOY;!OCCqazP<>skJ@N<@m=X4$DPh?pg
zRAp>f)08Kbcqwc=OEMIWZ{a;d5py+{2UY03f;F%&r%NT6yj!~6x`c(<SSrmI3)F7&
z@jJtU{9UvKVpN5{{{e}g*FJ>IZ&Th)rSOHSA&LR>N*X2-xR{{=s2QT34iv-gbHl{e
zB#Pk@Lk@y5*Tjov!#Z5K@6><WzGAFA*Aag*UVaBRHv7$rpFm3%NM|R~R7|}WuSomB
zQZB8*lR=zPc=W?3Aa2%nIWFqWHMyi&t@>D<j5--)qlyy8(wHHdER-%#RX#8&-tXgM
zuF&<Bf))H&cfIja0B7fT!VUV`AQc~xh;=0ne=Gozjt#F9V$Jo=k1h8Kwj|g1m19RW
zi?}pT8H=Pp?k?3Fe<m$=@#W*e;(IBHh5HICqCjmO03jHF8A-V5&`@7<V#FN6f3}su
z6$y7Z8~Yh3i)tDr6thwY9cP~^zh!!Xzbsx0eX3QEe*U-`HrzIKsf>i8DNf6ANa%q+
z-@86xWr_Pylh*pdp!Jk?kLc}h=nB?!ljFXW7+bem9ATnbLMIoivZO8g!woln6`!6X
zcHc@IJ45MDZyOq4KO<P3<TEN1F~+0$F`UcXVOIFXcVgm`+=xXO2966Y8K1OTF~hvi
z(GpF&t*fAi!K5$Hty_Ohad;Xt?j{l`<hp%Lx2Seu>{=~gpkl0wGe?@OA4pFKqwn-1
z9pTigfHK*MEdI%HdupZT^?}j)X_TvARw=_v7i*4ZV17h!{JqqDs;;>2g%FZ6CfL9N
z5$w*)u42s*jBh~c*VLC*SCp%jCUn-GpU~oJmA*$ZHW_{IB6W+^{fi}EwHhL=hs+Ab
zvlXZ9g%IzTI<au#LpAG@W_mi~Z_aU?%MzRx*}iw<(nH^YHc!SX<Ku<~zRJ|R+~A5>
zdE+k;a}0iZdJWi*=AZeuZOT*ZDwPbI+K-w~oYqGvHP!V>*wmy?s(C%eROU9nD_?d_
zuuPv}9efbVV(yUa8hJFoUDxHK8waYm?Uyq9BGLnQt;(A1bmoyALb8d&_>Hg1V9}aj
z70~`_&EhaFfWc3Nb6Z$RDMzX@T?z5J!IiN8^DL`P)>=A-fLmy|pL5`j90Jm0dn_{Q
zQ2NJJ4V(^KNwx4o(wh-<=#_?~!<9w7nvia_BwPjEhSg=(ZuVWVk}@8i057x}0UlXM
z_QV%hnk#cW>nG}{OB4xKyrt4S$VfCCe&hWry`D*Cqc{Ky=(Pb?!hiZj%`l@uj*vzU
z`yh`&yfzpd*ldUt_lxRE6mEA4pp|O0n@aBY3<X^H-PP#7cz+t`a<>QLj(vb;BoKZ@
zM}krEyD0TQ&#w;(@tOSR2k(NE|CLVX?TPU}T}g+m{xm72V*ZOMX$A23{Kcg7E{{gU
zFRH;RK;JVXKasEm9VY*7T6h<v<O=}MhCYCF9s3vQdi^?bwh2qA&-lx!o%&Zt?=t_3
zQT)3RzQY96bwKk+T!YfYf?TUe`P){AJ#_|Jh}3<=>Z^48$=9I35y!dXPGoA!{e*0~
zLq8exG<!VRGp_LGWN#OLxl{k?pHD(Bj#`ze2_<mBoP5jV*J$z~<7BnkVY20nu92U)
ze#3wwIBRm{Mw*0ZxXim9lJoP&uWT;(mexw_#rj5HvK$$&&p|dS%D{9Q**#F_>malB
zt`_D#P@ibCmBY#6s2e8Tc6(1APFio3xW70Ut^0ly>4DA=&h4KvfRN6Hb&YCNA<6G2
z)0t<$Bh1P~rWzA;B-zvMli5lsl-*25zH<Gk!%LCxW&RsF9^0Al+ji%F*r<BRe^h^b
z4X%0|RCgoOzQ#G}a5w@klLpr5+es?_S{<CUa!10*M?Ee`xe7lfFY@^IF6TkPxP7*5
zRW812!f|e{5SQG!PwwF$gsv&$HyLmy77$Ws+wF-I=@FnH&h+C!jV28};`~$*X`@qf
zr{%QWq-g#nI|XPlxNIYA?0Kra-9VHXBrJz0qw&+C;zy|-e<p8Td+PhsQ)jPBx8E6L
z1x%V@=%33J2k>JZtx6n(B)SFTqs3!LS1}>JoY~8J4GhGqk>$uW?(*v1#WLu{4H-iN
zk&D&|YgyggYSJxg?H@c~jg0a}^34DR>1uRhRbaU&n2S`<cBAJh6l(X`+}zQi3tm{1
zIN#cuRVAdU!};o~;FL7qcEBk8jh!OaxBT3uuw(yVxv4+QU0j=i0^$jXwg=zE4cN*P
zY0}!>e=g3p^A@Q3nncTf!{oM?YZLLd;<=n@A}V#^6c5lCh8~G7gP4@WCrO=MrbHS_
zwreiZwotn6+*tcrYv*TGAvZ*+F9dsezH4;9m)`=?>t@UF@H7Xu?N#%ic;c$Wf#%3-
zWY42!H0BA4Q3o$Bs@exM#5o=0*v%x#{K*9lNUq9?T(2U@(T(>RSE)LLnK_d1wr@@^
zhFJPHD)I1%C7bsuYRvM29-3E67G{@MR{{BEPCW`g?q8mM@|d%j1-eNiWP1s(eU#1F
zt(%BlrFc`kldt|9Plk}-T`G$Z9%SQ<23}v)zIE|BJ)c?HuayK!!N-a<vsyKG1xIPI
zZAfi?fTVSDH^NT8K`Y%d;Pkh3U)du*z}ZDf2=?f1f^ndVgJ67<1Zy)7+z$5qF1KqO
z?*~;I)Vq?!n|uXoXGOGffIkxGxXI~O=vD0=f`olVk7E@*38{Nu;TI4dn>wjYE{-BL
z=0`cznr?IbndQn3PUm$ij&x3miygfeh((MsFxBz_ypTXIQ)mNd7)AkL8G#||feKy^
zAKn}8blo9QHNk5MVng5V6$?GS7JDO$&g^a`qw7vRt0~}G2hfBrj{{MvxI>L-6H3bz
zPpnP~lbs3i^e5TY{L!u#YS{%f;uFS>9_Hrle4A3N+?8{Am$qDuDVO}))7eQ0S&&gg
z;HtTaJFnxSWpYQgp_1=jwEfB%m7wz_m)x0t`WP1&=sHy8cGP0p_06m%J&%eG>=Cr#
znCWzX9wLM+sPTws98FF7)>gG}%V|*YD|zM>|B+nl8?W`qG>rWL|MBK`k-e&;QzYw0
z99=nx(6*Y#-alN;Rv8@fgxph2ElrDx`7}rO$c3lEx`Z!uY?CK^qFKdxTRSTi8@BiK
zdj)!#LXtm2J?N`a5_cY|2}sFYfY4qDh;Lc?o}o@3Rd}P>xj1y%xY193nzk9L$B1~a
z`MAEcJjLgg#HW{w+GY;vcGOg2FGJ!2RU`7af*%{|)41>G*ALpxlbj?B>oGa31}VbA
z|B7+c^bc08iUtAX_e}X?PvDO1BM#{tZ}0wY)%#Bu#s8SjPb4FWcu!!p=>N-V5vcUL
z(aF^QKR@_CZFKTi?5zK3>XwYbUA{9%vSfEsHxMxVk<^Sw#X`<}BtV)s>88wEr!g!-
zIaN$EpDpCyEnIR*^~iLif{%ARbih<mGF@|kAnAB>#IOpX=*#eluU`fg_2fgY5QW*d
zrACYMs2s#cq{0dLjV&}6VFIy!vx-JnTbMZ!p5M~>Zilw=8mss1e7d3v$SvO$O;5Gc
z*JfY#WckLcwfsoXeV++*(f1ng$VMYV))nvMkgpI*9r-vb`-<!;LR%WHNRc92;;P1i
z5=`~@6TBl}*ses?w&`22j;*8}OaP{0zeO(!RECN4H9Z|VZTZNwcU@eTf#D8^F^85n
z*Lm62%=~Km=Xd#JJVomx%G3kc(3x&b=9<Kq*rx>uv(*QKZb$EeDvguk1qfZ-XSuF%
zT*~7en8_q+ymkVxZe3%Iy6vJO_eckrGhe?7TyB)LfHm%V=ZJL(&+G5G3dKIodl+Rk
zp_$EG$m-#?k_JE)2~2f7Tzp*!xJKPnyqZO_ZZWfI;3t%OlRZ7gLL&<mcS5Gdh9o#8
z7CI6fjBGjBJD&+uTjF>D977epw);*|VfrFj5FCXp-xXKd*RD@Dkb8T1045GgpAk?P
zQ1r~Ze6#sw+3S=;Kz?x^t0;)?mewL1XR(iYM8kQD-d<KVN6g+0D@cE*Ph)Y!$mgp0
zEb@o1Gb~d)=KY<O@(1HZ$Z5Z>%`L(0J08do+#>n_CFS3XtemPRfM@G-U*|NCyq%x)
zxfN-ZuXZ?J9#qtk9o!z%IsN|JGwPF{jXmFQYvzwUw6QX8K@s#JJS4pb=|`<Md~fz=
z+*px6v`p-p^2=<w2Fug3N%70Hajt*KB~4>YH+=p|RzNby$Q<|}Oz8>)k#o~xl`A;9
z0VNiF*>>xrm(}&ph(|SEQW{tJ@6b3^WJ$5&cwqCDbDgit4`WpxagRcLYRThOlev=%
z8>W-1IZ0&j^f5(~d`QGZ)M?=*8GLO9e2oilrM9F?5LtEHX^wZRvEoHC+4hNvx%PW4
zVM>op`b-qxN$40?`gfx$^&%T?l1+(cqYLe)E|m1jjL52);D?ll3ay3^GgZ>#Hf7l@
z53pXT&(6O-2f3-q>mNy!40DS;v)s1W>Y2pO{=?LB;``^~anp#X<At%p7gCzE{W*OS
zVzQA8ej4}Wu;aLI@y&{NpV_}xz6ThVUy2a-*{f*qC`F<dT~g~Nrq*%uei$_WJp2`a
zA;`B#vXhX?J`4~>wU3-TMHiI4#Mg&%1nT<xr!BZceRWD5_#YO^-`)@$450l1ehwd7
zZN;6y*z^P^HC(GBL{C-cBSiIxmcx4=fb65T<m6#)+j4AOhiP>0^M?mh@)J!N!oBnU
zJ70(0x|qDN+SOkxBlR01bO5s5U9X2%UQKGe$kA-PQ$?>UYSK?ud+E-XAX_w0Bim7t
z_J|QCM2G(Ji^{!HGjyrxgH`eI=2j)n57lwGb*tZP>JYk!UPx;&p4bA973>wpPUBwr
zO6HT~EeUGDm@r=hP)P1z#ZeNa8*3S~GG(p0`u<dJSS5!+-MUykw8IGli{<jwj#S0O
z>Jio(UOUzBu3=54ti)0ZlRb?~#43MeE0?;L#n@bMmJ+Bny?Y{dz<a;RlDb9mQ)-t$
zxZ<6>O0*phZD*84sdm&xLGuR3g?MHor`_VvHDbW&mT%vd6x{N(Mpw~N(EcvHh6R^M
zxJGu-_Auo80gKvk8AW^);c~~dZOphir@zow0l&$*!thLz(kI6CVM|54P^4u&{>1q>
zTZOvGM#ay>x?z$#fOaqvJ==I){21_c{-;q78-`?7{Uo*)6oR6~(Bkmt7c54zx<z!j
zM^6d&a9<$VhD8~Vq^sIIxnfP_#!IVhW9D{FY3XS=x4^tU^@m05z+h*O?J%Ln<0uim
z=+|{5w+e3?!gQ~aoP0+K!+TRiyB1Io0Cy@Hz^Cn`$Ws03o!dHRUh=kXhOK8NZWdj7
zt~X^aBp!G_Vw~K@ui%9THfG+wh5(~avUrDA0e@$4M8;3A<=mv{N`lq+%Fs|!r7In>
zZ|<d?sFu5!*YnhQ&H2&oi^;3ZAz+4`*dQxTzpIULy1eC8$!0;_GTky|6Ba+WyZLJ`
zn3Ts??@&`cp%QiGRbsFag)?gA-l7knPOle{byzLX@>VMH-FtB8u)vU;a5Sv8?>ubm
z-`)xc9x>Bdd@>~JPf(AkYo!Fk_VAthJBljMlWMLsF_|_n-@S?>)%f6udGmRuqqaDI
zw}AB*^;M1N7<TX6bq8-nwZc|g2P8Dl)S<*;1ufvYA<O+D{chZs2ZH+NZ|Z+zq=x9~
zJY}5oBB~xeP@kivz1TCStKx-UWl{xdXM0mKfQM>?Q2d@)_nu>;X6{9E37hl8ik3Z^
zl!amLUb#QpefIG#mf%U&d#fZ5%)x3E=ujk=q5~d%3NTN9{Q6#>Y`9bZ!F*Xw?BkNk
z%JiFpmTTK8!e0~i!!JD1*y8jWx0`8SkDEn>Twn19#iEri+H(vY2JLmt+|ept-?0mG
zcsbQhtq$?^l<3zC@Cssm_2FcT8pKE`?NkCM-^HltsFJ%{-@YyK1z~f_BVMQyGXs?`
zzvYSR9deEQ;Pt2yHM~30FEx*nEno9R&Y;6iO9r9JK0w%gEejFgZ{8c>j5Tcq4tX89
zIiEfs$57i^yMHDM);&^8P+BLxw~4qJ$vY29C4`b$`AxC@yy5=5&AH3zT;+0y58}Y#
z8_w>vM@PfZJ)xNcXCt<%YftWbN<C0bcN9K|5JS1>I<R#E0eLs4u3R^G%f`Qi$f-=D
zR+%rqaglVO&G-@<<x!AS1t2#_$g6W&!ns&7=4TI~p~lw_ATc%Sxr^4qnV9VE0*$s7
zD`sGGrz7f9ugxHSnpaWF-}7E|`U3Y}$mlbD-XZ+O%VVUxY1}xj)#~OTS<<fnI(53Q
zyk4}mCOsI<fZ$qpf0x<UdR#Ty;>kR(-T01fa9*sBnEtTgr;f?2g$9=}RTK^N>!D0b
zp~3Tpuxa`%saIUn=X+xmJn|ECD-+QqpW$Cr{cgiWxcJXwat)Z`q@ztwq+0*x9Q+li
z3K!jQo0QXhkFc8?5ZyW)F^knb?3T`4*2`qlv|zBGbLF8tiN|$0c#vyH3aHO1iBNEu
zbBb4q8Z&ayc;s0GuXr6uu(cwsGPgj+>@8mWX%hGFE4_CFEwRE>{@5UhbobR8vBlHa
z>55C^Dy%kcV*%cW%&rIh^-)rK3mvR5p~>3LlOsDl*+LsTX6EDyGAOAbNM_6fIlOyd
zZaoj?pp4?q`!n~Tab(Lf!VSV=sG^2sh_i%DE%cx`*E*YlgjVHLFti+EucGNNlsaRq
zz|liiJ9@r?<5U!VLb-yv|E0R$-6vA_-lqCsmicAgVsz%a1w_9Czkz_fKzzSa-&aw#
z=jht>Nr6+hubrBkJBw)F`i#9_86y>bN+e1y@q7T?PTQSei78YpvS)KkB;%n`%xgEl
zXV?}l3yvDL9~?=ZngSsR3q_Z_rOxI+=FbH(VSzFX7wIztsJ^k5{~6HnM@WYn>xtmM
zqv}F^HGvpQb@<^X{1;W`Y+*7W9Rhq*{%hXqe{fr=B>*8>(<Y@p8`wU;Ag6rg0Px5b
z*bej}mnzWp8~@_yN9K=|-*a`WlnIL)8ar&O6xLr<Mi_0X^*>`appt*4ZUoT&8M86)
zXX?hsv;4p3>d3BAM1dc}X>T!y;av1SePl)fP1rv&jnDv7eaGB*3gCL-fwxwDf1Fw1
zzc~1jw(rjY`+e~K>3hDvRcdtq4X{;yqEFxcV+s{PZxlT(*#-{5RnWG9SbaT6mFcns
z+9*l!1p+)o{axi^Q`{x^4aL5$jfuz@<<YOxC2W~T_GE>GwlT>dw2U99?J%U|BUF7~
zua3~PjJ0sMz->As-39;rH4yP$z&>K#^R%HYL*VMVDWFFPT10OFM%6NFzPF}h=_uHg
zg^COu>D`JFZS`&460BR1&{$)+&KZt%D;u-7XIxZWwQ5GQwi>WJHYXT9+;SeC-VgE@
zCb{kz5hqX_iqKhcmKOFyCyt?H3ctA?DbaF#Jp5`xcU8KwU|oFsd)Bvivs)bV5r?(0
zdi@!7rLPUjlW_VW*QV37wRplf1s*jrGM@ses1^@YyJ7Il$8PtuT-6#-!(@5u8FBi}
zy#NvlU`kp^4Y~nbCR1p-Lf_eX>&zvy$rMwB%H!%Jp^%~DT;XB%FXIQMBE^MjeK$4`
z0V{Q0Fye5l|E0)gGxfAtKfbA+M*|I`Gu-0ZjpAr=y8)-EiE-z|Y#MQ^^}C3Wo@=2$
zwAl|Q4Gr$zr7{Shntn)JJ~R})nt_G1lPmQ$S?Vg_5J|n|L(~mlKN6DY4Ig7xfrQim
ztre#_4%?g&!4EaYqs0N$5zEnIE26HqWdiLLvzRL_GrMg^h59EJ-UCcbrC7YlCZ1^A
z5}D@M(==w4$rRmI4HuAxHZ7=lvIfPb%LS=MpI3Tt#^%J<;NFSGRr2Rqa)iM?Y}kl$
zMB!ShF=bjA-_qHrI`EgQCd!8@UM6m~-ChibDLP~#(tETAr`k3cbk@~}wuYLXrM&g*
zReph$DdN}^yY8Wy^&~^`r>M^iC5@O4KIwa@iX{CJ(X5`Vf-Q%p-8Y4paZ<N>K9_Vm
zs`dPO?u%TwOT!ZfjUP>S&=sqz4R^rWH+PP&HE!v=hXWUZz-GI(a#X+n%t6~?O4n~)
zo??aK$9LP|G40nVS60R<($k1auxC9QL-?<C3FiF`jjjtTNpK!Bf#<qI*!rl4S-K(_
zqQcu+$SJmde>z`yH31WziVq%cL7lOfkPnyT6^7Qd2JI)y+dA=Mb!S_)#3D--(AP}A
z8Y<uV>AKIshsx$b#+iyZ0QbPrE+&8JadvlZ8lc=U?<HZI{Mku3{3NugO231s(jpg`
zSEiHWxNl^1W2BMaJk-J2x;9B`>{8VQ0oOC}_vXPKC%-h+67<$N@(}!5SfkAuiTBnH
zeqKyJ^Jpfs4mUFSN1I^i=aoJstmoRnW31z?(rrJ_*OjoaL27_O5uU~F6!D^Vmno3g
z>@tHg+~F|!7gZ5_8xUgk`U@i9Gr18@NhP@mjB(#)R?wK^SlVE@t$>5jB$ug*Ld%;B
z5s=*Vs3ujTsM50GUYQTx{%@;+Csh1`WyA^&$n82tib$uN{>O<;|B=%4pRZ5<!IW)=
zy8xauNTt+{10W1(RgiLU2$*2~Z%krc7!m>4KBFCwz)aZ)V!{lXB8SUChvLvppMQ49
zo_Yx!3U&d1L_-L<hZToFYv-@5O#&4B{#0Ic{VBxwc!IKSyMpwn0BsCe<?h>4hY=x%
zm4E!0`cXV!bOW%Res4_JQ!n;}Lsrnp)iETH;Iv<lCL_#%lY#&zH68m;j@X~r`G>(*
z|2cfW4>RqjBFRuNaUST6jNF4CCza{_jSP><&G0*vy#P6rig&|akG@QQ>gOky!Ure6
zuniB3`T+JDMwyf~&>@394SY=psRcYXLJ*2X>~HUjhJRl7??bWs%aQF!;TirvfW+}T
zs9*}$%K4>7tAMtvmKnX0uIk#uRA|(3^!17<UPVEg<+3~7N!#Fp(%l1l^nQ7RJzvCP
zFLES_k^nGT?_<c8px@rVI5b|@nfAej8(W>JA<~rlOJIwhSJ#xt4buhPjTlx^?YS6(
z6!qRXUnUhOMdM1L0Z@`aG60y;tWBK*v`wQ$PBOO?bp;2u?i7_RzYLPXsmXMP%hvhZ
z_{>L@esX72z7kyAtW^bd^lsl1#AE>wJ_`WAb7=hjjnzX`RZo+tBIvlLLF`K7=4ljt
znh?oi>i#pS;Ht{&Uc=O#r*-=>h4oF|oXGKIInHKoiyZ^EnaKya^Ku&#)YI@_X6Tss
z`dgd&W?WaE*bglHGM4?tx@Cm^X2-1)4$8F$&;#Uq`8#$;7jXSZ@|omcRFUX6;OX)P
zg<%S(f7`i9vOJMCOcCq_5X<WmF=K9%4`=$3*NOz5$96|IuU(C=Zu4sOON5+5HhLoG
zz5~3Yk}aSep*e>}2I0Bh|GXe&{NN?I2Q|~tnXVi4mNz9=-1yT0V3NV)MYN_w#J2R1
zMP)%0um)Lnu{HKk1k3^^6b>Ls$6kXzn*f7!PZf)CVvb2z2A$i5q5$6v73|eP_o4^X
zT=j)d3SUz7i(W}iY!_puJ8nhlTieec_??-7K8%QZ1fPV=W8l&U91?BMM{|TOnz1d+
z3&roFtPa;|K7jxBw}A-5D0cADXEKlx*;EF|MQ3-bi8_0NL|lNP&rGyPm+II0GQwsQ
zM<WWl{Rv1*Y<JJ{(FtVilX*xT{qbf8ujsPm=q81(amK#Rl(4tC7hYPUE8UWuQWR5?
zH4ZUvbkEYFscReFCq7tsB=))beBQ{3vv+Tyr8(ZunTXKW>)Aa|)e@c@QykK%HL6&z
zu{1pX!EVq(nt0UII;bm?>Z~Q&m9)P1V83F|@BLQnf8+EA9U%axGCD=FMVGeeHYNZd
zcHplN0a4xFn?_HlY+Z>;x!&b!t@}3$omRMgiu+e?eedoD!Xguh7=2<}9)6x6IB+{A
z8p^bePt`BivA>l1<GkMD!8o7L^^WZ}b8fmzJa*YLE;7~COJl=R+*ZRo4au81ix--R
z(y4*bKDn^mdNi!6vT|x{?Irl{Mt29<Y~>4B!DM6-r2*5EZVjMeIgBRtP|m=KqOGWN
z@O7jekm8cDuUQt+$LKv&l-c}QtjB?M%Q;%&?zN*q+b2q^Ozkf&y-*Sco;zRiQ-WPn
zDux@8+Q_lj!2Kn-*jd7V7%C8VxA5`LCtCL#)RkL4$;E9`SEWSU{1H<covpnwX2nrE
zYF@iklk)7kqHd^5P2mhW|4~KK#@?v=nk(+_PI-5~hs=FUENDZr0Gn_$_qeY%F*MRw
z0}987EkrPxo7G?<t|^UhcnkDjH)`jk;xS%exu$;k>!s=8B@CH6@)y-r@!6guHh{O>
z-)E)A`{c_&sn}!ugKMLX@e~^$EAEANKlIMwmxqe3X-xH14mb6TXbWdx-s!DO|2Nvd
z|8A!LUu&ip8|_oni!_c$z&q^4`CrqJkS~38mi{UA>qP}xJYpH9_t?2jZ0w4ttk7va
zYm-FtX+VdB;#~!m;-cy<q;r#kKSz74suQ2bx_h|6v@#+%v&&M35M9b5O)*d3*l1e5
z##hDywPVn%8sL7`kP6tlU!%w%n_dFcfnErpW&HLQV0*I1tR6!8AugvAjDSt{Vc9$z
z@L>3pAJiXzlF{Qr<jzQjx@Y%Q_&r;mt1HL&bk*Lu*Kbdgj~-L%cC1{`+@s4l7y^IT
z5R68LK?wH?aN&^Cl#2)*Q=)UKy)O-+^ACF~`J_Vwc!h-?dwQNb>q7<MU>odf*}BxK
zP<_2l*WIh+t6Y-DG&?x*89l%>oh6!s5_kxwoXREjK_Bf|%KW10fWtgj+S0NXsys10
zt_zSTa7kz@D7GdxP*Ioos0GB}3_Qq`8AM^mYs~?CKfJIQ7B8CkMtnM*bH5GE-8OIN
z5`|719Hw;QN>3LY$&(*946fx63}Ztp;B*dV0*6AuITmKkwtjZ5KGNMzwuwD)!WgH_
z`DP(c-gZ6!FFDf&Jci1C04R3y(I0;Je?6o#2No%-nB6VGf-IEE!#_;s0)dToM;st9
zu$~X4#C1S`9r)i2I|)l+2w;u?KcmwNxnOx8#Agz>cQa-7m7UN7{!`Q5!@YzAgP$*=
z*Ly%e4k+T0={iwShU2-C-^q?>08z3<j+cOKVn<ioxWLVR^h1m7e3FCWzQ-y?r6Iql
z?(532{-V-{jW)}KsK*^}d-2Q}2P2#60p89MGtl!WUIda@`he+k-yFCxlz`58U@eLw
z4;i?*G+oAJ)mE1fjjh-((}i>{+avks^}AhwV$h`7z|q4&$$V^O*vi9h(z}Purh$jI
zaU*g_i_>UsmHh6{_DUiH5^fBs!baN`SmQ3S3&sktY_;eYFQ%!n^Nub65N1fZxPmz+
z17}~QoG1P;8xB^~n_+@zM+})W3qk$NIAYY&-tUWrS8I-Vq}7`TC;`g5U>`sn*$XlQ
ze%i9<7Zo=U`@B*0i|Vc)6u_T7!DQzKzZY%y6SQ?jWt}~3K6sg#Eq!p?89D6PtqsG8
zCUTc!F+xSH+oH?py767R0Z<u$|1mdV7{SkRXM9CTvG^jNhlCjtvPFr9C@|*!<GMx1
z+02)WeO=EizuIiQw-lr=!tmd093%n1l!lXFRdpmzLg8tf08J?=Wf*uNL@YOO5_X63
zT;bx=TN3GB^9{n|9$#%9$6UI%?i76L#FjBxbP`SpI2@+XZy-sNAOhMQb4U#&^@vsj
z1%vzWBf(C`p}no7x(NW?t^!LZ%cASYtx|a2-i!^ifB5*5&e|3v!OF^z+iKh=@2~*n
z{KsHu`k!4<x=u=-xntLaVwLG(0mukqzA~~!T#MQ<00|0<FAF(yVMr_MihN?fx?SUJ
zR~!8Rm=8IfUqjml4=`(Zo!v#$Xs*d#48b)s<d`)?9rDgyHj_!2A7k-gP`!)DaJN{5
zgKm&=|8~G*Nyas};}g4RG8=Hh#F_;Q`GoDZ%)|*Vn3vT=o<PNx&i2&WGK!7J`boqw
z`fWAZz8oiAJBT#G+C+JAyG5zL(BoW%WZ($SlH?CnvEa4Gz|*Cp=1cwex8x@<!MP`N
zb4PCs(vBS4yB(Zg6>LpE%pTuV=s$Ayggd9=ULk3dMLkC)B1$N=boF>Cve_5IrV{pI
zP^90%XRQ1eRU!&4W1xnV1P%QMNcOK@|E;P2zoV&F=3E8#$4|TsUM>IQ*Z+;(^FP>W
z{~K%lpTb)CScsOW&;<QZLk<UitBxz{<w<I`HyauAmB~xg<r!Zvc$;M~t^p_u&H!82
z2=HHjOEvlLPy9YS{~nM3EBA-e-;uDgiOErg?vpe{ZkWmr#e}<tx^FwL3*FNa3t*(u
zyIR4|Q}S<!@4o}}*#RCj3||jZ<Ux<L)Tkt8SL`SJbOl+dYGd;<U+&7h)jzqRloQ=P
z(EtDKkDb=q{NL!x{ZVlIyEFH9%d*Dsss%c%L5^hHw9j<5pm3aXV7mS6^A~<}cV9jj
z7J3vVn@}=nU~z@gZ^iQRZEXYpfJrBE&nyYM7eR0z4~9K`a+TuKC~((L%fg`Z==}Qf
zFDj{{pJNf|Y{$Kn`IL#J;p>)wv4w}`huf$Y!wB`NuYY$6|7TUjKW#$({|&!azPb8e
zI!FDTvy>eI)oP@~jMbgO+>DU&$aqzw^=?PipzFpCYq}&+hL4HRx{;T6@@Z+<_s8z8
zy~2m_w6j)7!qCsf)@4vc-Sehd{rXd58bb<nt^p-6Ewh3(DGm;<xAd$uH%tb1x}h^k
zNW4(`?7cqojpe<~$oK7qTg<hn4ao<)nIFlDeTvfOEIIC%g~iU^2zA|k-cghyTubxd
z+T=<LUH<j_kIasN`&#7#kE8DmjlDn|&uQa+7)D&<l68$Dso_iT;HU<{vOa0{q@fo*
zbFa5F_^U30UQ<rjKls`c;*vcarD!QK`y*z9?)G-YlSkyyg0kGJt|B)KV$yI6Kud#P
z|L>tU+wLD8FJ!9X1q?2ADSR=6<jGJSin5Q-XoR9Ad{Zr5wc;&i9Vdlc4~9B##!;)Q
zh`P|-qFu7T5TEqJOgQ6J@L!vE4G{0roC-cwLUndA+qK~aDLI#<)$lX@`KNr$VF3dq
z-BW4Wuk{y|!xzz{$i}KEc~>u@l~Lk{1#!7E?_n^G-gW*T@P~+<T;~PnoXVKOoeG6v
z7oJ#y?-_NA6gHzY8*0S!*++djkeWSDXWE%4ZB*yS>Ory(o<{unAv{7nnPj6^Ht}i~
zl9)Gkbmpf4DRUp#kDuBZqY@yTIi%l0C@GS14N}*J_~@$5GuvzvlVtY=K7S)Sq@Z7s
zjfp3M(r*%(_na(^dhXL0D52xN9&KxgS6v<7_C14X-oE1$$ozxuFhaD`4Hs&4iGX09
zMzi5GjZtMlqM^#wk`1MdN?>Of&952<YY;Wj`t<X`V2wqWt^C(Fez;5n=T?zQ(jZ2%
zZc{ja%&Nqp*gU)(THy2bosFUtE$vo;tWX~A$=_a}V%M46n4V_L>7LJx^b-@CnlSvc
zyGiOdsbjoth|89|UJJROW5Yl!Y_JlcWc;&H{{q=r#+R$}#Ypy?s1>=yq%|3IjA!`s
zQbcW&*?L%;nI=EW$Ng{3%$*f7v9WwCL$>GJ3zgyW<n0=xSD^#fFBVMCX4^rnF7%Vt
zv!G*sX;VHO=fn?obKNA&A{`*ZloLaykjA`w0@&P;87V2Qt7n;KM9j8QV_$LU)=`i_
z#j@h`(=L2J@qvqzdS+URUNfkmRvTiY-g$fF!1^^!{_3hz(;QaO6t9fo5vzWE(oot^
zZb6@6x!<#KNdI(wzo6-Q@f$6k$UcB}c}JvMt77AiUYyh>MG@eTtd2o|CLckg8NO=-
z*<GilM4BB<{nJBKhs=K!PBaJlJu>s-S=^tDk<vd2B=%H)GDeCt{v?o4%_#mZd9uR%
zRbnR9!S;;tVFB)N5A}y5o!=&KpYgGycGo$8b0YEo^J7$gtj3_39=-{jWBd|^xvpAr
zc4mVZvLrL@1KR9}2_MhPbg>oW?FMo9DpwH(J55bhB(e*B)Mk_hM2}E*q7c#GF>nZ!
z$*E4OkVUQ<-H|KpQh8{j$sajV7tz{-VY6%Y=cpuf*9G==$hJ1azgEAm>IOirDUZ#a
zB?Y5Ih4E)z78P;rmH^(b(G1Pullnrz^-H(zrkqN@@rz3L+)I={ZM_?XlQfKvWmnDB
z9bA9*W;X<1_n!4Agc4F@#8*YY-X(G;56MJwe%OL^(YF&X=DO`)O?pYP97Y|a$z{&g
zvuIXHt#~)QKLza&cR}?IOMmut^fS~ZOZB1M+m`o2LC-5d1o?T)iCFKvY%&+2E!IV-
ztgnbM!lmev6ztGhsK!=5f{lv4j_Nd3rm9T7jwf7?1fF|&!52m}4uS_^06zzMhx;$E
zBPDU4_;TZ!duQsUm50~J2H9$UA1yT8p*K4<L;08dm`e(C^jA~@R2a{xD;Gc9#Mh09
zlam2{z%FfX@w`G-fW(o)Ys!G-iG5c4mbc5hHDtZ}8FjtBCICG%q=yZmi3^_X!Csvx
z+WfMm^p<(dv1ww~2$0c+i<>vVR8Aa5+%oY&i0>TmC9A!-ja(PU>$IKRTG;xQj&Ue=
zGuVAXS6r)1bWWZLQz5w;lr}u-*?4ZuPgvE;sgjU=3Jy+T)ki4yX@1EF^vDzc#;f<#
z0uxS=L0C75brh_!hXD9&(slVXAwRiduS2Z%T&FhumYso`VV`W6qDtl%ZaK<qYD+Ll
zO8v~ko8Jo_M?5(EZ8{##m7y{)9cz!=K{H>wy_aom_lwHX&JY}TtB}+G4(Xmy``&uN
zQCsosHp7GNH!JG5<(v@PO$Lb7CiyYlfe^vESo=4O2TpV%FL7@~JIMSq1%SHggbXO6
zvfq5Pt<`ClZlI1v>t}y+Rqo3PPqbdIzX-{-Wjm}~913Km_Jif2sKzf)=e;&w_0j2p
zrx6I7i}rJOJ8}9BxiHQPfu9eicW)hWlVlYPQ4dl?!z^sA<QQ{_Y~o(YQNCPb8m*dc
z=-1aIBCo%4M(1d~8&@yXr0!5;X`e+Ed0U8d(4R^52|kf}apGl1yQ8j&+rpyTQ1j=E
z2=&|>cm)(mUFnviQTzv$83low$U6&>^H0Fjio==1$-Yl3zG4dj@c!J=cdO0j<SUEz
zD?~m4NM}7q^WiQ!e8(K7qW(q)=6Nw*jxV%ipZ4`mzIVYptZ(UCB_xu3VV>3Cq0@h|
z0}MB1eROX>*1fkfMw`4L7N5^?c+%^m<g->*>aQnn(SF*^2%z5rN1HvyUGNun@aKkx
zU&a=}n09+r_QRdd-ew7)>bak?`(ya6?q~RMZpFn={-Y~0yKNJo<COe6KSam0)Yis8
z0H%9{e*~YeL|vZcj@tZ6x%FARfn~*?(OR+zciw8$8dYjZIh;HWTR$-NRO9*K--J?w
z>z?&!pXJNMf8!?=WLTJq5a4U96Xx=@C$_JyT6%^mLbFH>AnE4Y(P>K?SKhLN3|GJ+
zxh7njO~=eF@_c@i5i0Hj7UnkspZIwSU9)d@XtzT`04hs>=Z<k|^G8HMGid7?B6hu3
zQU_)xDIcpWf)AZFdPZu@x3@qXHOqhbxayvJy*6~^@zc<GwOZPWs+JUm!-WPh(%3A1
zGth2Orq+IAA;u*0eC@fjdko{KrW`_hD=&2$Q`y}?aof~7i7AVMUG>I%6x(9hhy#1F
ziMUVxc+exV`I$GA$a`ihEGQZ7$Qx@);)pk9St*!6xYE;j@lAffY@)&Zl%L2PgsnpB
z+m<hP(dj#?$>%PC!X1YccQdm&wzz^Y?<t_U=T%XP27Z57YDy$OVJ2Eyy*ELA<F^1E
ztrYZRKyR<a&7^t1Wbs?|yM4nkbfiHC^}}e8)xtM<aw0ne;nLjv;^K~i2`ura$>)O)
zhh=;w$GVmo5o!WSVSu#iH0K}7c#eg6yC=1pCzlR)l+^7IBfe?u(#Nw`jYtd`6O*#-
zp;`5P5?Vi3uSG~8CxJ`+2v&DzwugQjzsaIppjv-v;2Gdd_U(XwyLcv|`1!LX75Chn
z5TRGZ6dm)WLVw|9^vB8j_cUJC{wPbUKZR=2%k+1jd>z;7%9Z{eUO1uy&2Q#yt!sw1
zUzs=Y6HWL+lm*av?(E9p?zT+4JnW0b*0#fY3hhS6l8^sevm;vRY@#E;?RmfA9$HMA
zx+ACcq;Flq9s2z%qNp>!&5uw0^5Y{HzXJYN)P>6f_!4Xb2xmS4f$|g*zP@yzI@&_1
z#IS;9lm=aOu}}M*tgF80#;M;tHJ2~}{Oh<HuPYw8u-Gs5vy?Oob?~mFC}H8`+gm&u
z;@_E_7b!Kl)WqVkGw~~I@uNv56SkIT=bx_7ty-*4W*P7GFzvkTW_-;U^C>a(t85qQ
zb&3;XSH=|7%(gsqv9i1Yfmiw{seoiO$h?Y+MNPXIgSZt%?TRNHs%i$aIE;!)$W4aw
zo+pUqak!LPPohe*hg=)9$Wz<o+t1DNJc@d$+vaJ9+qx0sCJvQa^ii<u1uVM)HYitp
zpgUIEtJEt<X~QahbFEziD5pEjQwN+WJ+0ihaGxDqP@bY3ddp%}s?Fev)yz4s=lko2
zL;E3h3NXAbI|Gv-eKXa{1JjW$(^wZhfx+(?Cj4hk=3j}TF$ho!Ow%f9V)yO$e5%I!
zP=+3lv`;e>Q{u9?w;nF}JcgBX{>ymm9D60%eFmnZ;-@s;blYXcJ0u(MUvQddV>1?8
z^EuIO_8CJhQ3uO62Uy1g{59uX`B2ZZfu_8^3AsCcF=|jl*EHDSRxVwUhJPn<BDbkR
z9^azpDQdp4@xdk*HeS##qM)N$C~h6tDHC$>@s%qQY^-in9<1Fuk1G2Lr)G`6h73*J
zNQyV6%OuLA)>dcVJh~}dRdR<H8aU8!-EwuK*H^fIZXo6bd_y^~`%WWR1{Kh1R7FUy
zEvQPJ)ni!^n_K*jErHVe(b2@ts?{c}do{2jzwanyQeJuf6Di=xY8K96$QV32w($8S
zT(Zlh<3;Ekd{Y9+58);Qcd(%?>R|8nAF)&Xs^gQOdw<O(`|B{uw~YT!Q-j;N{POP5
z{K+jthTEODTBP{p{)N$OG3nS(HW-Cj^EcybO)?`)`JWZ#-&C8(Z;m^sctMHyeR(k9
zn#=M4szphvj@a6g0&lL4u8+78vuVupDyC%o7nN5n$5O)rdWnlBH^lAh+KzpYzQ$&f
z>*TxL=XW{^<c9i2$Ft<Z;?yn#t11WU-=?C~_G5~;Ubf%^EcrkI@tZF}_MgyIN6{=0
z{{i7~u{-MIJ{XeABaGi0oZFTt@3KiP??opFAKrd4G|y`BK*T)r9nd=lghj@D=ZRKm
z$JbfLPn~D^zI~lM#6C!zeUEdR5-*RC^0F_V$Hlfstk~!N_;DQN4cUBt3e1eJIZ<bd
z%v+83<Zwla62f0#-pP9F(K$R?UbjDV537vxxY$B}nz`2~n$_~{C$`?7BxWUl?s2m+
zc0VbvwbVPtU5Np-gjNsPxr8Z446Wi*zdVOZ*Ohc0;9NI820S;{dKtK)@cMAr9gmEd
z;v)uKF4r~c%i3g&xsu5INxd;=a97=JA$~3?nwN=<dr~!S)9cw|aErx>gCU_ZqE7P|
z!`gr>RQkp;qvWFYR3nQ(N~*<Rhq$@?is&jyrb`3$Fhvx>&*>oWA|LY*8vB*>st6J6
zL6X#zdr_s+ZG0ojyO3d9o=jJy4?6p7aARn-y(*dOxHGM@3M5{xaU5nm4|<gFV6tP;
zg=C=giCA@HrT!Z4ocyx*`&q0TuDT59wp(&10Sjlu&(tO>0V1+{cJsV0oZ7v#KQ!(l
zU-adJlp0`WuznnDcwYVF=Wih82N}n~YZDFf$VQ&MXhLT57&pAUzsM#vFXiQ;re5Cj
zZfC)$^Pf$oU)^2f*9Rx+sBt(|(6y^ZA<rSG)rj{6WxM72opz97qUgTRD_=ei?dk=}
z)47XArdc<|G;+=>Y`FdSaMGMKOEDZ9@B}Q?&9#_j#7eZYc`w>rS3GC0SIv@>UedQO
zHC+=pJENW_UKlQ1|E0V-LiH9iXp`g8J}0Qi$vAE)Wb+%C-L3xo1)s1_QYuapCD3dB
zFPM*A-NCP9SKrPRibyX!ILZM^C9N-`&rD}*-m7E=7G~L8zoU#+{6g3ar<`>x!!(D@
z4#|jyO39%_*AZG2JotzEhQe@0pRNMu&y+OOW7j<-A5Zb5byK=f#aq95^Oqu&Q+$ri
zWM}n<Fkk7JypR`kr3|PaLv4CRy!JI~5&*eUe%f{YNOieVGWOgu-xaJe*dKbOQz=`k
z)!mAnI2Ai<uh>JsB3Jd%{V_7lKi><KXb6_VSJRd(K^e?Q4jItoD?X7I@ikUPGb8VW
z9<6X*x9<zi*T_eP?(Xxhvo)HVAX1x~xz5(|WzsF5EjYbL-FyEX{0EoY)GcB#rV9vK
z_?hqmhl@27$tBpFGI)BV<BVE7;2l}*(I)sw;vbPMh<uqd%zSz;_sk>TU+8CbVh=aT
z|L|em;w;tbQ2m9mqZaQKHX^sfp=E89jNJYH&e`715qhQ9O1s&o&cNt3oFV~ZUqi!-
z^t5-c<#v@w1r|Bme)?`ozTQBnQ&8d~r5a)N-2z>zuK%LKiAjO!O=Wt*9>}31%3G;P
z!C@0f?KR=d_n{@RI_T7!BXy#)ULg137=cGP+lccAFLm(DA<1L%F`Mq2ERJ3ImX^))
z&gZ=Bs&3L!2UDM{<q}@7er)Zwi|qzxorjKpse`Fsx3cP=)(i7JlS%rFZ23j?pyKPx
z{(Gr5kW5C<Pzg|KzxEijizq+VX3~3{B7U<ZWN5)!>hh)7#Mn!&<bsk6l(f3@TY-(C
zPk&hng@KCsAAM=@n_Al>8V-igfBDWo@v!eMXAS7}4u;7>Pcn2(+-a`5J*Dr`!x2jQ
zV740T8G&+T0NlR*+q6h6-@;xK-~+|ccbvqHO0&hh@GS^>8WJ5g?;4<THi+I2)57b3
zh4lpInrb|(B3>+8^PVLX>^!PIdwWt^Zqbma^yLQ2vbUIB&FR{AerLvBZ^=FYg?e0=
zD#C@OFPhaoijyU$+pADIUqq7Vr!pc#%k=#2Qstin6a*)F0f0A>`z26p8bfwBB`E=e
zMDXtr#<N+9VlifQ3UYj+U<Q!<{zsfi`H3CS?{4*?-<5us!rbNkKMaAywUoR=yZ)k5
z!u~~-U#@s3tN9bc^Fi4c{V(HV_adl(R1q)o0XpihWiaFH0KZ}$06eUS$R&om=AT#o
z(FOaP|6`oZwuSQ1^wr%xswfg^n#a@;iZ=mcgmQhMx8?Q=w2iS0p&fneJ+~U4iyl0$
zbVD*ZO!4W~umxuWi&M@GnyW;f!If*1rG_`#9|r;{117(N=FM=<uPhg_-3(s<rIdtg
z)NXr)(r+u`Z@0mJ7!v%y@p_^PM4WdAhGh#FP9_Ko`L9$?l@j3D&Q(hN|JqaFx*@53
z>c~g=(BQP55M$|D?Gts%nzz+2Twp(6k8%ag+wS@wpMdMD)>rKR!n(f8PF3*}YythZ
zz5D-E0vGaJ-xL3f=>jvbM@{tYG{BC}fUC_t{--jw{`wx^LZ)zFQG~QZ;ce&7&A@d{
z>nrQOumQa+weS=4&LChW6GzQtbuue&%U=jzUlEdIdVVPbmdk<8UU8SXHo0io=C7=G
zwlE&~vB+k1t@cSf#pwJ<i#ORfYuwqK3vcZ?d|XWW>W{Y$@@6&e8+4zqJRzif?8fW1
zpyhHuOs^gNU7ckodtq(D)i1qjzuw(bl$pHQmw%Q!W0!)~a)tsvEq?ioG`BkK6E(39
zn}BCG>%Vl6o4B(6p#S=unAQ)+I_kEE+yC)R^#(5g0yh3_DuNw>y~W+@|0(U!kNGe$
zJ!ft4bvquNx`zw+fot&}zKLr8%QcJtAM4%vk0SMlZ*1lNC2Au7hkMt5hDX}Z>VG)-
zfA^LD&@%tsEQVjn|KyIYsK2ms0dN~Z>~-J?WbS`#yMdjdg>WnO0f&-WRQ@xR09WgA
zc>a62fPb0&s1>6DHJYME^TlWZGFsA())zynVtou;X}>OuukypPR^Vog^7uclS(*Dk
z1i!xhoN<rgBA#EdF~Ih|>8CAnJX(jfvKL(VqY`?Z+d)3q8`OkRy0C7+C6ivYWA7d*
z%M`EnHSCzj%~BxR$N6ARam@6?-9r1EdL~M#WY60X%8-7aX-7TBkA&6gr+)#PSM1J)
zn`-t=VSM$Ufj@WKnwm1v*LC9kT>HH~uV=oI6Y_X#RegKHf%v5irBMZsyDr7=j{H^i
zHtItBZU?SPQLm5Y%;8y_mrWSYWS8x}^6}OVd(oG6S=-p7zWn|jd*I`&XQgZ9&$25u
z*zh0yCt<X?X5ZFl_mn?`&xn5V{AIl7>wO|ZlRsToU-d)8!!Ou`@w49A4?m{at7S{&
zx4YZFI{!4@^WGmzp5vS$DnBwff6rgaQ1cPE4*bP`hV#bmf3z3>XRtY2%MBE{P=DSY
zbW43$^FQFG!pB<}KVOGR%YRtc|L3#m7yUolz_ytU<l6Np{-3~Y4t>BTc|2GexbbC|
z{pT~+FYN!Ymi-TKf(3LLd~1gN^ZEa*9pr5xvcP5*#O8P>;F$Cl`Om-|2f$nEMS(4}
zdG$ZuGSqy9DHwIyXsC^*wb2|pT6hexBKKmAl|ujB`KPv-%x^zp@YC=|_%`*!juSuC
zO|3fp@I;uT7sKa%z6$Nr+MkNQtoQuT-p1pzGwR-@JzUDlPu6XA`mmy-e_Dgik6_PF
zQ;W3sT+}Voc)T?&W0(CjHrA4BV!It4HRwk!yP);rWq`wsl`j~Uo!BYz%IX5Eb%#0g
ztaE!WADMYJ*QRnsN^>bgQTQ#1qPnP4yFOe<{+_*S(h>8lCSL>dgbe2M=^rMjzpI<d
zTwx*q;IH;YY4`Ydm-)IlpKvjJzW>9S{ky%F{X-u4JAbt=?B6JUssD}Zmj(Q`z%G$N
zeesvY{{#;HJ%4F0_iw>kjeketfgT#wGa3e?>0mT3z{-P%4?fs8EpI>MAiwihc!@~>
zKSS_!U=eeHT{-*Vg5~e7t)12;(6ct*eHr5ou6fo1dsi^coi|T;t%SlYRyzx`D<|cw
zE-)S2A@WLN0Tbw4{U+mUT^fwb45}_kxY~6w^c>Lm#J*sq#sZE%jW0%-!zvsExF&Tm
Wq)*bU+32^Zfx+++^jZb}|2F}Cky`}-

diff --git a/components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.png b/components/engine/docs/sources/reference/api/_static/io_oauth_authorization_page.png
new file mode 100644
index 0000000000000000000000000000000000000000..798044ed0405c50596ffdfe5b03bf69961997148
GIT binary patch
literal 178773
zcmd4&byS<d(>ILMQlNNoE!rZ*3Y6ebycD<M?t~zrIDt}HTuN~-g(Af*5S#)*g1Z)X
zcSs1leDCM}-Oqi_ukZhF&dE7fc6VlHW<R^v?93!WQ(cJ=j}{LD1A|ccoxC;%2IdzG
zjK=~`u^(Czem~j5z@UtDl#|m`mXl-B1iRWfI@@Ak7~qx}c<Yi6Rv*niMesWI`QoY!
ziEh0R#b>GH7TvOWtEDAF^6kZs$Jp}Z-(Gxv|N6(fp-2v`w_5y6PhYuqaV@nRHKUgH
zJnS~7g(iiBO!XE`u`qf}-^<HC{Y>&{q%xJmUk5XIvE1eHj6TNW+D{~v7;1PzVzNt9
zQ>3@kmmu=Z(D`rYu7>wX2ls&;>uYpsSQyn`&HYjGI&zjK#O9!h@FHrAZ^u|)R;^hA
z*B(>X$amoVxrV#$-{aJy;eUgUj{$LcEzAQoPcaCyWg|{;J{@wYQibOsJHf}?7#69W
z0gpQ|EGR>&h=e|^Vqz#^46str(%#W+wHpkeme#ND=?XNPy=}BP?!>Q$+uB)Ii0QBt
zmA+__){Ecg)Q@~K@M(q8;kK?}{v6m}DSRzq-`%l7DK0WFKex#z`Rp#QO@wJ`V27_j
zk?xPjjeRL`cke1+ETPxfeH5qGYb2G1MKo;9oSwp^ja8bv3t1oJy!UJw*ct-Ki+O%G
zhJLIzaKD<5p_I}l!aFjH<clTpni*y0Y<CM|pa8bz)tD#t4M~S8cCy}In7-P`aqWI0
zl8*j`x~8SM?{2kJ7e~r>QSbLgJe|Ef0-+&ts@~h9?nL6&)<5aJw`CGd+t8jF(kyT<
zd-YE*Ut=r2#i0KD_8E4749AalN!A7`LYB8r7gVB8)WU;%9(NvxcNM+8|3v)=BH|Q)
zHPBfkp#2yReEJ^aHnw9)0wbVmDV8U^?1<6mg@l>hbBwN=AO~_~jPzg2uNzK?)eNvM
zQ7jlncEwd%?m_Fhfzl%wIMmBCn@<AXJ`I25_ya@t6Wd5g-4d4bCssEshEI5pEzo&y
zC1!|;LUg|o3CQqrJfZ4%=|;Hlq;46|fIrt^eN1p3Lh|}iLA!(x&WCp4N?e&|lq_%M
z!^u{|<e8M;J<<;O$YkA1S{-J>%-73^7h;u*9wFg)-XDsWt6lWC5o<AcF1K(5<D5P{
zH2KHy2=?QMc2<LD%})hnDRV<dlnj{YN&HFf!r#f0u5z$oYJK96TX_41WsYR{8EZIa
zmw4AJQl_16&hJRIX^TVO$j>n?ehcj7SeLP(6(BYYEtLhZipR_Ka;^)UisOZ_{CuK0
z#-Wx-(~qm5pzxFEr+O})*0g3!QCJc4#2Y893w*V=XFpz!(mHsYyVOdHF=Ry!$(bt%
z|6t5j8adl`r6vd^WR2A7PPH`Qmq~@B>ZG2fI;qmxVF*SUc3V|t8Yq_nrm$5y;1)Vn
zTb06<WivAS5?)!Mv7tGN!SFBe7`AA(uWWIfVuO%$nRKjlH6ukM5+gz*IwQt8`8mPb
z6vqrll*5*zu)C^=RwiJGgzAfUG*`Rc3d4%oYU{}8DDGJC`0Oaw*z=!UKT2}_WrfwQ
zo)1T-w9~CFo>W~E1c<g0-qYWIearL>*YAn2ECF+fri{;99|eO#_A$gr#yDz(eVl4k
zc#L=~$l{0XGs_YCV~clIz1Bt6+tvnl`L-_vX$7>Yi3KS6|60;po7l1l^a;+s{wk1V
z)i`vX=on9fP_+ZtU0O=@2SnUFI^!l$CTF1~E$(9NLUbv0`BD-@aYTu#JW~-vs3n^v
zQ+%-d@bZKG)RQTeDgRO(=XU^s3{m5!^E6N+s1}sa%ghVnWqz5kueTqv52Rn9_oHv6
zcch=BXQijhe4Gi-?8r3CtQTd6X_}Clc$u7-P&F{P^LW&_0l_-3@dhBw{Fuq-h0nh4
z<%!Aa&ZgnU#+uMZ%(7$;>XUa`T#QB>UpQabk<=2Ybi8?(^f&3Swxs(qjFL~SZ^PdP
zx61`nkP`PrldHUXdGQ^9rGS<7MCVBf7W-E>Str>*Sy9>NvRr>||9tp^`pWgyJbWaw
zDB?-@deq0r(s+eF-u1Qh`E>;?A}x>67o+b-Q>>own^wK65~#9tk8Vi!sl4_*3B>*K
zrCR=ze7t<l3t4Ri0nO9q^-ttR?@eE+{#JETrR6K*d(LjkDaq5xX3d$v;$gfQQd(J>
z;hgMTxX&kQ3ws7bfXPk=PMg+s)-yJwx!!STQbdx6Qs73iMfOFiMdl>FND4^e<%r=T
zODao@<MQUX*VWRC&@R?C)Ta1wq0RH*xsJ6~jh^_gOZn$zE<dtM1NG5Op^=Kwie+#m
zHOE1V!M*e-qn}2tMk#f6by#(rbHC<v#2$;8iM<rlX?$TC>5_IBo&7C4?yp`87Q`LR
zgr-9>608&aB%mdjA`l`VriRim$Ee1PMf=61#bia}$C#%*O~202O)pJ-m2oHt5|qm@
zOtnpmNjpo|8RQz!_bNUVtK7@Q`unHj=ZF<t`;S0>^(>xc9b&h1QUyq|_j+$0&<<bN
zEFH`*D+1+%qMpNtrpkK{V_KTgfhcvHpCN^vo?))B*s=EX?3rDeR#{@1G?|N8T$$4*
z(I(ZV1zw0lsY+BDR|@b4FoAAraQ5K${4T?qB+P$vF=<g}QRyo3P;CY^5rSatTFYh+
zVehUP!avwp^<3P;=?>LaG`s*@@m`wc(rTX-9|fETfCG{P>L4``s@qz0HJTD#haN`q
zVQpitV{zlqVpC!V;tAk4QrA*ClbJ9yQ>>C|KYvfQOX0^JEy^vjZz*E#BYXY!i;cWf
zmu|kIjm!G`M1_e-2M#~ik2(bS0W&+X6j73t;?E1o^vUZPj_A!(+7q88k7RMg`v|x*
z_r2KZmzt2;ZH-0eqr<K=7)PWv{ho<!Ln>JfIc^+IZ<)vCris>wa2OAj<5l|9Z~VG8
z-koXv%?pbiVi1)4koG=@Hc8CO<m|eetcWa_-B06HwuJYoe!7N{exr$>88S|1LdUdl
zLxU>wZ~rl3TQU#4Da*zt$nEh)MR?B$pyQ=|xo=of6C?Uq)KS#jL((H>lXJs#pl73J
zQ-i{Q@=X?*REqDRlI7c#ckwb>p8OgoeXDh6Qd>BD+ona0z5e{@RYhfsKA&PoM{61w
z_Yvu)_QEgWlq^1PGp#0V_oO{1<Ydl<<%Z7meuZSIW?50gkOx}z<xc@9cqbGUbC;ng
zobfxq<bBEP?{VN;HRr*3W3zfiAdi#y?!@lzU4`8!x^P0r7)@)dwf=)o^EztfYM9<$
zi#rZe&Mpq|j+|{Ojm972F8-#W8c<3{u61m6<xquMo_bXMu$PaQs>BT1;yQP+^RE(R
zT($(j_x6WQTg^qpWkQpNQ1;&)?Y%~{>V~0pJ=j|=4y++p@!r)s$H`o$%`fQe(^NZJ
zX0hXvIWM=TbF*_;u~Z3LF-x(hXQ8J64uMnUgh||=vmADBcIBpQr#L1=C-_$Qm?gDP
z2AN9!67Y1Lb7=I3TiRJAi=kY2{SJF>M}@x#`{Li?Q$*oKd8eo*BbN?+#qW7n7dOGX
z{smXvj9pR_K@+H%mTG_7JDrKbvf;v3w?NMO-{*DKlU^5-^&_qsK*znzz3J8x$kBq^
ztieq5eK1<<Sm)OMj4#TZuU@tu%EF<Qcu<2u+RA!+i*ap2gwa8PVI_?rf|Ryj2N7LA
zCG3!R?G<YC!#n)!9dV)vZPeWt!#}a3%>`NTvX#*%0xei_1lG9Y)bX(jVL}mQ>5yQZ
z&ryG}hR1utHuWiwU)nyM!Xv~BVq%rw>89@5Sx!1?TK6w@++j|`sU`%cYzR^iabR<b
za_tqrD<ahkDjF>D22KDefzL;Y#;T?#M-#@jge?SZ-ux6&q`7}%C}_%W{3d5k$Ym6G
z)4N;lnKh_3zvo49IsM#4?1T6sxZI<7-t@@m=tF(s6ng5fQ=HSVQ3c!kCU4;j*f8Bv
zMWFGckHO9|pF6%Y_vbcRZmy`4w8o!k73NjIYvHjykoP~-$lqx%+PCERF|Ak_f$ws^
zcmCp}iX*3&^xziqTsr9`3uIp$D;>Yk;LM>!EQ@w#DyJx9sCg&zhq0z4vZqz({(uZM
zjQs8`_8Iow{kj~*|1#{oAmTlrkjY`=DROrj_=ZAa+LnvZMP%{3;(d{nR)Tj)DYUx0
zycL#PcQSfVs3z%+ovvgAKT==thXj>hn9e)loIcu<t5PzG1Bn-FtmYJWQb?B^x*XAL
zXYKkgwTV^oUt2qP_&{tt&&Ox{XXfq9o71U-L`7!LcKh~}bm9t|?6B?Gw~{yYseUNj
zlJ*$qdJ7<Sj|inxgK7=<k@?4I=(8=pEc4+q?4WU@JahjRGc<Z6bdk;RY&`BV$FQv#
zx(<cjb>0a$JUXYExpQ^2bC4cgIc9lcjl>8QjDD_a9zMpMUAi?BD*80@gGo=ryie<i
z@~J;wCd(v#EFOfylIbk`d-uCldeV=id*21MTgC<jQfxH(y8HY&Q@Q#%tGLj***ZJg
zWgie)8e_*JZ$?;v;|^`(G$Wv~ru-b+Z&uW<<W~EjRc9y50&CtjmEO;jq(GR<#T4?_
z;HLw!CL$Dyh$mJ}op4BqH>s(jF}acAu+Lq(<*Gp`(!N?>;AOXXjNeq@O#MOyyp8h*
z&#|(m`SH76#0ac%<M`s8D!G5HZnVt)VMFCLEACB%@OPst!owW#%JgWFFXE~>pQS&G
zp6+c=TdNc&^x&vVh|MN`NDExi-P}oxz81_)yED9-m9ftQe+S2{|Juso;SkgRV4$U|
zv*31j_%$|a_`RaaR{sY+>vA`fB#!AuJJS_k$)BeqF#{Pd^(H5;oElwXCR)plOU)e(
zTo;`FEHJ;RsdZbVXi#e9oBTafu-IDCc_Gu=xvpf-nBonP-tiTiynxY7c221r>KqDF
zSJHo^2Ge-axiel+pV43W9bSAEknvSc%WwYKT%eAnsx+{lqn5#ySrIT^J<=iqJHI=K
zv%U2%Cti;e;Hu7%w<MlH3ZUyCb?fsTLRX$KNAyc=AOg_Ttq59hJEbpq<i7eoDDK{j
zB~~Fyh&J{<&h1tQ7UdIq^Yqr}aYueY2TE4(Pg}3*&lmi-?(Vo+%HPRT-sBOKaeqUz
z)H6w!AIn#1?feFp_mfP%t83Y%r2U;PYjke3H&-KuZUp&xBBu%76GTOWV+2)WGZ+L^
zUdPRBxUN|4IM}+BS?5`C0oh$Nyq<ZHe`FCoYdYTF{AlZ8{WrwB=kV+0-TCz)Y_m>%
zHlHQHA%Ny~=GOP|yWn-E2#eWgUo|&gU$`wk9e>xvF}xj~DpzIb{_CWkbdD7Do$ab+
zzAf-se6;u%Y1NF!9ZlN{qbt_Wizj=AbKZ&5WGE`vi~aI4;s{}0+e*7i6Ex(j=^2jQ
zh~APKrW<DDqZSu75;1wBE8*69Bs<*w_j~ZzXtlCWp)sslE4ERw$f9LPU%8dpL#OzC
zo>4vgI9aRAJxi-aCd4f75){KWDIPgk&GX&6@9N3XSsl3Ez5dMesr0wNB4qD!m0lr&
z?5L30)P4ASlg7Et1?9QvHs5m&I&PX*3`2~4v}%mvVu8!Pw^7FtpHj>c$}8y2=GAA_
zng)D^6^DKeY_-CmBh@oCZ!Rv+1a>76I4f~@Tyr_mQW*jKH%<+|QEDD)wx)MY>)5_J
z%Q#yat9*YbH|x>&6Ym3$aH&NKn+cA{)O#LP4m@7|%!Xk@ZxZ?gr#%_tQ=Zsc>dZ$^
z6%;;wYpSgYdW%tKs<Ddkf(ci5<#vY1=d;^4f~`c`ACDxk5|;75guMHPz5ev8oTH}b
zId!^{#WSm?Dk9TdpU#?WU$Bo6q<tw><o)?&MfE_yiG&Ap%j!8bb~IH1kxIzLALxkN
z$cvHYACtd$!p`zT8m>NOf5h}*y#;-KvhrAx3+;$a8)_Zx0AEw}DX1A}9-xrdvtp0J
zM?40y&^<TCZF=P|t@M;Vw&pt`eUHnVKaO*l>MyAjS1aKi_z^p4`UD5{3wcsM=1eXt
z4Yuz}^7!4&T?*YxDig|V?|0r?=c8;QZ7|m-)_2y;x!%08d-avW_%}z<X)(#<ju5rb
zY~8!LYO%&fB0m|V65)Ho`4~I3$^ue5%FW=WSi?jEs6mWz#VmNvaULa>>F(_Ahl8q)
z0Y)05vu|3Q8Q8K<%#sp0UlqoMxF#>X#o%}I)>J+Q7ugvoUd!gY>-rKf1EgGdJNT<S
zaxU-SA$Wa4VH-M5ajzJfJWY^YlW$tjKaY1sm#P+&X4aU9+WL;&@NAXh*+(VtJvH6u
zlk`%)$2;8}2hL7Qy7uZZmzXd7u0S}2H-o&D%D)~S4xmG!6S0fLzZh7>*s}prh=Yhd
z54zXX-|0x`bbJoqXuXDsQV5?}-(9ny=IM^qq=q0;t*@Fc!K`bAqnF5&>AU^;Oa0&j
zSA2bH*^Wow9=(72+(a%FgUhY^6S4MJ=UfX8ipD4Uj|-kXlYMIW`Kh7}tI;#pZ}Rz%
z1Sox<i-xh}aujhD+18SZ(JY3nbbqmCu=1^RpJ5hB8Ops;-&2_Xs?%-yYb{?qMrk$S
zIOl2b7e}Pzxi!HMfpxS$wSDU6w5ilMlG$(yZZU4T(%@2K=bQc0eaXs;9Z?|6%Y(I{
z#Am@5x4A4p>z3tq?Xlwv(3pJ(P?p@%Yy~%-r8=yra$CF#`$Ud3`TPF&8g0F?2m!Wg
z?&>qJ+9?fQYoy<MiT4@(39pEk(WSaAntAVPR7>8Y7@D(NM&|{V0TZvm!cxxKmSPr{
z5UQN7<-ZCiAMKq1u0Zztj?W()giLkuCGVTnSBIM|g}sno%&p?1q_?mQ^pMiP^isv2
zd&m#%k&fkZ&7sQWW9Yk~qK54%gR%w$E<ps&cd7kCdTI@*_(X!0Z~j&)Xm=SGm4LZ3
zRoEynF!a$b&HidrWTUm8n0JOlLQhp}2|QZ2u5Y+u8&|Tw(MbVIauHV6LkM|0jqgg*
zCZ#|1rZh4-+NecBxg;@&{TZmFaSz7!?2Zg~_85xj`>7-7&Vml5<KGzGAs3_XOlBXu
za9%Fn;?yT~@BvEDdqZ>;L4VlQeP*wL_xB9<70@+vH}Shp=-NFA{k_8%4wI9Jx9hA%
zB(5vzvHSuIh7p-ECqEaKX$Mu_;FiNDegs)~Sw_BQtb)&+xhZr<6a*({c}X8|58+L#
zvMcI;Dh!siNLyB>E~w8B8n9>|8FFa9PVM{d_$BSnZM@I7ui3x8=mlT!XNb@1UkcJ|
z(=TRPn#h+^x|lQAWdr^`m3q_~c-Q$D@3HGUh0jE?=d#0J#uZ9?RoAzE+FIqV?vgr0
zJnB2s4j%h0V34*|tq1N|mn45f{s8PmGfwZ{Z;C$rHr1&Za~R#9N}u{WVmq!gwFGh-
zsa$aAed74rK~ZRUVbYo3S^>!8x@PCUa0o?zXU$27@_?$eaph%nW=mYT6Y~yBnsq1Y
z>oVssE%^m;v;!)+9eBFfY6a-2NN7b#LC<vP*lEqb_a^Ap=4`z+tnSJUCGTYI?0Kvm
zl-aAw`fECKYRD&jC-Y*{S(aDo2pl{Fi}(rIy5W`J#^qaUd*k=AexXcu9l0CBu15tV
z1)A>a(ZMpFc_$mg59{ia>kFlh170lQO70xJ+KJs2I@n^omU<&LCi3C>_E>%<{|Y$l
zct6{9Q-klRvW8d=S&y9G(lHlr1qJFaMx%VU>d|><a*Dts28=&+?HfJ%#>VEo7#1~;
zuG8x3>I|WE7iXlI&dpDL@T_Z~(ZYhEB%hoG=vV^}4L#>w{{+?EKf-!qqBAaCr1}t?
z#&vsV=z)QOPxhbhBaHM+Y7C4=*^asf9}U!0#jIUHyp}euR<^u8Ah(Cn7#I>hVh@iX
z+mDt^J|Jfo4>2D}mj4<d_VE0lW<D0C{~GcUD9K`=rpYAd3bthu;(f#WnnenaiHS)9
zY-1;;EwA|B<PX0jSsXrobQ9y_^Y-@U^%mrH1>5uSi;9Z!y%yjT5a4+j!Q<iU^3l?V
z$Hjy7|1kOg@sWS<B*2btA01s?nEu1p(#qBIqa+K<e<u2$&;OCr*2nSx&gA0p-)cQ5
z$oHQfK7QWUeE-AyfmGr@tzw#vKDN#V@{S-|7mtTIr1<$?zn1tfg8#p+|2yUXA~pQK
zqyQ1&|4sS7dj6YIg6}^X{4b6EkGcM<^}$|JcoKa7V|yt)87ONG2F6<qWqBE0pGW&G
zxQV9Ip4q;dSmc{&7*C%uagt_oI%RXuCUW<Htq{-ad0+`2=?lrcv9F$09E!O6i-xrL
zi301y<=8>uRf2xq>OJm>^6y#tMlEK)3w@t@8%b)9$0QP*8d0n{i4xy}933|L=yAAJ
zzT99~Zt)oUdw+K&h063_5<mKT^*b?_fQDM&wT(q@`?p|bOgZdOg8z><EYtC0a<!6#
zFjz7COYY^Di1wf)|1Yk|GC?)bYcGu#F;D)f8J{2aruj$slKmgo{Fn)0?b5d4agheP
zfAZYp#$0-q(Ot2nHl;!`uhMbj2|WyT`=_aVf@yp>0Umr<Tln;LoaU}{`BbFC_*IaO
z2>Pf0B)G14g~?|VawY3*KJnsS#`S0NUJ$GyGgD>uHEzluo7P;(e=d%&J$7=9u#Z$m
z!^Rvp)zwe?dtxiOT9X_^2M<n-!I)Y2fmLQmz&}^jb%3Dxo7ybcIVFVI1JT{WVR(mL
zAm{0s{`ER#EF*DawTt-TpC*&T=1mITaGB!$+LV|rk{kllZBCiE4|L8<UbE&L&=$k?
z;cQVh;8nlXB>oquj?G=Mlbe{E$Xz(m+G2uj^wBeja`Roav0v9z<9uxPpAe(LJM1p}
zP0FXO2e#~9um1_m<vm`^l(WBWZS1}N(XG71=QrEQ)xjuj<o<p2TmmWB@QKQ&lvOiT
zVdcLmv+SI;2O4;`oQp4-tG9rK=>HeNE>eQGnyQTYiL(636c>6fQ3<bmIT9+>YHHO7
zY^V7q;r9H0H~QIE5)H3#no{W(etl#M<TP1Y8e#k=T<8QbZ_sTA%B;RpVxUq%SM#Z(
zs1_5LSBhyHIo*$L5%xY*^)IB#&S`r}6aoN6LHon}{=HJ!1l-V-^f!N`pi9#Qe8cDk
z?4aVi7Xwy-iP9Cw?!OpntH!aVaaFDd%e?h*rqDi+C{+m`P7`$x)4wI#W5q<P&1h@c
zI=cYJQ+VpzOfmzDP=Khu>cQ%HzRd!A(rK^_jrDwbu&R^2A>;T_$jgWch<K$+5~7>0
zTWI^=2oC9M&sUq&j{oFM91rrKLv<q!rHUn$?IaAnVFD))Yg|e={35&6Sri?eHevQY
z+4BX{m1DvTH>O<L3t;++@4t1we9--o2l2`^N(6<bz10@Du;T4*OEqJ-7%mCq2goIe
zARnx_ixk3?Em*kA7egQq0;SJ#^HjeJ4IWGUd(!~1kr@K;G+S6pqPj`jlp+kR?3p}T
zVAG_G?zZVo(KFjtbodT2hw3t#PR(b(7#72}530JfLPoQ9K+HvV(lDF;eO?~Nqy%^W
zU1RmuXfF~dU(&aSa7s2vO|{n1qou$qQ_Oo;R0)o4HfULZM1u2w7Jqxfn9SL{oEOop
z_M5$L{cQ^3#mx&tD9zkIPvC$xyJavy*9s++cZAq4snL)u<{2`IhB*BXYljEc(h1Hr
z-1WHacUD5FoY_CacdnAQ#OiCxPPvVL$Haa=NVoC%_mP?L5;J8^)fSx(tv1;L`0ie9
zDfa2O1d)D-zUcipkOrFIVM8Dz4ydYccIGz&UDjsqz)r7kM(g#%nw$3?f__y&_jeQ}
z`W0sGm;1B*L3g(|6cVqPvcdj#c6QuK(&FMxKPm=)eWVet4g1&I<r+EI-k-#U$|!NK
zge<~5w%{{*B_DVk=Hps=0`?_08GV+6Z_Mv6%o(jeCqjt>igc3qS_6xv#3BRGm-$lF
zD#;4Maw(Pj^E{LK^}1P}wPzukyt}S*wZ#j*TUk0skRyLsqz{0hCc%xl#)eU)Z$b;0
zU@PbUZ`hR*tjFlan!tp_=BFSuU<R(WDrA`}WN*RLdr`>y_WGpTt-r2j2t2PcX{eO(
zSf3XiIHl$+o$~<k4DO7H4}fCD%@C$D(9iy|(TbS{ck9_!2<o>IgRc#u;<mqHziBO2
z+{LuYs+&SbN9WAL!@~k`dmB*ZsPiqX)l(7e&Q5D-eiF>J3Kq8p<rQ*MRV=D#@lot)
zi&+~IVef<8Pt{A6ja9Ks5>o_%qTu3@x!A{~5^Cp7Uxp*D$@Qi6l`onzRFJA3=i0->
zm?KII1K&?<m(QHddGCK-<HC$y<tzBIQ9tZ|dxzvLFL?7eKqmRt_OIhAg8-_V#xDNE
zHIw!m9DXIvDT&wxvuA7g+q&xNzw=TWs^Z8y@qe^&k5?Vxeo)zYC9#?n6;xh_OKv^-
z5+=_Zk11LjlRLFIkCn!2%GWuq@IqzA<jVnmvSpKnGX#Z;<_{z}{N2Obl9T?{!|;d#
zF2zo|0$lNrdwG%|lFS^EusVm30{heGrVttuwNX1oy7RgL(gmyVKaz<dx-HYIU|Ehe
z67_<cUu#$LMJ~7YLOclWSAtpp-to;yd~Lo=Xv6Y5S$<r@a!EJ50J&N;zguCvTj?op
zxtz-jBW9EeTJ6G>os4a~f4hYJ#xMocafvdVavd*p823x@F{^ZJeDc9_iR~)IsRSW(
zpiCT~_FaGe=yvER6S<5d-GF|;(31Gy^8#UX`}z6#o^?WllZ%wuyAP^TQ9WO1q%*qb
z7!DrwfN8fA`KG3r_L6LkZB_dMZV_Vh)(^?WRkdA(3^yy49gp?a)NZSWL@AutaP{tq
z*F$D5J9~u{2niSuQ5qD225-!^(a+d1_8ydEbXBxmt5^#Bh2BD9=?kkq84f7H5iJHh
zjO@~Lmm5PS5K~FK`R_(=`G|5QXqXCx8W$+JG;%^(8<l62O;(FavX}R0Sb@o-aJx5~
z`-Mx%eKS<Mqh3JseXBZXY}2LE$#{Y4={WgGK$=Is^gb0(|1drqdgn1e^G%Dlds6d2
z)Vk(Y8|3k%d^jFe%PD&Jidxe2eH%H{H3J395=DaCd)d3g&2FqfqBUlQLkR-ASO(g)
zUHsJ;8Opq)L#={JE^;zCt0F*l$%_+ZPc5DDEzj(x@G{)>d|^(-wHmW81(EEQ;OyGT
z!baslcFQE5`eep{*s`VMVUg-qS1zxrxhfv-*mGR-Sm84Sr`>mT;~S)PyCMVssROVr
zE~{&@=TfvLaQ5J1sa+17FfNd7XVSEPX~yeZOyn>uw{^Y0vD>Fkrot3%7u!9zy3sEI
zowRkHn*ETow=ax9fke&|ZmiC{@BVzn&$(G=m%edrMK!gdFsqb&*)BPvK$od~UaP=5
zbYKihYUo>{y=t3eaRs_79g)eW(8tGLd$45$6LOz9oZc;98GT7Ad7;vFuHtWg)i~V(
zJeaFn0`JdMoi2C`n_B!_B{}=z%cWi`fSQ06DJ6UM$6svhR_+98KLYG^oJXZf@inOQ
z3Fu!Y9JGHF1CPZRE?Fq%e2cCETV%{zcxV-Jd%VgUl1O;nA3fRX-j{UIFCgtjSv9r0
zAC;lICp|xdO{{dtm6!cODH*N)r#IenPHR57r&TIxd>Cs%TOnJ5&32ZEhHn*i4%?`t
z1UfI*5Q04|CT-K`(X`wmAS6;*%ohc)n(W*-DP_Fr9!pV5GeB9a>xPw@3upulhA6lm
zc3<A?U!fzW3#$z6VXf7KBBG-iR0rok>FHf?nc2`jzNvJ%)Ze=o;+`-{9M>Vx<+!W8
z|NQAlVT>AYZ$JW9sMuPqj-7OmP#-ppg7`6|?UbAL{`eH}f%3}-@p1lJ{HZJasqdcs
zMRj>lo~c$5C(l}*<z$^oiVRqtUO`-UB}DSlu)s9g9+Et6R!SWg;5Gv<SkhO_a_`^B
z(=c>CxbS_T%<2&=UX=JaJfnqNV0q;lP&pu7h3u!E%O*yFQOL?6@Z9lkh?EEe<>`0G
z`Pwt3GTt*=h&1*`<nDa99`TgHc}S`G`lwkc<QV*W&tqg*0$rE;xB1hc&&~P~ii~S$
zrnJVyd=@)1b9*q#3t1;!OgX-Vm0^31a%aw4r~die&eODFuG$t+-@GYQVMyYiz=!UQ
zyX~#XYr$j7u7r@q1{0sxHg$*PQ*2DVbJSUPYN6V>0SkXY|L|CX*2&Bd3mx2IAesib
z^A5x{H+00k5Az{+$;K`)Ny^Q=SbEVvPvVaq*(1}Hs~H>JwE(zlpEbkc1?J{9p~zAl
z>{zcU=DclI>-eaxA9;(@A-N73#&mP&v7I@w-G?MPV#P4FR2s0>FJz*!GP1=2H4ou8
zJ2{WhX%<87vd!8;pua$E!>&s={A`d*Ao^+p=IU%!)-f|w<y4|>5-Yk^L+^Yz4t3>G
z4BR*e*{dcqQ>6gc6QwBA0=roAX6jwWE(zjH=JI6hg2w2J5he*XX-X{uDDX@UIWhIc
z1eoclKB-TRkq&OzCw5R%8fQ!}9@kA>H5>q)w3o7-=~bG440Wwg4-i(m5z^32VTJVB
z)3a<KAoCL{I~#{<J9|oPR@L<WTMnF=&?&3IV8}VVgwb|_CIuB0BiEccv;H~gugS&1
zjyUfe1hQ%Ho}DPVis`|{KJ%%`Ixqp|l@7NUNF%By?aj+wNTmgO685?)k-c74s7q0z
zxyz1|A2w3c#NdmmUhV`Nu)XT$5CB>uHNW8nKc8PM8r51Z7?h3#&m+A`SGjz?93e(H
z5uVU05aH0z7|5=2HLW*on9uqtO+7t~vMrVStk*tpA7N?Ua@yS>C{^Fl8SgvdFV*X}
zzFa!G!O~+zeNe<XRa-X*x=7QY5t)0~qY43V7OErqS)~+}rN2_Cm1$8ey}Gv}13=d}
z(w|M%71ekYNR9~!gJqXzd4~9W$Gvl_t^zrARf_5vkIj6|KRm*<4(dZbfJx>1MdFh^
z43Dw}+L}ANkyf!Kk}`uDyTOl7Z%ERfyL-Cn-8K^IW5>s^1A?kM*2Oy1e?UO{c|FN2
z$#a3Au7u3XviL2lC8OsMDn<b$vJd1r=SeNa3>>3(h1=%P$c5)I>-oTE4||ySPFu_S
zXxSHh%Q8BhHRx`vJYE2%A#M1erjw61j%S}tdC#{tdp#5EAZ>*Dv5b(-qqPgx(ALXY
z0HQ9}Ohjog<#JAQuYNcpmPI275;5JHOJm&=QMwaf4@<^@(XY~%WKOJRvF>eFY{;Wb
zN~Sdq`9eF}L<IoWJ19LO{hAeOC;VU`64navIk~TKT=U59C7~h~<T~$~vrfIQgKuKz
z+{~N-od&R;Ivpg3DCQ9|fM{|7`Grh3b<BfL@_8UP8(NAyI0u0;_En&)jWntjNEKQN
zY6$oHnM&r_>wu`Cwj(8?dD%1m;(!Jwc2m|(qajb?{)X4nDq<L>7?!ETAa`glnc9F=
ztSzQ~P%3DTRlwfB9aT4)ca~bm*LI@1N)i(56$ZK)QOtszO|8!WVnm!G`E|H}y_cnJ
zrHE?4?I9%P7Tg;bP%Qenhq^9zsseiBiN&~E6VqB8Us6-i$`=+D26no+kna0H@UU+{
z$v}-3x7c((@LOJvG^$o9dpRM7Dhm#p3Ibn7c1qZm{j}p|ugLt=>R`N(-}@!|Se%wX
z2b~FHVaJ5dZn=zd!r%UjKT;05O^1BTe}S3Vo57<)zXrGdtZBE1I=XkRG#EF{0?uCq
z?tepI3T(ZlbKj-2jxuDlD&~Q1=w<^yQqE5q9{RlvmGV$};kmzCi%3-&7}a$%GpKi2
z{C!=5E&eCarB;9C#o^soGE!pXlf|qb>Cu70*W1x}2J2JdO)}&D@%{L-&o<jZ##_gU
zT33wA@6?mG0$oDVBB_*jcdk81F0cgIg6|q$k4kV%)tY|fjVzVZ=!2?_&5nAz7hzU#
z*N^h;i^r8IDoHTNyD`<wJe=#xqjmfrPktkOV5K!g`sco#GHPk-I-=BP`W>vdvh(no
znbg_@ouG+R2QIexbpT+l&Z{s<B|-!Vr3pH$&mMNG2l!Z>%D-I#yEkQN4kWmT=WPZ*
zR5DG_NcSnCLd%BpM4B#QCss51?)*}kZua26O-saKRkV!g1v3l%o=}kZFb}}&ppHT*
zs0wNT?1^8~nd%uyNim{tleT4O?^W>Eel!oCik+r7f!I2)AMT4%rUGyKCpO3<_}{4e
z(s|{&s6Ok5m$Zlg&*39ESMY@?n(Ltg$6AEQyhT>cl;U{oRVmr<%;+Ab%l^E<na@C{
zEbs9t(oWL_w*J8-3-XDXm;v7~Wqt+_RQf2*2t@z9pxcQaf9u-Hc&!#Yw@kEOjOLrI
zZ=1#~?1z5xyaf_%H$6ylLOq_}{Au{Xek(243)^8Xi?_l-i!~-Q37E)MN@n2cW<uSB
z*=k0nrABt%C4-9bzJWMZ&vds87b;JUoBV8a4u9GiYvN+bYOK6$vS7oI_vPyL)@6Pm
zG`Gd4l};bNM@1J23D6b^8<poRc%`U8vo!mWpH(Lo_gb+<GnRJ^x%I+xFi<--L$ZOs
z<eJU?uW_K0_4&kcSIzOK!#FAv{dT^A6hCVR1FM65`mhD~^a<}kh{;52wnYiw{yriL
z=3vig(aQr!6JMidvyQUQer#NV%#VYonMXBRi=g(njq&|OOGi`V?wWyo_Rv1B+K%<d
z9}HbW3}@PWV#9lycbnE+JcgTTiK#v2PVw#ON*Wo4@rJBVn6@4F91=j$i^Hi9Bs9<P
z;+%?zR;@<qFI#2gZh`>t3v7`&WwbGqkXfBANf~UDus&<1TCPT29dXdW5}s*O!^)_U
z-KAb2M5gG@tf@1S=V6tkx3SIXF_WFI#Gd1aTKw$J&~!6JL}#5_Ru-kz0;YU^9bISo
zbw@dKZCK<Z1SSQJiSb3?)KiOY$hI2viOqM(WZ;0ThahMmYa6w-=3gffrLwsnOQ&pq
zPi&f`wiXt?_FFr{N8*gl-O{3389_DDKJ@0^lfTP!JSV`OJ^pl=C%b~yXGSu7Q1dMx
z$|w?1V(?V=*p$nGhjYwk^{|p^f=|uBb&{dD(u$<|D^mveX`;{VHrLjpa_->;<RJgm
z{LJUPTG4dImI#Hh=Snf&)qEe}mfU4aB0gq*v5jlLZydMq_Bp^~fDbpb&12a%g{uBQ
zACBERCC0I;*uW)42v&E(Nw@-$c@1!nG)-b+#_d-l(A$F;K=nG&PEI1G&G;T)_*Isx
zwS|OlY*RqQ*Cl$*`Dt&8=<JE8T*~S0nHZes#Ak^ID0+zLRNh)HpC@S0tA{E3h6La~
z7c5K(ig|FvFGe@&H|)mvafuboV;R%dCc~)L9MP2aXGe|OQzo6f0csOrbtkLiW7kH*
zfIC`qgk@})*KJ&C8p>tRt~HvGUukmVxnXQXYwO_ihnhl)9h~`I;a}ZjgP7Iy-Uo3*
zDc8o)bSAvVp9?MIsw#Nn;=Q8U#2G3r^EyQf$5T!U%!kCF@elPL9h$V>`mAJ8F667!
zTOw2lcW4R@je>bC`)tUObFY^7?XIwgjRXkKkKweo5m6u5{UPr!8DJ<P@XVc~$HqKH
zHOs?!Nkpc@!@U%Lm}j|tJsrB12Py?`T-RYKRplIH6iAj7ZpN?GEzLq3swF{dj|y9$
z2c6%C)J3U&bp7eLNwmzXANeA_`SVaq(Vv1XMXDVzS|(jgm^2ehz4K>`QfF;|c0FOA
zGQoa+t~HZzMFB1uEW-i?Ee>(3#X65+MuX>Ian1dT%Gr@!XVf`1nWYjkmOAVM%AU+j
zI2z_n3y1Tz>T{>T2(Q)Bhil;3w8)6@$k}V&4YW~q^svCOTji^Fw7;ZXKxchFn2lQ<
zGN@paTbP(x4Z9w1u&X8@(E|K4Bsn71N%}Ca{sSF*8jv&FtdOZV(I|p>s`1roapxQ5
zDY`-fr?p=GqN}eaMEq08NL^h9Y0*ToAgc}CLLTrOvXYqBT2RW`!JZz1C*ZpyPFaPX
zNensI`=+&?KxgPuPd)!CG(-xCe?|pwdlB7io^HB!w72mr1mw?*wUj!sg76Vh7tpWS
z8De}?h7}D+>+zEF?8!6O4YzQ{SEqAgARMQz1-2ZD_7stGyIP?2K)xG@+ud_^^R?}v
zBpRiK%yh0~_h{0zo0zX+s08UfkUit_GD5%&S;><lvR*4WJUVQ$x(+4gt#DsQlHw~$
zcrqqj)N<0;m-eo_;YGsKq~}MWHlo$e>_h2tzgm=!PPYxZR96Sxf7egNriZOP)fjE_
z32dik6*~J_<}q;<CPjrx!<U5I>XZsn!dlraziCy*BMjCNm#`R9#;EAAYsDU-HDa0o
zI9n)f?EZY_z%(I8c)5c{nQI+*ByLpK-E3Ho!Hc}d&RA-liuahU;rTqx)=bA~FSKs_
zg&sR)y!*xpaB1stj{7+eO-4`B#_485ysbKFlWz~)1m+)VG)rT(-W!SlQ?u6bYhGO-
zDKY;}Q`k=V5|l;^{2~-^vpRTicAeMa#)fk)C#*cwj0rAjl$O4uxiCxUX+V(yZipO+
zdNl&z_C^9&W&Gf~RV{OF`}Qv7FM8a@BT0igEV{}9S_g*AI6SCWE)!WH(VCgz1y&V*
z^k*FeH5v9TpMJ;r_3}p_NLa0=MvaG9=yGazJ^#KLaklu3bihhsF`qV#PI7<8e%9)s
zk>&{<&XWVbuiv<Yc`H*hNc4;y)SuPiV}3aZj2RlE#GN6^@jd6nX{^c?*`27INjH(W
zh1N~7Uv5+Xm3=P3e;iMY=I-hpbE2&BapSQCal;5{>0h4hV8Z-t(J^>lR^d6b(OTAi
zS|njs-=#0WcF{JQ_M~j{R~Nnu%j*v}h>Mq@t$^NM*XMgrsRiFK2<B{_RzSukHZ;_o
ztn&zu=*b3H@frh5_4vnT0on8(8?;$A9ky9s<<cm$QHF%qT(jGHgX0xHcv7T6uaMC3
z5z%umldQL{IWGk%?gi}E_D*HnHoWBN(a{xw*0&SZe-*Xe`%h_QpRYU#d{T-A0FKGQ
zn*nRY{H}=;%ovW`6G#l!IMCJ)cTc|W=MWn@_h?$_T?xt!tZ7%SnhzSLJ-V1jR!0r<
z8Pv!b=wR0$joXzUZ%mgJVM-q=q$VB2UDl6RgddPhe*5EU^cKpm@Wk_w?!k!^5P^6k
z`Z{poC@uMo(To25wOO>u^RC_KTv-~ip;aD)grbDRqM9dGqqWi?&JJ6FYaP%&4+-eT
ze@qPy9EliLx*%(KsMl&T3Vb;;?MYJA`!)75UsN`wN7k5TVTJ}DjMkIRrBW$t8^|?b
zII*h92E5#h=0P~yKNmo`ou5SxJoaMF-sc@iF<C~s8q^%*mrx_C0QN8qI?-RP^Y0-L
z{f+GiM_Bs-%rmf26s#VDD{^rAX_zH;S}uS0TO59*mT(UXym1v1kv98qZS*@RVQ?;0
znJNrw<hCvWt;=WhFRdYb+%~<w#|TV+hE8mApVttm_vD#0-&HEumk}ea%Ie~|uHrc>
zY)&SQu6)nqL5@1eI)mL!D%G$Ax+eM*uk8(a#gn>s64eVsKKrBbjPIvL12@y``yZm-
zcyw}ZPkP=#T^5a2d#vHjb6Rn8o^hnjF{!pQ4D`C1nyhk5M73W*ueZAtYoJv!Qx&6E
zQK_u~eRmI_e;+w+vTbj8IR9bzlcVt#Kw#srdQ`(7;qXGrg@&-N$Yj|<t^Dl8qpF;F
z-Ubqd?uOoFuMUp!4>vEwZMI7YJ$mk$tYx%H#*>X;4Ne(2!jBPJP4O`jW*?hH<OBP4
zG$i%*;0JS2Ut$3n*Q4yzw?fVdQTSLLdRf%BBb(iJE8cAFb(kNW<MKCujym95UQmmz
zQm0TVe(L#-XOn5#%qkt=^ge(>)y$Chx(}{5kvUF(1LVhI|H+>}>lv7?y~Jv;akLcp
zb?DZ@m7u>UNyr(pSxo6k(4%3a#Z*y6y1}98A+jkiMGL;5IzSe1^`_z+lc_B6A}<mg
z0%BdliUKT~{VsM%rHf4-at@ToG&#4IzN~L^bEakCvtAO{*-?!6@KEiZtkY15xb7Jv
zr#XC4zU}36d}2VC1uiJyk1)_%!u4so>$ChOV-HB%K!SjC_^-L>RfU4qwO^BP1(1mq
zS5G)TB<kx2E^Fz$6Ha0qkX<uq&%OLHXWU({zbX5|Y7)GZ#~pw=B#aeXKYjM(RN~NX
z8Xg@RG!)<54<W-Q7K4niFAY3Z5TCO;&NH_uhxN+^t_H=t<e+C20SQnYNU*^?_VuJ!
zv6lE+Nj|t_qG?;IY0b%=y-nK75UWQuZ$9B=un=_p2-M2yAx!=b65vH}xt;5J(6w^J
z{5)~sa*gc-z)FEGA6;b2bBx0NmROxGEBV`A))3L$r*3gqWSx-FX-<2R^-osx(95KV
zMs)bHQI*50q8xg^au3IQZLcr~<>|(PlG9mzi@W=B&>k;4t%kO(3tds$8?sZYyEdyH
zi*;4u{8KUwY({r0Z-h;wE!c)NdS>CtYvt;+5MX-kwxd2pG2_xUt#ynXfsj|7{Kj5^
z`)@(2%VHGlbEiR#q`|HBxA}rNmy>ChrTRLP;IBd7&26ogu~l-y{2<yo;O0&2Qt0kV
zs_wcz`w%S*1QeYdoo1w7x_@IL>~#!Jo=?+ffSonanWs?k&miU-(lw5UrBK{Kt3(bF
zjN!%BD;f*v5n{CFY?ZZA1Y;b{aG`rU1(+?fCDNa2=}XnN;kQ<18Fk|p5b*fmZG`US
z+^Fe~JdH=vzJGrE?G$dfJSD_~E+j+v)4)!Q;F)?hT#4;@C<9{E#>h7Q+7D5bfLn}H
zo3O_6w&!!9wB(>(__NAqic!oS4kZM1^Ue(gD>R_c_MdA{G)9wY#TlqpUlric3DNt?
z<w^?4U6B#N;1WAcn3J=;IsEO2$5MXh4$ZzxMpI?R^Kj8kf=deb8}TW#FH~dicD7Sq
zoM_=k8iiv9bPnp%Cy>Izy^=mSbVcu&tdnytT|FXev3NVeGuW>;ZgvonCtLZHo^SQG
z;-y_fEAvxdRG6uP?mQ_SP7xi$sunxoN!fA^X|rd-BNZ+l^||0jjQ7u>XCJ!3lT~35
zwO)?)o2QkeAD|X^yr-l9R(bqlScH9hUNadGOURh1)C-R2bCV#4b9s&V07rPPH>Irz
zBtW_WM)P27SHk2Sh8QYS@sm7YPA`DKV{qb4f}Pvp!VP%2J-8Zzx~z6zgBzT=L7V%m
z4<$ZOQwo?J8(du$pE#;oOl$xEZic|E3{DgQw1vdb=eFMZJHMws<8lg_f27p>iM?|N
zMQems%M7;%fmL@cGe0rNxtDV`x%FfO>VP?w`sdm4=gbROw1PP5xL<j3nl&TF1Ap)9
z8M}fpIPUL>ErZ)-N4)Dv@5YFEr`%ug*w%U{M&+>uamvd^&s+F(A62YU8~BqT5xQ;-
zy(*Mam6ijA(i@YbM;P{;zEPntRrq7)A_}pr3Bnijq^n1hPb`KpgUC_Lc;)aglMH(O
zPN+d2a8l^IyUD2)akf}JUFKSGQyn4wudnmR5IPjv2kDU?G_Covd|?qOXXlJm3@r=X
z*6A%Y_&CZx@(O1>t7nY<Q5j=+-ASzvle~=QNqPvPLVKHx2DDbn|7Czy(!Ks>8_>Jm
z<B_=EtwV=d2MqB_Mi6Fyj<w1LW|rFDg$*^JgaENJ^Abu(Ec^J*R%&a9Q%Yh3-<m9`
zx~dQ5S&-2Bh3TKkkwZZ}qc(8h?ZoDI0N41GPwk^P0$ykCTHpH~3cbT3rWDGanT?PI
z;U#de&>eT4+9=-vAa?FI$SB!4il8*Go0@n=JuC+RI6#`f$E;j|CBwM&UP#9(?;a|E
zML;d}XuZ#cD^K}GLyOmr5^qm#=7TZHPnLYvVlG0C`GRf`7Z7oMJl~)}e~|F$jNSb;
z5u@rW=})t2E(-3olVj?u3AP{>>+M|ZHUsl=_}I#U4r0{Re&F-vLo^dVS}}{Bg9Qmm
z1C!>pnuqlH%}<~&byc5KJ9@3C9_HhM@VOScf}|ZK{LT$vM_lGSI7Cur>N%o10M|JK
zGp_?7+xv^@lse%2;ZomArnzIc_S5CD6HH<$U50?|c<>vkmk+^F&smR+q>X|M7moQg
z(rVZDRlh8bKHJB4RrAJ42Nng0TKSw77jj)u%-1K=xi;jQw79yO+E7rHm>T;=V@XA=
zRR=vJhr!&GdxR*~>@59>1fuN*b#l>gpH)ICc9to=3_1YaMGFlA&-deq*1Olq7f<Li
za$t_+C$bb&AHpqpkE83&e!lFne8isdvoQiT68<}msYH66^e2T5Nv{I|*J@bmG0m_g
zohwHOyM*4bhlQ1g5SAJ!_O_=&cBrQyqUuXS;FN&I{))8%L{KGJF7EzV&wR$6MvC6G
zMOH=?A8tG=8-5?oLNA!jIkZNC_<Br&SuP>sviAIBT4dRE2C(&%|9MPG)$~kNSF56Y
z{s~`ECypP-ZfG>NnJhrx{PiDwENm~a#PyhfX$zLW;r_3z6t!`=sMW0;ZY&999(mS8
znf0<Ldp7Gt^Bte9@GXSq9pjq5^;tV#CyPr7V+a(vRh=fLlYqbCTR3rp@czQzjKn&M
zV)j8MH^P74LuGo=`*ISV$q30E!pAf8jF8B?m3S2zKTzpI{^7E>GC}S+WL<(<7!vFK
ze#+K(Znt=nvpzHqdeW|BZ0xT0+D|*Kd{>D-_k&VE!sgRJ6$Yh1olIYWWM&$6Z~&bv
z>PL*{^ah~Eg-(+Apm-%QYA%z5OeIIDEnKHZEN<JV)V=GAp3rFPk@S@#V$C3)CQsD#
z^}TzvVYQ?H#L3=V0^HDjY0Zzl9}q(VBsi~msI~z=1n^^PE*ftp*sQ_Py&WQyCl{V?
zRwvq;F9rX)vvvlOvZ1EUhpgqb4!(8hSV!wd@|z=t7<MC{<DQpg`B=;Gnx)Zq{bGC#
zLH8<@!F_30);*m+or6@*d7vGLUxan;HklG>nCKTU_aE#4WO-F7;ug9>6~Y5Xooek-
zW$nFOi%y^|?FJa&nMfTgJqn5b?p`|>Q|ISfqE(%+w_4TJ$k>gA%>emhNe7ck%$<fC
zWk`Lv?-wMJVn|761zqHzYLkq`KLl)Lu8Obi7}x%S#}cM|mBKPj2-z80fwL+y-qbxc
zhUixNkm9s~V9{Au6U06K+2e&8Jq(th#V3Cdw;`i|r7XZ{w^bxiDNo_ocxs~q^ed$t
zZC!j7Q~b1drj|}4)$EiK@l*(nB*-1=@q8D-#b+bekjjp^KfM~i6^1LTm@%hPcAlhl
z*0TkC9)Y9J{xy9;P)0SJOa=LkQN*XR`96e^_bTWh0(>Dfoj6D*ob<50O#`=T%sE^G
z2N8&@rOV{%VzV2EC`>7Q6LyX4S8ZnzOFWF|E_=jOR#ShrX;XjAa29V4YNQ9TXx>nG
z8}A+94+Hp^zT=ewt~)E<kK;&dt7m3#Im_#pXY%I2wmMEDH15rOd+LLLz6U@vJ*ws?
z)qC(W9MDB=62Ic1_uqPN^I3|FiLGpLLt$L!*xiiM*>-g$7Z%3bK6t}BTCRwYFE&cF
z*6i&`ZH=7FWmPZ>o%Yb^7A&sPi`naLWf8CUGkFhxqpF&$*R<@hs{<`Oeg<l#!=}!D
z9bUMJKXeI=B4ZSLye_Tb7MeM$_%)H(?6JNuceM05J@^E`&M?ZRMA6<A685G!?C2@$
zoAcaQlP}H+0iQya8g3f;_k5mOu3I+-j*zWo5#4>$zogZS(l8@66n1&^IpoCeWgSsg
zz+2kDf}d<~KL!4F5K($-AMlG%Hq%#Ua&dkE_;!!atb9fIAhUZnQN!l1Sm9N{a=_o^
z*g^LTvH;I<hD`FY=N~V)<*c1}%bCc?&gftvVHnh>din=kh3Z+a!g3_(8AJDJDm<rI
z_kNUpt+deoxm=Uv@S{QiPRsi8B+sg83Y1ELDU8)j{JNHNt}g`$>R=vreP69E1r%K`
zbj<}Z63zWTG@WZa)9?Sszok-%RmvfURVq10ne$YVP6)|q4mqEO&6#bAkkgi&l2cOT
zG|hR;ki#&ilJj{p=hNo2G5q~*{O^D6T-Wuu-q-u^e7!!gilfm#9#0Pb>8YGTg#96n
za%$o9p%&oHVg6ldqr4(X9sR}fcD9P=?hRC{j2>1xkK0o{Zq9OYB)f;W#Hk{tu(IV+
z46&G6bT<mq(z_5N&5w+UPebiFOoQqXQ@>So35x6lgi~GMUnSMikxJ#LElP#1G~dd+
zTx><Kkr<yI!mST+Pi+Q1^cpk9l)9}EWgzEY_D1x|&`<;YtMlmj6~R<f>SrP3lj}UO
z2OnuDRG*Sdh9gQPv0b|u>sF;6UZr}A^by)@Xw*EDt_(stYN9z(L2U^8qOq={HhEoT
z^Vec}uZi454Xgrh5Fw&1Iy2Na*JM8tlz%iDlIB-zAy%%hud5Fhjd%ma>S1mPcI7gB
zw+3re?aRFlQmFR^o-RcS%(Q_zXk_9Q>!eqMn<8AtcZX9TU09JrhGe0;Jl`(g$Tl<~
z%v~zkTw3CdmiDoj5FgQySs}C8Qj8_3-_}svdX_H>?;ev=Y0qQtMP8$0A<{UZ1VyT$
z2Rd!iwW}|bo?SK-S<*fha=0H}7#6&<T5R1IiYc)-Q=LebnrV~mth5%4i+R0jcdzj&
zlEkN|3VNF!n|fZf92u|h)#I<&%mu7<B(p^#rS{srw&#KTPBNK9fPMMXP{q=*wW_*v
zY9dj28dj$Rad#vVgQAqMvq)wYDo-6XgJ*DPGO?wH4#DKsp%qQ<<wq=vhPA}nA?6V8
zK2)7eV8wa<4B&rt^Fy9DENh*gxcP(8h(Xp6_SFtw2DV6f$kbMP$U0F#HJm^-Q}Fu1
zq;x%NdQx)oP-oJtvUR73(a6JJ^;0y6($1LJIZP>q?)1}wCwG(KTdN`t{hJ-|^@S!{
zLe{Q3YiI4yYnb5Rjc2tA6<AP}PPy_)k0GAf#!k&=DZ{Swt$!)C8|;Q}3v+=y;);b*
z{%|P>MGk$q8a+2;(|qQt2ar~9F}%>J&;3q%_<!HNVB%hmC%#{KRw=*!9?cc;z(DDW
z`^#M01T)S2n1C;%zvfQf!2atmgdT;4vhHV7QSS_??{4Q3Jiym;gWflvk@7e_d)+!U
znhiTB_@(?_Ir?;>lzl}6AbJFl>1;LChXgq_zq~0As1On7|9UQwetfpkXsD;m#Y411
z@*yN#xmBp^=VCx!yWNxYoYVN-5Bide)0R74ibRlAbMpngLS$T$aD@1FVRPAaMr&@l
z)d$)P9~H}(YP|&TCH#3~RnVsN^TOa5Lbx^7-y!x)lK>zM<%R3V+-t#{i$|RL{Z)+b
z#KyE281ycFdY!ja;2u@GNBMPg>qp;4uD0Rog6>G}9#NGmKxK8MgXY+T8+c{jpw)b*
zjLHNzkq64L0<J|Bg6#43gi7(1T<)y*IJj|Y6mO}x3-l*Fi8dn9V>*JjnWINpKWjO`
z^F09HYnPxBZ_sSm<nlsyG;>c~Fia%qS!=tH=tJI(J6B3zLxboM+=mB`-^J)8yJguO
zD})@*Ck-bX5ym=NBuXI7|6Pq{47l|$+fMRy)6i!!V6TYtMp7Il2plL#bl$uDsKb1M
zGXxz63i3*Hcaw(u@2_@Q&n9yaz~=5U-B-A9xdCO|P|}ytUH&C={+J1zOWvXTsO`dR
zA;x8?w2seZ5KZ@xol*kqu5GwJ?@Bjn{-;+Y{8t8$u7YV3;Z$s?ajQx%?M&BP75>iy
zV&k%;MxIV6!)7)}+~r%AptzI6gqK?aA<BnS<*-h;fzg*WS*xDnR3RR3yVx#|H|X+X
zCDu!`#lg3%*^9SNzK~7LD;bmnO_f5of9RRbc0yNLrUAgrFc%{Q>;Fwr`hH{tIxo3h
z#CqlcX#Xx@PL42~i0i_P)wLY-+z0I|@^3F^A=@0dHMONH0-e9Cnu-1m(*SUhIIt2^
zBb-Yja`Xt}ewP?Im5Llc>3xAl!&1neFc)?);JP{~+)7&bh<p5lRW}%P)&X_ow~(`~
z-MmSjH-Gut7_|iigdq1;ss>BQh-Euq;atI2p$$O``-)bT;Oy}h0mO>#<NI{M@Ecci
zJV$lkd?*kW0f>Jv-*bMA-<8%;%HLcOf74n@9zT!f*5MAzO&g_r+ydGr&4JquJ<`5#
zdOER2!{+k?WBDJZEhmeQy!hMMSpdJ|(Z~MFfk_&yr*}Ef3i@e(!g^kb2vx{fR3!;{
z*3}_)SA#o5swQ9iL0~OR-v9W{#JnrKo`v6gP8$*Oh_;aTPj1rDOU%nuc|AE(Vu~vr
z6W#_Mu3(ZPfq~`j!Tkd<d}qWXgQ<&C?ZXR<k!p?2F&3WDufx-F-uC{5CgVM<1VCfc
zlvO7;VT27CuJFB9)6j5-kK#;q<CKPTner{Sa;J5SFeyvJeNNPd)3wUeUW%s=p(^1Y
zbzgr^>AI?!M*fCX3;#J9A(MRX;LbHFPU>gXoyTPl<)>U<b)Lxj?EPFU@NBM4T*3v=
zboOe<by<(_8PfG%HxGhF9feQXEJ3rAs$8{>`_E6saNkOJag`~!0{<rTx3>&dkjD>t
zaDjvJA(tKj#Af!#>ASDLj%}S}Q*YX5mr!qlH<ht!B_9XJWhZp>UN;AXp$qx@m<93S
zvR8%M-Fe#o+qmz(6}|l7;<<x2Zd8Y*7UA_V$olWzRw1)k)^TfZ(J<Gv+7GygI`l`z
z8v@@~I!?-;2xW>{$HsJBi+oDUPyd6K?{iA9EV(!^_03XT&E4y<?48KSHzYQ%xVM7P
zWVmJ38@utJxQXiUP|9waM#wc(pcEK%TGY@0|2YEmcLd6gjkpL7Fi0;>z3N*5`7qRz
zu3?gE+t<ExnN$_^ulGuuUAEaH;zOrv1FD0@AHHqHTYN#4AE>>l$dTfNBDXM4eG<D(
zmiE$V<<pzTOp@ERGLS+Fg&^zf>;7o2%$8^flPdfz#MSP;RehS$H<zkmzd51mmcPk;
z-WOGA<$sLe5WGzC2*1t9Y#8Xru#dMCCtco;`V!q`d+?`Sj_8Rw;s*xKoyo8>_TZWK
zCsd9K3ns8_yy>-RFT_Y3KW2Y*UjPQQ!rFvoK8+@O+Pd-1SO0{{l|xxgn4?i^T$zyf
zD(`b{$yhj8fs+v}#OlSU+>v#^9n+rb<Vz`NoNtFY90*G>)OA!Q9Lv1WyMY7z>AMBM
z^zh$wUGt{azABSdW<Hd>w%hueppGvQDJ2}sUi+Me70F8FP&s5@%Nqd*hFAWW%q_8&
z|JTt~f`5ROec9g(bLD><!0kGh_JkCQv(Zv!%)l;0wp4l_<4MJBBPFXMB0<WC;iECZ
zK+O@$!bGJJ*~k}Vib`JJ2fxLKKt~1<<}W&Ssg3+6>ptId=`qt2Is^;fwf2<9{>it$
zR6iFZdrIYt+zc0{Z+R3nHbqaF<HXBf&C`uKEoD{9XOR|p)G?1$5yi&fRz4UB(bs1|
zND%4><CPr~4I1|y><3h?)vghDiD6P<{u6;tT}{|(sgL*os?ek<l<C!sYZDqSVNZwk
zwgz9`%)fJAZ&L<VoRJU<wSb7U67NA3mVNW@AFnJ~`<UV^<D@kNIQ7hdrvruEgYJT7
zuF7}(T-bY=xrd7M0)q{Np{G?ozpYF-gZH}jF_}uA^=(R)>hN(tl?6r=6=Bx6u(5@%
z;yqb1d6dc?-L$G?aZ$~eYrKxQYMXR-qFMlBIUL?al<J5V6DJS*@^^e0a%L3f=ILcc
zDK$uulcoH^vl1>m*n8g^t}9Hh7gh-(ERWQQV<)<joH8}623mFie=@+{mFoP$Y9(Wq
zXyM=*6r(}N1`&L-SG$`DN0if>`mgA{H(8w!^rQQSwY^SM?p*Zl(j`2dJ3H{IIY`<g
z1gU^!K=4rS;c5>g`|Anuo+q!=+pg!^8_wDFRV!eZ`-e{#2$&HhXuQ9@&WqpK2D(QS
z7%wX<KK?|0=3ZI-H$sAn3E7~#InBKLE2;jd)=&A`i3ov0s<K2ckA2dhb2Y;xmC_}J
z1C0ii+J82l3E*gtIQ4R!63U@yc$sBaBt?A^7nb^8Z}WX+iB6pSbo1D`#U$NU(~R(R
zsaV?alw~hIYFyc@k2|E0c-#WA)uIw$8MceDaqXVHeyX*lyU4>GCV+_jsCY8#@I%S!
zpNIOjvoYdc)80X@H_I;8e29!cRgKb7VCXzy+KQ3ck0X|b+PwFFUA--NnQ-U4mb57R
zWF_$lslN#%k!`ml1PS(AlLe@Ih3rqg&$2qzb7c(Gf@a<i1u8@fe>z<6N{0o@qN6?)
zHf%8qo;qe%re6rIbrp$kW_O<=#fz<Qegb(;sDt@jznY$GWy29i=+UT*C3gbs`>)oE
z2)@mZpK3e`|3G(yy{FV=k@A0eLVR_by=PxyGN2zX;Wsg;V{+{=-z<YSCTaIo6al2C
zPz&I?y=J<aG~<1q<fk4}g>EJ5ggZr1suePVzKGU%s@qEIGsJE@?}k9PG9M`{^Y8SC
z@&cJ7c@$tqLMxHRDA%mxbj}fGpB>sx@#lF`zhcAC#`^8v_K>y;w*#$)s3_`<>QTr4
z621SecVGC7TCiOiko_#3r?Jgn1HyV_Y}zU4uYYagLoZtk-QlzEyvE-B_xP}5)RLEb
z5WHz7aMy3hc@jP<;-3Lo<MK{h*&E{Hatnv}1YQM2vrd@+<|eNE&7nJ>Mi*zO6&-;C
zRv|VnwFm9M7WpB^-F}y}{r*v?4rFBJi=T#URJd=C(WUA|Q=OS@3w6ZMQI$w1K9a7W
zmUZK{?KpsDXz_u7U}v4U^uK7qn&Qbt4^-)x04^*?;|nxXb948*ZhYQW!Hrph+MFNb
z&lh`en@KZGIO@S`()mzfqvX+3;t?Qt#E4;Ut8__FvVD`HW(J{{Uj=u!au!gVEaa0K
z1`0QI@8jn!R=u?cT>)t*Z^qQkCF@&Ia?Yontmh+fOay9)W0dWDV~xQb*>i>Nc4;F5
z&U4^&!VYyc7l54CszA>7QfZmNtHpco{0USMn9h_`LFSI~6wB9O)p6?0s)*J{lXJld
zA3RlEd9Iv#{#*Ay=qFpvFUFV`Dgv;1i;FHYi81Yp(6gY*LYoVzHRf_oTGb6-2Vv*U
z(!+Y7@*_WwfY%#t6tP?N9d@=Rzs@73lhU7B{7Q{h$`YbHYl`4rBDZcWEjq@YB&uQ^
ze?6_a6HF{JtCi&w6DO|nz2d)0xC>L8ZLL-f-QV?fqa=esP}rwfZM{45Z6QUGHCKOS
z|2rw5jQVP0H<oO^Vy9K(=sOl8z)V$cFa0z1tZlhnj9b&ZA(lJ%EY7qw#`A_vb}4=2
zqNcky7*ulNy<l3_ko=&G&}g+c?k#JAG6z(7iJIQv?65}dA22%h-4>x=r55$Qs=DsG
zn_Msd9HIOm6Wz6lZ_{U&KZ*_XHLLUUT?SD8;{w}KFz=0W?VeS;8rP@sJ8#EHnRF%c
za<0i(2f`ij)XF9D;?VxD!0Fem_|Lq{!%{D_d8V4I_xW+&LXPPLLpuN10|B-Pzpl$p
z>+7gPtkwKC-Dn#-S<+SYyR)UYyu9F>@@KIMIQidL;&%LFLxK8e?^Vbcnr|nxHSlY9
zNUA2UiK!F0pnr*qZr`Sm#yYbwVQQhpX(PW%?w(KST1@(L#dw}eXnp<3mBp*qm8Pre
z;+$Dm2TbFAIm|qbxt;fYaUXE4{EAhiPicOow%Xcb@}KkDSa@Z#lP(!XprYlQO)e{0
zab5eb+&f;w9b{+2L*j?q9Bgcjcr=X!+w-GtXx_+x^#2~Q?*k%#N0oeORWCWm)5?bt
zkTVgskYy=$csq=4LmjrIynT7A-!w%`VSI(FOw(0;OGo<U$XbF+0ILDs)pY?Q$Xu8x
z^~0Nf*t+?<5K!TNcn6=offd?RcGy-k0kyx&C+jAQ=0aPeB`|<QQGQ>`{s&DOEbYhc
zm61)TEDja#XK}K2P?Hy1<Pi_e*5iCCb7Cr6mQN{X>RLdGR7k<wquPml#_b!-pfIwD
z-(af^F5K35-mW!T5Ti11!ifOZM4&OIGmT*WT|4Yz0xHGGcj(^o?X~HYZ`LEbOJtQ(
zGx^lwB^u>(qq3v2yBf;gS00V%D@5dHs_Tpsrke(@yLX90AW06ojqeCqLJsIua5xe7
zSLX#!S*G7)HzJ$bbuMUfrb#Qli7g@acs-HGgFh&>BBXCO_HOTeEAM(Y=8Kqd^2vON
zmX<DD`K=O)lUf(l-yXikSGl;voM%3=Bb3uE_HtAn-V*mka};@Vqiv<jH?r_AW$V*t
zve6pVy#^!IZe^{Mq4MG{rW_F5hmT&WqG6`{3waa1yf2Z`4RPJx>lXpq!cdjivRSA1
z?bH<BG;>!kzbgO;!}m+L%%&Ipj^@>JBTT1hsmEVo+L%Ky>O!WS!cbVf+AUg3WaYos
zge{x-CMiBa<c3R@d6E1PGQZ}1JMVD{uJTVKxk;e0R6U^Qi;C2PLy5QX?<B*eNaGLE
zGQk3a`3E2KbD)#HIo-<QZx+W|@Nprt?eZp!fWJI-CsXY>>*oVyyXBk7oTF@Lqds!c
z=yLG>*5II2#Dj~#7r^|v=eE<0vj#`UKbPRAe!8`!>cZ=kqL@*e4UVFHq72f9L90}C
z-71$WB=mA;cb_h@PBhqXUh}DKlpW|{Y>U<pU&p9S7b~pgk7i}qJWRcMEA&iG?=7)^
zZnhjCUeBPxmRs(9yA>;E-yjB~<Bkc{8j0&CZoyhSwiZ)OAzhC}Zy_8IgPt1^6%G!B
zGvk*OO$3H}VWCGU5M}xXh;PHe(w$H00dqyp5EPcDpDrh4dlxT%AlzItWP0IlRV!?C
zp7+8^a+i=RyLtJu0N2e8n#D6_H=odNHwq^-K+E!wPb?LkAeaU~>1FEQckD@*I^3lC
zCpmRn-j1Xs4;}_=zF<AaxlyBgho`ES-i6T?*Xu((5u9{H`XgKQIlT!J)V4SZD?IFD
ziFaHYX0YTmOeXgE4-qW1(%4JKhxM*oHEq_+DE@CpC0a^~D>ip=R^_|=uoPL$`oM=Z
zm^J*$gSgT<^h7_!7<PFTf*`@P-H%ws2g;XK)PuKQEL*=mVLfvrS8hTzrHr1CbGH#G
zi~U*}HI?$L-1q;z02*!_if089I`urGt^LOhMeEnNXvo9umw1|Q$p->9Hm+${Avlwp
zUQp_{H4?NWo+dFH6?ZDFA^#}!${n&bWrHUVG*i}UkvfkA)6)AQJN6DX){;%?spGWd
z75N^zql@HhdXf(aG&DzjUk(}|g|`{KOftUfM(NOUKfzI^YO8?+5tWoQj0T#`m4gp_
z?zDdTS^Lsz%&B9s`b+1|RVOOBZB9&I%IS5ov76)Zmf3rh7?zbvSxvK-T{^@lrrwU%
z<W&#nffrk&eO%42U)Skl3xrV@maEB|wiUcqTeVDt>ks>H5#eB4bHT_{ZYjPON}%zb
z%JQ$xelc#{VVF|IsBKM?(|MWF`e2q1o;7Q+xbqSt5)49d@6eg_A8w;b>vulK4OJh9
zc-F_=FR589fZs;_bQ!Pl?Vns6IxiY!O{Zz`&wfmi7*G<TskAoVx~H5Q`V+cKG1Uf+
zZEYJ{A=(8auGz;Wrm~a=23m~SM&m2_gs10fe?=2m6p`^G7DHG~cXC&^FOy$X%Ralw
znF>q69IB$Hu!pCsP1c_-Y>>n2pz;)2D^QhoWPErhvsbLi8r=f|JEw)kYUe^c_I7{h
ztC7xfp2Q#Q-&IB8k%0?yAc$8JHGuUBoU$AV`Z3XcMRB`rsu@hm)f2LU{xd=U%8uR2
z0YQ$q`ZgD`78EE->u8Y5^RxPAA=iK_cx<{k5|&-<@;$Emi@N!TrlCZGC7@bh{uWjE
zXF?9pY4-d0oK^(4HqU75%OrXtwB@B#m5jB>p)<lpdU0VcU<<&9xBJ&^F1t0$t0H`9
zWU)+S?p<3zOM6ZRY|HNV#L&#Q9=nT?rA320mb3hYndWt>ZaznX7<4=+Jbj0*!sE;Q
z+Qp#(u;+s<=5Hm*rwRqOI$4cenmsFe_P|-q%E9(-6`}PuhVe{5KXWo5>n1=z^pZ-M
z<u*ptV-syM`s}>^W`&7UvA%M3xVm))nMmuXuuF*f5(!rr3aIss)DYNT3{yJGh;<Ni
zqD=eBc8Z?|pD(r!Kci8p-uy+#p3i3=3~n(0CzdsHB;Ls`>1pwqr$Sv@=vEPcOnMWi
zW7W8y1u`pP!<e4)R-s<yK8VqEJPvs~MbmXb&&o3E#8(}sIB9Z@+G?=ZJI=nj^czhF
zrT^0(Tx|IMiH7GMKw(`H&M&gt6h^i#Bp5DzE)T$r@Rj=7xWXviq~_Hc+u-3Ek0Z(d
z<|Dl8;AL32SFXqJYUri?BgTa6YqC;QRZHi3sCQ2>=3N}cch4^+4-K}!*3K3LB-GS+
zoM73<!{^(L9GW^`4cC=fK6{)S;tI~F_FKz@&u{D`4F}}Z9z+*!#eq0gO*r*iB3AJU
zB(lt)l_D7bM(ItwqK0?@lT)s$j4>3o#x<ui9H;dB!bo_v%qQ-(KfENe_*&psHl+@e
ztdl#Cs8QxbhSE>%Q+L3oeo%80kD;<M1Z9E65aL89YtqMtOP$EOrQ&eE-QVquq`tI{
z!*$L5aK_4BUWX-+HAo|cEQ^!BShMnIfXQD4>OO0EWHI^eE)zzc+IG^`g`WH-OiGXD
zri}{Rv0%(+sj#DinK}H*{lL+d>u|ZrTAH)lLsE&jJOZCyi0sI#-?d4#t|}ocCcAaK
zh|1d8U%ZQBshXjap)`llT<XBcUE1Q3ozX>HX_T_}ay+Bwa2Jyt{Ca<yQP1`aA-Jb!
zNu<5jIRG*Z@jLmvwCE+Q)Zprb)$4RkD<X3txFf;Iu_I0{ByhM+z7kqCw`fdSP&Uxm
z*rYmWx!*H$*@|9|=B7EQdET}d>`cm|4ooNDPU(q61$Xq6$PTX5=P#T3W7RkNBgwlW
zdmZTNms`vxOmcn~?rHG0jf#40&6wBHfkMdUOZ?m)C-SPm=+P6W70Oy*_D(VTV3#)<
z88h^|4m)vGi9*}0#f_XqLn33H>fqt{96!Bn(NU>rL~GXpO6S>`Wua!H;I^*bfm<R<
zi9LwbGTPo@El|3C6M)Jltc*^+7S-Ie52WOi$OCbs9lnFs{Aq0qrT&vdrq>%J;wP*i
zT_xleib+GL@J<Gfx2s|jgxogm$2vM=gsQyt2DuUEG|*oIo_+|SiwqB$qGob{QE@B7
z@C{w16hH`5tkJ)8IZk&H;r?n)Cq;9~pEot8Z92(hRT|JN=LI9Ix440QY_xX9^84tG
z&)qZerEReDnB6()`E{3&PB9_!*AHuHkJXwXI7p-aWvK|Npu77+YSX7J*r!=u)d6Lb
zYfJsZ$|Sfu!}-Lqytv_?xhwK*Fncw-hHZ@eku2*cj;4K`++c53U!p1h?~-!BJpb4Y
zt6%V+q=-rg!+~d%vK&^?#s!cYVa4gUe%)#LB^Sw22l<zdSvIjOQkjhh(U}xIwb7is
zt5tqQn|r%wqw``1J+1RRY5#_<DMd(=;rmyr<X!Zk=im!HS3G<vTk<a4&T|0;`k#~~
zcXQopHFa!hcOJVkKhELaD%~2Hn#q;3%BX-0F<yGeIAOh|r;e0-NQa}4$NYYtw^IG~
z?A5(bYThoGt{WQg=iOPvI46S3*`1@^`9gPggG?cB^NKlb+acPNGfQQ*1q(GQ0=Ag<
zv2lcsxOe74uIobvMP=s#SKVS_L%E4Rp<<lkS<0^Xe=c^`MaZR2owP`K8?9qx4i)(=
z`L_5i+@_`ekegKZhH#C#&b&mXT<?;RCQ{aJ0I*$N`&+<VpQtzZX1d)EEi*Xu?vE4t
zj0keG8(0c{9XwOnXfRKHkOg=bA4OK(Ocd5?J!Ross~E01_x%dmJ)ZndBOJW(iEbM^
zs`5Kd)fIcGRPaPfh*<VT5-&WO=qjH1t7|Nqv+eTlAS1q8VnrO(M~*`7E#j#)5X@~!
zK9!SdqeonY`HM_>-qBO)2B~fR)DI8Gk1%1!-XndR<>CW(o1dhW!V+T8B90^~HMxVF
z-1*{MFFBD2pB7`6x5SIbM41CkW|(R30Ifo-4VZ7Z6sRaejIOk|im8`U_TR=cYD^|x
zgPJdc`Oa?3-dYYUt997OWsbhnPjaHv`n#XUFL&<%fEr%Egqb5bw4|zKxjpQNCBIR#
zIsa*O-}n=pCa34Z_8Lh%&1sB<nr!tDRHZs=^Da$_-WoJGz)ho7P296;OKqZ?I*Ekb
z*obCcOV6O^-Kjo)DUTTNNc6fJL`D_0i)W-+SJ$(9No!KIl#T&Kgug6^M`!>lS-;zx
z;1KM7-QQ!_bTw!j!P@KTOwxi?%y&x-rij2;?6IRetFs#Pov<x4Y2`6eSG-&|JzKgv
z<wSm$AVl6y+DWP3j#-l%ttytN-`78Qqk`;`>NtQpk%L3%;^dOnmG>4@$?;rhZAZaf
zPV&BZWunO{7;=zxxU`nUH8^gzI^_3_J$l4X(QsU_q_tH*GDqQ2@bUl~pk^~PO;H;-
zJBKxBiFEB;mUR7IDhI8`qPqXyDc-W+gMZnK_#L(@Yb+tHgFLxjQ|dJPC~&Q0KL);Y
zm%n4W1X0c23(oDRBJS2O`Y~)WV@;EH^0G!?2&-*8k_@d{lUt&O3Ws>)bc)DjF=ysF
zDupHuJtmu=L|DtpW)5u-wVy-F^$gSwWcM9n5rY|;mX+f*bqLDf(K5@9SgMMu?!=G-
z|HC!-_O4QjMP<6g+CFDUt?=YlN2%N50Yk%ce~z{_>8}&WxO-T{&N<rJD#F1)X>uVP
zchw{_IF}t6vb8~5t2?wAuJX+-8n4N7|FUn+N(q_sOx77(lhQ}5Dv>$YG9*0-D;<pf
zkR7FtD)usoyp?84Jm}i%=#s1dksh_RrH@(wrc@DER<=B!gBj~hu=6icF#Fw}E$M60
zYX0tWS*&FzTditYY;1S(Bx_|dKQL%}SPX~iA=RzY^9*e7`l=qBX!j|412QVA+s%;V
zDO7$#dKjlNCOYX^SBf}T?MabCPIEaR$4>2TSB2;dm%A8g@Yvo-s><YQitTw&{bR$Y
z*<S&KMwHHevA3(acJQ5R(t&oBs`iN)m6BQ`OQmIt2B*s!&`)=KY$=G-Tb5Yr@6Y!$
zQzq^RnON!ogMQIB1*VvrElCjX^x5OxoT@8{E;$)+mHA-V-sH8pq1@!Kkx+<81$(~V
z%q<00zGu3-&%f{#G$rh|^<coRDe{~(Jgjhcy#?yn8c!?th6&r!KI!1AB{AWl>RHe4
z=2faVZo>Os=MhTCL3g0tl3(&b-ECoX39c^X%1)OT10#QW>=MMO4YOUoXzuhMJvk7)
zJ$PC@ag6A<ex*cV5hYBC)p8dVQ;3F<-yGQjC=joZcx#B6^cTOk?W#(UWKT8X$BKtm
zqja4Y2T&ze;kiI{1#6EOC<5Baa5_Sw<H83=DrZ#>mU#)pk4<j%pIQ=_s<B@3tC8J!
z6USni3WW{(tP$mnfR7f=LiO;#ndC4O+7dOxaB`nDz`n5l$HI+mKq|9W+>YT)n|uAc
z1VaV{g{swgcKPTdF<OACgFj9pLD2j^^fqwg?Vf;<L|3Jtm26#Dx2x0UjS_|ZE4)E5
zs%}SuGBij#7KxiTPm}jGow*cH4*k?hQ|(dkiai5<KKYvU9rmp+OSm;H&{eH_KQPu^
zl=VOm_2iUF)qC*Xav5#4b`2Ynh<eVZ{kJ?rN>MMDn18&>N;SSKMcl3^K^|zV1@>63
z8eef`FCQB!Id)qpOh<t>V0QSeGOOqEZ;t`<+xsY<^W(MvFQmvCAl}SLqm(YU(|lr`
z<F4=Zhs3XU-bkMlUmQW2^y?0D(A_evi96&iU75YujM2)({gUeZiHmK<r}=s9hYYLF
zmdbmC?^P-hYSfwY?-)Z(fRsoIx0I(9-kezsBU8GiDqH+7)S7PUcNHf}*Qj~KSWCod
zK00i(i|jCp<Z1a9T}z?xHCRx4Y#?Qx`gLDO#V9Cq<x$kQb9Nj_Oo{Wn(C<-?y70^9
zq*n<olbtbZo?Xqirm&G&w?nq)yBRVi^|A*C)A)<^aaV@$aCNvhb?XPhx!;FX1%Te(
z0S6Z$<|`NAR7L;hSqbd=zc3Z--#fVh>6lTsxmi0cL6c{|ko5$b7!J3O1u~!0bclP~
zj33B6a?g?W$zh4kP0v#qNI9fhv+?kaZeN-^qGX${pA2V~)tetI&M75%?%RdbvFTM~
zFL{s@V2brY93WAXRbQVithO7@nAqb<@~m^T7-kN5O0Dhw$&&OOt(O6X<dJu*j48>T
zteU7fzHZ-9tej^6%Z;k<&%V#XDowmXkL|Y@R<6i}?CKmo#Lu=_(meP7*3sstIcQ;r
zo0ExoR)<dH!q*yB;B`BoWXLk-q!ret%zEcGY^rsvV#B29LaB&;Pw|vrZ$My{s`13O
zk>=}z&a8t>MzgUvc@G#;lb%&mT7-TcZv^v&YIl-$xtA!CGZ6f?Ovq1mNIj~WU4lbd
zZ4VxxSY%DM&a-nzjzV$zUnqVfO*<i#gth&hq<Y3iJ!GO>4fOOvLte<%V24H;v4lOY
zdC=rAyKp3AVMf(k5(CyFOvNlZFozBPiHG!_aWk+vs<Ja95DW3`>Zfs+AdOjAe}vQU
zg?f)YMu2z7a`T_k?dL}g-tIDa^j(<Lou#l*Z7PulCyDqc=D-w!RS$06tRkvk2HLut
z*5f9&)s^_&+`z;zL9Y4<^RY@>+=VpBT0bkZ!_AHq0HSydzE|w9<adC026_5n%xh07
zFuJJULa*t~rc=kNMlIRNPOGDC=Mq?XT0b)#ZSmFwYb$n<6{l#W6aq_vfsUXVW+QL_
zwTF5+CaNnWO$<$4D;ro-j*usD0CT;#q$W)^!}&vmIWJj1`H9rZMqd#OR}Vz&N!TR2
zg`I<}_F*S}Qs0S&7>gof{6+@Ab}@K5A~co)(+xfbX7;MQM!qAT#M>$G;1~L4Nytz_
zYeBK<UTgRmTi*1s`YNYDT}!3!mLelnem+q7^&&!#BZjD{L!tF!#s=E<1V9eguy7dL
z=9BQ0*(l#iKK(gVo@aMhRK?+wZc$soM!P^6ca0>bqP@6pu@#Q4mW{=UrV(V9jf|$`
z4<v=U#7YNBqRbjnNDUFu`X*cN;>H3e${&bVRbP1$^yNK_5Qua+4h*Np7zVcjk*r>M
z_u1MCi=vr?Pu}sP^E0{7G4#{Jj>ebpNr6OzU~mJfQ}K(=uHdKue<p`yu1J7y@9gc-
zc8mH!Q8yCo?SnZ&qkh&#I@J4W7DK>nW|0z@$g2jGGE?t2ZOVgCs~^vqLmT@BGC_bj
z5j^x4I<ivR!!;UGz7-a0t7{>mcv1vPYx_qNNOY)EAZ6IKD^p1+=_93jtV$zMfa)(K
zSXt&Wuo|>0>*yZnJj!yRYRjII-AnSEF|zRH&=aNa-q9nS9(d@^z73f?Rkuw=tcO}(
z&W;IbeR~>cd>KL!--^?=#Kv9Q_?G9a^P*fOk50_mxifjVKWQyLM8Ds?2S8sV-S4t9
zywEhx5ie$_Fj4qONKCX1x!!srwF2(?Y}HAyrv1Uaw4x^29h_w;q&uSbYx0d39bgm=
z%s2?UaV=-tKwdt6GgV;M*ETSxodPfY+)MDvvG8*ry%O>g<@D>ZxZw%#xkd5gbGChv
zY9aqZs~V&Q_+QpJ$Y5U+7Pr$zkMr;#yIQ}gAXSNKd=P2dvrti4Ro8oRF>wnAZYAi~
z+;tJZci4I)XpR$g&*2i_#Ii;<Sy%TBf<#fX7_IX3)cnBfxgC|!cWUj}Fuhqp){T1N
zQp!WJIP*_VSzgC#wV|I!kncYIBlKF$j?cRK_A3_NO*YZQvR-qdtt1K<9|a8mAQeSO
zwZ6P>3_IyMK9UM&_G-{LvSQcD>sD4A7QJ_pR)hvgpDBAm7FErUr%VwA7d1Uf1NDc6
zP3-KlEV>8l7x)8Jx7^1-ft7@XV7=zclC76a&JSAihLpja0{d$Z9a%ZG+ewQ2qLNEH
zmcS|r4>^8YqYG*UrLs?$dNv{e@1~u_qb2@wYtla#qZ#&VZzLsU$v^xskFw`DN;z0#
zc^~!7q$u0tGPIh(`Z9KyJ~Vn%-DF^GrlpcF>*4Bv;Pi2X?pfK)EU@#dzmO&uVnUo8
zO<GSKMwDu}i#qwp^I?}WW7ddA57^i;edv9bq{%7X$@sC-KqSkje5V)!H2Fsfj-lsB
z;TVf{AR@3j=qSbu1Fx)8wZ|U9C^Ps{zrOA2hr(kpwUx`Ga?PzO#Jy^`)0kgvy?gYi
zjuX{06&ow%<wUJ~ZPjDaQk*TWCn|NgCdYor@;sQ|X-2LDQ$P?aQ;H{dX=8NAhP-tx
z)$;^4s*BB<vZF4VPlHZlvA8I^@vhd{*!0q4R)R1Q4OBT|GY6Oto@CWcTCCPAVQU%@
zM`*FNr_1btUb5wV9ipwJPUavf@<tlS18srD^aHhR$Kf%IC}w$F;Q&7cG|n1&q!Ya)
zlYPMf!FK@y>z>nf+J6<_b!(qVk|Q6->i9A#ulsh9XysL={0*X%MF=9Q(43B;3aK3g
z6Vx1UjZoV*{!{f*zam>Cj}gaMEZ<K5C$*&w>N44G!s*JNs#f=WrL9gA_$c^%J3|F_
zl;=?@aQemiBbO%2tE~3!NBYhBvEjUKXcK8{{AiE*P)At0sbE#<_NlV=3LQ?_9a<;L
z#rsbex4>CAbip4wn^fi|eitnnD^7~!25kMiL^E>|Lbf^}1Rg_H2-hPw0O-(SYED;J
zfNN9`Ncr~ggl`-qn0n22xr-A@;uICu)_~gEm;#5qtNwEn_Sh<ylAS#*3|0QOXMQO<
zDCJmCXX?^`htS25<S{H;wB$cS(dKv8^tc#TwEm$lq$;~UM_)b%!0+O}mS9^Ie>W-4
zM!|4J4UO73EGWCA{hSJNBTNIiTrerXGntTEQu2&X|44lY5{2vICJ_pmvz#h|6wg7!
znKr66R?cun_+8gYAyOg~Zc#^XAP227YgO9d%D*m0dVaJw)Vm`p6ev9OviT3G9!YvL
zIkXEp(#*{X<B9PO9(2Yxs=?ljJow4=dk0uK?fTejqnmqiIYNb~*0K1@v;26wLY_|m
z-+$`2GmtBlkc-|v8<4kUpFQm&pNk^NlRGCP6;zIVxr96koPRj|X06l}_AlNs2%Gye
zcPd7GbmWxU>=|MC^)&AFcd2dspe_DD9Rfjza%`aV*1>xrAbgNZd+M=@&YJmUH|b3m
z9rf=vl1$~P#p!22-ynNSU9<V0691r|-283pU6Oak<}Cg#!a?t2KD~IUeCO3Z2noD#
zbPmx9i|qfLKBW?NrE*?0NNaw)C@u^LCER!R4xSxm>Rt4VWnI=*hkvq<cct1o*Z)+`
z9HQG&pItMZNZ-Bn-=3c_=GW*qXt9^U;3I#VXqu;3X|JhuGmjk6yR!{>b!};#?#`Az
zT&bEAO$#%obKJneqUHOum>3%AatfZQ*gd+layw+{K&N9ZL(>2|T2{<%?VBT;*cmAR
z#VhT^vtq`lQyC$vSrTigtrggRJ<XVJ<-Ew?;xs7?VhTy)E!nFqo$iIO8Z=of_-w0x
z(%PZtnl#3vCXYQHvXj*@J1pM8f7q`nU2=fVk_eeUYQtp%4k4@->-u8CeuNYmT{oD7
z?-TDBTL~#3%sKfbXC2V%4bd6<3yir*b`2xh1VtG0pL&F!PUfb)iVbmGL<BOXjJ7z<
zb3w(DBmfGB*qtz<#Z7K6R-e4P%87ZKOO+&7E|o|hQnY|lo`It>4$s-2$$c1MbbYNr
zZLW77)l&s*l>2&3W{ruq=<sa5+<CX8J{O`4lLSFFaK~coNu1p?w3$J$&}8bKGyb46
z6YlDvg-5MLF_R2D%3=#marB_YG5XL85@0l46@nJgyd1KO^fmK7SYTLB?7XWE-z=ob
z9c1hz?$qs(I>dGm-`V|H#9G2m71%2Cpg}(=YtKoDtk2H(PlU3+xE7Hzl!yfc#`YoP
z;6ScEkKL}cEVJZqZRCO2NF&!|9q7<B*{j%626;`c-hWlC1F%Z`hG4Ak)7CH3vmX|P
z&7r}T-OZfm*k9&eumk>xYi<q0$z4Z+4j|&IM{cJ2<|CEBMLfLkVBdEo1Eb3)WR9|T
z1T8z+5#}h8B1exfd3H#;CjtRNv2Py0mTq%lDq7@vyGc<SQ`sE!D*2w2Dgw=d3g}rY
zsyE&J!A$!sjuw%#plT%sS-cSrm#U_LCLY0)zr=O17MatTBCtY67+}KMQ;w#cta+<v
z^7h!TH{QZxF!gm8o0;^rO9T3=O++YLxk%;obX<k%ZrRNZ#IM%8pV=QgPY=c|`7EDT
zYAIO<dozcFf+giTE@93rA{IAIZNU;$YLJimbvrh*gk&n<-SR|nE`Iw+XTasKqGOe&
z`<_($2=b}Eqi>|yK=bo61%yHD1MDp*L!HMir53Hb{y~T5PI=rhX}hB$cUvk&VORZE
z50u3h%==W?rrE*DVIb97aJ%`VU5|WJ&Ol}*+|C!ZFj&Etp4?fSftZpp(>b>|1?sV(
zX~}heW_@frZaok-mkspt+L#JBmPY*z&_=sUrFgzr%=Nf8yIrL(hT@z3DPTR@Acu@b
ziIx3vvHRy4$Mxp>rF4MZ>0{CNr8haz-vDd_0sc~9-ed}m|GA6~`l(95On1B@!&OIM
z`hLieF5_lokUK4RHr=d5xeR1`Zr?5o;bupG8#MKBWGK%h;<DOoX(H_ujCqqPT4_{X
zuU<#y=;ut}%^!e^@6ey-Cez!E@Ekf>*D;lh9IDh^KH5}SF?|0Oay=%8FDDk<^7)^T
zkSfl0Ip^r3Pj&{5BE!JB6F?i>4}mb~UiX=61AtB=tLc+YmQj>;0q-o3GA=G8G3G-I
z-~nA*-XAWOGw%Kc{6e71^cEi~hDn540a^=?t5OM=k#u98>u9B~yHSmCJ>I_Fd?nLU
z68v2T@9{&y9;}~%He}N-0AkTuZFYCJi?h?9SE@vqzB`WE%x!reyR%LJ<gHZWriFDy
zC|B1I?{Z#Ee4N{W5FZLaL~nP!%{OP>*S9T7y*DC;IWkS@L*e}HTc!U6FPeUdxq3Un
z)gIh%M__jVAJ<8;g>N>0uY<1SQu%pIgw+GQTGS?4-6lGF=+AA*1e+Oq{MScSy3Q7t
z+&j9Pn+L5iv6WdD?S=SG0B+Uk1>DZ?TJ)Y9p}aZPI7c~OQp^A=#bCH46|=x^2LT|~
zgHQj&s=6*e<(u%8ivjXS6+UIJbDp`rvGUsm`j2~kOAVA{p`@4OMtwFyXR1YK1uv&E
z3KV~^Q!R~X;?}qv0<~YMC97%ZrT(KW&y~2`g!+=|!{pJ9FJ&aV4M7ur>q8CN_!=U3
zSg^jl#@B?+nBVN9J-0^wTn^Z(CHoT>6k!!^I*6Y2EgIWsCuI-Nis^$Oec8;mN~S@U
zR7YInM(*I4DGyM^V%sW2C(xHI7%hewGa@qDcpdt;-8v>jEXWhgiq1lc=U6dDDr`<)
zSXN&|(;7R*U-cLMZTf~FqpOyxV=<d4DV|rEhzzC-Dq2_OEl00;bT@nLERPy*Th&%U
zLY9ghn!GtX>a0=K>0c~`G#lW?X5_~|SHZa*0~t!mQn{HiQg)<{KM5PO0%l{DTM1s)
zwyxA2Qifk1h8YhFPA*6nf?A;QCM`Qleo2<2CDL=5Z1dDfloo3mxXVl1{jl_EEICjM
zkwWjTYTh|h669d!z5E1!9VOtb#g3j2AG&ko#i!vxuFEe{_4|t0YDjQc%4E_rEY@xh
zTG!U8Z??!K^4<+50}ggVzAukf;$9SwzV^H@j=PDX`7|Y$2F|UPA_vio4ijRoa5VR*
z4Bbv{uvM-dygQ%cFga03HSttxnZ%A=t`Dlkxue&ru+$Vcs*XL#W5m=6V{K+x53@x0
z`$6~ZV=7wP<23af+Y{^S+Lli0kY{z%mVox-m(<H}?Gt>OK|WoIdyCM&zA`QC1Y0Ta
zfVepABkY?~LN_$u%jBT#?he)4VzGv)XoZqd?4)q(6MFlpQGF^|6D{7GOK1$Q?8V*7
zU02Xlj3|l%zvbDAZcXw4r6WF5U{koRnA<Jjpl4Kf#g*OAi;7SjcOP1Y-mjb~z^i}>
znSt+&Zc0qiviT-Gpl;Mh=n&EQmY52U*ti6N1}7li8h_pMQXsUc1atO-IO3INHdmOW
zU%G8Y*{MfDD2IRh->|KmzW3LS_r!SQJBrPYFO~u~+ep>%Mzg0=;jq^4W8i7~SST{O
z&<~dWQX!&Jfuz-m`tUL-Hv7>0(%JPx&EU0TPA0zNdnNJr?p}GCWA*Y_)U9_vzkRrV
zPJnu4r+QE2h^lP%>zKP47>L`TRP)=03cYu=Yk2FDn>wK#|Gwt^%Qed@6$|@^dsyT^
zofFpa#vewzCU7M+xMw1Gt734%Y0Z0EWso(?=2w44Yl__9lF;7>8o6Ckb+-c<E`k#{
zGiHcn1ktuWguBf1lMq7jk-&YPx*XwBLNQHzv9Ud`SB?okag>;9O*Q}~czR|yJsKGI
z;sL_wA1qmA?aRU?y`s%kn79`D^#B^?`ZK#U_Hk><jVTWcbjZ*pBFrqhxL16+y)OaN
zt`c~W*(jw?WrQ0|Wz|++U|tyQzP*!_^3-=K4<_60WBFUJ{Y*N6r%}O&J0!xRk%Q32
z=^??hb&QMH)<F)7;Ch?=ymtokqx3kRdOtifE+`;EcHLLm?tZsp2r<d8SAbi6y|I1H
zuIM{BD@dLHrt#VB8JCBei_bRR%`s8|^K$GH(rlw&;$r`4+PqRZ>OpcF+*<Qt-lTFB
z#blr}hz&GqjXmNz&rdPDFpVnU+kH2O8zSCD{ON6JEA8ZwT|*$U;F~AWQC0IUcNb1t
zt;g8?6Vtnwv1=TvP)D_=hXKIKngf!@we8?D33}HhfWCpk*_WK#=8UG21{~r)mZ0`o
zT5m2YkBj6lt@3hJztvU=iER-jwQ)FYi~0&n7_Ip_Wg-1aOsoQbY%CtlyOs$X-FxYL
zIwG!@#@{~SzD0OQ)qZKnA0;(On7(V%OOLwL7$0dw5<w4%i&P80Q-K_7zM*m|z@{+_
zapKB5(Z*!bJ5Ht#`^mrfP(Ec=SDMoBXL;)8@5F@Sr~a(J`p2iP)7OFOgO6VGF5H6+
zzJ5}tktpLIryCcP{Ib4wsHC2|1Y4TDD~NW4irAmeqbd|T*2q3@$sY@`3Oj=z#U`BW
z`9SBDV%tB!^ErR|O5nRcGBG46N*h^hzuu_zEiB8u_p$c4yqoKV7Z!>YuMIP0;)3J>
zF(;n>-JCF=;XQ=v$dsn)_$HhD$jVqR1kH!anEN<CFtU<eDgRpOw}0>bDx1!GvaZ8t
zuF6pJ<~Ow;?9K<)GM^L|-3$gTEbjP5zVOfdb*4^o=<NMHH{3PPg{~4;z(S|(huY$A
zPq+l@L@F@bcPpRyFE+M%nCBUTr4wWuSi?~hH8DT^xfeWs@GZ(dHc3{F#>y466+#ei
zd01Z-U1Yv*ANiF<RZW;TZ2hgAbVQxiJ|SZM1eRCw(6f0Z=d<g8zU!;)Kgq_d(v;2Q
zyFPQ6EYeG%4|1hU4HBQFrK6h6s9j)L!ST_h#<|uje;yU$qg{ng<4-p{$~E>+)R6u2
z{3`Za{=?g**c%Yo#!6<h&}(Don8h&_Zz!fRuJr3I`h5_;v}tu|8c)ct3S%u|Ul_Hg
z5`R(h^z2#uC0m)xcvXEKD7l}{Vl&xzB&b~WikJMYI<!SiaQzE9*V?@I_?FA!xB5^a
z2gV;c`h%&D`aKq*@fUp&A2~z=2d_!_i}QE%k^>96zGclhoV5CsNSu!J5YCRfR2l|e
zR5_(P|1?#<LHVJM+Fh%Y>8cEvPw1FQtY$W+gQ2<bhh)BPpK~D*W50lGLxKIYLxSi#
z;O<vmU#5(8Bw-yucsf0*4sdP|ix<ZON)-aZ>s({%!1Z@0MI8+1LyNxt!1_@5Yiy)Y
z*H7v;e5LZ9G3$O#;NbIxor9pWg@SUp5OsPAIT?){Jkm3@FW71AVW&)ofCQD_N*xaX
z;3x$N_I;J*_PKm6uz~(C?c&n8<EfZXrF)H<n*g(^^<$CxiSH6ZlXrV%79Rp^*7MRe
zXBRm5N1pV?hx#XKVbo;<0)w^q?$M8B0e&F}r!?2wBIO?D^&YEAl4UfWsjJ!4m}Ufj
zOxFnoBA&FJ){J~HCkDiGQv@ZZ5}Uvi#Ex-2XGYDQ-i6IU#5*wXO!_?OjnR-Gjeu_Z
z4qna{_FaFU{K)eATkp;$v8+qah~fVEkoi!)D^rm2GwO@KQTC6CZJG;OsQ>~)xiPEe
zBhWXoN%IZBw~>=@TT36WhA+LZpr|!PDDjq4&pA4r@Plj57bSh6IUiR(UJMRJ+YKdD
zRj7?K)_XP4fv9q$FQm1}$MUP87|kaa#ID_)IU&8A7ps1;`i-?HP{6@(V$uw+WuY6~
zb#&(|OAs`v`oHEsUbtQUs6t=A)?-Y(?fv})Qo?GAQyP7{Ew5a7i<Q%Rwk|fvP}nGc
zCaq=Qo#CRfc5GNuV<+`vPsnjAbN;Pzn})VI@;_3tfkwnkes8|>zti*1Pd?|Wq8UJg
z;!{pm|M5tu-U|@DUoh(`=j9o2Tq|H~x{dSk6xDL7f!QFo=@r!YQHag>)%)&k+zIuW
z|MECEg(nuUws~>A`dWz#-8QM2?Nl^CPH(+-rsjE9x7x(|X*q0!vGdJ=68KN6*x&ao
zd_!^lzaErNWdp0v4W!2)4cvl2rB*R#`2<3re$e};dVKKe(7?B2kq@*3GR)t9vxuye
zWZ119aBN8{Kg!$5{MkQLS(v5W8?5_rvQUfbNrB>>1t&no{eQ>vM89sHuRBw9>>w3P
zU_RnA&*M9x+x7baKtoB##P;RV%#S<VuGTwss5D%>Ot~Q>Mi}Rxv7piBF~H@<9z2eF
zDqakRUx@*qgQgr5n+xyqosyBYpyxBoT^gT1pAtV45x@0!e7w@H^3Aid?Z<WV+Pi0`
z1Sn6_d@9|p$(H@SY$2jOQdBh(YLt7VKe4(du2=Wylz>~#Yt+RsHM@td{lA}iG;9@+
z`0|=x^x&pm+p)gsKFA5;9$J_2CNU{EOSy(?5l_nF<z{a);x!I#WO`nHy{Gbp*vv7R
zm-S`6`?^&@Uu5N}xRtN-cMatT(>Fncj2Lj6H%fZwb%|NAQa1YEUF>CB@t&BrtrY#f
zma{&8IEED71^K$CepMZw9lYf82xuNLCxXP47;ctr3P)}}jpaf<n$P^U_U5ic2MatW
zFNOd96QI7>=IxMj()-4YyyJginNDw!uxO)1$_$4na3=?GM!<>~V5kuw4O;M?YPh?e
zVX%F9^HO#ctef>g^b6vlob%6~(TjGcs~g6*$CUZ+35Ri3ub%-Lo@$L$wfO;0e>^bz
zX8i`u_k+Tn6mH$K_vJVM8eg?Csc%xiQFa556Bq8JN<AbIRs)3ucsKY@HgZh_ifpW$
zOIKUD!TA0)M|iVs8}vzrt&N=0q9(kV`-r&MbAQ!e_M#s1t(XK;yUt{G@f~kMQ0BK$
z(DClbp@d`M+cDecR6flF{k=7<<^wo9flADlnrdHFj(o_Q^%Vv@4IJssyDvBXdHK)h
zhTnS5&OSEjA=i&_@)0;Rry3qU&a|G2<mtA4)QH*r`hy37j^})=7OdI%{v@>R%&xMb
ze&!`;v1I>c+HozuGpOE2V4vK~#1!6p<tdMoA8~pnHTsXw^qETk9{`j<Yrmoga$z5E
z`1x4pu&(1=!cV$G1Wniz_PJ8}3g1y5yn&%3k2RFyQwA2cLhrT`N13hQ<P-JO@$o$T
zr5Ci3;0GVzp=;1lj(YGz2jUJ%z~B|*EjV#;5E%8qeJslK$m<V2i8}B&1|0f;1spwl
z!UGo?bPOKUh3&wgC#JgSE4l7R^b<bkZ>QHW{RV8(1G#*_1rDFQtjGfk`QV2ve1Px4
z3%xj^7x>hN@2H1=@Clh=dyxj;rM3-R_<$b?+^`)OAIkX@^#KcB$cvPRxxU1Jk3swQ
z#qblfPA8eEhZfsNAe3aSQUIw;o)0h&v68Zio&qn9R7Rd7DLFdTM?OLJuY)F!Q(6u>
zKOSsB*af+p0)mPy)D1#ORTvc2l;cBP<nzZa^=br%$=NvE0~rL8Tb%_44I7P5!;v8L
z;LU;xdSKqL%6l+mfdIbK2`(%jND0P}NuCJ;$Eb&<G|*fR)zb+`p$qwtpVu?=foEPX
z@Tub&Eq)qcn6_dz>5h{stv7L}iF&&xMbc21D)Y}m3VUQj8;b-@;&C5-0D<Ssc-e`J
z14Rny!(vN|6zDoNJ7>EeFRXDY(Yhzq;w&wZ2_1_scy?$F<_iZ(%<MTZiH8UtG@Ume
zlYT)!q0E{?i$dou9jKC7`XLt$raHpK7c#2!HK_<Y_0k$wH?x-$S%>hY0<GnX4pe}t
ztW0*}C(&`oiVm-mfcPx^EQ6GAf1rm?)OA<Vb;8FoG`+Y7pFt?r=qv;{&^Fi_G2>?H
z3sk<L;rY2ToTMX)0t26gHg>V{>kuC|i7(}QNoQ<_3}X^M@{$J%wJ>-8p$tBdy@DYo
z$x+!CaFD@MB0x>n`D7YCshyO`+C4n%dWx_2ootNb&Ty+<`oo>UWy_aay?+0YpQ^x~
z5hF(Uox*kN*J`n?XI9~jzr`pY*Q)kJ%X38;U%LM?y^@Arsh1E9u_N^J7+eqmpZ>&M
zQHbbAB=5f}=lc`+=x4|#?`@T<cjAm5c+gXiKKW1Z3mkmI7GV-~^ndV?K?+*O7o0N5
z^~iLf3_M^3xOhZe@Bv1m%nM1NbKY5<19SP{>vq9U_HiPoT*{j={V4ntC%^nS7kYFz
z&LKPM0}p<_5O%+Uk?btMr9bkZ3p>CH|Dh+z{RJ=O;U{FT4?eh+ddl#DA9hB<hTxxg
z($|YV4?6IjXUZgBFnP%21wWUkP8PnT9=;(19;Dz~T2Du23`%wq!x3jpa#DTR9(>{m
zukcy;g=5$obkP=hI`Z9}i>M1-6TWQG_!V|g2j9FM<belH=n#{ssLvmxov8z#E#OIB
zdX^{86MLeZkQ5hLJ3t?NX&WC8h>xs3;to1^giko)yTIcJ93Dhe)JOaUoMWB`e7#Pw
z5x9(xfe%kUrEQSjACPzjKX~O6^#S7;{PS%Ta-fSmxSp4NVvy|0;M6;=dQkX-W2#L&
z@Bwu22^?tfCBDHH_@Ga;W5itW2OoHpgBRtX2^hFxA4d|f__%&5V>fv|c^rphf&K$G
zcymM#_=b$&%Q4R{+9-7JKAq_ibs;x&2pVZCySmB(H?L3V<b0)1UN>|EH{^tF@SrZ_
zQD6EAy1?OxuOdMovXt?*&hsZv0xx_;89o8a!=sL4<bjhv*tw{*-{y7C^NT!3bPB!j
zH~B+77ZECjHp=u3neZkbx`#~akO5sD9{Fga@K?|YxeG7BsnAr|{YySR;Q3T5SC@#3
zI8g?dL^(B-7Z3OaZt6$}MC%#&Mi+#oN{0mM<CCu=ANBcTPxW~m99a0s$>eqJFAka!
zG&BHtZwNTZjpX^zsPT!i<AIi=^T6XSS9XFHIPuWz8s4PRV?Izq26(|g^rMaxfl3~H
z=<{^sp$&SD)X^E(k~dk;$?<{^o@b<^@gv_X0(x=BMR|Vcn@PXlspF)sc~Nif%w!7`
z{Nkqq*(AxbRf<4IS#Q)7nvx?W9aNS(QXLBvc!>@kJX6NPgRAcBSA=6ba=cPlk}VZw
zW1?q~=07VypOKRALI>xld6&Bwolyd~e%q66utM=gs^bZXmyKvBPK#i_&4hx~sO|b_
za)c)MLA7Zc0sg?J@WwWM@Uh;&N_|>A!Ge0(gFyTaD6===sa_`lmH=!uWfGv_RCv-+
z`J}%Kb-Pi(#|M$c3J%|Sn~H=vD+^f!C7&rTdr`w*4kTr0<KAk3Hr2Bwwzu&81wz7U
z!~eao8auI9`k*&uRi+oUsI2xS&fKrbC}AiGmpbkg((rf{UHnh<;w~Rat`^R0Ghwod
z4(Qe<o2#_#m^*>%*01xsgTyH(C4RrBzn*L41vFypqWGdOxD@27Ol;&+^rh$z_=&sw
zY)_5n2QiNN{BHxogSyl=owInSz7_o|c*lSr_(=vQc63cCa4GrrSqX(VxTK)*Bi@of
z0`3c-3<n(oH*b?ODZ!yG@B<#YQZAiPgf75B26^{!CbtVe=^kbH7WB>86c=8CPyQG_
z34g*X67u0k3cVaZb^NR?ke_S>FX+SXK?f}C4!-c>Lpf~7<NNdA;*AcWA8<adhj`{`
z^Ek*O0S}*0MvluQPeqoJd>_yp9=xb``SPv*e1pn)ndGDFcWT5m${a}?;DP<{&9`}i
zC;P!cDL)FpG5CX**D2^Yf|p>F5?;urafn^)2!oTYNpJ82m!soRsT6$C8(676-~>(Z
zjAQT&oH$Y+u*gFbbl{PXcL4~yAe;8`aZvEkDQG!He8B^MxW3AVoI+iuL&)Sv;uw=}
zaPxWshaWhBA2i^SLQWnhWKu_-BY1iKK^y)J`aBM87<j>hW7J`Lq|n1*st<kv_ai#!
z<2ac=BJXnL_rjPic<>0HfSb36`oIB30v-w5Naz{)JTL4+8|vssdD>Fm(ax@?@JWG_
zf9${k*;nubFL1+u!03}CU?k=jf$J6eqMURu_7k3U=R5(gkP-R?KJ@_$Uiot5qx}OX
z<i|1Kl%e5>+<>QT*(e$ua{VB)EARs&bfughmqJ$Hg^a*Ue2C{_TY(dF(aw3g$b&;F
zJ%%4R!k-TbIub8_^qm-)eSr@Q+)}!rM;B7?i6e0G=m9Ms%26M99K{1=bSl+^DkY3S
z6FvxVcn?QacMFgD%%T{f{TOxNL_$V)^#Skp_(m6mFbiXYad+jYi(}x%k^1<gmM@m0
zzROWgcIV=38ZR0KhFN2HBl(LxvOtMOrtu=M$meOH_h+)ypz(qLa7er)gNZPFkO2>l
zBzOcKW%3~}@Ip`EQ3oBJDz9_!0anCK^4W%`m+9y(OtnpzFkXwnCZQ0Na)<tPeb*=H
zy;wjg-{CKsNdp&n&Qj+1oxg}vf!z*lkw}@S#=vG}w8%)VrY4gEi~&uH3ospDgCW|Y
zMj1ay?n?-j0}mvZN2i6{Pus#0mAZzvrT{Dx#2}$cS!A=IK{g9rr}9OlI;M1M6;EF$
z3JDEZkolcH{2&>sfurk@7D29BW-l5i{Ut(4WnYBhkR;Q8$X+<u(VN8-{4g7PF$6?x
z)SsBTetx%Ato+J4_4;>vdCMlWh()02or4%s1wH(^yXw|R2K+m*mqn*9=0rwWv}u8h
zY%T)`7gdx)zbtfI4kBGBC?fUP6`o6#9xNa!f#Z44N(Z@tX2ZYumhG?PWVnt_n0TnY
z*iL(#-gvrUqkf}Pi^9>P^|Ki2A54}wR#v7MBu_#Ik2&Ru_sDaMa>A9CQX)?WPx=OR
zrTvWhJa6)Wi_g&9tq>md^gZ~%Gh_#T@F~i6&7Cgg^qukdJ}bs?qKB4kQM6_7a~zRS
zCgpV}&nI*U+0+HTA63@C;`HD!rUZ_P*%(EiO>*L@KD2zGiBuSO(1&_-5D<HVH^;ng
zd3yL1Wf$8h<Zuk%<@2F4w4}gK`XHZrY@@%+Ch5b)5H5tdf|&`>hd!Zmls#TE-QgcH
zkw*eQ<c1B@g-&_=nD7G&nQ=s3@PaQq14fxitDpHr3!mTte-dTrvx3umTV$}{1wOJ8
zz4Xs6Rz^KM3byBT2;LzNABR6Ul7g19w}Fmf2l7aHT*{$W)I&!?4*aO+NI7_goX`{e
z$OoT1EpY0+xn+CALePaQc;xBX1rdDX82Sd!(2a6z*(OgLg`S~z9D$QU7QDmmz@aX+
zQHqs3Ztx8rarcsXQpkoLI(T6t<-ESZ2OMAQiWXeTz`!R3pQs1sG#Osh<5%J|XyL^t
zQslvhXYl11a`QCsA^GAlqk%T~04E=OO7qd)dHKF2Ka&SOey82Y=k<aHTU>U=!0pB!
z)ki{h=;`B3rcc-e-$)^kBkh6gyzb#g>bh&g;Kk8#v%Zq``a+w)7oB{ZbK&x@{uuk9
z<pWOSLCO1-a>NUH@WP(ZE3Yd!%yCKJK^ytt8}z}8dJ@Mx4e*d1IM@<AsSAJm#ebEd
zi4=B$7qWmIXq-zgE=sWuZeE{|g?yiT<>VtH<b}@Al0rUk2AuSmPjP(lH|q+wg`Yyx
z!ZvIOKfwdp@KJ(kcXtS>Fa3Z|NZ^!!QCFIP<#CEmOmqh-m-6bd{ALz}Fh$ANo5JYs
zXmLy)zF%I?DtX<G9Xoj2sK3Ah1)^bSC>kc;V5yN9&=MZ_?!7E9!;>&BxLn!b89@V2
zNU|6z@CZ2M<g=hi&QTfu&KrbWO8g~K3xGV2(tyVv0(JcO2{vic@#-vk?o2Nr>Ei*2
z%A!|HWt#;(r-=4DgPbIp$g@ac%cA2F^om<IUtcUFd=aAwzOMqrL0%M2W-Q8UQNjYj
z7jR76GMX^Q^%t*pY|(Z?pWDHYm56-61X&~+w9yoP3_?sMH0cw7XCP4|Z4;%fD64~s
z9}7C}eX*^SMFPUv4l4xbt04yw5(Oi{Bm)|Mt`gj^R}>iSTWLe4uhbI0+gpf0aTOoG
z%Z4$^dqTXDKf5U1q@CweD+3V&q52|LI=JrcVA-Rssj>_t=_)@-7x*FrkBgJ=nE>kL
zHPEQOc!Fc`r#k*+tXw0!ROXJba?%CgBcA)C84Lh2!F5}8BsOR#e1&b2B`pNjH{&5H
z%D)93u5vmN!y}$Ufp44QtFPYvdBOST`PNb1I@+$ul{ZL|?7BG%`hxUuy|Dq+km5SR
zElbkLP1E3-`UUY2!2OTl6#86-=yHVWWMbwg3c;|O7{YG;To>>JOR{iPQiyW+ATJeg
zCMH#@0*W;55U=Dj8&oKj6}&=DVZ4GV#7ZtZ%Ljf2z-2;9Ct6VG(|)Dg3zFwXXZENr
zaZFs08FmI=FGHId1x^tUX8CfWf+qSRHKjZgRuPw6x{J5Jp99z12s}=z=&A9I6n;Vm
zAGato%H^W3W2UdjgDK6tGVB2#{$9&@B8#!aSE%?Qm-2MLfadFxZb*V>lI6VMqmNJi
zGoDFy;x9E4HkphsVu8~2Ggef23Z6bmR1I=N4-k?bB7>h&9HU?4>l~rvE5@^QAusU&
zC0%?fmeWKHd5mX8Ij&2pNNtqatb&`8Z!;%E{|x43eHHA%CG^n@&KT%<mBGoo$Gw?@
z0|cYME11JypRfde$e<#h2OU~c$Rr<ikq6c#!6)PH{Lr(&ANnGXpe^9#<T=m0qB$Wx
zNfpm7wjl?4?9m_NK=Ac(F6?uYihhJ`*cAFiIYbuZ1pk7b^vlpA<=sH(5VC^@$KdPZ
zT(knb^l|(=axM>y_|1<CF;)goa0)y!{X!=7`Q&AAvU>bQ7<&;^SIHgaJfVfg&%w?c
zS$U2nc>w`Op9}c~T?HfWKU*e5U%*NzRNxly;DaFa;Y%qGr%Y{ksss=G6ndmQzJ?Os
zqR;t?+9-#AGbBI-*+se}Idp<H=+M{CMKQ*rCI2qd*%iK^b2|$)d09yYIH(%ByGKgs
z;1RYuRYJ~jEoNPw=>6^?eI)~h{eg)+B<G6)DuWw%@Zl3>aDn&L?@McKLa`U`RZxni
z0^HpPL1{1rJEc5c)E(*(T4cVV^kx@?r9x4rH06y8cu#dfTM93f^`qC$<E%5MlwJDn
z_v)FtI(eChp|KpKeC7|89VV`R@=?R4$u5nVbu~x{pm3qHD8ix*K~dN_TI#|~S_lXR
zU`Caqd}l#fay{?7k?lx@6MjKts&;JOHppTJo{4GVBic%Bn}f!Gyj|tCY?0!3js)=&
zr^l8U3SP!lARSqRm8IJ~!ctx*6}D~S8$SMxJnV5?B<l|!;WO&Qm%B)X1&$Pf2g?SD
zP#zlc6tvhAt=GX;e^SPMB@!GZo@v3MYe}g$V3>12rsS!ds?ws5#a=w4TgH}2{#-sb
zGO^P^HfT6<{@9Bep`7EQkW=a#Ty&7Wz9vF%{lf<x-CkB|p|1eRUKfN34nj{}?t^~#
z5#J&M1CW^v!53O-Nv1El#49FtphC$%cOLoEP_C<>un|2f$PRFLu@Nx0mpa+#cX4Su
z(48h_(8ZtsbO<zp>w!$SH#5uYpg~P<Usi+sqdPk5%A}X@w{YO$qB47>AB);%y^Mz+
zsy}_o8G2i(p7C=ZAVia7Y=BzCK6pmaYei4l<#|SUu7K+BgiB5BAvx&jvEjakEYW8m
zhdVE*oeezHKUoM%akwQU2fFXPUmz&~U8eWb3^NhQA8x$73LbhmtE8j1Gu19szzmLW
zf-cF;aD?l2I1hX+0;RAQdK5~us+az*ANB$Q*GZDn{_S6kMF3cwsQtjx2MUi9;W#g9
z$pdm<CM>rtSC?WLoFo&W@Ga<@$e>Ui5vQZR+zl#GPGbo4DrflEQh<5Rm3JHrRd-f%
z!6@;9zoVhFl7G9;5>MAjwJyV<%B%0XJnSp@7e0X(jHnY&bPB}+lvEH*3b{{J0e>-e
zdxOqvlfBO06+|~=0nA_-Z4!pet~fo}3t6%)DHP`+S3Ch-M~}ZQ_Fjwm@c;lo07*na
zRA#zL1vCfMzg++Q?Jc$sawHMIIU!`S1q9lMqVjkJ3*8Ro-FBdebz%BeG4%r{>gtok
zE{TvlQmDwl=Uzh(WcXj=n~!C$Nu&ucGXfohSy69l;gnJ`$1zi^0B}8$V(6Zb6Hbh$
z5l=<jq!-_bKr%dtRYTwPF_X5=z|Jmd;omL@IDpi5GcP+q-d?X4k+YDllymF^$m;y$
z3xu+gvR-mo8GTlND18^ciJRmlrNu-wS)WOIWU{=`1$Mk7J9A{xrC=|5K*Jw)Bm$pr
zAPidy`U)m_U;xTcz2GWjdITtZ?el>{IS;|m&2jF^CtV0&mm0FeUh2`$1(Hv$py;v%
zab5M5Y~y@Lj`|FiDNFnAKZg`fVwAHts}s*IW0mlnuPXyD7n<21i0hmb%&bW`l3(yI
z;7lL47peNEeN+EYu^W3qabF=45*Lj>GJ6Z>-NZZ}%LphmoAY*VE;f`ww%dww0=td{
zdvo}%M}o(AQ_#g>PMO)Ob`TG*(U<2`PKmZb5I7w4#lP^tPiRhAp!cy#IAB!k{T^CO
zQYzD0g-Xx&a0E_r>g<@u4_Lk~2?vrAu+qAKz3$_oE(k;6*CXIiX~Njxoi9h8Bj+D(
z!;;rsvhuPDz1F{6uj429c#cXJCA^`T;g?aMEGmLd(|J*eR4wX_Dma5S0jF;tw7CQ2
zzV-Et!o(2?51oR^b9aOeqRC3oF?_oqeIv*RGuM<dlXBsr0RNz>gZQabgOr~rsPlwg
zXp$zbx+kc70($UjfN#_7>NZVudg~6HmW6JY#~$&g6$Bl@?G-LpaGjohDOqe0;Mp%&
zIt)`~k1rybd<h^b|K^sJ9wqdX8F#um{6#3z8vE2Uc!=7uRptg{nYJ~0zj1pp5j-8m
z6<PR?lFL<=b()0hqeZP2Qye+j`XUuu@Rj>aHp&lNtZ`ZvrpN*TdubEUwLQS=ysUN>
zEpNf>)B}v@%Ns1w$M2956NG~61a9&R+cMDsm^MGTt)Sq=^hQnP5DTSr#5TWc3EWS<
z2^Sv`U|ju6I!OfLNXoQ{gU1tes`3j_s;3>CMmqQM?YgRz(%$wiSaiq**SF@vPjD86
zZXYp<MoCW$DcCET<Zo?V6Akv^4_{ouPr1TNbHqy^C2ggYf_lU<(?R&ekEn&>^iX<6
ze&cEwcVgLEK^wsx3lR+!{`NdJ$X~=Ni)3u-r4=u467{~qx|!9mw>3VI2;@L7ztY4g
z&~x9#yU=h<(plFtqGO|9)KHP$g{9s`;PJ1Io9GUZFFAUEyQN|Q1rDK42nJthTq!sb
zhw1(-m|m@;Gj{&8Ed=tR7Uw*JN_@J#ViuD}G=mSp;eC!6Wgo9<A=kfX@r|$weOGJ~
z#Bn)!mkX|qPO5ip+>2O(S=h=4w#Z6<0_0-Z#}n!0`nXV6L3X)Ay&kCv1AE~N4$S!{
z9;CaMi3<n1PZKWf0pm;uIUFD3+D^R@85`)29;-6kUyLMsi{mmdNtZev%YqTho|j%J
z`rMP=UZ{uaMSD|x2~~B;x1N_yNh?=PdL-XRExrQocY&oJlKc(1Vou*BeBDQq<<Ay#
zKJj46*(+t-2Rv7V4JtGKsKLZoN6#ZE=^I*u$6I=RoRMQ_&C*zg)SD4vno2nGrdSBT
zzh}jRIw8k+4W^XJI1<YlxoSKw8%q0b8L=$Ccj>zlkdI~LW1~-0z3(zE!yDN;#tX4@
zp-<JS<(Q<G_FYtjj!`sWiU;lGGF3&jFb=)%;vl4@J{P`}8@#^YGmTZ~>EmCQzMHgl
zKMI`q$kr^Dad}5Rmc;=+oHN*glA<$dKyY>_*6<T=;HK{uV;OzGPClbVSSIP2-$aAn
zZi(b3FQ#7LexWXPLea_bstjNHJVJ1{S0K)v-S%DHKwTQkNTN=S=`6Cg=0Ya1?6E)}
z=+bv(NyIW#xxR}{vJz!nZN^$}k9;gU4SMP$CubnfLz$BFk}mM!&zsbFOD*Y3>=pVh
zW38Wu1QSiVek%m@#?Safe<bvFeM-(l?oy8t;q4d8l7x@cwy*Czw13}48EQ-WZcpbS
zbat5h6z5%^cldcsobUzh#K6VkRQY6Y>JzGvPpFIYkbHzUgzkOUgPdr?M;!5!A{W<Z
z_O`<}gNjV4<UAx?+A_0NVDV5H+@8<7E<jw9o~3=)_3%E%c^4dgq!iO<G%TEVrK8Wk
zQms^%t}+g@V%!o+g8F<*wBnnBAjK7U%(wX2u<~-B0BLgwQam(K)J;Jwl}a2V-(8uy
zo>HE!C!ErHXk4LEK)!sa3&Nm*VRy=OR|ieLo_u_Ok)m9B445P3@znXj^|u<e=w}7|
zj)d6I@A(09hERggu^5oD&fCraOfLqkYTrt!24fL|QNVh&ijJVs2*AYI2MZr;gd;dS
z!A>okbpUz=NecKKDv%T`h)RnZ=oI{PMnKG7kOheZ6Ha;>GRY&T;ODd)M5h@Wx*#8H
zh&*^zWNJ^ZLu*f2$8;-H#rWgAI8jJqrG7il<*6Eb(FvYRzR(A{G`MDimt&&^R7t*f
z6k(^qhfag7u8jPTe&VCw2TWSwEhrOpvKKiF2GB?<9S<6G#5K-4QKy9~vJwsb3t3E}
z@v-YFBh!Ral(54P@p98d=O+{W7NEE!Swy@>dj=0pWpJmG<hg8o!D1n`5B^9Dk`7>E
zqQ{X4z3E{qVLo7D2u3LRw{YDyA^J%MS<vZ#y*?;Q8U}h)sp;KcWojqUFb#FJ#a60%
z!v1upP?ZP)#-c?D6zne3Z#AZ|NWRt2Vx*t#K!WrTJWW6oDQ!y*R>(|D)1)ME1&V%7
zDB9#RCN2Klq4Yro{0P2J=iMLjsry5e&PcL-pjAB!A)avsuGFa*XX2AQCwvcFAc{*l
zftM6{`>EbFflkP@1^!}TRfuIhW95APWEU=iO34F^*rbe)(gH3`lJJCElH$#k7M@P<
z*v1f_?(#~O_{gn}?|oNv9+xSIvKSGak0ZnuKJdmx3Hea=iZ5om3w%p6_%h0I^>Zi!
z;s@^1#TD~-IT3H@B`#g2d`g_4Ju15ofs^nz2mJ}Ei3nK5SOy;+AQk#9D#+mEBacAw
zSEX>#6+1jypo==0Ml5?PsUBHjFR{j|js=XYN%n#)9PCZ)rbP|xsMcf~smOAB<pbA(
zj*P?PJ4UhSyUtVi$j;oK^705TV)C&Zd&IkFuj>7TE<*VmdwpDnzmm(70-WH5D7bh#
zF_uv!UuFvXi=~i={=jH+O&XHtgdYI;#eFS4-YTl65Bamo(#>O8G7GURJo*WJH|d8D
z@gM$$Ry5e9Jl3a46In(tFj7i!nHtI`eafOzoQL2;86NS|MTtfhxL+L7W8cNGL>Enm
z2i#sYmB)f&yj>R)eY|vAuor=uy<lba=*$bs;G>+k6?xYM)*eS$45^r689(4@#Wj50
z$D*gL#GAgGbW`4E_~7r~cb#`~5zU=q*<+KKLKjs!OSDvc;u?uVq*hHH55C0=xjKQU
zN_42Dwosk774fDzT8F+%A7<Q3u`C?;;}3yh>o03dHSUkzqDhm}#D{oE=ON)zfJpp(
zG3h==0p#h3T7qK-H0~bNd!0-}UvDo7_wgH2rvXsXcZqwYE`3*Yeoj{3C5bfkUE#`o
zZZB$d-*?p}&<K$ude8`X+Py`LQ{}KsPIrA5Cp(3{WSBpKB160MT`}P-=+A?xf&AjK
zaPc|(Q{UxsDFxy&1E7`Kym;Ovj))7vh3tLTaa8Zl70lzhYv09Ew-QycOJywX+IJbF
zsTaiC3Z+Gdf0RX~;&~{Q;X%7OH>Zidi#Js-<$VrGJL#N9o<uyQ-<ejP3LH(}rLTG1
z=gvd;Bl8tQv5*ehcfs*QUvhitjrsEs@YHv)6$2uc>8@boBT*nwdHm__kS+%}523$w
zZ1ML4z#sY8s9456c9`Kz<!LS!#0Q;2;*zAG_@IvFkRp!rkZUWP7X8jzOAEJC^vhzp
zc)~IFp-iHVl!xW>3ECB&uXDyxksYD$uD-jv64GMv^)3j*kRpffa|grA8y^bi>*U&k
zv+{ZMw-n92HA{pbU7^UZ8QDbUcknc55El$Cv^p<_aeqk~0{x1XI1v0gZ$RbqYVLB7
zPaQV}Ac5%H51~{b0Vkfo@_<Dpl+hP_W1{QNV>zxkFo-GdCkv-b;Z9WYoQWtMPOu`6
z?SM=xd_o9&IwYNnD-^D;(COehq_<QO^unQ|fX~1UjjsBzXPuu2Sh;$o)zvkMyWj%*
z0H?l|_@&NDJwKZ69R%Kt=q^uR8u<iP5(oXWIKbvKQ4u&f#c_N95+QcEpX6tn0>`Dn
zEz?hI8MGM&5d=%02ty@YCPYA>bJ_B>pZ`!)iu)auFbI2*2mx}S(}EelcouxO7p>5X
z6Qtm38{~r(124L`y;KTEf}{^@p~O}&l1^!WjZ#*p0mBD3=p0W3K9Zu3d@mkuS<YTp
zyu@C@oewlP5E_5WCuKQ;UQn<X1@%c2NWlT%8|XRcFa6|3Y7_hmiJ!#e8|Om>qizN(
z#4=@AI$ORerz6~nTAzp!pI#P*?DgrrXcg9e)!TVUXQx)3cV```flHih;7{yhH+Sc;
z8(PP5CMsi>@-&a%rS&)fNj?S}nfh~{&=+iiR-EADNWxBqF0q_d2`|&vxhjSbh@XfW
z?;pw&d*bI4kW3aQA5L4?;0tN!q4R%)Cwu(_OuuyoRAU#>ne0PRS2c@eksqY*3PBX~
zU2Jge<x39*zFqw!Kh&r1CR~*Df7En7KI!&YlOE0!9FVXr^&Kc)ci$C_yAcPK#xl~?
z$%th%<=fqkOt&cYU2uTGCyf^%V@tBnoiCle<h0JVfSdX*{F9$_5J|r8QZKlIh$uu=
zk7c*tk%4AN(gkFdi9ng;?F~&#`g~hBj;7xWK$b6$3lSIkE)C;?vDPJ|MMS~gWV5$l
z*o$z+{mf_HcU5Gp^7e93ULYqelb$IcQY_1JNuI}xdYyPd&mAj=DesXf-AiLRjqi!S
zZ#M>4cs^!1*UThw@IH#(!YQ1GT)))QsZZx2RU#2XmC_w^+LsbY_&i|A{}IcMA)f#h
zrjEtFiw%tFBGyL`W%K7D@4MpdbP8;@!WrQO=j`K(Ph>@$KMx(K??TDBwcGQMbjhE0
zlUWk#ZGjz<%=yc6DRxjl>~(E1NivevIz}vunTEyWHyVmDQcg~zH8QAzgYbmg{dre#
zcL;F<o(hzS4dq>5<WQ-g@xF^b@MFx8vPr@r^j!?&Jft>qdz{wUBH6{pc{f>09e>iy
z8#AMmdflCeRE=|hCL6>bk(9mf${!9;9lOmy_45$+;j6s85bDF?%Fi{#6}(jE2W8WF
z7w-ClhX4nQWr$-=<=Q}mz5>7}&O?5|0-2dK^z%8S<j{AyFy`kH<vl0ed+fXNosXU1
z%Kzx-v?!p2T#p^_gj49dZt|h^T~x)({HMN)9P-ItsVz%fS){pDP^9xDIn@RMZH=F$
z46#fQa%XzrkU@6TxFfxvIRzjTmQ3)|MOJTVm5E2yF?PyV&IS#Hi|xE!-7Rxp$g^57
zFt>|&m|tMfNr5>X3&rgDL%C7BlKNuoW+0u&qMXlDCP5ImQRjeezJR-cZeaPUL&bBN
z*SjFh3+gF<D2C)|!S9YH>f;zRUe>GN%UGoO)(b&Az~y2(KaHJ2lfgka1PM(WBO<*-
z0RHI2guK%bWGTuO7pl{!-CI{wXu)(7hA>8m{?UTufv5w$5JUw};;e7~Nf>wvBzdr=
zhXU985>v}_=1H?<)e0s)sE7VesHmi_5L@~kJs+$yus`%qhj2ZKF}Fr#gsQ9{XS?W{
z)oZMe?hu}G%1QqE{w!FN2<#Ch$#vAx{Yg241l$q4P^f{-6SN8B-C1>5x_?Sg!SF|h
z;I#RQj4aiwP*jY9LlZe(la{GUb|;w*%V-#2yfzUywTo5R$sF!EIO#7Cb#z4k$}~y`
z$1Z>~dnG8fQy0`Eqk!8LwqFUxh$|ZIC{YctV6TKxAIVQr5X%{1Z?ZjMgbN)dqkKK~
z7JZyaJw$txDMbrHU$2SkZtYEePbh(y+RQCimDh&TDPw*npl5q?2#y>Sp;_jBFUs2m
zuzR(L6mTR;c0mo#yJlT*3nqf>U>K9himrLUs7vx3)oHS}M^GZ`*50mtH@Fm~xWL?(
zv(lHFsYXt$yR#LsKm|(&=TfvQ$5h!uy=O{bDk7mYmct|6#WD&O#EK`DrT?Vy>xpF;
zb+PwQW7+lYY6~UTE0il5?ub#1#Du5sELbQ*jXxchl=8x%#j;ZgU&o+zp2aW6;7chM
zzywajYl5V2M}w8~%Gl-`J3}t;1g~3r9Uu^L9NQ^VPT%QYun>f9nF-D^VRnt>BD^Pi
zp@Mhfsu=MMk=9+xVhH>UA(@h7=P8ONx`d1%<r6jxluHF2lFU@3UTrTwcx?eE^b|O&
zOA!JaFtbWmB%d#8MlEQ`OfMB=7qL<fYtbX&W_8eJws*mYm74@Y7f7ZR+NHRKK>-~y
z8H4`$^H83LPs|+-YbZ<Xb!SssBG~cLmqX-Fr^crJQ8QS^Mex*yp(*@R@|vhlNCG%#
z|4!i>HU?r51Gv|Q5|kw`RC=@ax_n81r>BG2o8cXjy-D+~_PXYh=W<e8!ZKN&jPqLT
zr4pF3nb;J|sylGs4QwYbd=;A>38XAu3m7Srpn@f(yfW-<X=%2Vt5({^4V&!9@kfe-
z?uu$I%ybxZUKGPk0N?JO&9u2-+e-+vG7^1zv*`Q+uZ&A~hcz$P1sQCG2U~!BU8+Zx
z*b?hE0K`A*4rwx;)a4t|`A-p&askWNQ+J>Qyn9C;i0S~aH?kl+n35qb4D1fS6c#v9
zpXWiIdK|2^Q0gAsYU2(!#dL*CjiUvaL)B<$p{Nz3qQo0n0CGGJMvJC9i(<<<PKzcj
z>=QAoF%^3A!{=H^am9x#T_`{zxZp`AXW&b4Sn3LakUT)Z<MINFKGm~~On3YgbSz5s
zA@o3Y&Z6^|AW%nAMER8=7MPeVIVg~>D6zCni$cF5FWu6W4X$!XA}qj1t`?GPxN2@~
z(!S|3JN=9)R#9F7)5Gbo2M&ASum=u%;IIb{d*HAK4twCR2mVKSU_kW%TfAto&!xGu
zs9P$&Rn(1S3hwj$G-pmXdwfPNfM(a4JNsMkbr7M?%DG$W>wU_C_v#~l;AX$u?Yq#x
zr!Ko!m|g5*A;8CH^E!eRiF}mv$9#R@a?Io8>wC(BpDikSLg`xnMizu!IUHIk4CxL#
zVEJR@!6zT(vflcgJumZMk*c|kpY|PdCy(u(s#c@0So60?>LGtt{=QPu3ep!<T1l}~
zV$no9Y3=8&MIB+`+rU&O4y@h$YCu949KOQ#s~@6=h2OIGBe#teWR9HL!R4^!glK{p
zNx0lzMy@a3DEUH^VjpqvTZ=H(B9lGeT2dlQLCHdwzg})bwm00hM*)~?TcGyx`>l9&
z1eYOyRP`U=i^0MbSx^s<P?vS(;dIyohdprE1BX3u*aL?>aM%NfJ#g3q|J^;n&6@uG
z`dd|HRZNL>WU|e?IIRIX(w=aii?b$(DKt2}w6%}tk2|wxfYZi7?h^8>J9B>K@`;8=
zxO@T0`v|fLv*zkPbM}==(OJ~xXVm#})W@+%Rm=gC(6=|enFV1_%A<65FzULi&s!Mq
zz>Om~o^R_+4{XxFY{TTkoiSf*akos1E?<196$ydjZ97)<Vxl{XEU37X#)H~K0(bCW
z@6Smn%X4?Wm=pmw`gksog&#zTYj%f_g(su}a^H@W7Nj6kt-365+$k*T6eTRm&_y}r
z6-Yw!5E7Z*yXkiw*}_^bq~5*tn||5zkLbxA%FZ?|8Kt9;1+UOsKbur9Zm6I-e|AW^
zvYoVdA3YC~1u7EL_62eWPC1eTBOZnx*aK>7Z~NEfP~zgy+p0SSV&T7EdmpksNeAaG
z-BUz&Cn?2qK=zXtfJ2rW1UkMEnjHDto$b-bZ$NP3#ki95d&Z|npO(t`FZ9=2Z+odR
zQN|~ce{;vsInSj#-#XqwVm{B~Q1Zq0?b=`Rw57Uq(f2LZColJK{=bI@{wv!1?TGES
z!+Zbz^(>Cl`F@MuQSQ>7a#Gai{S`Rf!4h6ibAg`f^W6Wt=HGtZIcKnNW1i1jQ~kG^
zv-618ajxX1injIPdw)ro&!1J+zEIwe#G26;i_o!akO{W_p%b}20)WRk+t&~}vX!)*
zy@GnF3`ja=pM1Ww4p>hqk6Vi40!k}YhNdT2H|WKxH?trtaw+Bxq<mn36DjfsqYJzO
zoqhma&#mju8+(D(DBL~62ebhV?8`ptX+RoQ&(C#eA;klyo&MsOY(=jX8Udn~_x-`{
zMPIlj9*!^8uxFv=aPGi?FEU;NLx!!P>5XT)qo;Cud#P~Pi|WA#a?+25Ck(lJh!o$x
znzdn)P-Yc+^Jlvrl3cNDxh;KdiPbgM>FPuu8-2tmJqLKI4Ieeqnwy$!?!38n>d7Z+
z;m0rfi7&eA!~SMotDCM~Xpu}0$)y;$)~s1$t5>hFs;a)i#aViTtKQBudGcf%IdWu<
z;&Ap2c|d;e>iI+ALM$B$Ue7qC?Onh;WPJ`@haP1Wges^GS#A)$5t^Va9uI!PE#ki3
z+`;WWM2>E1G<Y|D7yO_><T!66*1GC=sQ!A(Y{#@W8|+<8(D;Wla(sRK#joMx5`vQA
zq2iU0<%(&X&&Pb8XFi`J^78~Vk$S`ng#W?E{o3$<u&tPux^J=V3w3X?-EVbFrFQCO
z%zBf0zomN8|D{in=l=ck^{MOJ@?ACYS9MWF*L-*UyXw><Mi)6nthe6hMc!{?E*af}
zO>d=K&4Xzb{qsUcHsJYP7>@;J-IVpOc{~$%&3yIId|h*H-(9G=Fc4q#DaS6rcz%!t
zgTDn>^eh^6Pe+fhannc(P~K4K%*CBo*%wpS&YkL`j$=L_R8be@(&NG4rT7OezZDC@
zyfFwYEgwvYJbrh1>LL~3x`XHMaq0BmePVHz(D*Gue@(q^B>J7b&Q`1JTV>m}@3dQQ
zxy9=C?X^Gu^Do)hvE!_{O~0L%wVq!I;BB8YHjOWc)>UfU2rRBLq=laUn6+@y52Y&z
zv?aB?Pr2>bvBg%dSY`Ym<*~;c?XNd(({IN4Afa1{={7aNnHHOcXkmdUS!^REg!)#L
zTg~oWcF#Tc+S5-zZBIP@c-U_zo-o;_oN>B+Nj7ZXvE3eh;&D6qlpkozGf}9;s8+CO
z&z#7EU3&7Cta$V?7{$P~Y11b8VvLO+KVCmD-l8idz3jQ?p0nqlf8H*-=pq|2VnmSq
z_dL3xYNI`??U5(v*w|?ww9`gcNmsm^V&Z^`GeD?4$~x<8{xgqT?GaP$g304l#({@G
ze?aD1TsJpZv)ZPrU*9a!4niPsM_aQsw6trH-j8<zy`j|7)TrOAEOWVe7VWK#*4S#Q
zui}MuJtq1<tA234v9Zz0ss`FX{k~35sa+QkTACWHsZBap53#=cG1gY<mPTvR&$?9g
z?{|oPP(RVLuZ_*(*}uPEkm*VOf$Ag9qd9l3Uu3hEx7r2om|_Df6*q6VnLDjT{%KX)
z_N%IVbD^RJYHnz-_TJ_4U5D+e*<pKYo2|0{5F0jZkX2Re=g`dLPFp_v1>4*)!Y-V8
zf_3U)`X<Fq-~MXbHyFF&uLJp%zSW)W(c^Zne#Ktd*vF=xH^l}kY@)tfo*k`L-_R&O
za`B8wj@m@y6*L-gHFo#Y)}PmRn#$Y2gq1RVprxtScGm3DZ)VCz{i?11z=1ZXf2GxL
zTVk`8*4mT{&auII5WS(X*~%;XS^7DtZnZv0C3fUcG-GJ2Z!oK<Qd{=1)~0%EY|*wP
zk3F3WG}9>8IjT|@_3{DPTEEw}?bu~y{Ri2I;X|z=&ojsVe_}S@hX22_FB?=k8+Y5B
znR9H&iBs*^Q3KVqDHgl4hgn8L-EPfO_F3OS!)(;h>Nh;*!9Qd*Y+Grsyt>U!n|7`Z
zt~9H!ZBiIkX}*$Xt=;MJdg|VmcG8@wQ5U;=s}EKj<OG;p-D#Uv%(X?EEA7H*CtE)a
z7g-Y|Q?mX~A&o^P{qyx0oN>@e+G_Xhv$o!SZD6&|)6`2&!=9bCr>VD%R(m(>-DNv=
z*J>MAg$>a>Y9Qx{oGjYBxv{}o^cYn2fWA3MWQEb*>f=#`<^tuuQ!IlqZZ@{4E&E&f
zTho*w^zA*$0Ud5rtH$7d`gx_dPh5J5WcEa#?*^1`=JWcrGhbGdRqEWrJo+~`-(vgr
z)w+*)EUVa1qR~G$Nrn#}W}o@gXKd7{5!TY$s`<5UCIJ?|4vq1?w$!?#t<6V&o*xsm
z$SKQrSBDcy>!~|X0-r=klS<2}_H};0zBBECnTJB9SchV07!|aoyb3(DCDil2SksD}
zp3lUAZ&vxfsuG6YL8{KA39(MJ+jnfU>#n`dUU>cmn>}Z?ed05pwsB&^ijt;d+o#8i
zb4a(DeIK!aK1pF9*B^0$9AW#NNw%xPAn|F}M59@EBFk;B0&C@})pp#(V|23DLXZU+
zdy;80>FmFQ;`gJuGQlELcL`O7U1gs>wr}q~yZPpu?bp};+Ri@jY`fx$pV;UzV|7Qc
z$rdkOZ1d;Ow=1u_(l%~fZx>yBiS%J3sjh6u0d9}m!5v1G`-tyB2Gt=$hG_9oWfc{b
zz91Z^iPAaeoMXFp@5ZCPD2x+~SLD8^mlT(q+5%uICs>AzpOlTdIFUrzsZf4D9Qn;f
zBzi~4zM$np8@23RXLtSfTQ+UN#c4q(n$%WBije6Lc#`0OZn`+I`sK@Q-8t9TG+z*E
z!LPP~cR~vSFUsBn)gu{wJM6WG|JD9&(TR5BH@{><ROXItqD*|kS1v<ez&6jl&+dJ-
z(*E>|AGJZ^)Mb1Erw7^aNc=i&*4<azy~~cU?|%35)?c;mLdjqK!fp2C_VM<opT5-k
zDPa6kN~REtK;L6;Ew*;<V|M*b58IaJ-u98d{eSk+laDBHL5epDdNgdcrysn_?z;DR
ztD5?L`>V_T%uXDVU62r%wgc_8XYaEo*AKU^e(BxDYmM^l?)-!#G*7^=am}p9?Vi~k
z_SLU_)COpz^0$M*EK6PdP@pF!gy7{4tJ}NB+Im&$gxg;y?GD?sW4T>^|6V)wjFYt>
ztPn1pBrYc%NUw~qw}+n1?bU2AKYW$lu<Rte_8;HxlMqfMIrUH?m5H%Xnqyv9aBQzV
zdgrgL*BPI%vj%Rq|GerE8-L;`du`@C8+*~G?6Ob2%Le%*C%ABw&bs)s>g5-0Zu3cY
zu@;0YXFg!x`S}X_@lF3^qx<U@&KT5k3U%>UULRKpzjj!IE|@iSmfN5~1G>3jKrAvQ
zV*Ay0<Fd(iO~Llej~aLPY?@<t&gf^ypPm+kS@3n07=cl@-tN2kH}>q3dK)rO?N!Hx
zkiJ&Y*<!oO$J*z=@I||D^6;*0pZ8z5#JS_|PHU{&XAP}oHfZob{a$2>mu)NN*c~_C
zXe;dqJMowiR<rCyo82+Ze)cbaVIynT+Vt5gZ6XW8z02&HE3UJ1|MGiw{<vxn;4UJf
zO=XnFSy!thU-JN6blJPF$*Kkn&|<dSI_h@VLqGkNm4EQ-_R%Th?X^d)u`3^1p>cJn
zwKde(&fUH2%y)m#KJuYUY{C#OW@+(SyT$Ig;RbuHQKLw0gPrlg%j~1mjw@VDDeXVV
z?XC`9hguJA#0bW9wYvx_<#!;up7<5&A>J>Q#9^jOktXv!ZQFe#sFhMG)wRfDKcU@J
z?BB*tzn^ciehvr0(qk-|7&h&*g%3PrCyYGV7lixyG}9lRwd)t!t-ra;w(Fw7-d(-z
zQ(yX`oqPPK6n_|#Zw%r4jAy^PWCAwxfp5dkb@t*tv+aaw)2wmF68pwSeq^7%=_hvn
z#F75eJSMY|z(0_`y28+*&GzltYaQhSZ14cBHV=@3*8L~ER8D>i82;fWxH|SMwQGNR
zy`B9R-?M2)ramZRy5UZYqDQ;!*!-&f?2*29_L(PIzX4jFF|PX<X}SPYXZz|~t$Ofa
zUtqSi)cXau0fPpoi!cR!x{3&0(JNeyJhlj~n){U9@$f8-nEmY%EfS`kFvi;JHrem4
z_@xd1@Yn3!o!jizYp=51BTl!f-AnA%`lIddzV-z>X`IgJan5PpZjb-=D!XshQTBsx
zU1p;yId7(Ri{q}<^X!J(7TD+i?oVyp;0ld{I%BKNYS+AIzj|P)ef+Qf(vGa!zumf8
zLJ41I@$B)FFv9l*TQkC_&x(a{p|n21Q#%r*Qh&b`yn)e-+gCkjH$GKsm;KqtjBEF$
z=gq+1kJ0O`(7fJtlI=7gzZ1?)oOsEM&v!H%Y0$;kAN}x$hs6B@ANYWc8a+yLYcb?!
z1h|Q$C?GnCjnr<5mGTj^93vlcO3U4NE>Qg#Ji5aJ)?IxU28U93D;I=^A}?^lxF~Zh
zbx<C*U*4_P7d~fjWNPa<I+W^|4E62X*LLpMVb}iWwYG5aBAayLB>U^X`D+`0<dORE
z$YwPrSKjG_3?AYDEj6qVl_7u&lW`UNc|l%H>v#L0<Pv~*2wnSzZIo}Z?4`RZ^;WAz
z-SQP$6dt2Rp%!HRgP@|-zi7BR%z}*tsbor4y8;#Y*!AK|FWK$4-EJTL_(wEJ_^_RN
z>M7Q*x>|O1+F56vZNK~79kyl578^Wdu&z$2-j#HZxa}SrEQn*U$B-TpGFx@EgM?2i
zDpChowrr^{5T{R{ZXf&D$86}(p{`$PXN|J^u4JGIScpcAd|hc7y}cE22q_`BfAZxb
zh|ZmGE9HkF!^i3hk7FXp+cGQV4)_AP5<FG(t~ye8Xw<%d6dOLCD7(L&snQpc1x64>
z3fW~g=8QkFZ%piG{T!4oFa%Z{lSXd2s#<Kxy!BQ+Qj35BO<=|`YzQNwzIZ%t+6U}U
zr&Rjli(1EQueU{Ww%G8~&rkZ~7ee4fxxLMLRSviF-+6(}nKQ#$(+{i`ndfqyx^gyX
z>`8X%rM33bZp9JKDkSCIKf7(&`t>$w(s`La#C%V>2Ti@LT))byCcV$9vQaAgeV+n%
z;w80Z#;Y`5<jZB#Z?#wYUTR;ybh6X&4DkqEZLQE^kQ6)%@!O4FMHm!{6Bk!$$4~j7
z{rw5mg)6k2s7q6UwiG})Gqru&I@`Ri#?Je|ARD4P$(Q~0SM10m2iw|XZ?m5~KGT+M
ze}_#SQ<3vo$mz5`vZJb(79C<Ya^hL`cVC}ugDO(wGP&xSO8Qq<ph}&#e)iq=NZsl7
zwGW@|3&PB$8D{jGa+`R@AKCww?U|^89~lh$_pi2onjeNMeN>~Vx=CgIj<Ab9@CBRt
z{&K6|zS3^K;z7IkYoD@Hj~=SKXk|8HOzH*EPQjw!*KkDu)IK|2eaLQKJ;uKJ*>{?z
zlUBcDrQPt|f3TgC|HQuh`H$FfBPwn8rVH$%t%}`#8i)7x@e7B3g}2{md;h1uXhXT3
zLXr`sB6^mcNa}a2w_pGKG5f^-`Lc~?L8v?DEwwxRhm65!+P%|`nsToF@dq!ls>Z#x
zW#bCF?}~r5t7<#!|NPm9Y^1K>?5kO3H_hs;iOOGE>+JjNo(E>yd$k}eT-*ugCXxQV
zU!N-Uhy5%NK5bcApO_Ww%kj=22cg4V2k_T^{7Ngb`1Clu%O0(pVqYZ=b3C&iUx=+@
zrYo<6m-OihNhNITDHZ(^@t(&NT~41o#Pfp1MZ|K=KL%6}@|{A!_V17MxYPzqb)kA?
z&5`!?Z++b6-Sn@vVBH3rq6J~4WB8<@L{xXWB@}N1=|SqJJM8@j_V@Q9^c^(DzWCF>
zv(Y05I4r%Jz_W#~qV0vMLS}zhy*>8e9oBaAhwZcPIMVUDju!<|kBdA)@Jjeu9A-NA
z>OaQb`>D%p=#b(f^FZwdU*454R2Totv)vT=@uG3#47=`$?e@Pe`<xxA`9a&Z1@`Ov
zUbByU@z3pexx!;5lU>v}<wC#cDSm9;XfMxr$<F-bWp>QY=j@?*^K7aXg!3M`)wWH%
z#6ETQI4j?`!!G{J-`J=L$67D-<zM~F*KO{qci6;nr&&4kHR-W)!v<UQ%#*gcYO2jy
zvCBSi^6)I2qaU=}rp-&OZu~?WRPC2hJ@(LS)oW|5rF?>o)MAhn{`5kRUtMD+Z0ioa
zJAMbkFN_)Cs4h%pZ*sC~TWs6nxi)n4`8G6N`|<^D7xcHN;3HACCi54;#7NGyOZ1Ua
zZEY<!eAsY%_L*m_S@YlYTZewe5;pzL71u(NT_sg^gcgIXE!s&Zm}99eSp_gRPcocs
zW<g9wvtrMOQm;`it?QZkErk46E(i}~WEkHaP8XOS_jL37aMYs5lRC3!z3ud+>dNv;
z+qrXx{pYpU+N(<z+tCw_whJ%1(BAW&_i3S1Zf#lw@x$>1es30)dOojBC+<$RcyhN+
z^=!i=sQAeUe?bf-1&IG3D6t|r9WdeUpB9ysy2Cbl)DgCM^JeQkxR>qH)w5Nr)1pvQ
zH{UYqQ#AC2kAldJQ<<xZ721}!ed|_xdFBk8e9~mQSX(xyo^__{Rj(`e+@9w5RW@iK
zDc8?Ow6?XTEqz*CN=s{#4!&rGY37==VCD{_OHTgEeW!tz#i+W6{Ls?UYR4RNtlLnb
zJxU`+jI_0D*ZP7m$iS7#)}bq0Pdqx)jyPqSop#JnYuNazJ^jimJN|-q+oTaywsX}Y
zdv4Y|Yw0)E-f_vrHm<t2t)BOyE!fmz7ryVEHmpypEuAyn7A@Os)kmFT7hiCi^|e}?
z_3U%DyZ3SS-glg!y>vV5#b;;Opi?fklgDIN?A?EwSZM<J@WYSWrp9VJdcY3bP}kSa
z%nWbcx5b`+{7GB3b+7fQ9%UE4=RJ19XeO8Pb?a`M`NR{pU~P?W-#q|KK(oK@oR8Rh
zPOB26P1`JethTy!Gwsf2x7j=2cc~pcs-JCH^0Gbn)XTP~ZLnSP(GS^~M~~1T(5Neg
zvutZeKWo^w-nQ2bw~v43BFk@BEz?%G*5)+8Abb1Dx%R}<vuv*xQo|-pvG>0Fd~K^s
z{>P_sqP<qv+fKdYxa98UT{d^7CJUQ)D_$#Y(i!L3>Bs8Iaq~W#H+!*_RS&eLUF&Sw
zhFUxJ<TGsQl!=-|h@a%P>7%A9q}F{K?6tOPd*4YDt-WTQy)bu`9XIVl8>>Aw*uHwn
zY}?Q<!Y(-TSQ~%xc{cvou~xHjf%~MuBr>k73IoU4)C<PxDtLp<ynmxAFd|D?oV09}
zZ+0}>1s{!PQp;@D#wGUhD|$AzrPBtFnP}%tJxzD)h{3d2?AX1<wyfW2XJ2rHFHBl%
zYiz+QGi~+GTJ^=gHtF=U?DXTu>Pm|IFl&+ZKjt)>IBI~k>{@TL=C841&N|1ccFwh@
zr_Z-ll^u3>(;j>O2hLVM=&h|gZMOE+SvG(3O50O0#x6Mb92=9Jowl!<Z!_ku&|R`l
z8#ewVJMZk1te+Nod$+8yg)6t)u)&?SWYr!!Y06X^!FF}shVP?+VEd{$_QL#4nvj%h
zo1<Rzq;X;FgcI!4Nn@<DX{XK5?t~Sac5BgghFu_A2WTrL^8(h88`o{IZM{yi@wzM5
zx3bzMr1_c+)fMat+o0#!IkB|Zig`0_;p%PLe%oS0jy>Jpp}T_RTE(c>Cx<I`+q8IB
zvwN!5Lg=OEXW5pf3OixSId;zEBh@+$wq(viYpBo`#JUZ(WZiZfam*QZ(V3I1dGkDb
z^0_&-q;-$o-BD-neAoFly4o8hb@;?KeQVoKr$28&vBNemn`1A|U8%cb!>sq-jd})p
zd;vQq$c2i0rcZwxcg*o#(=@2lhL=~__@j@r@e>9Yu{!E)@yr)({%aep|G0@Z?fi3X
zq;45^O3#HeU$NzzYpk`SzfHaLVjJ7J(Vlr`roC1(!tT=Ui1%GO)f!%V)?Vy$iGBOi
zpR`lB<DgV^>?t<p*d$_CtM&p!JgcfhG3nce0CzUo^0_bD?1gKrV&nunPj_0zYO&Z{
zqj*@g%Z81tww0O??&%z;ZFv`J+$*;gbDp=k%a_`~2kw^Nr`eek`f5vPKaH8GZ*cu_
z<d`FE(uAYbSIv$;@gy73x5>Wp^~Y@aC1=^l6Gv++Q-7N{yvkbYbO&+Y9_x49**>nI
zQdxVgEu6F1n&i9IElX_A$SHQo*^{hk&3t=m#$s#esJ1h8uA4k=h{mWk+p=Q5&04t1
z8niX-sLAKrv{S|@oOaow`OB@3e!zL#isiOpXOkUw=J|G}Vx&TPwl(gw*)P3p>uMUU
zylSYOKJ{EXM*T|zlr5R7`01ngsZa4U@|Y=h{*)7pUFEeqR@<x@^EDQ>SoQGncK*fZ
z+E9&eO*I?r1@T+Iv)ztAL$P?;F^X-*C(f`bMSkD9x%Slab8T^Jt=(sJcKomotF0KV
zpG}%<1JxBe+ckbqUu?sVpKSe`HfkYdHlS^%tz5IoDn_4Z7oR&t3w@?Gowj4`LYw}=
zd}}OM`<!=?oqW_#7Zz=ii7q+Nfuxl#pe>m*%a*LK(anHX8-BuBcK+$dTY2qfoBrY~
z+qO?z_NqtNS?5o)af8wYrsh3cZRSfa*v7`biczy|ZRK`!ntkey;ZB>Q3#?1GG}y>v
zPPL29*M;8fv^-1~lSd3$XM6VSvQ1lb-aV(E#|FC>_G;Vb!WFx%x}w=OY}#fMF8H9G
zGPup=z4VODU%lIgk3Ugc;Loxl@;_<U`X%<Fb{8~N9bto;H&}C}pAqB^?q2II3GX$~
zc(Q25Y-{e@-`e)Bw@vNG*+<`bqRwNl=`od8bQbPwlh3)x&fr`_>S(f+3uoJcm0LA;
zYO^CIouG>?yKK%Yi>zavP6MrH*qLXXX-DWTR?H84SfX*;8*Khdv#i$<8V`@xP7|Gf
zXU$k>1IACW$w&3Gm5b)uwkGwFy{l|X`B8TMX-Df#>Dua-&0&~qM2xsDxvx~8;;6c^
z#a1quq4UNnYpR}L7i*jtW}ED}XI`*nOB(F=cMP`oo;$`iESh6Wm#nmo-`;KSfA2f&
z#3TFLqFD>9z288Mfy-_6?lwE_lymLeQ^xx|r*7v4n=^Z^ZQi-h1{`&=oi}lSmA4MD
z6OKB<h7CW-hV0&EOBX(4e^@r$zW6uq@{2Y$aD+|L$J3|@cHFVmR>QfC3cnH2XzN!m
zu=QguvPs&;yL84}yX55e$m`4nm}3gBWshxqZJC{Y&O1y~CqH5M9o^0vTd{SgjXm>S
zDMmC$Sh!%hm1|+Md*u>axuwa@e$S;gx~xXK;%3^O$|LN;3oo$YEt_oS!VNa@e4X<L
zu){>>l=-u5d*?Xy-=m5?*7nDBi(avL%h%~~moghXR%7nDI%la%ZPA==<<1TpX!~r{
zsx{U*>{z?-Je>;%R%lAH$>uCvubUTDR<mY_ZE5Xqr)f+%MLRN53(17WTAR19&5r%h
z1lPSoeSGmuUG&_<T&&zCoN|txb;4M`=$iFHJobhXbL=EnK7|7l=xoj4Z|zs#V$RRj
z)w8Bf)e<km6Ds2awC<El5q`~}uCCVC4t_C3{CGZ*35x$rTxgle&>hJz!J8enfs!35
zM_n9CP#oS9tQ7Z6m%CpjylJ)vWKe2cX*r0g4_F)vFx|4{POW#64o!mmg($*eFzTg^
z$@{cz=*Amvv_%UR>AAZT{YTlCELmdLUw@tb=*O4a&wlYU``J&g)aR%6@Be<e-E;Td
zKGEu<g&|u_HP;a{22Xuls;&qy)6(LvLC=M~_Ufy8q04+*uyCF&&~g5}1-hFu*OqA_
z(4gn3`e<Uvb02&6?6Ea#*NK%nIq{)8iR|Qx!7ko}#L0^{9o5#>*{YSRbhlA2kI|jM
zR^6>>(aETfwvsMc{Hi_p!2LFC=rB9#$Z`4{Wh0L`!gVCj<q=H=b(EYA1v?cCE@{e0
zZ0?^Nj-679yO>-F88>dMovTUm)Tw9t!jwfKsdy4iyqMp-^cNqt`=6QT@MX{6XCKmC
z%_rt;Rk_VxnSPgj;^rspb059lX1%sUb#?aCo!_&Mf9UV+wO!)Tu*sgj^-K2q-+#fr
zaq}IvQrqoK6N+0d`;fiw`}b?eG263lnf>^Ee`)pd8_5?89CelM`XBwX{o_sZ^t?~K
zJ^cIY?e2%S=&rDqV@);o@U{P7m;T=ewJ;xS>z}&ZPW<v!wqjeOC>!mOtNz)}|D#Xa
z3T-24+qc=)Z>@v1{MO5=H34p}Uu)mgGZ#;<ZM2~y`&s?+XY2=G|F&%^8(~9Q=GmA3
z<Y%^Kk9?v5XXC=(YJxx2zIWYywyjS4%AJ#VC62ab;Z64A2cNShl^a$*Z{PmPnRfl+
zT~=MyVZZpJ3+&t1J!MUbhw$z0HOsB7Y=BKXDotElHMyR@aGCY49&GK~=i2wLddRl!
z<7Y`)Z04QU*iWy%&ZaM3ZTr^Gvnzl4D|>$42A90-`A6;6+g}z|G1cf~QK<?0gweb)
ztJY>bew#f$Z*xMZ-DuPA{iQ9f=b6`3)uCsdn)D1`*i_`Se~xVzu@DJpMBJveTHJM<
zXh&wxNz|-eU^id+eS3LBqg7Y7+Vorh-EMh&w$<X&O!)RqTW!_8<9(3?zdhS^Rd)J3
z>oat?wQZViH{SoGt*sZJSDj6t{<yumje_n5ZC`7T+<LQZ)q|46biKCRwKdjh`?H?+
zpbz%ZHTT6&+VB7Hm@V0&Ejw3TX-~~x;+L8Bu9&XvnpfMrnl|g-r^)WW@hbc6ALcvX
zeY)#&#}EF+uKVqswrJgM&C{A~mH2%3p2d0wM18ES-nMMsspljcZRyhw*x!Hl3R}FM
zfNrp7?!Vn0n7P$Pj2&ik?!DR`Td-2SgT)}8ZM1b;R#^2}lWjny%B&WYI%_xBUH3d^
zBab`JP8ro<OJ97*zW1$P*vdV6wx+W|3+%nts{YMMkFkn@e9N-A_S0|PXZ5OY)Aps`
zUw5S~sjIXRm34O8t#{eXRm6F#y*ld=``$NyVt;sPp{-lJ*naiX>$HH{t8MmLE;i^w
zg2uPqDr@dol4PehYO5_@__%%l?!_MGd$mRMXFs^s*4K6DS;&p{)N`{n^f2Loyu)g?
zY_avah_zAAD{tJm(Rglo!}@i$QInb`9KnF7)U4-BTXaFLrB%B(lv0;(wnZ;IWH;SA
z-v%8y#x_pB&F+~#TVB&-Ticp%zxNN;GGM6nZrr68Z#DacwL00*q31jI?$-8KO<uRG
zT4&QPoMOj%pVC;znCN3(M5z3Y-_f^WvpsR2wwCTqW8TWykJ)v%zGzk2vcGHogZ8^8
zp4SFnp*C)`-{1NRyZo28*{ka|+pMSVv77Imp}U$b>IZtZR11=Qd-vL&`eaLTTqaL#
z*3#6P`liNrTJP9XF0{{_vc@*-OJh+>LyPs<@QVHR*H_z|ma+D^KR!zr5ZlwmnX-DD
z^UOW=<122kCthCWSE%=_oM*S+a+mGuJ;bWpSKAFgyUVsU%9r(<?Y1j_ZEM7KpoYep
zn)-A;(?o3Hi?`XguDsb^S-H`+Z<=lY@xx!*f{l9=PxbcHEmzu&4==ECy}o_t{0Ho+
zo9?uw+ZltKZON=h?fd_x_<33Jv*uO%^?zJ#OLyxT$&N;wcmFT!k)_*hz~KH?w{yF-
z5CmF4J$A<p>hEUbMzq_#SKVy$mT`_C-ivLZ3Qz6wNuBy_tIngfd+V&JcDY@7^B-)v
zE_#u6FP~|@z3*wOSI}==GuyuP^`F>-y704e*EW0b+8^32&%Nrtt=}@wuDj|E+fy~%
zDjQbW?RVU6EA|m<ZC0~wldWIB!DF!ylN;9C#x2{dnG>ni+bd7rYd`qW4YsjCV_?fZ
zJ=fo;bHfgM;Fjy`jwhFCYhpib!N1S0zUB_w!~oyC+onHogI)L3DqWCnwG|7Vx92x#
z(WvJ}8Ly|`b-g`2f3q&KR@*BN|IY58zDo5ewJP>EFMYtSxcVmBHR&UE{>jH#yC$o0
zkk#*9YuA1EM|R`wkJzg1dZt?!0~bAco89*8dK*1<kS%`rE_>vOxz4D0>k_;3H`m#7
zI(JpJZ`Yly7i^8T{a5JDS;L+!cEe|XZtHduV{NwJp<C>VpZ&rfeqM`5jbZz?zGk;x
z|6AMGF-VKO9d_3(zp@28IfH1-c<~SR{crzL<4=>`&fcgv+M{Q#TJ_t{ZPu>4+%@|e
z_PcP%%!Aa~(QGqs`<=~Rvfj(41^uHBK4`O6>`}SZRxf_ee(>#|+5Jz<v3<?zpAB2=
z*#~~5KA8GWZOv9&w@!=JZ2Z``k#S_bt=EwYio_9bTd$w}u>Jngr)|ZSt@glAeqt{y
zTVpM~`dE|B1^9AL&2Bwo-E8%e!JFiF@2v4>t~J=&ix1vvm;d}Go4tCgZCf_OuF|fu
z=T_3w>uvsv_u79xx5281^tZ;{HM%pWXX;0`*wZi0vxT!?vu*R9wcp>r*gpE{58H%6
zjKnF`={*n|bv}Rg!Q1TF&U5YT<B!p80VRc3i(vB}dCV^T%optQ??2HtEPq8iK^P0@
z63K7%yJ~b1a+n>XcT$juTq3h&>jvAot;tR~E?wNPR>i|hx7#-_ztLWPb**h$E&VmO
zz2=rXZN>H)n{(&C+oSVd(?!lkd-nIgu_x!IcIeo>&YrsWMq8$F8@|yOJ9I8v@ceY!
z+FqsICbjm5+cn4Vw$feA%?s^^-?-fFesYFw*TsvcZ@S!W)VaIfyVVZ6=h|Otthiej
z;`itgocrwOH{WH8x9VLT>11FHyI0vt%|XUa7>z`0)gvb_&se0vX|Q!_YwgX~{Ki&m
zyFJO@<KVeB_N8H#DVo|^zSAe&%hN7B#(v)pqPOsCo?cV4)2{rF|FD1iw{O{ZzVjXX
z_P4*I<G1zsmhv3GZQuOYZ`v<@{&TC*yGSbf=z_1B%G*f-_|bZ9Ao+Y-qp{WuxU=}1
z=}CQeG4<Ie)pq?3oTx1=NB!G&^!R++xW5gI+p>L-G(dVDD-8&|sD&OwXqRb0Sg)1*
zbI(6-XP$MI1`95)n9b9b+{be-XrZoB6U1h{#N%C;zDsuxFV$T>HMY3uDItBU)z!9X
za-*v|9$<YmVX3!Wnru|*<qe4C`W0(Eo)c_s=Y<62qSnBmMciOr<*%!)6&nqnx-!RI
zINneyRPk3JF-diL-JN7XriEQ^-OVf4TT%OJJDAqGZd0o!O_L{|Y(M<|=^lJ6@^s%%
z_$*%aQx%#$`Tl!9nMqeYUnEi~mzubzYiu$2Fd^b@2X_*wYi(`uyO1jQ#2QwSB1+3D
zhTBIj|FZqR^_y&GTdl3xzQ$2%G%0VY(?0vz&)6;BxyJU6`;M(&yT+Q2A8cFJJSv<s
zY|GlMwrk)9UFm(F{oh}I%zpIUJGBt5vEjY8o5pdoNjq(w7G0g27TBi0`45{oGTkxY
z8XNLAzw(&fJx`1NTW_^@j_YgtrX6j2{{HJSx6`(7c-8*)pKiCumu|LqPa16v?>fgC
zbr<T9B_Feqx~uS4|NA=o{_kG0fBw{Y{#L1WuGqEJSXspgEkHFve&l(p|I$r%`PV;f
zgVY`mKKKWn98Q+4xElZfKmbWZK~%Cku6e%=+BV8&|I2&r(Pdw;ubwkfTMwnppa0Z;
zd--45xS@UBcQ_#iz}|gF*wK1H0CxhWKYXvf)bBg?hbz8eV{|q5?9l`4b07L=oAdD(
zY})AbQ2DauTddcx6KphmmC8q+YJc+OiMlAzX6qMM+KW#;Vte(X7oHI-*VX59-t|fQ
zlTW<E2DI<BaX<KHZH-=H7fm@*la&EBd{7lpn5A}mRTH)9(NlHRRB8A`n|j)5x?4HJ
zTBaSPE9t9j&Z^VxAO3nmfyTFx78wMiZjbxlfmZa<IkX_!s0GjPGcVTmC79LePS<1h
zbiWVTuP*zP4cC>*$rA?IKYimtd)L_$?Svx+3a43HqL*5~Gf&l4nRMBE#IdK@SHE$B
zUVPMKTSqn7oQK!z#4gnSy{xaEc`Yw&*VNXbq5agyDs9+tXV|;Xf7G7p{{j2_ADv+X
zbVqNO`pTZhq4sD0>#KI*@k4CUsC{<J`favPeQ&PrOt*}ExBb&!ebTq<9^Jpwu6gu+
zTl3!2t)K45_t#yui$DAK_TJORsed=xOH2CM7+p4P*PDt*O}fawHtAw(ty^cmne()L
z`n!K_@3~}>HLjbbI|k3%>7TpYrkyyz`s`a~S3R`A-Z}Yb8`@7}jJ6hSTE5YyeteW+
zsgDL7d+eEq?zDABTx|dNXO~)EUBRF6;Egu=li#qv{p>WWQn<2)>Q&aJ@kUoEvo`9Z
z9SUP74AoU;ZOhT(_BU&evLF5N`F8A(W_$JFAKI&nSJ}D89<S|H6*g9P^}q17|Bt=*
z0Pw4-^2a~Z`%I=~CS@j*NhZCAKnSFe&_PNl0wRbFMR&zj|LeMo=<2$wuDbgd`--B1
zfQZsdAV3H$A-(rH$z(E<WHP<~KA&^n`_B7LNdRdh?<Vto@7;3lIp>~R&b{Z}%Y7-$
zyYRa^zKPfO)nVfF$+%!{399SPz(=l{g8^)$G&b>Nndn*F(=#DC0|f(8P4U|L{C&XO
zh4|RVE<`R5Wf_;#fS+!VcCVOJ9$#OEZ5%+#yww3@8^e7(af8QU?iqO)l<H*NnJlw@
zo7`~jP1W+qL9AGGH-^psI!-@rB#M$M@P+$U;DXbrAk`kj(fENFKV>Gy<)`tURkib3
zIPa{{*uHZ(uD|gjuHtgyW7iQ{7$hM{!E7G|-?bvbubbm6bq4oTr)s&2Gw*Aj{w?y(
z{37$7f|{J;xaAisC{uGVF^O~e$pbLw!mDxJym46j<bC+v<2%rnya1yn&B2Jf4&$OL
zKY}qs2cYfP0ZssRuzVez%26}@_T|ZK9P=$0G5{6zE!ewd8UAwrQz$%h0(QQ<9Wy^Y
zA7wd7c=4WJqlG5a3#MmKzLPO&&V1bZsSA-sxn6SjPqFPtAwGZBETmTr-~_^dVa49d
zaAtNbHf^lICD%{DS*%|v8~}OTW_hF-{-3^hDiZ3s|LN!7#F908Fs$Jy{<xwOAN%~x
zm^U#Wt#ilVyI=ePmam$LG3O2AqzdI{(wX?^EjO6_-1Xyc@IVjl%jF99k$pRnJ^oUh
zI(rs!QxXwRp6}sA)RPY##SQ=eOztn{YTxQdxo31cCX6mb8j+!h8BWgZDhAo5Q*i$5
z7jUF@7OuW_4$>RTG5em|ux;0FoKi9oE2+Q~j-1K8;sZeA01TRb7H;DHtfKT7teKFH
zul{B!7M?x=N0vW{%DmxNc;;;6HRWRI5AS9CgD9Jsf^F+w!iN1VNaMaO_1%(*c5Rs$
zkc)Yjd<faJYIx=GdokgLZ{zcqPNfxq!}8$k4`S(#2Hg0?f5yzAT)~|>2;ceM|8Y|8
zY@C;0fyeGC$F0Bk7ET$KhlbN8qUFEtv~fy%^;-Ptr9+r~)uos{qYy1SHsQr*SKx}d
zr8v0i3EcDKI*gb;9k1_A#Tguj6sA_;!Mh$q*~M3*kdvJ4DJ8h_=Fed+O%ofcx8uKm
z^%ACk=JTAmEk#cC8vJ4PGR!}J8miYU$NEFV@ozu43568+sY7#d=N~t-jneoe4g+V<
z4Ao?g*IJS9V^6&hH-Bs)3OHG?@$vt`md<S4IBzaW;&yW)k_yI}1DJeDJXSpUTNEt(
zs%w8Zq_FW0mBt-wR-<j?rMTguF%oNYUiI}qCG1GcrR4y}L%vJN%JvRzq5#mEOYPAu
zw|$h>Dm1Y^x)}+XIY{9ch_kyqFlHHE+Ejxyo>r!OB`vb#>WquW%nKG`B*$zTJJod#
z!X-ETBW4VV$E#U~@aT?moHKnc&RZ}IFL6cu%9}odaoNC#<QlwI-hqWTegdZyZ~>rY
z4_Xp)G3VkB;pWRvLqf{|{OWr@!V*p_%o{P5E3~`Nk$x7Y&76;d><o_2cs|q_=b1Id
z4o=S1R92v9_FU9euE&!HGjPhZ$?Vq>P_cazmcIHbwrp98#F6JBGs|rpk;GS5ti_Y{
zr{f31N1=E`Gk#44c+0x&n7lxIbPf8^Lo^p1H4^!>LU7L2+<mktsfZtgVO)tb$8lu>
zc`$X}#kiII!;zgU@Xdwaz*tUbUOK%9+s3xzjvf1P#k}(|k1O1ZUwsYDb4pOoZ9$t3
zj>lJ~4KXlI!kIf2-b-$|m6L-lRM_@nH<j<IT1~-av+mQpe$?r>;WIS1%}vFQQ-|SG
zUtf%?=1svc*7s&w++6tK8*%x}GA;yf!tMY3GoE>|4HM3vXn9m@S;y1s2caZajWNgH
zS!MX-7e330yLMEr>%fkUPw-G4YHu>;`Wv0b?UEIaknJgOn)lP08anqw6UK?`JZo#~
zaocUTDfpyr?(ErIgefp95>a4hcW^YI#XxOU(|r}4w8WsJaYkfNa#FbOmk3=o^!<X-
zN%5et&`E*mq|)Q&HdM+ic6N+9u%(r=ubJ67_}u3{heb3EOk`uErQu81(BFFNt#&wz
zTY48HrsMR1_Q+{K)lS8VMM}7QvV5hqY16V4IeAF=O5w)uabw4@lV^UO&}rbL*iz<>
z*VS{?fcvnRMgzPe?pd^BX-#Mtk&$giL8P$tq-a`0r<F-5qS-lFT+!eObCriNoF)}i
z_gn)^*qV)qXNwe{n2a`dU>#h+(W;<ui)DH>#=_pN!>}4oC6D>)UvEyzpZ;VbC54c$
z=2ThSpFFyy70&dM>1^@o7vc$SZeFwaIj&k{<CnkuDmK<{!}G5;V)dFcar?*;)SWj3
zKi~lWxuuz?8~OwM@XI?;y>1Cs464AfD=x;cvRODQ@fSF-@dYeT--pxg_zA{tsmAhW
zUqtryhj8PEet;}#RHV}%EH)l%z=&aGD9U$=RK@`AzZzJKxHdM>b-S?_|B6xMqg-l!
z9?rev68v^g6)wrB!mtZ&z=X1~*6ga$u<A>Ck~3oP#jCGmiZk%cj_-imwpgSU*vG>G
z)@^(Z-~HDru7Gd_;Nr`WtPwfoqNTnG-&-h?L*YRn-Fib)v^g&r!}ZQ>RaGdRalR>o
zjEu6$<1pvOOl&ScMuo7Dqu&bb;)z!!r(IyUDNb`uB~61CVadh{mSY|2I9RoVGS~q&
zwPj=E;6dOxh@<Cpl+c87FJDcpOlF7=|1)zgMD6FQW<5$dsCF(9Q>Ki-Q#4!Ic;GNv
zw!ea$i_SxVF<Mg3#?)j(AOz&Z&P^;hSyD`WYXz+HSQYkdF2}U13uq!n$JOShh8mnc
zb2RswxsESmKoQ2qJ;K>uZ#AX<7)@5T^Pr7$;dBL_#>Rs=RzAN7uZRy+>SL2jyc5cZ
zn}pGb<QxnKJ=*l|J57sdpQBiyIGyb+NS<;kMh}u&OfzrFP0JAu3LC1p!qtxaVIv}a
z(Z~s-ko(#W9H?%_C{7Htr%lDAl6)sGf++szpJhkbtyTEzFMfnqV<+KXuDKX_6s%*7
zoiwFO!D~<4gI$Yax$4%4Ge+cE2O^BBIGEUYbOg>|dnG6Fsot_4kNtQxKKkIz$mVww
zPm^nJ%fi{Gb3iX)6>q)1ri)UgW<3^Kq_?@D896wJ$N&5rc6x278CZge?7$@*ZB$@O
zCQb$CQRq1F#7V1ab;5Kqed%OdNicNo*Iv8*_$zAKtKD?04P_&<sc<V&9I_~*YWeh^
zqdkn^#6xaVi%mAk$CX1H_v~ic$%huNkF45xGHpV9J~l6X1ixCz)m^S$%^Sx_KDGse
zrY^wTEqCMg&wdPZulxkAzT{k*?rBp2+b;6J%7qgH`8jde&y_-3^Amj$ruCj_hb?uh
zJlS@}(PV!4)A-HirOdklGil17!U07atv0d;52vE&_NJOFaTP`^XxHqsEH=C{GLpOh
zSer~w;X*VtusBlDf+4x_Sif{7n)7Di)|=;G>45*lU$`1J`lDxJ<)RHJ9x~q&wa{#O
zND22A8PAW=<c_O0M=Nmuoj+&4Kn@I=&brot)Bz*#*?(Su|NGIG@Z{KwantpeVe06i
zEOp9Cdord@8fJ<CXSPVsP`tXEE3G+|D4IADgNoeBM0{!i$_kRXYIoeIXy?9!VH2k~
z`RU{UaX=1^a&{&*sSwi_{sY$h_D+2EsfY2gkAE5$oiTzFSUhbpwVA6Cf55Y(x1*^9
zgL&ejZC$51sm}ug?){iFvJaIdO-xEY=3hPxzu?w_Ge^W=J56XuFPOoYJPBFlFmyEX
zyi<^KbBAMcCoLl=!yO&zXxc|b?AO&u;6!cOz+p7aWqxs)C>=cmIYsQF<GuU|%_e8#
zQ>@OlvYm>J<5q)HN3y+DApiJmZJ_CB-XIK-21S=Rs2D}VN1}}@KD8;8*jYFh1G(2o
zE`=vR4jPcmew8c24NXW*Y{7~b9>m^dov5vA!`R71T**I-RZriC;tRiq8)jzX58wP}
zJhS9wl+K|k@6MGN9&<Ixq~%E|EiCc|8r+8ZN*v(nxXmv<j-4wKXpvcuA;Txr!nFpK
zwJamrLT7VQTy8)n_tx{>x+@Z4X5JRk$<?t;nk|noWl#imQXV?0*5IMLeukuu7PO=c
z#!%Yvw{gY3ttA5sX0iRzh>>;Aw#`^gBcH{alRAwpyofw_PgTQxx^YK-*?3M2Nkw(e
z@YS*o(or~^=J5lXsHl)8KQAU`%Rt<fhV`8$>{&EL9wj?n9(t9`HmK>S8#k$^*0@c0
zbJRktCHsVJ@JSH;+v8JFkk2y+7=yOqD9s;?nucSvn#jhqxz}RzuYZk?-|`f0`t;4X
zVAcfWl}yGpC6lmW$-}5>OhIbHK5X8Zjl|<C@L**tK5^yg7<tMplun;P6W%TO%g?{Z
zRpk<V=CU(r-rRs~H1};zNX4?3Uck<zDt7%luzAlm9BLVZ0(F$_P1v_~Ek+N&fEFJ7
z7Vb9lSC4%MwxMwP+1&T+%2-V4=t#osS-gIXQT3NOW;#vAWwOfAtE}F{FCG>){q)he
z?@#-%e&>GF?p}uc3$H{$nyB^!oNrp`-??@<7C-k2SN;-ku(BSf&ar|wK4%OqK|aka
z<+5^0a9Zp#t`2LA%rd44bwRe1)A-CG7@w2QcGRu-p_6AAtUrdlv9q07Ez@^4R%7KW
zTuEQPjayvmX}+2XZ!X;6OGY9?s;Cbo4hCBE=pVMj8n!!;p)By7EjKH%yJt{<+nc#{
zhhzUo9)6hCP})Q25}3KE;A;<-#EuP-PDqzBs4W||txUizI{QmTWv!sUMoyA5Wh?pZ
zUrwdmFP#RPPT`VDNEMC(Dcwv3D#6r#zH>RCRB1l*%u_Taq+-QE!uavruR#T&g)3l|
zfW^i#Wux7O`uavTZeGRHQ_2D#YCud*Bw%c*;@Csv49w#Iohj9^vvtz|NXO9XgwWO_
zM{O|N%8ogYc@4<rEHU%ei873BravZ}hOiSFtrE6zmLw-T7h}hbry~0dUf_zw;A^jC
zU!CL{Fi}HgaL?|&Sif-{PT`DV4o&E~ls`sLr4$c@F!PcVe*OT`JOV$Gc{$f$sL^)c
zQV?AO?mwNs|0{aMxwO0~_)f=9xU_yBPQCI!@Q)W1VLO-Dzj<dlPP_R(xi2CO8PhJn
z-s}DY-)u?1r~l^;oSnH5|MrdV<L6Zg_}UMDjRD-pFzbp5`20`5kH(a#xZ{Wag4WFY
zaND<U0ZK2$_pchlQY4P#m#C6cdDU>%%B)%0U^dk?p@AkA)RcK`2d4qC0rld!9FKS}
z-}o?!&;B}+IIH&36R)G@D@PbGz%>AhL%^*(F8Zr?{21|Tp1_aq_&v(Lelv<W*vV>*
z!Kw2v!#93#D>9j{`jXUa4VD_nTh30h+>}!ydFG$m=HscmDdRXeWD4YR5LdUO!pxb}
z<{v+D43)dLAUDG)we|b<;_$%^T)+cGoNLDG&)tt-FO9>$e&v%$I<^g!%OB>RGFDsK
z|65s$F>)+#naH(exhWFKZm`Uc?Apnhuq2Ef;?Fj6zHii2lx3{utoGgLIMR-bZYqYx
zOP=U+`Yw^HF8t#JNbk<cfWne2E)TJ>Wf=K54pdbg#Mas}u2gt5NfwFzKAP!Lr<Fd!
zD%4EHh^q;<0Twi~uEd6lp}3NJBAjc+)|c+Z4_`>cH*WnT&xzcKAKtsslWxf_<$)cS
zT%(;J$4=4YpPc~P1v@?0<C7+EG`p+`BBo?V7GtyjF&q#K;K1!rmCS^kQ~5M;0w6t=
zWlZZPtypQo$T_tMlt<<*dbHQ<Ij-P5T~&%N-+B{9<eK_RHt@;;3hA87Zo-1nOb%eV
zA)Wif(rjeahN^?>ku+%x4~TLD8?{#nIm7Vb|N0_Ea9@U;n*^!D&ix$hjbJBlv{{hh
z5ZV7me>;GK1BckSR_sd}iLYOKHIpRp8WRps(=|a-V|x;{huR!vR#RZ^G)@i9$S=;=
zi&pW+FGq_T_z~@KEKB1(2QQ7>C+i%|PHE;BOS5Mu0&QHadJ0c(D(Cea97M3tCBMzb
zs*yQ%F0Q@uB3^;wrKHHjYDp<l%k`>LL%B+E!9U^3=_Q=>;!JfyGSXNk@o^(@-KYKu
zGiR^H!}tCeKTjHnZ(cQ>)No%XEk87qui;Vg*b(^OKXGO6%rh~yIMW8B3W+%KEx5w1
zcS*0<+{{x@N1ypgTt9m}m5K)2$D76dV$FNG;zz}>vrTnd?K<Oo>BPfk@-=u&d@O~8
z?DAYJkBd)m6C}2ui1lIftN6=~5_~H&mFq6;ERQ&@<fLNG<sZeapWlK1`~4oIPU0YM
z{BXjkq9sI}DWwiz3ewoO6mZ4$hR<G&H0ICjdHo3YI&npC`h_1u@uYcp@vnct?|=D6
z6n^(BC?c+%++V0Gn#}Rh!NbsU2Xo(Q+Hp?q9pqIRlo9R;i-~RJsj0+?%AcIdJ|aI9
z01Y^$ptDAxX!6<k@@?a=kxKMW?)oXR3T{IQ75|iD8TiokAE&iMs!iA?(G=Am{|Cg`
z;7h1FSVxmM>1kp}P7R%M5wgC2AO2XCjOLWFxNK|=<F**zbs(D$qlu=Sd$~rQK>FIb
z!kbZc8m_zU3KYb%uV6W)@>(1;AHu2^AI7t5xCfLIdD?fYgWp<s{Ygsx1l;)ft9kv1
z`eRN^mDggH_O5#wXisJXPy6OLQga=IRnMy&j<Kv&zHx}x7=n4rX@GmUx)q}cJ64t}
zE$LWz-nBSyN*+zw+i2O4jkx*>t}q?pU^9seWdpJB<DbC){NJPa*^X51S33`-*{R$|
z>Lz{Lt<KUigey2{2U>CZXD-K_X{EGEXtXwEKt>1m|5D=F#`q_T*V9~H7I+RN;lb4m
z!;XHe<XTztT|0S~FnA)ay75M?_K-%3b{bbqJF0fF-qvH+KDLe4{&<Zk2g$nFTL;md
z*vWE=+cDTT%QYN2jHAcvFw|90t9!b-NKG>5ROnP6i6!}|6~disp2a;+@8GyC-I>u!
zc1dGPM**(+{7o3kzDI4Ols@b76V<M>Yw;?a`T$u)_*ZS{JC-J<32f(FZZ?c#o$)!-
zgd;SYZ{Z51>h++}r{VLr4ab7@FXM;b{T0&Fzl4iU8;+`t&*8zv6<GMuGq9DWs?#pH
z3`1%c<G-KWhNCzgdBiC;CXveH1n%)1ho5losQT76PFO#_7P#olQ;?Uz$%2+VTz<oO
zxbxYK*gt0$3P$Flg_9_2wk2ZhlwwM)!%yV2^FXS78xLa2wfRnYH44Zo$velJax#gJ
zG3yZtsYaaS1=Fgn&g8*v6XRCnk>CG@ds-85<t@by4r%x6Q2qYpxZ_uU#;Mo*Bd$Ls
zg?lgW_S$#x$CafYx25ekcD5&x*J?9ef2#ISE~bOqC^!*V5a;^l_G7!Si}E>hOtFRQ
zXT#zL@w-Kb@u{zV4g)J!<L*B^#Cql086o7Ch$Zkd6(M?$d^0pEqQxc_4qtna@75^l
zgXjq|ONa8(hIA@=^A{|jOfW$4=yZLZFAwVDC0|-FspU3+HcmchoF{S7m__r4#%1aU
zcDsR%_Z*!5_Um!JzoG3H01K6!fyz*wk>o^$6vq;5)17)e+~FLWU&OG0o_z8tn*Ke?
zlRvlP)1UejXZduO2v-hR@OCOG3z$v1gF&TFaBLP_Vx`I=wNT5!%tN^~amG&qrQwu1
z-vl<U$B%QP?XF!kH{xK01L=GYXtTL#zl9rRgoBc*L0~cyJnKTeZ&9I{IK`iF$|+dB
zY`NV97{>v_T$*s`uD}+~OsrkL91lJ82=4sNule^I(sz#0Yg;N!&<#O{CtroH@Us<8
zX4}Itf>r`G<E_(1{eh8$UrLu#6nms1?cxFlne5bNU675heP$7^|G_vE4lKmf#0T)b
z*MWcg1r-b>%^rsZF)!e&G&%bD$bsB=&h@f~UcnlC1>*)eTk?V_bMeA6-vq9{5yb-s
zBXQCYEMC0@v#y?o!9&&g^Te$c_v0H6*WoL-aDX#*EGi%TC)`Oz?W*aS+=upc{Py9c
zxZrz<C>%Tn-<tJTeDCh3aQn5huxIHX@rj>~$Krn&N>if}{P3!cxZxY$!=TK6Kw(EU
zs^dyAcTy@Et2bffxu4^~FbnWcdE@Y5&SXA#`zJ8}0?x31^RsyP`Ll5q54t(JcQfx{
zo6Nx_XJ?x#xw55(myV6%@yeaJ^Y(9G)aSm%Q^SVQ9Hj<F>guR4#^dzaGw}U$zJ)(t
zKNaVUOu+B|_dl^D`wRGQ@1To4dk&x~Z88cYcM`SWxK<?NsTegKp_vm8%cwen3Mwr{
zG)c)Ea2(IQumnYgX-J_d;sYz1F#pCf<GBVc^_;a=8OiO~c>s+$lR2~JhFJ2CNi4*f
z;|uVGPka)kUwa6{h89>{$@;OX3hdvyg{PbyM)mqN*pV>`gNp|v`PdfR_s9~Yk2xO~
zpIU^N);jL(;C{dLyHQnMgUzefA$?pi2U=Ma^Hv-#r@743(OmWR1`Y997*cu$TEBBQ
z7V}iKQ;HJt68F=zUOJaEiyW-c9XYTLt>a6PH_+1*IKXY;@%(WEMk9uN*tlUi*1XOu
zSI()x7+!Q2d%PN}URjC~nmfJlAoutkPQqnYQCV*}c-_Li!+SX!KZ@piS|L1GBfdz2
zSvT4mafAcGjyN8~F{2cV{`fQpids!;#sd#Lf%d$)7?l-+>OH&$fitCEe_?4`Te#Pb
z9b61Mm2FG!!MDHmM=bow4>>3-$HsN_NGs6l!Elt0EXAwOyok}f>LV|<2D`Z;JZ3Cc
z9ynm!y?h6zoG}NPYHtXf=u*_1ajc;hwmpWQNo+?(@_>hL-|-8Sq}_y(=`E<NPr}5h
zWn4VqJ}X@;sbs9fM-Cn5eTGRKgv`W+E#Kq8K@*TaZvwYBRie744WmmFIM}E|gJ!zS
zaX`{|6pg0XP=q<K-MV=bcJCgE(Zw|L5<+Z1G{Gd3K20~MeQoEg@8Mduu{0qn95Wt2
z`qR@GP1C0A)_r*LfrrpgcAabMINX?W-W3=<pNgR0fiquCti^Jo!L9t$gY>H%I(CqI
z8Tph`5hn5Or;(?fjr*QnO!K#eD9vi;!5Y;VR$7F^>zCnh@-U1m9L!Tev$3~{35aVf
z2Ozt)ZNbhRlQ3Y^U>?435zcw+U+~MH{tVZA_)?4+l8xgBwqW^=W}J04Pa-8RYB{L3
zy23(e;@;U7)#>~!jF@#Xo_XpyY$+Ltu{19$-(P|DQXX!?_PmaF3z90swUupm&GANl
za}dot4u|Hhz><|4F+hiX5OQ<vA<Buzb54Nl+`18~*AL}>KhF4XTZ=`HJd5*b0yu7X
z5q1wr#QlHxGalsOFXx|9h>{^C_{mLQ!ezgD2m`h3%mHmPmA6i=o;sI`X{SuUi>n^v
z^%>K!U}_1D9oU1|fu%Izt-`WZ2QiuEi-QVjx?WBkg(S-&F0L7m{P}4Nyz&fm>|c$i
z9zTYK-!J08J0D{X{RK~PQZna)Q)tccI9}mu(no2&#%VL&5!b*&T73B-zv`<gb8&p~
zkdYUcVc;ZMObnuFA_sQ0O$jI(HWFu?{s5kQekHEG;B=ZzAHx2l=_o5L=AkND#Zf&~
zd5a$PwQ5S^v5j)LXKyLSloTSTU^vd20^D}rdff8$8+lSNBaz$j9OzfQM$3VDLohCv
z`??<cGe%x?GjeI#moRxI8Wuf`RqJ?w%j6+!oA;r*K8Ec;E=>)u!{qstK~HHAH02)?
z%PUuiK+?cLJVkg4e*V*6VaOM+#gMpK9O=wMDGwt`f9e%H`shoz=ByFe{@kP7E8L9F
ze449ryo2nt<p0J4Pt)XeQXV!gc?^HqRF7Gdm860RIJfA}JWS;kj4L{a3MVIc4%J~C
zw^58ZeHOm`v%4_#OP|2x!r_>heGp%}dnIoCkIRus1+J1;BDpq8Sb`?aLwOSJU_A2t
zD_k+o$Ka%9>^{K5W+slus9{BD|I1(4R~2DQMm?VS(*xMpGRY<*bXVHZ{i<K$GxsL)
zpt_XEM&TF?oi-Ekiyy%2E7v2JmL!eU<*2BQ!}y|n*1<XW7Wb={q<@U<Pb(@Lk}+XI
z0diuSuzbx5>^mhNg)|wKX{|4n!c}#i8)Rtyc^sQ}(2{6v6IMU=2fVPk5fd*|3@R8@
zzG|sqO9spl&nB*VwsTT|)ME5$AHtU=QK{=zR+{Wd*GXjTUEA5NSJgQMPB7ZJt>-vl
z3Kz9$hxhHm_N_ZmGJQB=I5w-T*hBf+j8Uhtzhs$bv{&;GCAKl8=K$re;zh1TpZ%HX
zi0?R#)jSw4E`JPVn$|cC#FH>P8usAN_dke9SNt2s4^P1M_6qLzqat{uoLBagSf8|E
z_kONkm++p2O?c?9FJR>5XWNO?+m}3wBLySz*~@4h<;}G=(@JE+0~d4O<5`#_g|KQP
z4zS%nn}^pq=a^H)iJFadqcJbX^_8y1aPM{_4?D4PB}dsl96!KsD+rD(bqx*`Gi!d5
z3V7JgFx>uMKStRNKSFVygHu($5_kS?HLm#hl_=x{Up*}=QmI()+sbRsmaRr=+$^-8
znnNWz1x+g!;ic6jIHfp|dp+;N;DwhVk9&qWXMh29+wk(MFQO=W8uxfVj1BSGm_1(Y
z2KRh#-A=~kVRWIJ0GD6g5gz)N%rfM@*zMakVdeHi7_+w$ld_9YzWHUWEKkFNd6Q`=
z)QEM@KZlyaiM$r9i1BN%^qHl|;z3W7c<_<c-G~4QG9ACQXe7R<-!hYQ%8<s|Y<65<
zmK2X;T;0F#{`+y9Tf5>p-nMZ+<GDo@$`AS2#zs@uvz;|}9<p<@-O2o%=y6p^Fd0ew
zrpT&q>#xp@4*SO5ucE<c@LehO{YL&Y)KR?PQ}1u;Z^)1#u{^~y=Bg{MoK!lzbTkh<
z;lh!2-nkhHJNlKSBxS9gH9!Z<FdiF|IBp`}i@WZ+3s+x#wN-9u`kE!v47-hwSfDyI
z)C5Vhj_ROnghoGu&xXe9wB&E6gi2bNTN0HAU2#!cU&{eO8qJh=00{+0W~ENCB<ak@
z1jkDwkyKh6Y<a?~wWdNI6qBBwfwk+_;rSOh7@@7V?jC&p`RDQ1zdppn8TR4otFGd{
z$N98N&$3kzQ)&%Or{G$F2z}0asDY5O*V`rYJ9q8EAU1R|nKe4N8mZMD?O{yg%!v-U
zsihf8adEMrcRAu~>|tZu$${PWO~df<Pn=5=nH0|455Vq0SK@~APDeHs7n$)Ta>eA>
z#7o$TPDcj!L?mG!CVct|%s+LsnZd=yrJ}T93+7*O9nP3A1j(F1Z`j(54_|c=rk55N
z-;VBDid!D3!VPDgiX!fX8pRIj=|A0tSJqXdbm9!2@^>c2j6W5liicq2%-PuZ#Qi*V
zZzVgd3ViuT-^cl<a#J^F-N(&Zh@4$Z@B~k?Tf2HKI)_ZhsbyKH+<yQ~1196tQDboC
zb#t-#H$O(h@adR&#(d0}nUCN9;tyE0X+2(i{#j&A=BcOL16aL(A6m1=^OV&=Hk;j4
zQ-R07bTe|U{0B_nz_aeq9vqDsglQAYFmTvtjGvr@`|o`et5&{>@}$%7quW2tlL@8x
z&@7er?qSU7m{H2rXVVUN>8%D;yI#gpo(`6fo{O^4iJWw3#YlD<`_`?-KAM5n@)WdH
zYqp?l{w26%{$#E!bW$-Wr#*iTCebW3p;MjRGc>8;9gTyvN<_i1K^RwfSzgCli!pEh
znLL3n*UC4hvjuy2YT934;K2!5w3p`$@xIy)DsrQ_idI3>-{pwQn}CVK*_rUriY3oI
zg=IUMFeEz(l{{UnE`2Bu@Zbz4XPjSq_(>E@nvID=C|_zQS#NR%^FXA$X1u&~88&m!
zcQ|G^ZoK9~n(452q&dx+Cmu)2@EMq)hF*1<v$^qHMXp)>BG&BK%Tx1)VrqU3)>On|
zOc@o`lop;=`w})CYDZCVDTWv2@E*U3$fx|qQ8_yF`cmvTRD)8Q=*CmAtZPWZ44%fC
z#t!fJ;eDu&8HmZFOHeqh1lh5Nv1I8ADn%R7lsyU8Uwe_6)HKu_Mio#0nRx0%WF~7K
zjfWB(I)KjPA(+mxsMySt`HDs(ivx%qJGNu}Y92O|l*MuyO|ze2sNS>`FLPu6){Seh
zyD10L#}7kH?SB0E$#P7eKZo^3cTBOBVMlbNd>a-$x}KuIlUJ2jEX@OphGAeQ_Y$t$
zgq_@naXgv#>6HybBju}w$FxrwUyORLtR8EN<6gk=TydnCUs*2JEm@4!Tee~4>g`CS
z+33h3nxgG1M{<5CJ5mld$nOIOtC2By5>MeBfH;~l9b5AXPpv&jv%%@ePGq~PcFX%C
zdUUZkT3JpdAP+O9l<=g@Vx({~<)sztsC34lbo^Lk<_yO8Q6rE+lfWb{0j6_LYg!st
zM!i4#=6!>jl(iO=@Y|bfafo{jhjS0kK<-au;Zs~vSf(QoU&XfY<y9QSt;NRbc#Ioe
ziiX{*@YFL)uz>@O+N25i$fai>pR4ULJbkli>q>0cvcpcI9GX9f=6MrnHN6?HQAyjq
zo8_}+4eF8xvtEutQcESukH=xmgt16#tK(rewJ0o`fC5g;3@)MxannvLUa|~3I5=8c
z&J~|gqmdKOm8io!EpOZe9=yQAz^V?=yefsfCk!rq(Qp7SaF19$PxUPuk;g-kxC%64
zDrGzq_0^TwwZDqxun)U-ZRg(WR-DNr>=!PW#1(q(p(`4W0fhe&>&GSzVvn?NrEuYS
zyi>Ck13AesC^v!ElvH2<O(n;8)&%K=!+82>2lu7DfGr%Du3ftUnPn4ce%8oIl1H#&
z<9ePL+KHLxUyf<RauLfD3^%RkX`q}mI?7WSUthHYlNNpiXH6TyyAv}pa_nI2WW8Cv
zc`NsHAH)2GA7+^L&Nkst`5~mxG&3SUoHWWBHjT<U_wYUQ2wq&nd)KyBVC-q<;#`>-
zrsbe`*kEjZ^?9t^v<(|qv#w+mVf=`}NC?Q5lQD`H_fy7l;CYNEMsB4X4je@jJ?;~3
z=L+qrCBVl%doJ?0Lafo(fnA$;nA<k?MYY(ldKH@Uxwr8{bCH|M{wuGDEA<_CY4Nkz
zylorn!G6kl8Ba^iV*irXyG-(208=aC(ui|0(rdTkHJ;$ObMrbhWENral&KgyI2~(W
zd;#mXZN;_&Z8-lUALZWMTw0%GA)m_A8d~<O=W1F;VJW7K&cPt=6D!Ec#fY(`sM+)~
z759zUxN#Gznt2N2<k1*P)8nk;Tk+EJHQ2Uw8(On?I_tElXs3n3;IZr<d8(`|L8tK~
z*DTtM$HY@EhnJyc_e#95d_A_UUx_^&j1Mmx#}j%Bx$;`iQ;lE7j-&AyQ8t1Tta+5}
z(MaUvLpiNTM$VYVQz1FIv3EZ*OU9tAm=lhygeg=s%LXN3*>j7mPOaU%lP6b}Vsz0!
z)&sUb9cq6zd+kpF#;_jbC-G#@mCs`bCk)EUhVwA4uC_wuDHp@akjAay>({Np<}C+N
z!b8|b4CKKg!$+f(7ttL)SdQ5ABJ!%x6xYs{T9i{+9z^*am_`c~T6bmi(tf1#P#?FV
z*uiUBD!8JV#eMO^ksQwn%|rXyPZVM5s3A1nP3J*mJF#;43S_V>ib+ch+s)Treif-j
zr5G|W1?yktiMs3~bfW0$wYxFp>}zr1ERGk*v#qON!XrF+bvyUH4xN7?_gRm^x)-0o
z_Kdl>X5LsTdBl(V^;a%=j)xZU6!Hts!=R2sSn~M&tP4A^aqW7b^a5OU?rh3s3zjX}
zf|3cR;dIigMqlGUZCA=1kc3r-GBKTf(V-R3qN1~y`+nK>aiHbKh;8ii7h!L98RkwK
z&UJHk7#tbJuwEQEa1`0YC$J6RzE*CzILNImV^5ue9GZjH9xlgmn!ZmdE8%^)v7E$@
z!%Kgu#D&*i$Ua{RAy3adx)TpSv=LKhPh($Gi1vfqIYwE*6Wr6-#^iBqRDtv%Je#29
z5c}<Q)WsXIW$kKIv)#Sn^7Am5)+|l+hiC%3f_nfPQMqR;*6par1($soXO7eOtqm)e
zzKp|JlQ3`6V17H7#TD?1J)80Bt7{NfP=sLvvv8pN2*#c=1~q$D<H<G6IE`&mGTWUE
zi~ows%n`(g{T2_>S^C#Sh*f>&ILqL4y>(PvL9;I!2=4CgFz7&VcXtmKoB+Yy-QC^Y
z-66OJ7ziHR-3GVExp$rS-a7ZY|IOOdy{o!*S9NuFRsB3}XvS30002P3L__<?W+`sC
zR`J3!;qdlc?(_?{b33FKV>iYOlR>mao)6B9=gja7KjPcC(vLWyckbGr3*9|zB#tI;
z=4Y?i4t6_+yqs&9YqmAFv*qVQ*!S+(&Pc^mEk^9*kH1|XxZwG&kMq8~vvI0a$!qV!
zz89s<4`hKi$74VvDT(*<rRv@uI63bfeBt+U`L0%(x)G$*W9?j0_Hp5NivQYlh0kt2
z#AMjZf3VSY`7*Y0nD<r?3PX}0j`$^qfXW1J{gRf%0nZA7c<FNLOri4iW+`nAK3}c$
zM*GCsm9<$V-b%s-woHCpP=mLm*~jczv%}*Gi4Ucak{vy|3ZKgwT+Xk`vNHwLa<&9k
z%55}Nl(#s9C^T&VSJaQCiEM8xZphoPXlVB}rdbc;zL!J|d#=W_e19i+*s0mJ`qh;n
zN$s#Bjxyx&e1zYmcqmgG^3QO{M~f3smLfmh3S_Am;ba%}Q)JCF)-zlZR{P7As&sW&
zQI>05QUKJ{m3{3%9g2AjCwvg3rfu5Y8UI9>JDkeElwaIkPZl!-;+-6wqn}fetgE`b
zoH02#=_AKINSk_`tim10iND5%bE21T`_mfGcyfkoLA}#cSa=f<5YoBOGqRjtJN@_!
z`ay@so74_cwJ@KbPTGofveN{@w$NvPVIAdO)b6S?@D<QO3T}4btV?yPE-5R^Sjh;?
zMEUhwsrOcH>S^LUU1f@ov;@w>474#df6jfIJkc);AY9|juxugjXL&#N!t)sX)16nH
z+|=`DY|BT@Q7|I2B9UI^ymslTPv{X5XTvv(`13fk$OuyI+&6h~i(4`rdoLn6NSI0v
zK%!$5{P7&UE8Tbh`{%#+OQoHnk7sCkCfNq}M1@hCjH5*6T5(#{6(?f8CwphY-rKr|
zEt`wG9QMd0VyJ^G@t-p`m<q{r9UeV7k@9MYd~JVCtGHT?MQ^iB*W|GN+-j1D&kr2W
zVO^YGYZH(Slp}d#vee{*2*`5oL=h$l-S(g-|CoePpYGr*(H`u{(x$9YUF7Yw!+RON
z2>60^iQe~9Pg&!8qFQu(%^{jQw?M#vD%G59BN^j$=W=L@XR9EkTD^q^{m9*71q2JR
zoYT}&z*odyMbv?sW6o{{)JmG*KQrq0wtCR`@q-Y?+h3|k(F3+@d<7h$WE2nmlhdJ%
zWH+826FN_%;EI#9u9_Nht6++GGtL2{-wvEJEx&3_Byx`rbtHvbAEx@39%x1ZbT~%u
zJ9E#QG{rD0&`e8R{-{e~+zijm`!UD^aB6H0UBo-ak`P1rP~Rm_V6~<RvX+CWX4N%q
zC7hokX$1|vtB_!Wx^GVOFkAe0{|RMIXB?|z96sRU^hq70W>!HcFkWg-;L)yki}9Pv
zE)8j1X_HVS+0YsQng1+aJe_|OJkEV*t0Mb)r$;ZlL~ex={q~d89P`vto??wp5y`pZ
z*A1qX176U%Bw`JwJ2U4CcIFKTfRW|3eZsB0fS^F21s!W|e9QVLswRm-AQFH%gmke<
zAbKmj@L<mAJ&teH9h#3bv-u##zvzkc>jMrov!U_V(A=o+C?BoVc2^#6k^|i#;}V@Z
zyqZ11c#?Rkej+Wm;3fXQK^YoK?j|Tg`X!F1ZF0NL-u@2P+MT7_pE0J2ywsIR$i<f1
z2u@B_iq)=@LMjr&4U$EgeLIPN63eRub|RgSwN6rEX-#OG0_uH!+4Q~L*TEJJ#FX*f
z<_nw-@+3#J!;n-;VbarjslYj_;0*C3#<NuNArom)*;CN!z<!fR1TVgq_m~p)Q>X3f
zIaCX(TG;lXDtS*6@*=I+G!3UMDyH@<gne1AMS3;u|1B+WjDXbLPz`Ac3rQiJWmxv?
zrRzfNh`|uBUm|k@lleeXI#=Ck%cYdtM>vT4&mT396U~K4wFDI0hRA$uE)Z|kct^hX
za-FG5b=A9oHIbB;WYpMpGorjPK|7Ol^w$-tHdj_wJiWT5I#NniS9nQj?Z@lQre8GJ
zNigEn92Zk-DJ}?MX?^nv2FUyZWG*PgBcgPscC`~!?Ctx6t*z3p+laYj{5kaT(2?b?
zox)dMCWq1k-if3A8qvVi{i`5nH-%d<_+Q**ANQA!+qgr=8Ez)EWzNTS*}?6U$2mWy
zk-NNiDDxB=Cm>^hPs<YB()n+t_lGh(-+e8IZA%8{WJJGzfBQTCO23$1bB4OK<eqy}
zKHt?sUX8mCDz&7XF4_wFijbiCZzBLF<*(eqWe)lwlLf>~NZg7)eDr#ZvG;@C(w-3(
zaGgjXiKI@MSCABC6*9Tet?-Y5b4D_go&DA~3;c6PtW4hoTtS6pq#XyD))%F<b29oN
zY!%2&x*keBFMc9IJujQ@U06^(uz8*jAHkMa>mQ|UPp9-kZ{se0yqmx6@)40A?}L_5
za{NdA7~P711``BPW8c8wy)6wl*vgLC9-dW7`-AM2QWq=b{WJe>zs(9{dF7v%=^Mlv
z#poZ`$6<tLOS<VXzq1wBvqlaV;7oiW|J~mNlYPcI2a9a}wZ=zmN-eP1IXi+i%j7y`
zlR>11H9hvpa#)$wlD!V1{_NQ0ZMgY3+l5$U?e589zI$PX$->;UFhBpdO)FsulB_#&
zyhG4tt<%k=1iI1?zHQ?9#ZXm$5UhznT@&}zf&xzzb$qc(eoG^F3IcdM+j^_hIKs?s
z!$of4oE;$-^k)I~BFd2uLa&_AC=!9@K>nwuW}66U4--A?LWO#L5z(Mt>P`uP?YO9x
zMV*KX=SN}o(wO9vgbx%iBkJKJR_3CIkvhyoS<nl~O#4L=Udl{BtDb*>1JT%Vp<M?Q
zviFls*;$FBpLrP!5|Ou={m4?bmaAtPkZx)Gr5wi_EJ+e^o?+yvuAA>m1WHi4HC|=5
z>-!oNxg!`Y6_5_mZK4LVbuyzj;zdN<P-~Mu1t7`8fw<8g>^DYWe%`~@`{4`=DKW<y
zYp&A4{zs39Plu$Lz(Ixx&b8yq%yGtVO!A&{3Vjs{JN@<-X)1fkmHlaHLF0r+TF-)R
zZ9WX*(FDT5H#rfH-2l?3q^s*&*egNBeN2r#6*G#|XI2h;^mE8Z*suH~QCDD+AvZZp
zI`)8YrM*bTkID|&PWKfQHJTKP)E9DVLSt6jMaVKVn0e3;ON_1B5cEKx86N!QDRsP}
z3ivoFaW2SpXQ)vDmGcY9KW=*BSEty!6__6mdgwE;M3!67_wJ8$P`8Q)@=k53RN4~6
z(R8h{4tJ+nfkkGj{KwO{eN0zo%ozYh{;6*}g;-Lg<I?53s*Dd><~J-yrobg?FA^@D
zzFm`LUwa9j)Vqm`9u%6LE=4S))&yT3arm+lcr?X!)o$-;fc9HlNr9DtXDC;KWS&?T
z=WS-TLim2ZUQz~7qs}g7^l_erHAMMN-_LQhW8!)OF{K?mS)_pf*GTdFJLJna1bz17
zo`Fop``rN)<zUcmnA>5`<)x5B!l+8E{c}w$VoDz)D)7$+Px?U58kAN(9EC(laJHWO
zwyCqyD13SKKk1iJdmWaXWh+re0<OG;e#a=Bzrs4ux{pSJm3;UKor7pJ4&7V9(kw2l
z0ZFJt^jotRckbrLICK4Kx!<mSkbiU9aoR}H$`ZBohBy5iBD3_JihIkYu`#kZ!V~^W
ze&2<o!tPMuCC7MGKo5^1V=3+M+(eY&Kd&<yLhnrMAZMqP#>wGKv(#Q<L%nbzhclms
zV+Apkk3#)=mY9(SfB~aoN49zTAgouuUUzFcRdmNu5*~-KWwM`EXKmX>ybp<M>%!K8
zL>22xGOCjh%l;&xpK}RVI7%q{%$_-6B7eiOb<*#tLQlu!BOmi=|CJdSYBEEV3z_yC
zpZ#w4Sd*AIjCc8D`rv(qe6af(dH#ueq><UhOyV7u5Os39=1m!zb+1^Z!`6_<f?jL>
z;Bn87SXP31y47GMS2wjh=Jt(IfU0G-_^mZ2TimitumG@Q^YJZWDKp_(crHJ5oN)Vv
z?DM9KvP~)Z?P_b@&#g$I^}9Ti(A)9)$NlD8nJ(9VS-K^AX{C?#k45%Ji|u!WZ2`B<
zmjtJ2!z=PyZx!33PU`(h1htT&=`?8S=tq;6!(yVw?&4i5nm@=-__a4pIuH`2N6O{U
zGBM?vw`cTo$*Ic#dB`FJa|F78lb9|1v<aeJbmBPl(1Z~BbV>%uEz;cx^f_~dL(_Kx
zq_NtSt3{SwnF={$i`=p4Sd1~@i@V)%hfWMp!XjdnKzbq~+e`=*169eVyi%^>uqHy6
zI~P1Y*KEfa?mvYbR-9=7$igO;GKF1TCNN>j#*PFGJI)d6??AS$Cv*$HP&$mNEJF@?
zT)?UlYtLWNyh{-x>?Jo5zbEKH@vb6+>#j#52Z|pctIjQnvg;qPgBrXL<@($Ju4{dF
zn8(d?_Q0wg$)iIXFYL>q2)Ri~&Odt;@1kT|oi7hVi=c%NJ1yfPp&J<jeu~aPtoOiE
zzAy_c8JvybueeQ!zPL7|p}Ff0ce^kA?7cAdssuuefz?~?j$8A~L4C4iL%FxRlS^ef
zBJ1-Rq<(s<{)`O%(=#(ZE+L5K$?{-GZEo>0++=1vQO5A5$s*cV{bs1^<9;2Q%fN%f
znhdL~a0FlgXs2CjMo767FgE(<y4njx(3jTh+2bMla8OHHtHT+zv|onT>&Jl_#0pjF
zMiMzA;tRD6eVghx>%t-#78It{CQK?M<in9W&4nlB?Mn9QcoI>hDpBU(;B`AMxKKGb
z8lRpr_yUi~sP9JPsc=Y1bceJhN_9uQM4Sr;7kX@8rdhiPlVkbUH24nmoR68UdBMi(
z+@A0fdD}iQE*K+na%&w&azNa|FT=?-dEd%AECko!mMcEW4bn=Rf;#@hfPAetdX+|j
zAQ7K5)Dn!WO2oVqM3Sl#4P=fl&0^#uDm)EVo!AUJW@Ce!-SBz6LytHWWsK;7xw-xE
z6SZlY1WmtJ&11;PWvvBQe}APX62Hcm!s{L!fpD=;nJJanBK&s$xFHd@o8#lgG2eX!
zhXHg<P{7p4%dKVf+;!r5j6QqB+3H9u>xaLpV(A4KJakj)h11mHq9vrK>T_f>>+<ng
z-sn3dV;=L29lTE(Rc_3cGup~eII8<p)m0p9$TNie^TL}6K?+L+T;8Yhs%tKh2d$ON
zd9>@{b{jE=8i1ARZ2~Vx;{3T?c12j^!+$R<yS|0q@dJV%aOR&y+Sl51%cYqaYqk(w
zP|nQG4-XuV3j&(xT|KeyoU^?X^Jw;|=7Az9*tyWaf{~BcGwDClE!YF6wH?fQ<XD><
zOlAF%2x6jT11-NK%&bC~Bqp(OqGl$dogT0d+UAwb^<@X~kW7#m<WB;!38b`<7WD!d
zf;JR7=Gx2(Vb$mxu%wUUld*@RD5tcitLbvgF_VKd@u~S0b*NpzS|hCqxja98fSS#-
z5jbjz;Bkc*Ue>adCiEITNiGRB2DT8b7=T#DsxUgvHoFpia-uwah+}FMaWEx+c>ZCu
zg}0Uoodin+AdA+~m-3|S6!6Qr-I}p**Yy^&2ZTNpOxI_b&g^LC>sx3rm|o4|7lfB$
z!4+LN&>0^Sy2PXq_gZLm5{U6TDh9c!5vbC>(ZwgE<mJf8UpGrUhPl5ffZkX1N9bw&
zd-et}Iucjk)i+l~r5ja9eugg7Gs?zSWO;+nY<^)TH^Td|u$XT(q5c8_3KPER!Lq&Q
zy4dXzbPQhbT0MFVtRVV1kmH9`|LlU{9dvxYF1I$AN7CbelL*Cz+za4-UUMIwu6t<h
z-~Lrmn1oLx^g$vbdj+FcpY0j9(ey9mvzj&QANU_R{$cA+An2wC@7JqbZm69HByf_%
zxcLzK)edb;>ERGjZ0xDO#49%-Z<O-yzPHfFv9aVwF5T4dS;S<-935k5)x-vcn6vr%
zgsKB(d!56Pa$95R`}8V|c}73wg)MrD@2k?GP*(t0P$^jLlD^aXMfSz~jS?-yX^--G
z_yKjm6)Z6t<$Z@x<z@i&<6hT_Lb%J6a%<n9Yo9jVfum|+F(X&e{Sgb=$kjt9@mC)B
z^mrcAwONUbP;Qf06b-ec*^VS1c!hjlvZIANwbd0Tb;%#6Xo3F%@5vvMw7t-S3Vx%1
zL&6yQ#k^XirRy>0v2DclYnFR?3o74PX+ET_2*3oG(b2|ZW-iF1VP?xYRB6}H+MMxQ
zE!R2n;DBz7?sgqU9)lArI*NWiA~_PS5c>A^o3O6yI!<zsVA2}tVq|w<IQq62cNSwR
z<|!jj(|5>34Z|g}9PO}O7g35}=2nfm&Y{Ov1(WoNshxBB0IjdD)1b=Ek4(~Rx7n?%
zLM|cEnEF-@8_N%?KUlcwD<j+SufJ*FY1C4?vh%VF<n6kNwM5IA^oSsYtdBh_c1Z6|
zK1nJh&DY?AeX(>^{yQN_Zp)B(*$gmnFhtb!)RiA$8NSNi#F6hr`YJ=Y2?>0wRFjm?
z5NR2o5%GzBI$Jo?4Hfv5*-^2<BtJoRTj-yK!GITB)0LXpkyf5sMrSr_^GE9{o$5q?
zv%ss4`xD=<W{-q%#$aBpUOv?m*_&2i6G6d_`VXJXARpX|03hwzRN3OcYXS77l%gu*
zztvQqz#c2D`gWgkWNY_&uB$ECoz8Vl|9c=C#7sN%@>kB&=`}nNHFO8>Z_<j;!X4Rq
z4Z;^n!R8eA-VNQZrv#XM8<nSbc28#*W9x{?|8p}PlU}mvVPYOzdyZnDYGp!wj84?n
zX7y@=$OblZRFFK*>$b6(vBe@dvW8<x5lcnJ5z74jc2Kp+5X`{OcO?dG@-rEW6{ix5
zBJPcWH5Idkk=~xcG6hHL!c>oOWvk3od@~bymRKy=Nf2IcG)7h%PXo8hso;-OAU(BW
zpl~>htZXJ0TUyjOF?2}~WC=eK`9YBpy|=3t-uzl6=~r8xEDY-8Vz?6{JovQYDJ(&+
z{jQs$z8u{NT==Ho#Trc@GG<mUKmr8ZcOyE_vGS^YW8`zY*t06^XudA>q&I!sY-}*>
z^?IB%M9Vfol5ouR#%9q^w?{9$n2fso;^|H>s&5ckNe4Mv*5m0=GQ~$b-RW*18&&Nr
z*+vn;hNF*$b#}wW@}6F|bE`1BXXiV`A)0GMSL3A(RrQa#FvxD~<c<o=D?P#oAl*Oc
zzq?LN8<fCD%f-E5wMeIS$Q2~f2S0~1FsVs_PA#2vT#J?*ovnzydk_QDNHeyji^~kj
zkkqikN(93TCKqq_2eW6eAJi#?a<7xEY)aPni;ln97x#;WT<gK4*5#$44t??B(S_W$
zVH4md&W4-8S{Pg@>?%(U>tU#YhU;h6?J<=-18tM<lsr^uv{zA*^pJ2TSP`QddX6>v
zzkogYaXnIlwu`t}C<WfC&r?WK7d<*x3yx^h%(RN3jPv!MnR$cj1}DR&SY~(#av0|)
z0i;rteIbc6usbvu*-pzk{FCbC-%TecZ`eGs*Y=+e%rfX>NTIe50m@TSPnl(DWiJ%I
zp*4t(jYVi_eH+OmaV2G_T#*JqIZSH=@NrA~=Vr%12yxWXOdO9nrGPm*1s~#Q&AqbB
zhg*nkx?juq9b|Q*Otx>AD;S4O!@?VNQsN@$8$Q7Jl||_JrT(!Q&BFs959h`?o%d1j
z<Ihq_8-H-S{q@$GTHei%`0~5(TVwb1$H(u2Bt7@j!Kp*n0~6D)`}9XU)Q0?zf#<#d
z>f%BZ-TzUM7$6DY8U65%n>|G<2}>*cl+E1CL|_DxY_Nd@M)gtS&GGqwYzIBX53i?}
zn{t~!pv^k=Ks*uUaj4Cr*&VmCr7x_h+sDS=J)d9P0UdPgf^<E3bx)qx-Qt2If^v+F
z!(1maK}A#D$z^kFV?Qch&*y#hiTd5%4RA;dV(VfJ#AeHaxAb_>eneSAOi=9*<wzz?
z{tH1sMGa`HB2~?xw~&fbsvDfypRu20C$PwKrEXORyU)8UZ86x5>VGJV;V}v_MS{-x
zmHwg96JM*VU#o_{h#sq1L4aGiMRQq@ZvD=W*@mxIlVG98bTC+Y`yT{+&h%mWn^UDh
zdNj;-rQhO1NlobR1t|8nhh6rk>|r==^BX9o;wa`7X%6so+^xH78+hjdHK_B+!ZGu<
zvlrEHwo^<(Gb`M=R>sglio0&}sL7Jg5DAS(;I!eqR;N3yB|B_U_-uIw7b7{oG{h2V
zov&486I!PMx!~ET*bvKv;@9h(AG$3~l93pNNy2<^a-Mnc@Q8+&e>>zOlH8^D6xtt|
zWmxC2li&~XD<FEaSjRTB*)qb$qi@XGXB*(5Yq4CV;jweU>b*3x6XFR}EwY0|ChpoX
z!FqD@7^XE0t(d)2Y6?#-E4;sDr7R|wBjq`GE0AtGHIc@qgxR?wPt_YGSq%3}re{ki
z;3o5|lIxy;hF)cPB@UMGq^IHv*QQ@EJ1e)o;1Tsydc)}fs!Wl0;ke#`o6MfaGG!bT
z`YQ~PI}9}w^592UF!yw)u!PpMCLuQ2A%BLZ8K51Bb$MvT<58viu~;1}PECWiuONgS
zWN-iE{))!`Ql_5Gfp&900aRreP}B8r0g1yMh$!*)?P`h_X^kJTSVM!(F#x%+gJBh8
z2!F+{r{IOIWjxwhGi0=Vadrv;mDig^OGP7)H3g>a83L9qy7dv=3aN0dZ<x5+iBQ#N
z#Es93VYAy&5RTkqYe!48+bdnKk4(K2^YS^^BYx<@vPUn@WlLXwx&!-?=Bl`1zVo=d
zV}=%tGu9AE*U|W>=MmZdTx6nr(GXD0+Lopzg2oTMVJAazNf5@RXZIzPep>08tE^G=
zQU1Qm+9WJDPI|{^fKRactWIfM|0JTfU>=@PxZVxDIoD<PP=$6_#r2lKh>5<7f6eKu
zjkR5b8{#p(p}tPdh&~}-ctpLq_o2A3-fOzDygN^*;kIxP`Aez`;jeptd-dL)f09|A
zQ=o|m68YM&qZ5qSzBsL?Lh2LAXZc{LdAiVnr&I5<AQBuhKb{oG&!C+VvlWqMBDhKM
z`1sdOfcIZ6tJb-e$<&1XB1q2U@ak4&?pGol5gkqs4Pb$svfz1w-E~5}d?}HOFOB!T
zNF7Ka7m);l=gH-_!o|@ji`kFqo%FaZ4|jHDux>9@@!+Z{{k-)$Hrb?_!{cX4DK`uH
zFaDkRop%0^Fc3p?H`!pCm4*qA#@UU9^Y+gnZB@zEPJqz6N3i%w?U!367p`Sg`U=o=
zGqVsi7{kl%IdZmYET9umJw)h9AmpPBX8q?aUF!>Erqm{ari+{axuYx8C7BK19hu>b
z;0|l?%84m0Iyg<wTRPcj6jgB4cBfRtMeXF3UoiX|Zxlug2fd7()b`)c9sNK<LhU)7
zEK0ki5b-uMUqrnoH}p6f_JTS}=?i4cr3k-8+1UJqL7JHe;KvZ`S<)vZ9TAXOkJ&oh
zC7_D9<je)%0tvi5u|d23<Bt9YJ)Upz<*i~E8ncNObv7xfbuhno@F;fjQVOrX%XlW4
zQG0id#EX*i0kXoNsIPl1H+ZIyzHMmsRlSB3JsXOt$3$!h{9x5<@fZK0>>V|NCtJ)p
z62q5lfGAxYf*eU7%_%txn^ezoTvtoV5Ulv}>yT~WoL^fEc4Fj;&KbK()Y&3Rb6Gp^
z-hwv9GpCK-9^5*eR)8aARxTNZwpwCil`e_*=~gWEDiQ-tT9O;El@5m|4Ow00=-Cfw
zaY^tEgTBeiAaQA0x2O(KgX(>PIlF!n##XDcC3w=2*9h(7OP$e&pC<w_RXrzbbv)*x
z)OqZB)$*F%Axnh6Ut{6%f~>zPmXJGQyu02=rA^T`1yWJp?9o9`4Y}^rh32S)#|~;4
zRuYEd?q=vfTw{c}Z&EtUcfF>tP|nG1IiH8+F0$%6lIO<^i_Sql+CN!2m-L5s!w(DW
zm-!iY%JriS9Qv8`<swjs#Td|FqTbCO7<jRF;;C@xc%$0w546`NQPx3cG;v=PVkGR{
zECduTw(A55w+CCK=>PRX=sD8z1Od7kDf@8?ZQ!Ce;7AJ7;G(#q$#IL9Y-R6{%<5^V
z;fAl1SUL&kYZ=kmQq%bHru{(RNTz79f7OE)<yUI8&laT^djf2l#)nECf9ZW*n`OR=
zC0**av^J76Psp)SdTZ)kPdL&xArZenK4x@B7#Nzv3$sE^SjSU;b>#HN<i+5;k=p<c
z*7x+m#QB2T?4RY{Lwd0(NCkUF7(;aR!N+DR7`Z<U#Zxm3yuNTm6a!<}4sLSLHKuo(
z8kK!3y9T~n!bR>go!J=eK(poy=G1pT?$p2G$`C|*<skbUD=3-7OpFaX?agi;LYT<V
zF!r8=5g|&t!`WH41p_|xd@yn0c$D4r9nb@BFcbnht<U3c;%(r{L4edqoNalbP=H?!
zUYV=PW~e_1kRN@zO<J(Dm+I}_<gzq-#yrU&W?tk-A&B!6j6jP#7Lf#+Yz0Z%KS`d{
zK0_8%a2SW~ST`z)<2w<3NQV|p9$}Lao&YeRS$k!tJ{9cdTftlq_+G~ipSf0r=xd`q
zs`Vw2t-vYsE%`5+%c<jFmo)of%p|jMgvlkKn(q)h#iZ!+(cP-FZ*KVoFSP_%a!DUk
zVI2751<W4WaAfMjMKQSpm!#c)MP6|?8JHW;ImtSaeVR9nTCz<#KkE77M&Xjy9MNd0
zQ<@jn7XiE_cOJNU)`w8@pV0hG-KNPrAql<~>d{}<pwGnZ*{A;pmv>V@m3iCJI)Opg
zQq`3@al(wrD!=k+k^SpEDBt1@KdT&47)Dmda7oMUH9MM%&(Z)ujq-kd7cgck3?X#r
z;-G!d+V^#rDK(8YW7S)l?80aL&<dg=vz2kT`U_qioLb-YZ;JRg1Cq9(&zc}(uq;$W
zmZCksijZmaH->ao7pZ+4Gk|cge8zdA*<qRd^H~_)@S{xU^GO(^p7$;OAXYEqgMnKM
zoyhM(>4<ZEFfe5=&5!LT-J?+DMI;tYd^H_BJ=<!u<Y`#)P+3|t0=Jcrjt~{A?|Mro
z{nM6T|K-Nzy{6l+!M5#Cx=qim$yhieq6)w;Ze!zw8NLCdKwd`3(q=D(ltQ<c=(4<`
z`DEHXQGg|UXFx^BV~ol)lzWJE9P2jeEXp+WCJW4fzx(rhsv@A|Ehj+b%^6dT0r&PK
zP3TRT+!;E55GBz)PCW~TiGZv=aiod7xzVU!#$cU<@2MS9U5fJC?|U-V3~NfBAtO^;
z7=?Q0z&hPRxY~GZrD+a7gu-lI>2G0+_V9wcUDu>>*XG(~@{+dHaVEfVxF4sUUo;$k
z{D=%o;+Ry->9lWEsHl~|!1*bguHEN37sTDL-z*XVSI;}ZI$mZ!_YDe?jw2+_l2Xz%
zArno~IGuphn&Uj_t5DkVb@Y!?W%l0Mepa&J5^O9A3%BcVKUMF4(eMuS-WosBF?XN%
zaResj8RF=++tA6i#pgB6g84T2+&>cSn;NpVZu5>7zLBXuFT}S+86e|nqigU-*75VT
za3y_NqeiS83UI_}^C{twbnP3EnQRXHqjrH5+Gwt0`A`m%EnD<ft~$+^KGKlPJsYhZ
z6JoC{Ri;CGE%jlnAt{+Zk*chr=y-E`HTSdiyR9j3KtoYeQTDgnw$YXRJqH;s+0M_H
zn4&-Sx4PeC(~;5sO1C}lS2rr>4n>WO!?gZki{glg`+0=L?47Y8riMwtZ=HHA!SVx6
zs|OQ-df8NzV<kXdo~1iRZ>JDXAB>@tWcFNXAe(AyB<B8F_F8>Qei3Uh(omR2<mrI7
znT!bBI7~<|<$!m4r;TNBGE9}QtA_DqT;m*!VC9f8f!w!L;o;U~X9AR{;f<j#=)1s(
zFDh^EMd%+ER1>Xbq_HG18jb*0GlqzEBT8s2Ah$r1+E|V(#68~}B-XwFzM|VU4eYVY
zu$jw__;||1rX(4KOO{n9d`zUbuW=c^RCoPEgcqkU4bx=Hxd5HiT)56g3x?iFUw>+@
z0A^NCr<~psJ=O8J(A?waqK;C8`}L)=E7;m>;rqH7Uek$z+gf;)UY*O*Uf7P*do#hN
zr3|@Hs#ozvB*TI}Iyt^YI||lO(}gN$^io3SB+%$da$+1l8DYTPBq?k!%~bE7`g(FT
z4-eW$hU)g~p=KK$X0px#2Vb|ac+%)l_O<(u1;UChek=vmiUG~{+D|Q~Nf0>wC7v1)
zw2=|V)1v0{S6{~e$_$COw5ip<Sv%zVgc)LdlZFn`MT=thnLH(ARUws>9(-E67puiP
zpQrc3<En4mxcEYskA`Q*Z(qb$HkJ57zKA~}e1T)}N%7ZCgKxO~U&V?(?7pHGa>_x|
zm6Hh5wUb&pmqGrl=%hZQ`l+H5=4)lc^GGSjp&MhQ@yH`;S*S8M&?KrC?nAIpA3p6I
zs#R6w4!n-!F&WdqrcpVBae6I2P<NTs`AYxwbOTj}X1AIY<I&)Rc{?1Zs%xi7`?s&O
zH>S-gVQ~6&(!)^$|6iI_ywQ{R%}Y-Q4Y!D@cEA@^s09nz8*w)+A@Px$wKOw@5e6ra
z6b+o(WS${s!}QvDG^|6S*|kVBVQZpUDW><Ll=-xCB`wqtFO|K@8`?bVX)W;E)9q2r
zMOZrOu3SEK-fN@d$w`=ap_W_C8?_`=SBzD#{--lM0~hh*XVnnyHdB7E>?2jUJG_om
zo#~2w5o<-)5=F4M%1yEF*ri*_h^Ya5jKPv5u(F?5WgR<6A}M>7Dkdu=a$@P3e23-+
zd6a7vl`Y1d4A19YjFA+l6pgC`^W5i7ET=VRvZ`xH!zX1mFxMsRH&oK&!&z9fL?rjM
z`g<|fL5-WFhL5rkRpB>~FiYt^>gL}|S%l&5cYX{+G33~C<dwLsmQ<b^aK_nihgGX6
zJmV$Z7>TMLZ3XLXKi=QY%QoqQW4fU<e$Dhc+N?Ckq(v=u7OD@MinL^*HQ3XGH7hih
zF%XjUG+hC%sTHMP>ChMJb?;29RJHl2elwaNM^Z<>#{5<fS{hG*{<dr`#kgG>ul;pw
zERu!3;VfOX3P*Rtg2VbXIBawFHpT(Jb}X1&UjlFR6JYy~I>ECX9=23Y?#N>1A7!!9
z45NM{j)Q`3;vQ9bB=mk|2@US;<!{)Pq?+XFAi9g2wh3YBSZ!l6k{d17CnfgUpZPn-
zhXeuxMg$tFr?1d?ey>J)rIh49VM3ZaH5>HrM(e~SGk1UqM<Aqln7v2~TmH9&UO+E_
z5j~k~UHb{QdZ}iD1j*aZUn5|yd-2HP90r<Ps2Lq^OhfSHW9f*7gO4ZlJPbfIQ{}Gq
z-%tnVfo(Z^z<A;uP~A^dbU%N3-M!lF=I?~a)5QElo^yhw$bx>x#J^s=S~~H(^iCM*
zKc6>t-dF|`5oV@z5eB}xVRh5OW=2;>bwz8#VuK<#(_=)^a6)P)STs;@N_S$AR&JK6
zsS7Jzp=s-=w~2aHHhN-*N7$&m{~Sw_%tVZdvL0D~T?MJjfWwn%Cn@qsUN2!_kW>lY
z>6Ntnv}xoE8{?b9QAflU@Ku!jBkgXs$ALv%oz`EqKqqsLjf|2nE?VGLHoYp8#IG*g
z#KA?wFvuK#$E<}5rl%(4p1dBHPk78SRMHjS6ZulJ;c!)CDNT>+u8Dop<C4tK%{Tze
zAK&rgCFyAjmz>p0Sy$oJfJJEAI}<7n>-m8!LjeO7WJzW_19sRwtK??ela0kAFs6{z
z_WR?(nW2fFr%>*d-GwK$<G?}bI%;ZV5FnRM4m;bt@s26I_JSeygzyKtfCgzwUj#np
zlZ#d~8`}M;5nbX=M<+ms=1r1NKuOyz$L0lGd7hX(RQV-5uWBH(8I&*fj|_Vvn;&bi
znj0*ugToc*vQ$$D5PTaBCUHsgPmkedprMy7zCgfP+s}2;a-^=EXLC{;335r>$SGx%
zO?`|5hhG98TE}V3v6J_W)?Gf`syJ^Q^QQ`Cc%Gmm_f17lh4*o?rM!5qM8F7JA-GiQ
zxx-g_k54E0m2ezMi)iVAt%i28ztj3I+GT0HaW_qqiK3BF`NZv|yh}U>D6Xe2Iivvo
z2^`#;s_OC;DyGmdJUpq5cWbUZSM#d!O`|Z9mXnn~W~T_jH49Y^DQl6D{oG2Y#B#&g
z2&YoZorF>8B$6eX-;EtD$Y4|=%8rJoroxr?Y4+6nN;j6sFi4&>kz(}07kLR$sYCsf
zRcJgbM0Ws@wHHdMU`g^zr(b>AFtdzqbOQ(3x=u=O9imFE0nqZWI2$;bq>^FsBe>M?
zdX@wwv?T5#O#7Hfe%r`CdATgjzQ#~(`*ZV1Cbt#%hIXs+y+rpjzmzUYDPECT-7Q4u
z`1ZJ^v+6OGWnTL!iCJ*Jn$+0yS}`J;W8nUU9HC@EzskCJVI)40Zz5hb;&Kr+!Vqbx
zPESck)1!(%J$5|M<zeqF-gIS`Z5sePUUMgQf*RpG<15{eK0;D^fv|hgSPj(5zHnKh
znH;m)g=Mej9b`ET3zn<DNF>q6EJE0t&@}t>FZ}XXhrBZ+ovVCbnM|bnNP)dkf(w+N
zwtp0;+~9gAHgE`KB0Xo4ggNwQgmXk=L7)8OB&kU2E*VH|5M_vDQD@~V*rO|&EMMsx
zl_y!Z7x9@>n)sfVnHzcY)-{g2j8M`8F3R&QLp$+B@8HbMTv;A_vsYlM745c_UwZwU
z<zy!~oE7xp8*W=AbqOo}%!cw75Jn26b1_N*PF21{b$m#L^TNdp;rGVP@CmFQaO8$?
zdXEhp@IAULXBAL=-#D$MAu=W~@hFce)h?&w)fg`7_2Yle5lzp@vCYom_W&OJ$qIXZ
zetz#iMw^WPN)9WE5=;cggXT!KCp;GLUk~0dxZ_h(M?x4ZhL27e-Xg|6x&7HxuE(x~
zI%lY+rslWf7H<8&oBof!eo{o?adA>|QQr~oTvFb}4f@pJd=4^e_>n#Cko5m!7joDQ
zL=>=_kGPkz81Dba!~b|OsW3_~!ZvLEtXQJh|77=nHzoUQ@PiKaKMd!;{(tm$BvXeI
z%7-RRB>uk;Q6@(+`+r67KglcqFY?V>pTSxGnf$C>T@G9n%F)@`SqgG@^w($7&i^P|
zQIzcPuLYv+6c^nygFCxBXqbf7kw3)YixZbYpnzDx<lzS%8FJ76IE?NnA~@^;w}cft
z3(d|iO|=COwly_dfHcH&p-q#7<mB++;NUj)E;P;mC}_X1|LX0lU9S5o7aljbgKIc)
zo8?By#ZFAj=5S<VCnaS<%*=nQK9vp}*F<<B_aLA6&s@m;FD@cLcGjG$6k}$eF=G=B
z7C-S}aN~YA1bNNIXCa=g1|O%S;JmjU;6oz*|7X^Ji*@TV_EQLtf{b&$C{gf*mE5ah
z;nm()NDPv`3xdsiIQg{|vG1cnDuWOI7a@Wt0+h+mQkX7lEErKEK?p{MiW5fJ$s!%4
zp3Q9>1x*Dw=YNnb4{`^%3Y9yDKz*`qh2BLbVTS*4L}0i7`noSQP#r?`B{d88A08IN
z;K%|+3|nivuZ^(z0zAYyE6|oolcG|h6uVqkasC^@Nf->&O)Vu7_vLmJW_aKJTXp_>
zfd6YEz5f@J-g(K{8U7=qyJH{|_ltck6@4e7>(_g&7h~tdXfQ`Eg{;!hZG-Cz$zB_Z
zsD&Jp@z2VH*=7H~J!}4IkyzKrDy7&W^l2>J?O0-=NF(J5l%PdPiCbcOblnZgklUW=
z4`L%LIN<+D|M%w5C-v8?<%fHkMFxE_F@X#HUWh1QC<OlT7Lcsn8J36{HZ&S4F)@Qa
zWpIx%TCqaXT#guJiI%*i0f$K)%i2=#SyJn<n2cKa*xTn#Qt$pZ#*|#lu-`v>e41#|
zhgiCh)!XtHbf4j~^ZkwSf~V4URsa92!e7uBf-f7e9w!oVpXVd>eSZlmh#;yYW`^SE
zQ;SHj0eUebf?&u?lMsx(DOPX7D6H0iXVZj{MInRA_146dusB6AoyN4-B(O?DprG2(
z4Pj3?k;+5;&>2P_eC;cAoA9Xqw##1J%{O_1Q0%n)mX;C=-k|#f-{iI{E1O@OO@Fx$
zUVia`DpQo`gF1^;9)p?xgS=pKzFxkMy#`HR{{qYL%xwsKC`HP7!KU<v^5)_?WdlN6
z%IoSR)SM`FKciLWXBSrqIM}+A!p5ksmGO^sys(aAyvs0X@lbL<qE8E!Ro<G_WKq>W
zi#Uq$V>CG`tMel$Me`7%3O0mC8u#?aL+&R}wzW2vHGk%YE;scNeY_X(U0ta~&B_kT
zbN7Ci&A^(YVJM2@e`ECZTv{)$u55kn!j^c%|38h_*4NShnr5g`dI%~eYV1ExPn5N^
z>}H;yVc4t0WqEZ~*+I#f0in(EBsfXYC<3rp`IMA|IY_XmNmdH7&=^Ue<cz3Q)85hH
zqK*!F1aqbzZOzU1`Rb9XCMJ}XJM-~M&@~CNhhylw*GUuZM7-`_#>eTUWfTwC@nvLW
zO375CP9e%zP(ifAbtNsxr<}h=W_n);U$^Vx3Mwj&_0`6LgQkopQAq{_;shh?Hg3rl
zZI=IviCjd5&I;}Qmf@L|$~hW*Dc;&3Mc;52@bkJ}7*cZ!?|E{GyM2Gs%))$qSz|rz
zkM2YMx9M}zmh^B5)3jmHxUTOi1h=!))bGKC@Q%EXZX>lZYAI=n-ivP0i1p;i(r?c!
zD?X1aeM)`$EgMvL13z@0`u*{Vh6gP(x>qK&hZsaX#micH;Leom{R{qHgG5r)7-J?X
zLgW)Al>tSofR&!~`m=86{?8v$Hbkn{C{7<n2)xB$hXv-^+7V53_T#)|&`7&2U3snW
zNrEH4mJgCwRcuF+tOuNeni}PFIuO0dA~%xLKu*M#E)vPd<wmNsbb`{%o<7(29a^1)
zX99ZE+_~9}On?$|FbtcLiz}=&?OcGN*ifXz^kgRc8(dDP6rqA4TL;v2s*d_Sx^{oF
zuULLMx;tq6^LUO>zRG_~P~;ms!i=ok@YtDr?Qhp}a`3#Qzl+!PASE{|%Xv_8)T4{s
zt{+29Ht9^*epuK{A1ca_{hV0oih+Zd`0(ei4e(`{>B!L)gV@LVu)$O1)75FLeLQK_
zh;&cV=F6PSmtX)BMK?~o<#SN3AnX0!pdF<*&rP2`k8@g$piz&^W!oG{&l5*AY_mT|
zGweRrO*?hSPqUL7KI$;oPC3>4<6)9rw$*EFpeu&@<<|}K;$>e(&u-rHBy(=>ns(3i
ztDeC1sbb!7;p3U*{i%MQ)ke~ng`C<}DpedC6H|zhfE7N&vJI?tHq8fZgp+$ZIg|&*
z1urFUJ;UR@2~#0utrTgFpWY?Fzj-)Vfr{HydDqRz<7sk}(H@g0@;J7?_>$)Uy_d!r
zX(P1-r&*ut%`%tW1_%w_8Zo8jkn?<~C&O$i3R`a=QzI~Oh+xnBAU~tZm#sSx@)|ze
z%2rar8dFzYhHj6^25o2UdxE-l;POAwAq`?-3s0QH<?D@wk;pkw_Xv9L8-z%ouB)VO
z$0@TCQ<t05Qe^d#begs~B8@vq?C{9%p5~msO_eZN08U8ym7yx^qVKKSXJE5*_68(&
z3wbGXPl6O?t<QuZb^L{EIrQ5UHVxnY2W+~cIzp|KMJ|Vy=E~o>dAu|sav4~CoqQqV
zLgWD+Xt+X#ErJtTwHgTZ*_ODBJBNdFZRZwXqtowxj-K~0Yp*-IM2x9vsFN7bzR7~Q
z*ME;(wy|r<VG6_Q-qOFG=Xy(yL-Nr~7cGCOD%<P*h&Yd5>0FI8I9cb5=&1rsq;-^|
zG-7JeZchKiCo1nv;_fzE&Tfy2Io|83XR_SeIBQ*oDlVZ}BdcIZXR~4Na3MU$!0AlK
zvn8F?j{8dZ?qpj%8rSRJjqL|qMtL&k@lyC)A;jm}ZJ}rth0kQ<M5VsER_lh1WUEHg
z(<=utQYdAEnL<b6Kaz2p=T1sQUKXr0k}?ae(>MAQlj=FEsg>k$!hhNi+^i30x7QbT
zkSOzXL3l7eRr2EDE%kL-_VoWNJXPF`D155Ej@;?}>QZfowV@rpDnN{|&C@d6K!C`p
zZoF{vN18q(P$kHHKYdB_<$9y5tX6cseO%$h#S&eZ+li>$ReoXP0h8(H>DzUxJ?Ar>
zwL?Sg`YFjTXLOhq(ez+BvktX$s@wT=?WOt_H5K{%zUtXj7DGkr4)aN|Ln$g68sq!3
zm3#2Z*+Z<><xI9%$dv#iu1nNcAiIaBCA#DSu>>Z-Rbl$W<WgX3t@8%3{nelBOCp(c
z{R4AEAuqMg`pKV0Q=JQ2{^6tynMOrd8Z)jHg~q;hy9YU77LYx|Jnp<<-@x>HE7kWz
zGo79X(F82|`wbcAvnN9|42j8DcAC*tpFAi?clXO)ubG;|&0mnSxDjN8-)xCjZamQc
z2)}V46C2Sc2CNL_1NAuw70e-Fej>eHkB3*+`Li%!_O??MgIyBDbhi#Iq%7E(OR3nn
zD`FmiOddyD<a3F8#Z*|IC}FaB{eR2xP=pPfY4`JgT&#Py!n1j|M$Fh89Oh}H7C9}s
z%I5)PN)bvA)pE4qGS<#T_`YR*yF+dtzzx$fEiTDt<st-uK#|QA*p83e-f8{9kloUU
zHU~XgC#Nb)%kp{SzI$e7WCGtpAY3sl8-J<<jmCdp=%JuaqG)MxE37QV!Cug6-?$>D
zp+QKB8l~W2Q_1M8q(F_W+8&ORA2OEZ{T;A-HY^uzCce~t#;8Fuo+g`hSz}8q-<Em2
zM1QQBJs2w^&)0vfe$YG!%hbUoZ%=(*Tg&{cwAeH)PnRFM(Em)r3x~p#^zMyG{@ari
zuY)PNjwH)qGbXsuLz`D1=>X*0YV~!MP|<k)9feW95sk;S^GQ|ODMk;OSulNM;n=s{
zPWF3`XKdc!1Cky4_AO;pI)6r#y9usqcN;NNDTa+Uf2@EG%|$;g@}Jv<*9M~P&3$03
zS|!m^4pFz^#$LDHpw<x@k$gSgv%~$^%d$#Nc-Z1bptdzt^aeB0S{rhhuG7`5ZAo}*
z_&=MY!2vw|ys&NV38z{CyQ>DudzvS5{A=W`n`58lhC?jxR_#P`T+cVoDcxR_rYMZR
z%R_qQA2*icacPT$Ho)d*3!SI+%L4mY+hO^%PkR8})z%$-(!9`aZ7xU=MAEX=fj}rk
z2Nkv;Q?4CkEAN9JihPMUyX5U}Vg|*eW(q;=0>oNi)m&=fV{Z36_C)LN`IS;1Wo7vA
zVwAC$P>2l|3C>IZYq%PMlj<k$%d2u@@IchzN`;~m{QUCW!T1t|h<gbxixMaI9!DJa
zPyfk2V!Y{R1-?3CslC641^YN(V5%&*ah6h?t~!-_>wM6sM3+Ju`bZwC_LD6f1!Fke
zRUEF6ZGKJs_5mDH_6xV6_d#gNnU)(+^KB!A-Hu;YPS?@gKMAo~Ez*9Sa?#j2*K*BY
z2i%f=CNs|0j6<gjxuGD;8T0IhNpHI-5hdoGvJyC|lq2Q&567Pl>;|d_GPt%+1ud03
z*Ya_NzZsEuS6;F{=C-#<uXSCliZFUiPo8&lQ(@!Ox_u(%x@Xl=EzWs0e7druP8Sdg
zss*_-hrYTSb&G#yfziJ$%oCj8X7#*a?0Q<mOk}8DoxeuPPmLCq$R*gF3_b03rGHRF
z%N*_v5Dw^m^LSnGMh1Mi^u-7Z4$4UTmb`)8Qh)58(y}>iBTUgD8QlWxiWbvCzqv7%
z4re92eL`+#aTajZ;<eS0gcXt6jOL1^gh%hMCI?a|%?2jo-?A1Jqrtn9GUp10*L+v{
zZE9iavzV5~#sNI27QYduWd6L<>nA={L6ZtVO(9FW?+Zh%deiRlB_0|2-eB<oq3*Qa
z`fHt+o9JI&)@cvdrnefpxQ-Hn*23s0`fTvkZhG_yK0ZfXk2r8DRVJb_3*yJK)$__=
zEa^<d64@%PmJre_V=$T^s@Q;Ie39nt(1>j!T>h)g7MbOiCgw<h0iM|;Jc_07Gb9SD
zKFfTgY(BoM3?#(q!eJ-^T_WM96$L8u(!g@JV)jcAax24tm}e*oiqj}cSYWg%ie~?<
z$tdhP{Oj|qps*rwHNtlfe*K#?bpB|`VzAPw|0H_<d4~11F(a5sfF9yA!<c&9M6mD}
zmWR$93rSp*={>2d{c`8lu2&9o!Ie4tO%Ls<1Fu;*(PU(9h27!M79fKr;|lB5@DC8I
zaASY84A1{GXWc$G3%9h@qteZiNab=pb^LhX<3^tK0%)WH{&ECi&&^5L51p4`eGGGP
z?auf$p;tvkT^WANKd`lu87@Rb_2#_95e?gIx)W-+Aj_|X`KAJ<B`er(TOU*L+np91
zGePG1wk+G;<6BPGs?ZyretfQHLIYB;_LUXLez#*i?t2$^*;i)5&!*=)3s84qEL@O{
zK*Uba-@i~MnNq#wf;5N(d1a{IZ1sO`lXEgRN=Ix_$U*T6wo;P51i-oOW$Ur{u>I}@
zAf`ySDu6g5I5bwdD=aM0r#V>&&`9glN?EowCgBRHW_GrMren=HG7;*OGKj~F5_=^S
z@ciKIDegNft`ml9ByJcL1cce0FmMfil!|NK09KNnONwtKtlsHg6Hld+_N7WEp#`An
zi0?GGTP}$dl?a2NcjrI`-=n_rxfM-!r1zK8fb3R9>3Ob;Sx3q6Wb$Yw8Bi&N3B7Z-
zD1-HJ7#hP)EsbgJEPzfbj+T4|8?I0~YPiOW=}6+wo^)F$fs~PuOgbD1-s9=C>C#XZ
zm_B`LGv2|d6M@=(m#RbYa2zB;fi+>@>+iSu{sw;Iv0!k+i&TMPoEu}yrcP$#`Wwq%
zNgQD&S^j5i8E4=-)sC+*nFl5j1rs{L!<WM(vTtd%tqe9kw_gs{{ZJjVi4gUDV{Z$1
zldmVsPT~gwq<5w~Ip<P-&uho#)OE+nxNSr^;Hw;+J2W6A{LD@RK4rAR?TH)P9o$RP
z{A8z4;1p-mZOw=YTKIMo_A?0!>ABNkuLt*fT7vXfhCtX;l$4(dawZa+4egow9IQ+y
zWqO=n9cpAi%oOU<Gg(Aayph$GP2XJZ@Erx2ZMLoAYFeIC!)KXat6Q7oN<RW_JE_LE
zr}AOehPW{wpv6s$ZN?j~QLumqQK@#(@wAb|e6L$W-*5ynA&zpouoimh>Ap7krKC*M
z3<d>@$*3ifh@a5JDQ^P11Mi4R<o<=(OAUXJ;rjssiN_<e{Djg@CT0G?zA~w~p@nbp
zADNsmC}?9EI(Ox8D%&`1cMU^R!WfQ<+rn{VWG_cs|F<-e1MOb8ScuAB;Wb7$%uepz
z$_{AiS&1N84)aLYslhu1C}_GKY^jEQvX^PGHp+=1=apBcYN>CE^|qew1IA4S0itC=
zOb+d*7sFWG!<23I2o$@F-kc5x={6mpWr{c9Twd)D-vdz9BBi5iF{+gbP||r<F9#7Z
zO+h4aA*SfEFU&_~TskuWl2C@i18_UFPrg<f@)$BAma6tl)<pHD6uhBIN<J{=%C(#;
z$vX<ENG2Sht$;|=F8(;qQ(Ok^^<XG&Y)+#&lk@w|`pbDX;039JXb{pl<ELZ~A4;17
zQCN6BZck0i^1}sUd8J{H)RI!@+Cpqp4NY~1AcU(cz^#u^kpbS(D#!JBOY!WL6<3Gw
zS4iD6S*wpbQN=BnQGNj=EW<Nhbz4DA4YHY;nRcUT1Vin*;!Sm&l7ukkfKrIXo-a}o
zbVhrL(?nMaW^yC6g~h$v{9%fWe^e+Lyw2>98$8iqL{Jq(WHcT1PW~xsrUz=v&sP$T
zhO}@)a$Fn;n0)wI@xMdO-rf(1vrl^@@Vt~?zv4Pzkd2H5$irxpYq=mJTiX5-RnXv}
z5$6WYShOHqCv5z2{s&x*w{)E}f6#01c6~vb>Im@-kDR)~V3udruN~=oKft%)^@bd0
zR2udtWLHfBDTunXmJkzD>0>L|1}EjXJBt24Y`t@MCGD0z-06;OJG*1s&W>$#?4)CM
zY}>nIt7F@?ZFX!YU*7r6`Q|!v=FeSq)l&=iTJ>P<b*EFe(&7f4&a+I7qD^)N>e(#&
zfge=16%iSsX3XV^ZQIH6T^Ap}Tv`3*8k*Y{@Or_c9GTn~#S2%URutKE_krrTVd(5h
z#l{<Hd12(|0+T$wrMvCrRh<nbE7B7-&_z7g>r_M7OK&iDIZ;N{VEXR%9@Tg$&(Kyl
zW}J|IWp}BYR%b#Jy|}sTKlpKGA@$o(5$H2E(<ZZL!f97iiuvd4N3r{Zm#5P!;C*m+
zQ~Y>OQtBEI@yXbD{w?Hkm%=;3;W@bB%3aCUg4PEp#Z19xnG|YeuF2?dCS7zZMxw70
z0gs1;i|R&Y9vf7j9wE$%WmluY5r>_aqzBZF!5bJdH^#ywrXok>8&6SOml1;TL{D`?
z&Poo5<oq_F*CMkWi&A}MF;t}XJzgs*nFh<gpc>8F2%uE!5SupAv6oXNfqP1czcXuX
z@_|TXx!v7xa%|J}H0pd*gh@h84`CEugN%J7xSS?+|MX>7XZULwa`gcJoLXY<C{t+`
z+^CH__|8v!*CyZ7!#<k`X`q}9q9N%KRIdSW01z_@rQV2#X#|CMArK(BJl*8*{)PTl
zl!PyO7a1!PMkmpAQ9ZY&0%Ic^#-0jiXk1bpyj~<JiH=cI#@yPGjP5&vqIYK5#nz*l
z2vCk*Dd9BFHw~FF`nWxb)9w`?RZ4BUq8?74!#)D<{`yK;^l0#_68DD6kD!%g`sYAx
zRlKTaZM&U4P1XhnhNWE#iTv+kH&2e{<rn=qB7;oH`%)6JV(7z3t$C39cV{vzq3<1F
zm{f?%PwsX=@t*bd0sGJP?NhksxwvBdJ0eOz_V^6uObDDmAh^6))g%1uyFeD4V;q=b
zZhO=_S!Yh~M@q;646^S75fMeD#bEhs6LCY_V<L4~3ka%F&<+)U&yEWgS|RV~qPi48
zhIg`kOJf>N_F!t7tFT!lU&AbxhlXW>ht~r@HIBs>x7`K>cj6o{7$@ojn{oWc0JiGL
zALCe6cM4bs)^5-=W-(%cF@=UkCF_M>g4ezZ$s?80tL5AQy{dw|Vi)MWymUD=gPrcX
zN4NQp#=25<C{|8N6*jwBj~6EoB5u?1Z6M}jM#8n+qA&pk2gD5HBMy3^jPz(}!-!2S
zAVsysaThERFzMfaS<c_VCZJ67_c5v~we`cIL@;3-rJZrURVL-+Fd&A+P!I#1`OvQ6
zYUY}lr>2GfNYLRw8O7p@bbncd6%Gep$L91QC-}!prXNbD19*j+iqN}X=j5y3mc)#U
zin?&jyO&wm&~;|P8Mq1EgPL{96P!>k8fY+@W<*J_UkYY%q~nF7a_LYsOXi{<>UWhi
zY2s0hrWe<v>7y}pVawhQI44d@j&}J+olo(|Bfd4K*P`v@ZJ%2UFYjyJ(U$S08Of5r
zo~hgA<b>edIqKMV<L`=kD}uqxvYkqsO|31(1VAmjhQk_gIBm0DxV~`70Sd?%1inS3
zjAE-)z{`HCUUH=j!)@TqH_dl=6YYjvRWw5z#B4Y$Gm>T>O!iY#QBl~E8CuuDd;Cfc
zI7BBU^Xq|Zz_SR*vyUb0O;_>7X<Q4hE~(2d<_R;>=?v4%N4EGLtIu<6SuWaq+kNSl
zngmOYJ-xW#JMtH|$v+Mss|j;Yi8;Zlm=k3TE{$NgIpBwO-R(5GcNnwa0bK1TrO=o+
z{>!C^@qVF^RzuXul*IQX<Tg>p*m!|BtC3^$^w3NFFU!@HyURa3?0y0Hb1hW&hYU_5
z+~MNPu^@c2ZlGSWNg!wz=z7r@h`KY!%x^O{gZhrG80&|^T=hH=rPbGf<2#sp`};X{
zb&1aEegLhWk|#}OcB#AXCN0ZIve4qqkS13QAxjL4bMuO&)xV?kPV-9$PL2nXMp@Nw
zr-@?n<-ZPzDvX-#`r-)r2u|#&vjqkx<MvHa^!5gUhUVj+TTzBna<-Xe*8F>h&ZtPO
zM)fVrg;{4CVv%uwHTmj8g`Zmt<OG;mD9z>#rN<Gd=WA1(tX$D>$f`LW<`i>cjgz`t
z|M^xr>FCc&ob-F0!k%<J)@tzjqP%;_epf|P)Sp(gA>$yn)BVb%&F2)|!NP&7(}{VZ
zQU~Zb!nuJo7jM_`c#nzC<r5Zf_$`b)rNgu0@!`&1@n&T8V&^0FQdU}4lnJWz!{de8
z*r8Gkr&!eE;h^Dcso|qaY7_N|_x%(qh9t-|Te#TubR*#6bq_{{++g%`pEQQ32~P9)
zI8jNFS>pH}28jC8+@gD|gw-~wANqzYer!!cZbE0R?e<{x@eoV*&=7Bl(Tlm`V<<pE
zR&K9d*LwL1jL^rBjGVkbFP|96=fkWlE<@6hf<DwklHK*J=(DE`m`eQA`_3}f)u#CZ
zNQ^Gu{7o*MD@5SwYH~~8y%u%nO5IA$@O(^(O`}k;<$Ix;7Edu~di+D&`KRU7HgG@f
zZHe11PU%O3EoyhiJu|qBCZnUG*WWFdwz~bVuu|94irQf589}z?Spj|nyN~k>E_wRT
zDhl`kh2I97Le21YpIO86i*xB9UHO{8(%z}tE=TB>m}~T1>-7)g9IQ23Bj3qf3S?96
z`DQ{QwVCmY11@rtt{-%|UoNcspQ54B$;GqVu8~)4w8i}3>A+pGM77w1D2giduS-Mh
zUqsPH5Zj|NObFu_!8IsXTinWF)4qSV(|Wf1YfPcG=D{%-=~+=@T!!B<ozh%L@^v(2
ztN`ZeyY<RiaON}d!FX!q`2yx`{E-uT#vsjPNBDWF3}E%y-dp>N)kQPZ?CdZ5%eNGT
z1suP<NY6d9`P}P0u2kh&gYRK)mntOZnj$yreZ?sKG6NWS%b^XUY)8&GOwI?Q(X(}r
z+3dpeaD%530eJIRNIUzDNWE#J?9+-d0VyCxvdJ(T*g~D#n~FbHKt_JVpYW^)+daiC
z4LCT6EPtar!y_y{iLVm5+ivHytM=uAHZ?GZ(Q1Z0Gp*G&LiF_bOa9}79!!N(VJkNw
zQ)lVHAr~Y2ZenBt>PXaxKL=W|{3P9BiVqwkt68QurV&%Zgu6jn`6ed4bIvfU56NUK
zv;MUg)A%P7A=LoeFBGnw!A4O)K;L&I1@ZA*s?dQJE!1osCv2<Bm6O%&C}|N??yL8A
z=C%5BHPO5D!P&_(Uow_&?;UEab-$_{!p(hvZAlJ_!%oWzzb7(+ykwXLVut;eSBo$&
zO4aQuSfD)YUb|e{+TXr93?5b^sp*~tyqyMgzVF-YrN|i&;p-FehVQxE3(2V|2D_*@
z_3xgyCX?-qgghS8q$qHkkycv{b{h?Dh3312NBq21$>XwwCDdYrNrEy*<=7XRz>>s1
zGVjB)P46KnyDq--#u8seW&A13jXOF)8p}(x>8{VNMQ`0d&_YT}l;TehVn&1qS6E#F
zGxI@v>x(veZ}bjbZbm6C=Z?(c(~K5)`~5Z5(87|p=j6$5Jd{zW&U?p0U<*;nE+N<=
z;$S;({LXH?wCi2DwR&HHWgtpc$XSeyxrlCXou)9i=m4CZzZPd`ghCP0FmG(GI9|i#
z&z_5##U)$4;mwIhvjzk3?D(f!<xH@4sF;;3i(COfVQMbqNP`A<WHgrhLU)ae1w!1_
zrn`fBfMF}Qv*j=G-vc^e*gk2dy9>k2fIJY?8<7xlQgxIG#mF@pi3!>5sQg9Y$GUHM
zIl9vve)sw84~YmzgPRFux2?EVl*#w0rFA5ZMXh<~pF?#{MjsX9jFV6FhI|=rXUpnS
zI9_i{%w&I%pc?rj$o|O5{EiQp_zQQmB7hRZ-}1GD)eJtI+`Dg3-vtv^v%Fn(>0z5)
zC-Pur$C{!hrH?e+L&@U}xFpfk%1PMqyjFIU->OjalbDroqaAG4ag4Lc3oV*ej6`5P
zQknvZ)Zx{VS4r@CtUt}EKQ4=n@&PxUHLwctk#Z`v1$>!Mi?7Y~OY;MLHseMlVa4=b
ztWIcBXw4;Z6mw8U(5zIPw>1r@^sj=bUs&fhEC14V2u59~qp^NZpdnzzUjmOOz(|ip
z*ZtU{PhL0Dc8xm<6D+C8WWp0210%Pf0H<-I<%_fPo!j*=1(W-=@qA%#g&_5}=gC3j
z&kZ7@*vL~D#bxP$6bMzkdV8N&>TmV5sT77rAc4;|UrJ2OL4YdP@HKJnFed6a(3gtX
zz@bao@%$1a6j@<Zu^O{%NX6)_J(Jgr+o|!cFVkVvvOY>Ah7!04@%-a#ed;9q{BZL2
z(|0$Jpu`c%uJO~7Oz?r<Oqr-s(~RtlmL)0ggy*A&mp3w4umjQJq{GTOI{2<#Tg0MK
zA*tXn+wnos=1>oW-2M;6IFW_mPYv3KThksF!jO_Nd)fnoo|a$2Bf>9F4t4uhiOvF&
z7E7+LHcCObuj`|~8M%hTO8Ski9vg|oT-1V@@wUbO4grQoq~v=A1U{&BcSZT?^RZ(#
zTsbC^l6IG6FNlNk%kqh_1l(>7WN-!K3}`imJ9(w-`f0@h2f1;H+u~!_eR>CH53acl
z%}LQi-igt80iBQUu4#+b5K&Suf9Qtt!-nY426sJTcm-ihGo`f0G{@!|3ghZV_Q>4Y
zZpYYpo6gzM<2cz_*|(P$*-N_kCpam*AJ4=Yt$tA%0+7a1WNJY0!GG_|ZWjeDoaMC%
zO38j{bQ=CO_AhG(L(vpFDz4}Y3oxs?j1%Ze?@@8Xo!F{R+3ebo-euGbq)#w2>Ic<h
zqa6;OM+poX$dePg-P+`5<5YIGCBbDn+`c^I_I%RuxSy_iKa2BveZfGZ$fk_&$I^_9
z{A5Rv{Ies%d>MQrZokEg70^gKkUI7Sx6Eayt710w^-oZfl^5psduMaXvYsUABs=-+
z<X||g!NC0{9}AR~iJ!tz9)vb|#vF_115L$6c9FP2CCVkTDo;fNzPs`wtuT({6GDpP
z{I8<|?V%-`Zz#z!HM_m8?0Fp>cwShIy~>PGNPl#}&8o1>T=?Y2r!<Y}M+z(q!5yTU
zQt@s3JI3X6$MixGo`M+faW1=Oq3limg74)YOxuK~4s&t}hXD3-2Koe*$28~-De08~
z29q5zb`8tn@rj&ntB83M=^>isB1X)Yeab`z2YT;drt(>#9Rckc&2H?ci4}|5T9oEi
zeV`<`W()-yOL^wMEaQk4A21#URG8~76rcW61$6qK)$bQu)NSu{J8HadAu;(_^G<k8
z1#p07RaMNVqr;BPPWB^i1sKG-1GyxkP5UgLOU!0w@^XG59Wdw(K;#j$ud}bUHz0ep
zt1H;ofC~NRFAs_ob8SVh^D*4)jsdAFN49sTJgF^C-v<g-?H;4l?Mitd8|4WC@<So<
zJ#OITtj+Li^uG`MamOw*MemknnRVshmpuytVFIDAVkl<i=L-V@NvQ|M=(}5DVNF-r
z9Ny1bbo@l1Cbrb>yEP#Kye^Yumj?Mc!_cfpoV_lwICsXo-afC+V{P;YMbM?9n+Tq-
zVKil|Y=ZmXZM;7T<o@ijT&w*>GIpEsYp2meQFT3x@|otT<V@i$xW^aU(#r%kCOg<_
zqMWDNREzu<4bs-UY^%a7Ulf0JH99u7f&woX6#@FnLchU&t~T<%g{Zg(1R_yc7y87e
z>L8+FPfKeou31rXd?{g?zW7NjKZBRvfh_+ZHi7t04-Cubv+j~-uyUVMCK;J9p_c+a
zH~Uos{G59VHz$hIT6Lqhp5su|KWSwM;;x;3a$3^GbxRbv=HJPZzmPvKPUtjaK8#Tb
zo-}`3dfWphdVerf>049N6K(n(@|TOG<v<qE>k4^x3tPUJ%TCuog$Qu^r3XO*<UkP^
zWoibVs6qJl3|qZ5%9I)IM3`gg{u?nMyO*C4vDik!>bE*;NgE*z3(WXDg2IwzdGSxm
zOqDyd(bKFC(MgW_HUe<p>W3qTWdGF*;0(p7ovZVOuj$5?w?UL=hw+coH}<iKkQl%|
zf)=}~^Mpt#8K|C7%7`%t2dI_8%C4gLD15@y3bCJ3swiKpNb@Jn(}}9(a@wWo=3q-G
zIs}H9(7OtSM=rU0!AL~b1nK;B!<CVwJAhA3OD66JIGu<JR@x+9`&R5C>0=IyX<dz@
zv-y2@j3Ki-ghDB?q$)M0%;GyQbVx_l568W_={B9Qato6!qmOPup1*&~R7Jhu=zs$?
zol>o=pu9NHZy1q9m(=CPQ_O(?eeRvVWapBot=nU1wQdjVu1sc#Cuvrbd&asHP4)!r
zxWaSOpA)!ACpHp%h&mJISV)Qsg7x*tAsi8e9L@_z<RW>U?YZSs>^WLHy>2iUT&8jK
zyXI@GJ+scg<;;{Uj@N0O5E78G6}n=#p3{hk=ykOeIf@}VgJcplq(o%J%gTkhtaM4N
zKXkD7m<X(z$l_yR6mRXij?MCC4>ILI(%4%zKYPgdrPeSv<u`j`fim}0w~R469;oCj
zO6*uzxMod_`eM>h>}$*ru75NOhJJ%98K3|-V86k@-*jbI*~fxvTNYgM`+24WwtB8+
z@k5uHWDhiW+YAUCYFRK0u73r#Rgbj^_!&Fh&GgTeFYFTOx}goqWpw{~Mq_7ZH(Xto
z#!f*GF##+pOQ5fh$)}c&%=T~g2wNmR)=}2#6jFhv!7RUMudG-M%mrxn8(pUOJVH?t
z<0QWH=Wi*ALGW{HM?*MSZ`iHEM&{K?lB!Am2sf>*Ekn?5yy)9zIiwoD=*{m>h!s{=
zxYDF9dOEcLK_)*mUpD$Qf!&y{=l*TZ!iF_<2;7{<dOJJ-3aV03kUSqIPc3_`>sW|;
z-#e3mP7rqr-stJ8*3-986;m?;%|S^kTxn*e%Zl<hb%Fp2L0}HLqcV-`$xcSt5R37&
zXUuyoKZR^BezCp#HtuCMWlVSIYx=3D%i7h}*_<!eGDSb7y>U#=F%=Qx)wjJz5)ih0
zOiCdKIw}|Z(b28`DSUiQ6F6%omwzu7UTka}q*)>YBqZ{dLf%+Beu-qL32^~pv^vV`
zIFLw(#z$UGI=GoFpAGecEWA$wdUe{;ab|HMT3E_SI>lAr5G6o_Yb9~2^iO?AexOF8
zDe*AQw}{oi({xt16;F7??+3NOzFD1hOPB7&<vhj&K{Q6d*1K&5P!6^+9c3&S^V+e8
zLNY9vI+@(xo4$^EL|cKGCI+s-crPZ+x3<VNFWj`MM27=&dWJMHOEf9V8ua!|vkW=L
znwR@UO3aen4tO=2kCPduB#a_la;0zp9WAdo&Ax9Fo0<-;EiE7$`!iJ5G28FpxPF>m
zr=ncMa|T?LsVXkUNDn+9Mpp9$+w&zx(dd%=RVVw8Mmv5ry70B+ZCPHWURT8E;Qj7V
z5`BI?1=;t7VDo2>YL~>m&F-MY08HX@diwLQ>c`%Z9`Eegpq_O2gH;hn1DfQ@AJJ~l
z*GU8=KuKNPRY_Vtq!}g`>#ra$vQ0ISCW&Nti6Keg_yjpC+dVN^49M}hLF#u@zMiRv
zfGk|dL$?giI15#FUNVFKn|!^r74aNY)Z()~>fws6l4qLsSfB11y>&MwfZU`jE^*}E
zCMTH;r9`H;?@2?3>!qC)qiC~`Rv4j8{(#wHclzG^xo8?I?ndkDc#0~g_mk}3<eO?}
zTG_f&lpC%*E(GO)=<bCCkLrh0(e##d2|Y?CqC#FH*2SB#qQ|e{7FkJAtLR5UW~$%)
zk8#qWcu;I(a!<g&wcC5k7MRF6DB*yX5l=IO&=Y6+xS|Wcpeu+w@J8gj|IA7`iv-bk
z_Y~KOE9t@_93dKRgN7ztl0fW`Tsl}wNAHF)ro_#mxVO$N1~E}U>#v78g;|=OaO5+I
z%R5{`Xr}kyqQ94G0cKl<X6SxOHyCEyr8jAdE}hv7F1Pb2PK)2jnXx*c{Xw>&_IJNh
zPd3k(ITSVmdx0GcdPgK;Q{f=g&ZiSYSkOZstj(`;Yk*O$e`Uc9fzO72Mdu+bTl^zr
z-$3wZ&X@0H_fR2I`wJGtE#}VB;<>839AZoe;4m{`?y{zRkUZ7AU_O!)HGfonC6>E)
zgsnJoG%s#b0VEQlmi7(OT#w*4Kjf%wRt(n0S|DK-1j_;JS*%#@<FqtiC{fKVm`y7X
z?GAAwt$BjA!hW(lmJiQ$vlbhsE(dY=YRTIid3DnPho>=9^xeN7y-I=6oj>KE5H*!X
z;>->clTIstA#C$;fWz+n)&1^=r>qGAPcB;5k<e36emTrGbT2)e_cZLt7q{wMRQa|`
zShcaNfD)apP#l1`r^+RUxZ@OnBQIw@QE}wLkH+?E8)A4{AofV;u!zNnM4wEgprt|J
zcbf6&NLIA7tQv4am((vA)ARMrrS{wUhE9rbZ&tL24?VwmU@FE)S1wmSo0D`|^`#4w
zD@v{pb+MojL{&|_c27uF(qw|#K{rho3phi0rj=1(x`CW$rd?Raf)DG}$pMUS_+l+R
zFIG5x1!<kT!Ys+J!|>>rgd}nfLw$vry$;Z6GLlj~e<2*NusXdl6PkQu9Zgcouph~N
z(*TaB>&p53%uFM`1l$tb%YL&G4TZ9_V0jZ$0y$z3Rf++_!+fb%0fY8%vR-}gch4SF
zwF%Rpj}TNw9H~B?#+a2EZ3@g?`OcT0=u>(^GBQD|Qog@|^yN*PkcFG|uxNu=Wt#wj
z8o{!Hu%iKWy}^%%l~&3<W44^nwZ^Yg#mEBr)Wr6-XIPj9sM^|D#hzgue^&U|S6!M}
z{ps6Pbyz<I*CYrSth;nO69dw(L=3BqWc<P7RTzU4sy$5XXkK&SNk9H}KZe~NIxB`t
zq0tq%AJ(Jhi>=VgQ|^#<V_PS}inHKmPWFn)4g&xQqWAXk^$L~@i%}zc17O0>QDu!$
zT3n#mT86NDnxkwEvbQW$mYd?c9slIFrWAg~)%ShPzD*Ya%n9ng;e(r|E~Xx7A_?;D
z>t-t2xG(suq)Pj^w7+Q)_qk?J_mD;}a&Yp3`bGf80B*Pwb4)8)QWVqMY3Os3mH9PE
zqDt)3CbzgfYP7JU?zDvc(E2f7zF_Yqe-hdAeQ%n#Lw{2qI>ticjiIB|Z@QM0O&SCi
zW2vrGDSYk7Xg7!khcC8d>(#LCtQ_(Zqe9$XC9i;PQ&dQWM`t#HH(k_yb5^Fyl;5i`
zcZ$8(V!7YpFd4>gUnrqNQ!r?ea2n@$)E##6@Uxp!<p<Q_Gc}$~ilWAQ9c?><?@^z1
zO)7eRCJd4+^bu3EMa$q+c%v24>%hpLDZZ`_WY`(Y4qUS~$h$V8#@<a~odjSt8jKnF
zL_+jSF8MrxgCxic5KSl_l#xj$la4CDh{z0P)`;eQttb=dxN67pHGr#N&-BH{d$>|q
zj=C6JgfZtU;4SO<fKkXblDJ0p74NNOOEEk67_VW~B<ZMx=Vr(oE<*9>vxJi;@?Y{r
zuKf%*S+%R8YuH*^mRbtA6Plgp$F@u<MN(=YUS*K<xGuX*(^H)!$tljlW#qEWUSSz}
zS{ARN*__X`M}N-ba)r3L-ko06iQ!My05#6#>K~<W8~dO}9V^fpzuzd{92T19XZ`FJ
z?MdRZr&gLs*&Q#^6}<wz;5e^JvUC1g5lRm2$RxBR|6QD9uiUg>2sO;rc0a*2=8>uf
zmaLV&)B<HTQlU?s7tOBQ)W->~OPh)IjUfR3jLRA9Y0QZB<##Hq$5Q5GmYIH5^|7Ed
zUyDhTlDWbZW2l&~nhcnw7a%m#+L`Q3ZzYV3E!ngX{W9OgaXj{mKu{?vd`V^cK?A<L
z@z^cYk?WYf=zYHO<F#&M*>6wQFC2$g8I^=xBb_hO=&O83T=uDc+Zs?ZI_Iv+O&jt%
z)aPv1I$_nw^0H6&H&`~j4H5)pX0XR*KbQ#W$Kpx}3Pe`w{oeirOgo&6x0{#Q8hRXP
zpc2RJbBhd&J(e$>+<2Dy)59mk3DBbvq?|3?ufP=(i2LkNA?YtX!oLqxr@0L;@&1J(
zA_X58pPlxPPt#EG!kM(KRC-g*q~j0Scy}3yFD?@H-xUZLIxV=^6ujkx{i;0ed<-x9
zNoFi{Bd<pU5r3N&Q^j@UgM|N~&r(Wfbk+Wnl6&@u=eE1<I>luM*)qzob9;<GzX)h~
zD^V_*!<Admr>>eP#(F;R_9YJ_)9|SYjrRrAKnU}}%-*kiT%BaKMQ6S5iSgb>v9Uhg
z<_-0?e?>}&Wcr#=P=Je)1Z8162cbP|`B+226blc79{?SyvN6=}@7Fgyw1tMEF4wc9
zOScXkcgXLXQmEnQ#w|jF_C-qTncE;=q%IAy0k|@(9b@B9=Ry57v7_WO!f}y1d%B&X
zbWYPs<+?mAc+!sxZh1(UazD0U4(X1Lj(eZNN8OHl-<s;80_~o$os{#~y=e(bW@l8h
zF{#RA1|pOFMW3f6W7EA6he){)iE^x(1j%8fcNegnY7_;Ay=r73RKMEI*aCq?Q}Gm@
zW=B8HQ@XVP5?8}lM_VrFxx;V*WK8s!7KyqMw=Rz)4<k9(oR4`jz#0XCndPWX-Ri`B
zDkXqI1qSMgVWzPkO+rLKfF!M+uAGiA<S2FN<>+Ci8G5Y|<(9C`L_X>()v&&zw@oo^
zo3#H(of7V6Sz#IKPdN)a$Q!0qh`0MB5nnjRdS}6*bgh+KR`Ka#SLZuoaxX&D$qc_D
z-Hp(NTx(X{X8*mJ`Bcr=&<ZrKBj?&mN5gz-p)<WhQz!OgB!`h%aUW)2YC5A4!bp}o
zqWoJSe2^sOoJ(4@<vL`d6hJUsw)dwOAR8eL=^jn$fd;W7!VC{-swWhV@|mmh?LZ3^
zl4#?3U)~->o|Adc4v^IewRapa*t`l@QgKfOOIcAo`!moS0i*9mL*J9nSyPo$i7!%I
zI(Z60P4De*lkQA;jW9LIuE!;ZdWlZ5MBX?t?!x{$yrt=~)RgMT#3{S6V<O@6^u6s-
zg%9-)yv96%IGQ$nx&`XI_;_0yu9mV4sZ>h&pvm*Mx5B@)c{7T>{pK#NO2usa<G?Wh
z(c(bKWXSLQ-k@?4L>8=#39;SPrN;yx;6xxyC`VjXva8W@%N->hD72I!tJjvEMc|&8
zt@ElWq=R1)|6>JjvwwgCt;+Pu^Uf>V436FA9r=XZ%q~aNkQ~lpXAAXDihju@DiMP}
zjSU#Q1{p9O3^J)|y3X2nH+2-NK&J9_P3~x}!OU(dDcYa%xv0oaKrkMowh~KC8%}rQ
zmC$BigWY1A6Mv%>?<d8Z`QK9!FW2vddyLm)Sr=D9Rq=u%)6rm%YrmlQ8tKK3*XoPC
z_rLSL^_e`ob73<MhU}l5_mzv$T>UQE=&Ich!A5AsaBk-}raGHC6nO@^O0$h@xW}Or
zm*+4Xx7xP*>AjtP(xeEtFc65#Z!o`hw~toozdP~Xi~w1&O!LCL7%i%hTo8`~P@`1t
zV-xu)v87jZVZVD>D@P{g<%UWP?%}2!{Q73O0n=!v&hdl3JZxy#$f>VLuRp@;5V@Qu
zW+1hBE;4Q}A}K6ZL^3gPu=irD0TmKS0^+6-8}xg@tBz>WHoCX8c{Wb`W6^>&k5>bT
zc5;djNwD+vmtgMU26Pw-r+BXZd58ZGZM^{)Eh>piEL&q#%(WZYF}gzF+-a8#Y+VEI
z4gAOr>XFErzXi>rk+3%`WcjGwby`Z*RkJ0m{u(-WWOtu^Ey~R_oZGNS{ESv~=@!6H
zXx0uk4+AFA|FRW)B@RcY-l{^LdxeUYhzIXRvMB3mymNae{|dT}t((gN$8>p#NP<y?
zZ|Fz}^=wB;81qGO8c_IlxSZl*s4K)=NITS(`A6G6uJE-UAn!#%pPQfRmx}FKVY*4r
z`yq#GLt}_%rgxc^%jk0NkiPy%JD40C6GhkVM6EiFm;e5xgEX3*+aBC90PQQl3zHlr
zigQO%?T)sNR7_{R4Pv(K_DbdCBO2WFz<G%w6gt0t8md@f<s?MR&ZR(n5Ma&l7r_eR
z0}no<>xx?f=5CI5bAqNNqpS~w-^FjY9F70XPu|6#CQEFhK={c7lL|8NFqv#Hr}Mm_
zKVvURUYqRws=hz+aO;TB(%V^HnGeaOg1g#kYaVjJwomWX{^;j(JML#r_FedqaW?eh
z7n0Q2&m}La&{e_=KX6bAH#zOVDGkGJ(hqTqWIhOlTl?gW?`M+b9Ro2$KB`p$xhC(h
z<o6f#;g=U8o4r}Rz42|MT<*h%mk*bRmpmTT&p(e^Ju#K2FSaMQFRuA-3%s+~tdftr
z{JsUt{$}TEvYann_3-d8p^Y>1+z$Cd{O(Usr+02*3{66xONCxbG%Xm$wWHTog^+oB
zb-NuAoOM42_D(+)22*T}hk`5#Ie#Q9HMfBJwalE*Z9?1v^Cc8lB`T46)KD@v3YT+v
z<W0yMaRwmP5FYzd&|4C9#$_HJX71ZL$_Io5#;F2h(c0nw)4d)UfcTHQ3KM{&(fo#|
z@MU5e)D0QIk2-Thc9NH)@8q0RIM#hJKJQk%cM0lOV>doA2#uSC=Xj+E2`_!{BeF8O
z`l6EpZ$*0BOe+r`W|jxuVx2uczYe{4J50H}AJ=Uihy+2(ah^fsGNxG}v=#lL;<;fP
zFRmZH+7S*{NFV#+@Hd-7Ue;>c)dEi_?|<b#H1?^iCvaPCR`iAgkVmAGR3G&Op14Xa
zsiF**rKBl;{CWg?#x<om%Z%kB36SUeAbo$y`au79swC`=c|Y<<q#xXxx<Ug4Fzldv
z<>{nr5NdQ_Bh8GdHq=6+sdT?axi)T3dOus0XK-Qo$aVIWJ3W_Gor;V)(V0EZj>mj?
z!D-Ae|9JugCoAoj_62L;IQG`%$YY-An?cD6rG$*M*!E5);6n$uhf6UAv4u-!wzgsr
z*pTh)>>3md%OH`V{K7t<%=C*l#=Xde+^`A<O0`8r)FSeSM9AG+z_Ah9+h5I52FcKi
z<BG%JY|KxK&Du-@1C`9Gk$(?)IvPyR%mBNw*zD1P{WHd_posl}0d`9yy3m+fX4t|A
zG^U5?2)kL=s9iDI!PHE4r(ff*8DE(oMX<B)3m37v9TdollPQEUt;8R;*y3uqs(X|$
z4<K)qJeK4Q<3(BQk?6>A!<s|Lldi5{?3AQUa~sN{z}NI6%+UFOEo71>XMeK`L>gxb
zHP7t-YO+7~NooRjkvA2I=s2}jxFzNKaRJ6VIB0k=ZqFPpEZD<SuYI#lQ>acQU!V!n
z2T*5=?;;VigE|h*_*hBgB#gJ9EiEHmfOO7flsPUTXo_)jk;nmrMBiK=TQ0j#CVNz?
zpcCT%P!^Hzd1i$02e~TO3fIz1P<gdA)Yqz8yc!;V7UG^2K;yMyf3joeWqI6B%S;kx
zBeBXl;>58<7pi;R4lA#UF%m~p^ng*UHuwQLifW_wPYhY5fL*e#3g**c2Mcl&B&g2J
z!EyEp$b)p8D;jzP>-6VBcm<f*2b55Biso`-&31c8nr}gMX>X?#1R2(?#xRgOM57%T
zC;A_-_a%HLA0l3{?q_?1ji}?RmUc|o!9nCR)zqTiSP(?0RKr5s`o5U_1m!o-z@;dY
z<yGz9Q_Doe-gRF?s~lEQETu}enZ;QAKWksWAlr|(b{3^Ryet|sBD-k(6%&encPDCL
z>jZm8;iO3zD&#0%@J5}<RxjBtW(-A>#wF%P^ZHtjU9%J`x8A0d?PZ)`0R>X{txSDx
z!%T-~N1x9HIR+uE5($Q>SeN(kZMPc0yqx$ftS%J4!t<=!;OFJs*RwIV)L^lL+`_ra
zGxi^vUQp@=NHRNLjy7hN=VP!J62>h}Z&wH#@PIl8xFU?UmNsUwbReLzgiVp2H|vrO
zj;#9MIUtb<$0`wB4cElX+}fi2>F?u_?v8{+e{2@7csxypX_r3c9(#49AQ}8#Lr(f(
zHK89B&{_=rj&FTKm6#OcsASmtO$1SWTeAb0%eHj^!X{`Zs}sC21HPn=p&?ph(TGeM
zrWrSZ(CE2FCZ~<esqmwc$}5j^tV`w#t6k842rXrHLq$;kl(x_l^pHc|N`pGSHe+JR
z5pV~R>+vq|4z<7Z{qlcPRegr8|2~|Rb=Fefp5<;Vpud%Z84Xug3-l*L7x9x;aAIe{
zrOu<J0Ejwv?BY)`<g+EhESrj+J4=YFz_vjCYHel<G7o-gja<fWA~UB$%a0ux>f2F9
z!)DV9WOG7@e+sI=updr~v>s!-)yGTr3{(AGV~wUD{s7(A*N5F`y?lL7;JQ{Fr}JH+
zf^>#Zvms=2-|>;{Hr*4^2gxV7G-Xocp9|lM;otDzCuaY)wbAVDeM5Sp6@TQr{W+vZ
zqVtSR0uF9MLWEQICk3($k=;;pDKx)F%0U_Afyuxqoau)kAVI`YgEl{<dZ>bsToR~G
zE9F0M!78LoibUebDjA1~{CCWH%hG?pb*=0iPirxNfOrk1DK$Se%{URvd{3+6l-2f(
zN+3!A#DPJRLa%6=V~9!;GJ^?Ej)fcBHzy*)^EDD6l|U(nuAkrLB`&YO5P57#=FXIn
zXf^*Pqc@b2YH+^f3azO#CdSg&5QOVX3bNEH;o=q56MkAB?vFzj)>H_&z!=w|fr>I}
z172s0Q)Wx9CFiD*gJZLNJH%d=&kdtb6G-9ZNUT)gmjtCjJ@M*zP!{GZ_SxNZ^d6Cb
zy*hILIGiz7y(Yl2QYSCX#u?yx{+5}Ym7V(WHtF-iM!&$8okkA#@%RVoh@lx|P`!(e
zqmq_%jp)ax5=cTZC-yw4js&*ABpC~igNl&ym@`CjXKVU+8)=>fu-GuJBH`i-_A?X~
z_x*~?<QVM)APbNcPb0m`T<TL116LK;qA+s^f2PMvS~aHmLf^0-yYYQ-sEHX@JXU+P
zkA)$u*E$y<;hS~Kp7BoWAW^GsntfX`vOBQrKq)-7EhamJ-??KBNmE$6(4>-_RH%k8
z0I+U}GKo<<5GA3@ktok|i}Jd}rCOe{2e8M9227%5>04Q&ascGie#k)wTbpbj_K<~{
zn&vX0S&JEA?#kpynm{{i$^|hhFXJZ(7(!Bju`oOC2y+f$_fbf`g<Gs5-1L68`Q-vO
zQ)y@+C}qm8wBJf=DM}^;|0bk6xXo^CIT(a8EQTwq_<QuPqH~KMfBD)#fWg!5AC%(v
zr_S6G59eZkx6X`nh-ihoDu3fo{^;7zBbkzAKu*qKsHAN-wi-TCNiQHwao~^!0XwU5
z?7I2V0boX)3DQP!__a(=b|$w6Pfkc(mJ0VfuImJ~7a`N4)TM{NM`oA|_^1yWt2Kwn
zU6MaNrO0s?y-Z;jPcYfNSb#!1DjV)wUNk2yTOqH`lh@&`cO}(HdQuoGNx*rP851|r
zE;a_P$iS#(jD&1a!u^<MhY09yphn?qzTtTZs*}wu;?gnI#b<V}ybXCzhFh{PO#|~i
zAdbLALz2bs^)d_uLw{7sj;@1;&C54JA{^n3e@Z+pdBdl3F*fGunqdhcnUy!WA9le+
zn|vSOFZ!!dk5hp*<7lx$z+Lc6TwSI7oA7Uu;a3SFVb~^>)&mjJJi|DHB6*@L$pCi@
zF!l8b+7fo~*1t5{Of2yWUuMn<q617}S0P`b_2njYZSaz)8_RxeA){IjqPLjLQ1B!i
z?sMmnsBqLk)h6vK3B6K8(v|BGoiIq`NRkHp1?O5Addsty@Di=zGp_PMC_(s~h^^K1
zc1Po74Y>^Sf+K`cX1B(Tz}!&mwYBEq-Kn-yYKnIwj9>nlW9+znJvqYG$ouP>?@0GH
zZXPWJ*?53@g3VMSORky3kD7^<rW(z~TQp!TFqm)5nGk&BkdJhuTRjrbj*juWtAiGI
z*(zkkCg`W^uh7%OvP7bEc{2Au)>ykmx%rLizvPc%9i%)6R|=tgW^6eGKa212e6QW*
zBnK7nif7cc`K3kRGmOw#L4jio5<PGfe`A3@Z9sNiG%{NRfqWF{gon#_+Go@~+_p$z
z?6BI%WY_G;alY^)B+l1D`Dc2*02s(-Mg(Xa_^8vr#;Entvh^5lb2>4tYJAL11frX<
ziTPwDtMgfxyd);!q|J0xgoAvbnJdU~$|BjNkovXabvYL4s|5Xpq!JUBdYH<N+8~c&
z`%V$5pSEetVaC*iXc2=wf;CI>O82Yk9NRG+Psq%(BHA3#x;1<OqLIHo0@mF;CWTNH
zLYP%$3*9ZDu(n)h7q8}ximnzG9wfS&iL`|H$A!e00g8lN?heyrXrbW#FbIe{R$aVT
zt(;>#5>iMR&Ay!<{b-N17hb<#%uGrl8WJsz(}&m4N)QAJ(sVa{@y;?bQWKM+FV;LL
zlIgUHWkg;muj)fJkBHp~zk=Q$>xGH)`BGqL*97t(g+RlBv@ZGI!t_#UgL}oz{b3zY
zM4pOq$?~IMtK&YIJi}C2Ue_nBLJEnI;OecMhoL{VjYr#t>O9v;CXF?X0}i(bFO}mt
za0d5cuR}4#&f_Pqe_wyYeVyQNhHoeLq<^K4+un<P2{Fo<X$!Z9Ud?d}o{c>L-o)Mp
zp~DaQHz)sX(dyjh4ZIfNO&ZoOwiXQzqzkOvyQdBol`j|#RH15W!Oc!yh)WO0K&sr{
zu;RH|(~WkW%g?9#z?5ok1f?xPTh^pKO^NWSU*dYoJvMIF|2lgjkumv#uo$pLb_`z$
zM^zllxZI-uh(djFSxfft<NBrg^>S_gT34MZhuLd^pRyUgQLh9eY=c_7SSIK4>2=_O
z_QiQJt~SR*r1M6*=?|=0z?)V9Oa57?n1Yov!VdE_qrFmhth+X!i_^QO@Mdz`l>pK^
zPP}*$%pIQ3VanxW!NlnN>lyHjc&%mMRddUOQ$8fq{?EsdtI*F!jb2RG^;9YpbqE{h
zH#3Xb_=?E!fGECO^kMtr$oFo0sfnSSYm5p8=cqM-CD+vCH36*<WVtY1-q%>(AN^WM
zhtJL3f_~aS1Crzli@avefGc}s6xoYC=S^WIua*8+9m?6z!#B$p7y~M8sUeh7=_f(I
zjaWzKWY0FI#R_$=Cm>d_O68A1s46KD#}ZG({wnAntUD(7p7-i^vS>Yu#mjb3*w6F;
zafvxjm$|05RmF?(0xkt`3M&x0l1K3p><uYGDlF~D0KB=upj-?z@!d5TK-_JL%Z4k@
z?26FE90v8~f^bGr6n9JxJD*kT554&Y$)r^F6Hr;4Cb=%F`=P^wNQtUB4v~9qk0rh1
z*G%l7q~;!*8Ia2KoX6LzXky2Vp+gQWSk9R~%>zP;TXuZ>QUAibt>sMwGzGtfS6gIc
zdW<esY%Cq#*>U3XIzRi_ZQ?XP9(tqNkcyeo0^>%DshQ8^8r{3?3PXcZh+wcdkVbMq
z^jBg+nqPsVnbF}gGyaZghgYW?>O;l0w>S>YNV#f$L`qpH#&WtQx9VrV4L@O4>Ok}|
zEV^teAW!B-&yh;e<gQ-UE8Y9)OUyJ8Q`nud@7*ZoHj>Xh9w=ZcKY1VdX8DPwD6c9z
z7B7;8QbG)(KESE4=ud0vGc;xn2<}bw?p^aQ1$>ovX9)`Q!_5gC3J6`~FxZ>W0b_M2
z*2ekg4t|@ld5eeulBB^LzxU2f@cz>*Gh?0g%m@EnD}ePCL=uKHJ~=hHNdHMa#nExT
zLXdZT%#yslQX6vk@_Zq}g!imzf!NH6sD#G1om?<Py<@t`I?tw+n<VLz&y?T&Vhms5
zGg1Gl^Ksl_c3rf6jPOC&@={yi^_BoUSdF?Nv+xnl44z-Sd<pSEI&^q^vf8wLO+T^6
zcNm{K{G2q34s)4uFYMt^N|+*(Smsv9lcgubc@o7}%1gOO5QgYEAOu)-t{tt_>+R20
zndzpyS8YPtwjqX0+P&RPCWteylTcK?jBWCJ!%q%gUJ!K}8Bcg#J67~MyJboOqV8G8
zw3={@$Y=JF!AePSI2q&ObfN&grF84XsaZU;i-!*_yoiN-w`)_A9KUWmA6}dv;LB!D
zyl3_JS-yghy-kbxH-l!H`Zvq--FV-P*O*>^8u67!E-aD|PVcZtL@lY>Gr|BXQ?u+*
z&GRNljX_7Zb+fFYD?+97Hk7JQ8s~04#4_Mw5#IwKKOzp8;=qg2jP2}Kab6p3%LkX3
zj3^&lH+(LPjuE&>Oi*S=RZxoso(DwCi)=Sa!YyAPqAGLUR-saRebH+4Hnr#Q+3nCC
zot~9s=*D_oiQ3fDg2M%ZPA8oXf0iB1s)v|8Fk(Z<O6hI*fS)u;dZO=2>J?Y?N7ukc
zI!|q6bVU2Sy<OPJ_kI<F?q{&)lFSgjdp&e*=<PQ*V<6xOP&I<Xh9-xlyCqp3{z+wb
z!0LT<%aABp9O-jyX%yI&KIT-eS1&U^Si9=FD}p+c{`uF}I1hG4l@<b;6xzPcy87)4
z-StSx+e1`C4I%$0AMbnV#A&D7x#`b6_50nV!*`TXn~WmpU#S4`T0$|aVu@T{1tMIq
zC|{ty3i8$$ksF%N1sG>@ySTq6RxJ(40s-+U?^+|{sF;lSCd6909|64%W289mP1VEK
zT(_UQE0A*;H|T_o>FQqjx73eQXXD2*HHROWlOdl+8d*r4A5-hX=zY_k!)uyucj}cn
zaek0B76)zxQE^vCb_^?&c%3|NHhWXk%M+pYzuPqvA02KEj(F$7Au|)&NnJ&<XpQCT
zRIal+X`-^14B$#sL>X^Az-L{RUKZ9gLJA1XE*Ft1`xC<w62}{51V2c^;IkM&O{l=X
zud9PTzK2aDFOsOWQs-=sqa2MiXep%UVr(g^GHcw9xaS)6!WQ>?TuO3GA!x!+BF~qf
zN20BWgkp~B9GNRM5iStk&)>M1cvui-&9#0#oR!TF+~g8`7WZU{c_Nz3KB{oHTCcWa
zxj-f^Ipn0{svvy>h#G0BQIpfB_w&IHBJ_x5!K3btI{k_PXv*%ZVaM>@etCn6d<>z`
z?G^_Fm8H-td6<Psp5#4jAWS>iY;+?89*cggu17+Snwcq&u=`Aij-_!cCjGeX{eb1U
zYAk71fa+DT*`f8$%H^C30Sc03qhO1HbGFd<ZDeEUnA76+A0FrX2tbD>E9lI<=iOXi
zP`Ex*>Dhn__sKt*BATkK#6@B}PeFU4e*MsWf&SpX<$Kjklyw+tO;1SquQerNr!qvL
zH{LUSR#4)I$D`w8Ya5bR$!6!6A~0=p(n(^_)Aa@M^)`xbPUVk+klI>gI=T>=QW+bn
zTv38)bQ&Xb_-1E@b<b?l4=3-09Tr3K3k3OB5>yFcQe44j$nY$E1<~Ffg+2YKKx&}>
zAR{i-chQU#hAjhao({)B2N_dyr>j~x@f*1HTcSriLt*Opqc3l76G=aMf~5DQJSasa
z{f{Dvltn)}c=v57;!n0i%wGV)KjxFP(wps2)+2qX0~I|#U@g?RqqT&>1i4>zCG}q6
z`;iJ8IzC${>Fz-`{Ez}s`+3Eqp)n@CU`btK!AuZq4f8=E<+bN2|8ya;icy?Y1haLy
zFsQ2*rA_sUU^c_x?Xy<RRFvNwOgLo7&Ojj&qoEdZFm8oqqN|^tQ$KSZ5|+$RQ(kS}
z&1+8`dxI;I1r61LP!KC^-+p{LXbRdKob~Hxbako2gAthA(x~O+>Ee^%2>YwiYV}=?
z|C|eVHr!9gpyn=#dG{VMi<)K&!UsCk&apko@&1_nN!kRJblN;Kp<rpr@+&@_n9Ucp
zPY@#9phX=i9?f9e(1tW;%H*Q`ll(3F8UKB;&NzMwDzP%t{1G6~SqmP2JVKH`Bvm^y
zGmOTRQF)0n5yxx9nFFUsw!+U6mJthd4^nCa7VsbI4%dpBqRHy$%6+mSb*hI}Thr5u
zqjLo7HoN6W>0RT=sfTWfxK^e}SAu>?t;Fk<M95e&?6dLybnZmH>K5rZG&NB=anqxu
z+aRL%dBlCI_#ef6{|l&(H6+BioL;YlC<>y%#zJ-4NNdf6wl?bn<2rg>H73%r172r<
z$m-J&ir=8$*gweQ0GA&`Xc3*9<S$Q;$fFltZ3FVZFSkRi>-D!s2T}re&tf^()?Q%M
z>9@5d3D+KuNE0I&6yH6zy)?bem^n|kg|qpo=t!iqZhxm^&5*|(yG>WAh%G-IKZN5{
zwAm!SPkHR$L`hg2y~psW6+CFpB5uA(S_JtlUi?=k{3o{l+jV{nc>jEWz}Qeph1N_$
zwAhxX_@W9UR~u}^fI=wba+%;f<2YnE8e$fy62_)x+?Pn6AL5`G_B&=R%COw17kpTs
z9X(Opr=8Xi1E1AmHoR<hl#D2ev+{0cGjN+uFI1@_nS%|buyFLC;VlWwH((%b`g_qE
z`J(5_Mb`c5VLL~9r~I#vIy0XY+pNS){>py|_D{zCN6t^vX2Wb_sgMa%0wlsydFfMG
zq|fpmw%-Gm-X=^%2l~lkR+Rx$NOGPF#ushJ7EF(uig8O0)fgdK&kA(;F<M-u=q8P(
zz;^ttG6JKiD2s+KjTWJUYpa+B)<R&p#{pPEvx-Oor9(NxV^}K3&(;5FA)J3K<cC4p
zCzB@akkvkyXuRe+cxG;O(KW4XHs!g`ESJd@<bBP@AuF0!!WJ17CXB*C&9~S?%tDuu
zYK1_`-{b2U0&$GPUH~Q|pW*wOZjGS=5gd!Dcu$9q@MjAPI>Wo}zjXco!|5N@8NWiC
z3v+%Y_Ra+KtZ>6zk_ySBPjHrNc$UE$&J2X6{y954GT0mMc=yKOQ+WkHJj`ciE>RV`
zs$<MGP4CUoz2?Ga6nk9;SUWGp(7&cnCa8N={^wgR=Y>C4sSJ`{um)(?2MIsPAUTrl
z`c}608eoLK_6D9??n&v=ERG7m2$G3T_5Y#i34xtt-s`w@|IZ-!NBW*mnX!R8($|FK
z-th!s;qG}usT?DvYaF*5ct7$cE&gA&_<x@L7Xows(Gxw2VcAUfvcni7w>IxTFc3~c
z{E~7a@;|Ws7drkKqa*lpfJe4+rys`ujhTP5Bk||m;#I%@RQ(fMAkt54E!OQgSF`<-
z#r{pM&!6OhEeQXe;QsBFUnSK)kdUR(#nS%2Wb*vpkP(ZpG7mg$;r~Ae25zyC+1;QD
z=b=El<LqG=`>}n09jmWknEO{g{h!wX!NIlxzz&;*-NNsI-Z4=8jd=Vqzn83p-D=qd
zGi?92%w6M=zLP(LH&2=^J`X-ndKS)YAnvE(_8I#Kdb<QaWZ^m{n*P%ic8+BFwPM>t
zPY$Y~jOxv4Qcj<bwrn83Y-r5}C)nRzHbaIsvSYQU;bu&f{qM)O%KQY8QPl8ohh+Dl
z9g}{SSaT4NM6!YjgYA;aNHmCc;U$uq3%jwfac8Lihq&tB{D{Z)0Q3%MTs=Dbrqrvl
z;?TWYkVouCheVxCNYq3<mkiJU_Nn=oX<ogN8DS}&-gqrlG97M$dvP#0opS#VCjz%l
z0zN&dm({ZHeg5C=`-l!63E8_ifim31{QHp^@umxvwu3S^JCl!AAWP}zbJ1j27nbT|
z7R&0h%YR5dM1l+tIel@*!ryNuKP!rfA++OEOBnCixfw%PiS*X-<>8*aYm6D^D0+U<
zk^XA>*^8(=1dQK<cn|CT#rt{j+MVMM()MCagHz7`!U&KM?3z$n6kO>ic~jHko!}Nr
zAT2!P6#rJhpuR9ESy*WDK3ukZCkv)9WV_He+PFA7AT|b*^@(dv=7b%L8k~|*`Q=mF
z(Ranyc0wRpyfr5H8$as&v`<6q7PS91*;9MkUt7S5C|XaPsB%%kzX#i8fhckLAYR82
z){SW6V$^9**yBQ<N;*#)(xh6e0SAjEpkCD>@S+(MoX(-G0E!Q!-25`(dfVHpEFyc+
z^AO37z0Hd-UgVj46CZNv@tEGGj1lTP`OUE$&2=(8c=?#g+@`p%mI6=Vvpjn+F4Ch2
zJ-73K_x&P=hA~YBd4~8nO079C^@-0$W5)6FjO#liTgq<MgK8H98Y#@FzN*f{YmP~Z
zVbBfxt><I<EB|Y33sLr$>@>^m#9|2zx9*}J0<Z6tBM&)e_hm}|A6su35a+V2jS?WZ
zLvR>ef)4Jk!67&V3-0dj3>uu^9^BnExVt+99o)IBwa-3he|z2E{myiCby;^kT}7pf
z@{e6ph3<hC#(uiwe%6KaClv67h>OGS)5=4aaaQs>A@`EI&ny*ifgwklP5(#;-{d;v
z<>l!@Oh_d-M)%8jSI$5Ly+e;*Kj9V0Hw5e854R7Hg){fzhfy(%3Y+2D>au4fEBcJ%
z&eqwPn5HOop+c7bpt}5EU4oeg0|$ke<Y!jpJ<TD{9t|Du0jXpeJ5&C}=Bd_rXgOJj
z-U-5JOD@!{tF1C5wWB$YSdVzi-pUJS<vZdmzyqGSo0S8jgNA!1=?!tm+3`gMdyrnJ
z*1YlmV=yk*#f50ZV?qVYDXc_-0w^F|9HGmeS5I%de!uK^<s&*jpHKp^<i1ueAlj0A
zub|nTv|>|M_!OiaM+e^nDHbo*?t71$yQXXA3OgxxHQ-}F)Hbf5GD=fOAgVH|#A{Zw
zESDuYCHsXq7&q0-22XO#gqg(0|2b;+Gv@%Lx*h;u$44xdDBLnLgR0^z8~uYX1sS>5
zqT?mf*{XKn8_P<VPc33HIR-N~wG>hS98w{rm`oM=sUcDp`jG1b&o*q<ktzTEo`IKh
zbNeBX8F1-bb!Jrt0cJhP;Vwnv9SUt5{G!X!IXs&9fLujv#b;{Dk5nbURwf=g{rniN
zi&o$MqQOIrN{2{fR#Mz=FmEKEplNN*xxM#@L0t^LmE7duH2-(7`fm$j2JNE`P2o_O
z^?fWF)-<a3delrpk+l2JtZU!spt^N1axR|QK-B=js;z<vH=HJxEyc>sNf_RQVo8c7
zGK_^lQFkMNM^H|zc3YnVdU94VCV7I5oRbz0=uJU#>qNh8E5U*Z>K{F5vcK#RZ_}7Z
zIfjcD0hS}V@rOyt4(_NRpxGiR{=|W&yINXQj53W;BQ<>%qnC++i4uvk0_&?=GYu3`
zkqwDt<ZJ}SAB=Cmc+jaSj06oKud?J}!PZRM)lp-JH+*oqz2qTnq{!$l*5Fgt3ZRuQ
zovx{8XWtnU#Zesh5(EF3y10yILBJyntJ=<V$7E(=P&4P%Z6{i^e@5b%YpwRN048A>
z_uzlOAOJglZztsQAilZ%UdAvkln^VGMKCy#-o;uk%-3Rv?Xc?XX5ot$0CvCcJzA2T
z0X2zHo9Dvct#Sa2=!U^Fm^V^e5?2wiuN89VRIRpH{n(s%7(A{2Wt8=3p^;`U-Ep(~
z@G#*~U!dP%6CCDNq=lwMB&4kncM1$*JeqPib5_6Xr)K{s(V2X=!^3FLWut!CZ#%pt
z05&(lHGV4U+O!8o(a16k_qP0M{{2N^Fo>QS0~13rHd7W;26NeiKTJ-lyA7Tq=X)3w
zML2o;CQ6MCy3*8dSvg^8H4OHY(Z->OAxg?7OIa2SB9zFnaUuVifC|4)BcLmDVhaiC
zzyUF_L8GBEbB!Nnq7x9O62I7;s&&etY$%Ef4Gq8HPa8>v6&E0;kX5@Ze_d5efOL=!
z-berkYY4Ie+8HZZsEMLrj7adV(d)V6sg3xDGR6+YVXYlzY8|RwJb-Ek2ZlrW_EKyQ
zlZ)q)I?4#garhH;R;zkEFq%LZrz$=r`*018QmjU5adKKx^d)e0)qOj2nl;Vn7r*#m
z3sY_>qNzQHyxyIn{dgTGHiR2WdB^;fgXE@S9?SpcHURp2s%=p3WMJN2V)3C9UHp_E
zEoAj|%t~yAl*eJuJgPt!r=ACDWqM^^(xhyLmQd;!7gx6JeqF#8QzMZW)F(yVG3Wau
z%k!=ChNPSkTOqGV<QE%G9kwwnM+tRbPLy=6faXeHKTbMc{m4j(r1+p%!H6Eq{1}pY
z*BWCn8KY0HciOxcfeeFo9Yi#YQi1(eL8jR_t*9s6;{yVVqrzU-Tf}^?1M<(uTMpN0
zhCs%d7~O+ETa@q}cGXCNkJ+-R1})|hM@H_DqplR>vC-(KgjsnFJ7`e``FP>>F1tUN
zJv1uf7}NAAsjAS~ZqifZ!(JO;o^Q+Vz=5tVMvlffg!b?nT%;dSO3@`zh<gG!@3!?z
z5e1SON#>%>ehgZlpZ5T49w9n;z9CmG`5ze_Qqxl9UE{HZ>5+|~ZytY9{d7CqFyl23
zVrY#v+-aujlawevh;j1vPMw*d%G29lo^qf0ufQS$Eqevv@fb+M@VmFyaiD8OG4Qfb
zf-AlG;@t<wgJ(9%@&==3C|uavZ647=ert#APTIyUi!3Sj9A7Ez><YJQKSSysqCO^O
zrKWIvBNuzN3hTm63%m7byEbMeWyY7aLqmr5B%ingo-@pbc<XPv;9V!O#Z}?q-Alm5
zB(O&8Dhjy%Kx>==RAw%?X~<*3t3wNu-Q_Ceqr-3G(wdiaUcTqsrV7Dn9UY81zslch
z(Om7(shZgw2dxYr#Ii*vaWHgQQw!B9G_Hg;Frr#W?XIM_lGi5@t$8y`dIAfaFdFtB
z-e2-XKGqOlOU}@zIL}Op%i{9a`7eL~`LQwvduntqbmoRDi%eR=X;`&Z*zg#ABKKjR
z3?8(I-(zQnQe7Oa|BRix)CoQS1CMW0WB0<u3G1Z?wRk4=BP40V#XUsm8zVMDVD`V4
zX*wbPIOa>yNeFfW#pL__tR3M%q#_N%DDH=IguV%(_>`-Qf$@p9^J;A{IUEPRI&70W
zJc71uxM$)=h}Z)m!vIB}T%B9^QS<#487py&gTA2!R>^oqks5udyU8YDEuQInNr|HF
z07_6Hc})u<_mbu{Wxk7IUCIEPYLXN!CVYIHahwC<ROIFhwhWtvhfWoh23~r9c3qjd
zz0xy77&i9UkSsGIxd)sQrfi<Iiw>zKle|nXRH;c`f=^WK<<1t7S$8)gk;acrNfC$7
z5ezTIZBEz|fD$2*aH!gvAJq;=vVHTn239^)hURK5jWw9_WK8Lrcp8G9Fdk#!c2xpU
zqn+W#QTgykk=s^Ix;7%JS;;=Rd1}_=5pz<Mh45Qaq`zjS{!19ANl4JCFv;+Q3Vy*C
zSj)@O;Ke|ux!$_mkg~JmbwoHWx(o#*e$;GYPf`*$hg@1aHl$Em4sFprWN%8O8k0KJ
z>a>Iqw)iPFLZQU@q)U9Q0=37{G9`n&=68>cB4mC@-!{;j&GdpazfHOWC)rJCt{;RJ
z;WIA8U}EpX5v~LMsAUOW@0Y+uoY~CfP{}Pid%w=&jW?>I5k!_Tj8E(|a9^Tr)0zrt
z%l*3l6JH@oF5q{Q#+iTx`cH!8DYWE(aC`8DPD!7Via;S24rV6=yM<5sg-fsMIzph>
z2_fkKUD_~Q;lk`{RLiXZg>+SN#FuBm+i^&tk`m;1oT<y*^vU$vnl4$kA;jm1wKebx
zqzfmNVIxfr$u!B@TD6ty*!c6g>-p;15+(G9HRH}a-n(^21%ZS0t+uNS4f7b$nWmQF
zu_qTvn0-dQkc}%NV5H%~P(zJM*+Q8Tq7l#1#nk{q%BQWEbuc@Sq(|D|pzBet6udUj
zZg%u3C<!PxS>vPIfOw#@zek#EWOP?x>QKK_ayVIo-uA5H=FrVJi?sPAPdWR`do3%T
zq}nr2;&MmJ*Brurh1cEHmWJ{2JU*bqnR|jGdVxdTc)2CF$1C1l@1NPbFB{c!^G_j9
zj1_AoYgIj7OE>*e$*|5}gy3mDP-a6X_+cnQe(9nh$xwmiz5S50WhR@W7#kZT_wD_e
z6<%0^=+I&k6kBwpP(lopr%EkXRy0{euc-Owy#CQ(t5m>mHb`!y_#NsvQDKT)=9Co<
zETyl%IpEf@BHd45U?+J}CYl}yqyF?d?efGd)G!3ixeI(cC7W+0L*RUC3TbNfM7$?n
z_G^6oA{Lf~ENyPi)%6TT^CMu%aeODe8Il$=v_@^qA_v*%IW8eHc#QU_D*RKtAxoI3
z4y7#Ppv<E^Z#2a1JS#1Nx0mQ7^ZdqUU1FjcHm1DHdmCd6l~IGDU60Sllva_qWa@%h
zBy79i!Ze4Z7t>|B35Y@#NeCLK3Jr7(c_f@HVh~q2yIvUxs%U5d<+Ncx7s7f9JNI`I
zjbYL7i9rJ_k!<XNYGblmgyzWkZjs?(LKznj`7>HxVb+?zIrhk^brPsBkVT$jQ`0Oo
zzP>EFP?NxB2>86-u9YUgTn`>&3KXc>E0r><{;`k#;sV%PeZ0DkcRXI^NtTo!=Z|r)
zd6Aytn<%&RAb54a5-de9j&bNr!0axN|IbYlf={=H&Zj<+`;eHC6!1~UPQ1){y+MS2
z;<p%txJXJe;)*gxbw5#b{Ku%A?CfBs3?CmBuOEYK<5QTVhcY=N-e<cyjPgAysh(6<
z(Ctfi<J-+A>NK82*mfT<kC#)@1~rPNrQ5&Xmmta9<f)ztNwCb@vClF`@cKUDR6oP(
z2z?#i5go|^^iOt=Vx5dJmvno$6R0JVjnBx?Z$=c96`>x-NtT+zU?zLu?3?O?$DPPg
zZMyuOVdJB=a+Gb2!j8hj3wKI7W@T=_jM9zvOzWmfG<!9BZnlWRYmo05zIZjKmC$4F
z%1w5!5|i~wBkH-J9EeCLMLNnC%=mlbNiQZ#bPxA@(dAxD?lrQOl9KMv%>SBqns4mA
z$VC={flAo(`ckt&5zP0JPnbCLi=<4pyxdt8@_$8Lh?1Nn!&5L7^+3ti*X6-HESDly
zZeGSURCi!eTnlc^fFezh!KdaiBE^_O4I(%kSHDk!>ax541tH4a6p8#{2nOtrCI4go
z7dDQ`qYGn7Jc$37Ib8Oq(PT)*A3c)8B%(ytqggQQtiH{K%m{3MXse?LBy{P0OVe3U
ze>5nPXKKuu!Lg5<%d^o(w;6NMwK;o#j(LB2+d}ES0=hC8+B!b(+9q1z+L%Gq-L}*h
zs^?-Xiw{(_RND$=ptZZd$LrBh`<&R4W}N6~E;(Mxrq!pzC)x9x2oxm-6vgkR8<RZZ
z%%1+LO;_?iYW=s4D{8`}Y;RsHe>u>D?ll-^z@mSv0n1b{bPwi9vTPr_TNgNfiI!cI
zFffvl>sh!;>QPG>vBqqwLLN(`Ed8DqurOTd#Lxf!V3N`qsEM_4^L<Kc?)2Za05;ui
zC_V6F3ZPAw+GxG3HB;{$jy}^bVFbZxNfAXuT1oH3>S>|$fBAz}Z_9OT_APPt#_aXX
zEb$~epy~&ElbZT}3V605CfZ0oQ&B#pJugi1sOzrX?=L$@!Y6?=#F*1fL@;9wEQD++
zS5$#t!nePO?&i~J8GOv)yEELc5Q}+}=4_z)w>kTJ-F6{po3HM#t44}C;d{qOzg9L>
z0}U1TZH5g6SKTM=46)ckKfLMgs`%=$g)d<g37q<p_eW5}8IKY1-~moIp*6XaI3CmP
zZdCr0#CIL6hF*lNn5{^k)r(Z&Xruxz_m-=ER$lqaCwy2)XOwS@xAg<q^9jB+N%jBz
zA&oz400g`A(DPV?dL9Bb9D!Q+!1S87y=WE+E|(cvO>NDrhz2;5m!bMEi~N7)x%dLQ
zPXrf>FmfZejrm;8?oCXk^lN^EDwpsfo#o`TI5aHTXEt2nv+9{o@Gbv8lLq?v3X$}P
zj4nkcsr`~-FSQGp3^=Cw%tAGZZ3m_FUyk5?TK~5Ize+$+HTUNVs$W$BlQzjOYNLq~
zZ=jF`zQn)1#sAT!2$?G__Vepk_4kc{V4?;gs?IhnIM96v>_X?<Rpt2CDiqD(e*bv*
z^X_Tx51>CkdQ^VWLVLY3nMrvc)_`tnZ;#^VFSq3X{I@$2+9M?qM8LMkkLG#zPM?`R
zd<sfzJgwjV;-}_<qpYl~sG(7utC$7*m+SgVpWk5a@9#<2*uK6Y7k{^|oKuC&g#L==
zF+J%>sVEI6Mcp+rg2>Iyz1Zr?RH9aH5!U-f*}J^(UmTA0L;95H3-xENG_<Qrs8_kT
zSMp{`5i&8x520sxVPDILQXehW_c}wKx~HcH4FIV8`Y&&pje+rdY>fStL6KAgo<Og(
z40`o_&OdqY^m2bd58m#xDE=SA{TcPcacK9jic$Hm_bDaGvI8!pzRoJZe-(jzJhr2>
zaw@O+-_2G$g8#aT%=+1Th8E&~9rM3g-8F=+DD39&%+~O~-~U_KvwJWUg*6O*$|F|%
zr`rEL%*74)8BQTOYe4NkCF*bS`l|6hL}xW)-u=%_rIr->xHSZxS^N(%{FhAnBghDS
zGzhllVQBgXA)C8!#Uy;(KKR=ICHNmG6%F8vNy@6^iax6UgOGH>_dTW_R4}6Zzj)+-
zmi?LjedtreQQhW035h3vXXfs`xz#^-B@|5gZe4mfGO%_2L5Q8h`%YyN3PzRxgIC2>
z??Y;fg);&FBt$;?T_oanimLy~t4~SqLkKHQT6XV*3}e_e>)0jU%vw^~DMR1Osy2m|
zkR?6j<NsO}n?KKXn8DIQd;d({&+iUCXfFG&Rrx!}b(z#A9$#i$_7G9|S#znNOG&QG
zym(scqNgT>vLt^h*vpa4RG6gYJE%SS?%>klHScK7Upaq6J1Q5i{1-dZ9Uv`8`SzsP
zh2Q`Cl@3xo_#=&z)WQjpD;cynNi%Qu^by<Js7LaY{3q-X18aNr!u)8;j5FUnL-``8
zkHO;98HuL4@;ud@(wkosA8c#5FRgc$613-8&56b~lN5Ozb`k!J+$r>ta0%qZZV00k
zjl2jfkKWY<sL6od`S`A~+1Ne9GxJ(1loyqlXg|kk8<(U*XLK>q;d62FnHqc#K6|~~
zu-%Kh_KD-%2)X$+PT|Efo2DCO<g1PM@Z}d2<aC(_R#q|v1oUnm7;(CNz2*VgU0AiI
zkFtF?Ip{XN3&`?C>k)-gc&RlOb`<;?Ov`)mRJmcGt40r#=}N5C2hGwa=ve|fCYz{i
zeJMMU9|B7m6A!USzFo0onKdJ^sI5g@K3El!SE5~juf&BEnIXN~W$KT@3w=NLzSXMH
z>q2rmVC@y^&piigw3-5@YcKWhZbY4;LJn8UF}KNnZy;#!w0xueOF)N_-(_;IkhYHG
z%jPJV{;hvRmHmU2*VBV6Nd+lPCM&|JC3Hr*Vl7WP3}bad_{W~$$UcUqo3kfBAEwRK
zxHWk?*;3y|@7KzEk3TxIhul~PNM|7=`yQWp(j@8H5-Z8CNcNu}>98x-qTiA1Qp2Cc
zq%@!nOTUV1DB|Kbo<`ebq><0Y1f+(ma!HRy;6s)$V_IUr_;Z66-s=xQ-kvE0^^O4I
zfU1fNEC|ReH$oc%L}*)%7R@6HC}hn<c+wiz`x$OlJ_OIRPxLBi9+1wQVRVi-zLEDI
zj_*v!!vw{!J~fxmda1QPKhw;XW}6@1nl0oq26)phrgo(EPH8>%y_91Wj3RC{Va70-
zg=RfgjgrCfk9ciM1Jol8KV)SE1b52yW{q%=0%<>lDqo?Y5l5$_Xo!V;%#*K`Kb$Kd
zA`9GwCAb<)-x=Nnz|@pvR-57pJYGxg&L8@NLhpp5m@DH)HasLimsOj2rju8X;S%uL
z^^t?ibG)P+d#{|G5$fjv(7>FC!Wr*5U|u)x?`?@repkaC%7U$T6V2rVsiwfh2~TI*
z76Y605^3MQg*k_CDp@Z`>#v-WEH0xY(Dnj_j)m2gqh(U<)dn>gRHRxG+5;j2`}Uq{
zUs0bC34VCVs0S{h1*zR#%^uh|Hz7{nZjLORcNd^~+kD4ZFX8l9i0WBqkh$3Ji82}B
zKOanQJQJUwGWb+MZZXHoWDe_dzw6F-w|snW+4{9qU>t7^<+VBVV&Pd@qbc!QpiN&5
zhc!C-j<c3n%-Ra-7II2VJNk1wYL<aPeM2epM@LhE2z5c3!~o){{`%vX5A7kFE!vf0
zt;+^gn&-dKMc*71XdT5w2kvbA{Kyj?vWmPSQ*7*aho!qv0i8jPm09{Q6*KS$4HeOS
z8J6JjHsdqs0mJc{qRCooxduG=%z4*23sMqJcSM`!H~Z{<Bi!ZAB3d|wVEV?DEgT)c
ztvkL@$w~r{342dmRvV_E7c+6PfEz2-ylogx1yLB>gZ;jf`W>!Ze&gRBaqut4rr~s*
z`R)_m!u;mI(yOhgh=Q+3)*(otFAIQbn;DFgVaph<x9JRW^bgw+p>xfS_0KYA%~jUp
z6l{221U4SWywA3)++kqg&TtJ1EFLrc0zA&a1#UEKbvkZEg7K91N=Bvo9$1sA%#@oV
zL3Lb<2xhDNz(}cG6}Fd$M)T9bL0tO5uTKkbM~rC)-rP*^Mr#H_c{@5`86%zS{n_P$
z#NOug<HVCh>|_D4KU4iqe>NDd1>mJ5?FV+zRI9V3Y5OFX2PW3!AJb-`B2qtSrLP*G
zA{y=OrlP&@^$szVwuCNB&_@L&dsdu?-v23hV!r*wL~Hf9)g6wL`{q|+hNX_|BmPlp
z*%$Dt)q?e_16YhN3^e2V(a5rSv$1!e$>9pQFZ@UQM2BWOR&w_fVXdw;hi%_ib6ByE
z&4+_ZiHUtB8XCJQB>DUz!k&t;Qs%v}LGU_ar@>ssn%hmP<m4}#pzgu%N-Zb-OIN#6
zWqczx7l!?EE|HrK0bv^ZB3%4_2~p(k377Gf;QXu68CKaPPYHb=F7txMnJ=BrJ7hXi
zK#fut86CHsF<g#f9DH?nVPQ4=2HTAghEmh5qvnna1UO(WOWKk=@m}3@!VWm0_j8u1
z1|71r+S$r|sgi#Ee#-Uy2u;~Ej8gYLt5F@>x%N%Nw&vhATMTvxx-|!Y4dBD{4S*Gp
zHV|vr)u;uP&VFmMdU*uvwg=jC`|iZ~YG&Uuh^kRApZ8bru-W$>6!6)b;ETR{K_d)(
zrXl8)J)@0^U^io^NiJUotGYTbHfQosOG=Uoxle^8?d-LZ8mr*X@fAg#PRn8~_pSMj
zh+J*nn>%!-XDDq><8G9qU@xw$@g}2G)F`?m!Y{DnZOqfPjH`G2s3tyzF{a!|fFev3
zm$sdin}PagIv3e<J6>h*+BRlh{BV`z*gC7@K+W*!=-5CAH=&P=>s%0l{SNX0$?_w1
zB|eA;Su5N1JQKH$7rlDxjNqi0pcgYHEtQ!Z$CWB{PL+iY^DfMQLMPQB8Tmkhi4=7F
zT}K0O=B4)b%ASc1#N~lg=yYPTX)Z$z;OmkY_$u0~rc2v$xn-<cD~m@dJ@L#pVxm?*
zt6K^^pmdfT?R8zH)|cA`#ip<zc@@1j*<oJ1XHA?DI90E!!Y2TB_Ieo`aSIeAne8|>
z{EC?U{kzHjpM-+E1RZy*_wMhw>ho(Rtm4tow6v|7HnlG@$_cFGzgR~3ERTE$Q!0uo
z`*v#;;!ehzOG4r=M?BS1{GpCbMXw!45N!vn7j%Qu`f*Eg)m{b;=UVAnvNHU_{>;aG
zl4J}`txDvRv7N1y<&KEhyuM^vbPu`X<J?IVAXQD<iLm^Mv%&F)I(zgD^fHo()mdt6
z+f-@%+e6>%lbwDASdsT(P2aQ`^2Km68~w$lwG(A+>*nt;l_mzdtU}D4{%4Z(yC@(?
zb^VdTHpw@*i2+o>_~SY*v|oIyhd^z6`8;pkj<!Y%2lYM2#l_I^$F0FSfHe+#8B5f&
zQ8c!ay>T#@Xk=f1Yaq~U+8$zgw%TASy*UMFjlA3s^^`Qxd)Ms__g%2bJb9hZ!(Q?8
zCP2+k&Jx@3Za<1EVLYe6XT4afk^k|=CW^%6RTdOLJ8-GuYP1zVx!BB<NTf;K>kzFn
z6MZ-<5wencfoQ&_arqRp2$(`Qb&Vd3?(f_=&;(5x_EDPQpLCH8pjxgH1@g@IJ-T0+
zefT1*U&VyXUiY=8(Y(=q95*yEhZ!+?lI!|#7QH%0w(YlnIUSDvQON1<ak_0oS{Jdt
zc_4OfF&=u?=vupPE$)CR`k1Qp3TEV$?0Unei{94!yb~wvZaOZ6s5A*Y1B#DF;4fh(
zedQWe`gpfg-@Ce79$|v=ghAtG8!RXtF4ChR&$FT_f|mG~maameVlsNYI$YRk#H}%L
zmXbO1KpTE-^3hf_&w0lFHshahnG>F}ymb=f2vg%>$cF6?5E^7;S6%Y-S}ky%KWb>R
z&AGvd!aMUBQ#tO|D8~#cqON?Vk5tcW-c<7}Yo%wcaLF;i{%ohZawm6?JoYr0m1j%Y
z#Xg*uQ-4a2E;cqPkj&!&Ml8qtN&axLss+7|=I6y`d-}DvMo+_vJqdg?8O{iHq?X)r
zw&hQ%f{@TOT7n_Km1tSe?=6J*2X`c#i0#WS?I-?bQ^#JbBU>F$u4Da!Z%^1bD1Rbz
zh>n{-MnOGsmURVuB8W{-R1ma<4(ZF4Td*<Hdavb?iY-?9D$ToK1a|mkN~~V*)HS$5
zpfvX<+bF9e?6w9JH)*DDB_{vgEOm&iY^8>v!+?FV*;Vf=B8;+&EmdWw9SQqF%GLga
zX|DTIh1pD18i6_S{Agyd^U;Sx&L(QY)}+nWU$t8VYuGrtJh-GmJFm_Dos(R#iERt|
zyT9!(+_BAn4`tXKY}X!LMhWc<poheOiEBuMY?se&Qh0s2QNHit3l`sp^ku6SRhVf~
zC+$^%=YSjCP+qX1mqe=_W>hBh>p_bpQ*bCK{-EvBh3rf;qw1UIPbNiMl}null4-~c
zp4TF4*;b>O90c5RY1s+~(P2qUP&|@0_-YKAe#osDv7)6VyEwSG0TM(W*{Xr~7hCo5
zy|d~}8KHA4s3e`S6QsVu#rO+Yx~+BM-~GJwnm5>_e}IU?W#lwMnL40K*3sm^Iz8P@
zzX1O_zeotZGN>2*b)Mo1h8~Sp^SCtey3ZUX;6W9IK^8aD5fE^DB5$jAg9^Dh3i6mT
zp{D%_%Jp*U=8`>nKtOTIG0P*VTfKGP*xp|G*1sZXD|{9E_4#^~+s#7)>iTdV&$2T;
zQruQnhzx&cOt51x8;+L@4|qOl+jQR23iNc3PDF}{0=}*t*qt`zoUo<s@m3k2eDi)V
zj`aQ6&Y^%aMT9Eb1j`wXAMgjuhMN}t{xyB%Lgz}!&BF=#nPba+bQoIT)bYcuwQht`
zvTnG{w|i{<<ski=lLdS5TZg1hIrGV~N*I?mii@<KQY7t3zTVTN`r%59Uh4z={lnS<
zxF?93*)z*@KONh(S0=@7!`Mt0BqGF<b|zmNbO{e9vLis`Kjdrhy32VXb|w&s=Z%s!
zIOyQ41aNES&6C$scn2wb<)L<|Nb$$fbNf&!n@LODKi&!^;d`9aZMxM#2p1w?K{@L#
zI?xNb^Ni_B@zYJYJl5+s@IP~VJzbe%>43mwB97Yl!Dj=${_!N(H*=>Gq_y?hW|-+K
z*Q<>=V6@G7^##_-`Mvk)vrQzy_=8^?xm$k9JkWZAgW~KdQ-B<pZRGkjZ=bb{k*s8-
z2}4OK%(>G$YT=s~vF(fDn5rYJjqe94emhu+sKZF1#(pk?UdT2MFgM?WQffox9G>f%
zyPyq#GsW6ALYsEMo>zJ!$OaBkv<tk9Mf=Tc&Jr4?Av5^nac6%BRAV;hAJQ<ygVCoW
z(YA|K)_a>A+TyZj9^_WYyLDI8@w4Ty9x*S(DjSaDA=8U;ypeMK{=vIsitWqgv%65p
z^54dp=UOaKm=l2LAx}Tp^`B9s-HcWbSC(yjujXw6*2eZ;JNZwE_xEut%q_l-Zmlf9
zr@==1V;MU8h4uw<)2$b`9R-0r*Q<86VRGPieR=@cPk(k3mAs3S>-y=*?awbH9gnGx
zW^2VT&+iExPT#6Hn#;V80Qp8V#;y=S->w-<YD0%q7fYTCFTU5s9o(g6c;8~Fu0}6d
zJ+p3CyRXQyo)_*_xJ{mi`X?K#$XRC{Xr1&{{-jtx_sLX*JbFIs2%bQeiSU_}XMz4a
z{Ink{*s1cJz0z1HL;je<RD)7Jc)--@caWJGBqv*$(E3J4A?P6>;@Geqe~{TfqtFhO
z+Mu=F13UwBUi=<AAZ1*gFf(%3-9xwgel~dRni<UZkQI3r{n>!U(4TW{LP8qfqwp`y
zqya!LvMT*cNyVZ2@X0cW)k$5L(*2j3h3bEX=9oCKi`ChHcyvw-2d=V=4i-OP1%V|B
zT@aEjPMFxYo(TYXBO1!sf^W><W`hM8j09AFZVx9X<#g{h0=JG_C!fc0?2aE^NLy;O
zdbNJ9Hhi3Z8IylTAuT^2Y@CP|+bQW<cJJK0QGW}4s(gir`q|jUone_rV$c4~b6+6x
z%?>?8_nD-EkQ3Uu6k7i(AT@>ML4eQuln)Dru}>x02_}jOt^lSqsTK>B@1DEDeG~Zp
zG6qAJU`|3}81nb#!XJS;rpK?soiYPPN1LHsLE|3*6}PGF1_A;e=7b%3M4=_3jJ@nQ
z=^y{7JwNQVHeK&iqs^H@e{(xguCvr45DzB+z8q8n!BHz{-&)bv+l-mXxbi1wgU<5Q
zNz$^sF$ZE+0-pr$;h8Ek!Z!+iV{RFEa$Von%{DqnEmTXRs~|+;!gf<@ZD|Jtofy_1
zDDm<t+#!vai2d-lT*{t|J_|e^0{NVVoEAH^gP$hM&5=4ID-iD~=?5dz+L@0AO(&a`
zkX#sFplqXj;bYdF5XstabG~$rFdv1`O$rDkoIdkX`8uFd#dH#8Jh}Eqc@vOiX#2If
z3@Y*oCX?O2!sAXC!InVp8qREQTnvLS?RxX#iuH;ZVd}E$f0vPrShUb<C9}+5Jg>Hd
zRgA&pvu4unl#PbA#<aVR0o?W<f%hr=x5ohQISp`qngSK}%PU=GyD4M^-#HrDK_|$u
zg+u5A4vzcznfAr*tTC>8{~9j;z7AX2cHpV+i~k)}d-#D3f$$zb=8o;5g1@x`Q~a@D
z$2Cexbm5#Fq9)lvOGNB4|C_cB?<IDb?Ig0Rf*0h$tu<6ufY>wm2FLBV|ITjxmF@X<
zsr7Jy1Owg@duPuFXGeGb=?CxNPC9A3=B*InY6CuKo{~&}C54MSe%{POF9-&P%yhz`
z?Wv6x2H>#+%V%e7``tDzCOr9Dm~^Y<=KSEd9>22;v^{Z|rRSrRi%l6^ULZE|AHK-(
zo0AKKU*RS9=o4~nfIy~ZBBr((q%mICoZt<o{U=7`txy<iiOsxF?425F!NCZ48KCFD
z#Nlkk$Cf){KNss|k`5D9v0%lmR^7`GLAya`9K+=hl%}Jt1)!l2off#ZI`S$?&*RZK
zQaWOwrMWUUErye98LGPZ%=O|`(%xrB9(VOKq+{V+SJB-|K$LI!;O4;E{Ta~S^n=S(
zL{mhO^|=RzoaNU*g-eUsG8jTQWIv|zVzvXrWlK!Eo0+Wau}wrEI2Sb4YOT9i8(;l{
zZpGyC;hORHK%KP0W<-&IL?vQnPy0cX*i4h1z{Uu8OdVh_{Wg%T)^6-(=A<oJH4+BF
z<yh@U=CNAZxs!(D+ZB5o6?I;~64U(CkNEE+{a)bveaht&iWUN;odg>5V@{d0((Q-Q
z^p?runS00OTnidr{SRaIW8%q%1Me^HABXu57ioy6IkAr6pKO2c#&-3l18<`|C+yuQ
zo2+EksI0gCETM4<A|shiLs;|F3sF4jZ%;SJMlM3X<eqm0g`V$KDWk_@rA7Twgdpxp
z4_)soWKi!G7H)EQtW1#wE_$yTxm}0zPBy>{PE6ICts^*FRPXTL;qyK9{lxWjA(*|n
z431g?aN!Dl;6_&0VTP+72qM+jv=O+(QwRzDa%6POwx5+xG45aRv(TVFtE+pl#LeqO
zs;(S6j0~YJ%hV^Ft*$G6K~N}eaf-jH0t$byUw^z+a2w=mvg4a<Pl{j!MvgDZsddN4
zUV(1pd%|DNbS6$J*98s5@W;epzl6lBQ)2aP?o$H>6Z1lH+}rU_!mtgyQ3Vx|&IXnm
z+ruP@TZp6bMp4{Hk{A?gE#O>qoNx-;UPu}7pCQS(nP$Z4lznEf@2$4Uxf<o#zCz0p
zaENFq;VYkc;9g}MY$b*Q`Y+`7+mqz}kWUJJ(i?S0xLP3Ub6zVoI=%!T0~eoi!<(+g
zSEfjY>tI}M6f6~%Np+rf2N&DUl&`I)`VZ*|Qkw*oQ40O@%z$=cG$nm0pqQ{K{!wXE
z?NK0>0?6DL1L(FFpS8KA&BduOz%pHLHWhgwkJS2#7x`uk<YA8yz5Q{1f!448WFNEn
zDtWdWk!3>6kk%-ylPI;D;Y_*yw55{nX(Q-Vs5*kC9%}qL!KdSuY0YuPeP_J<5$_3n
znygZlImGX<(c5%YBMcX($9}k6S3JRP;b6D7qr$w`S~|7Uz^Kt_Q9=qMxei7kZom6H
z3j!Kzg7z7Jn^q`832b-6ts*#|0<PESE_%<IwrJ%C+q|E@ue#mXK{rhUUB_{-0=phK
z`GQ){no!us1_2o>Y+{f8x=nZW=T+9n{a8Wuo4wqvH5xO{s2!oaHUxn%Q%P8C4nP4h
ztYJ^W-=V(Ox=h(FMd%vMUY`m(_&#LOXMq&fy#u$NnQuF&?U6SEqvif|4W<U;W%-H&
zrL-@MIJY}in1qpC_q4BCb7+oCS8vDZ>DRsBdQ0t|Py|Fm8vw5;#LHE1;FKWo6*U7-
z7tYz8YcWY1NE10$hT?^5+n^Lhrg>1W@I%e85xIz<?E$3h;}K@`5uv~5*(-qY&q~=n
zt>s2RvQlNjP3LBLrQrSp+^Wm*%d>D!#a7JtX;Z8U1eJFy^oR+)*mN@kHz2{2{_?D%
zzjHHFhFB6*UAegq3`7%WZDLoLjV#OhJ7m9n&+iyKSYk57VH7t(uZrd>b1?L!dw13n
z=b`ta7;BmEgenz~H%QkhHF9qJ47MD%kQ4qr&gE%#k_R?(*^YuJ5QuCoMCF~0hAcA3
z_{~HklvBoJbVyJw>#&Z(^i!fi<mIyo>VkBf*<FO#pjs4dV$(I>l|I6vJB{kRN7rfK
z<4?m_V`d)fIyDa44V=7z4_AU3VW-l~VMfXl0D)gHkEmycVZ!Ks18qY4v};d4FdS6B
zcu0k^8eHkLvAkl_?|aq6secP~^k~$VB6-*p&^k4PL?nu27{T7WYP(tO;sp`7KIM_z
zWYfkrOo%(=NR7pA%a`=Ai<9!ME7b!po=2w2-$>7zx$vL3aIBW8vo@QVeELhVyekFR
zV0|mR(fQLp8qKUz43tG&!QQ+dX0_XvPhZUzj3EZ5Np2^{qZSi?43ai-II50qmY69^
zT4j|1dRI;b%(@?xfk7IbdcJHG>MKnLn}>q7S`0?p+IR~U?X<tghxhpgDcdRn+9Cr}
zZeFmSl@dS!A~*rfETfO*Lv6`XVm5%dF;-32{2%~YcOuX6%=t_px76M$M-T`i4y_;y
z)$&Zsz~Zy=LI(=;U2j*8s4VdJLEq7Kl~@)Hqah2V>Bc>h&#OLxa^;tPe}-^b#HQ<2
ze=|nINjMqnp$6NvW`dB7^$(rxDPb9&%9E58PMH#Y@ej-)UzW$P7E^+co~oIQV9d@2
zx+*e|fi!Ie72im~hXNO5P6Z^ga?6qYzvSW?tfSFgH!pH*fQP`wST!cva$uy|dU#+f
z@F7s0d2emPt~dUCJL#BFMD-PPE+sE|d8>&u`F@q?YQV#w8|^jToY1fIoW9t>8hFP+
z24qTv`fBX+tL^*PWUVKTC=#~d)Afy063sPyX~?>1jL1SJ6tmYZ&B=NzQRmA&Fw<kl
zQ#R9%Q^4oN@tN(M0Lf-QiUD>{b5m#Hx<2Lcl)CERJJ|;DXmB1&6}xBx*u-in`GYCa
zT(-XSuOl!@T5s-(i+LdF0fenU3x+z<T8zhOY5a^K{o*6t<Q`*Pu{Ny8>K26xH}D(T
zxb|u*GA$v)%6ZP#;c7Ql;K1ES(iU6^jl#2aNb1ngyl5u17jCE{ZLiq4OweW(1k0)!
zlF~+28}YAT@emTRZh_I~2bqqmUhosYks@c3sPrDMluwi5-$6Ld;Cr$$X=h+6m)1W*
zTnI*1dXPF9)JZ=$&MkDhOm{IIBneh6$L0F9u8f&P)}aQqJK>E3a?y!?oFbK=mTP%p
zL||fc)+`y8IGCT2{Be*)i|R(UKrG)9J8q?E7WgF?#IJD&#U(2{&wgzfx{9dzdt$A(
zv=&{ZG#XudIzEwj?~s5vKugyKLf}53w<}Uu|IF#xY$#zI3?vLLz!@xSuEAtBnjT4M
z!!4e(r?F{rz%^`|3u&5VtLWhQnKVNDu-NpfZlz%m+S!TPUmp0B8l1DfmrTOfiV$F4
z&YQ+626c>q^^TmnT*zhTaXAV_H|prWs%#HEH}#30@M*;zv#bkVYYv>xtwmF<Pl`*A
zze(_^o@HmIf@E*~2K{UoW;qiU(^^tNhUI{g=5C$z4v@hqcr53tTM+D$?Is)^vPL1K
zdapN)!#vrMaU|r#CDOLAeOx);8{-U&bVng5nU4^E`_|ixV9_-AgIq#wK$7`DTO4KY
z$h6gdvjy5^U<bK0`g%u(`{9HC+XyPu(35*8S-rSiY9ft%rr0l3^>pO2s7!CatUEj6
zpZust9}OkX{O_x9cN(En9jSVemYk}@zlwe>&ukM!?H~r-OztFbsS87LQ2#*It@DK-
z)Cr=pByt{!)e0-I(W<kyQdfCdRAk`5m<`uZ+JzF-dOOichdCVUR}+(%kxpIH7jyf4
zi?Dt2P1e#8WB$`{_K?KkTq*DNTIu-yCHG3JJ0hSfNhiS!PvFh#<FogkrlS&@eRV<_
zc$LeCD_2ycNk7(VpKLr-u<s&+B|SCtX}c=$!OEdKYm#Qxn#z}9szU`;OGk36+H}3^
zN2>4k17JTV)mIc{FsZ>Te3$+BVr`(l4A7Xri7F+2OVTId+I``uUA_9Dj2!0|kXT{D
zb&_6EsJ!8DZXdtx;e}VD)|&oN5zQv06Jvu3+QvH%^N(YUd@o*<j<Sxet=_QQW<v|m
zP}cZnP4Kd6Tn!l$WiP<8H+#kpi$3L!ADjC`$Llx2!vji?grpI~ffUSKZtyCGmrl0H
zpueWsAo3A!?O6!#NjH1@ztA^|neWH~dWG^FV<pH>seVgu`-+uggrA#n2_}hqTRDJg
zS0m%2>}va<iXqAe(Yvi<epc|z?5Cz;QNowzFM#8W_!gYh6CeCFnmkuVBIhGQN1Ak4
zoFfPVT@#nhQTg0KId0>F(LWR*610Q-CHa<GGG^{pRDsv6Hm$*zseH$8V;2YE*A>n9
z#esBLHap_D2unkZLqARXGk8l!%=$h**tza=jz7UG2wnwl`SufW=2`O3N9-l`vx)RH
zExGF=6x~<6cdLS(toW?1wKp8R@5S!Y)l3oz+Iogs6}^hMVylg7!Mnj6!H!S397=*B
zjjKKsII-YDJ?R-p9l3a__`aH<>z7@X#wK$nPFl{iN;6TV(Ij@r63xn#<-F&SIcI@O
zXPxv_4O;bxC&D;vK$YvA=s#-kwrWrUI;&JI*mK^~Ug_R1I87ybh;E<u;sjTsz+%i;
z_Noei3N(w~oWD?IOzcs9sUdF7!A>8j&}#xAUs?vqf1raFLnxE5Yjr6Knfj^fVW~k>
z<dmTwv*TN*%Q>f=O^nV-JsdKr_XGmGC>GvpfKEQrjJrkC0161jxpl;q>BIbK&{Qh-
zcAK|q^_!HP8zH4KmAT<f2UzLH2d=2b7!~NNth?Dpzwy5#5YPcc;l*KWO-&fnJwaBx
z2UT7<0wD!j4G;!bB%F<CL!kQ=3DnRj0me{`s77*sy3Vxdhh`AvM1v;Vd_mZRGgQUl
zaz26Af^Vq$`ZIczrK;#i6SI+j^5OmGF4q<2Kjr<nGX;zkx}fAKfwIs_U$m2o?-8s=
zR2LP&J7zbg+!0xFA<0hpX4^P~#8ECU6TR`#(AV0})UPQmsG8&iJ)FuCNV{7hPkLQp
z0?2Xk3>%nbO?Epm7~(o<9L#LcOP-t~xovEc1gRHd(}~LPEBa1b#ED}7ci8jtMG!g>
zr{Rqcde6&LwJ=>D3%7ki#2APyt?|J`-`1mn9tDJ^H>9S_7IRq^?C3_{u2jBa#^-uv
z9EQp$#yDcoQF=)T3cKd;nFNwOLgxs#5-72E5M_}x(j`{!{gQl#B_s$vkm<kDsdfzK
z7brn~$%e#WZdLA5W6bD$%-{~|Xd<Y1+F*6t+f%>T*S6ihS<vgXtZesNsceHr*66&E
z@#!D1!YeU%Sye%$ADkDPnf|WDlm2^8z;T+J=}ZNP30v-Ks1A2=w`V7wslji^y_fYD
znh&hv5wk6p0BqM6tgb5Sso7gyO*aj>_+F$d@_tv1%({^_UaLhoJ?t)g{e9!Qczk$-
z$Aqe^YlW%3Ti7-Iz>ORy8FzLHOCTh2FZOqsVo-fP*S#C^yzS!0pD};{NT|hM*OCz8
z`igeUp=vPGX{tJw<hHEdI4nQz42}gp6GlkTHfm6S0+kORK01t(8(9@n{yriKQ}q3H
zj6|>9K8>4uM7gui#izVl5%m*zwdDL>_b{47@KIVfidXV+Q!Y;`>4J+-Rv<L^acUV$
zx4gsNar`9lH%(PH6A7As*-yc8Lw|o^IQXq9q0VV+MbTZBBwHs(q@#5lFrV+)-UOK8
z;Au#ObguzARAVatOj!*u&q-6k={$`;`mIiyjjngdJFjZ7(}eMxp6CQmU7Gtx628$o
zvT=<DV%T4$NFRC{;(U=*8p{SF^aNnEYQ6mTb!0qh6~EOXg|lVzB9IW^D2w<pHMTGp
z_|<{nglUW9LTD?~qfIy7h*^`AN>+KX%eCi??QHMGrlIe_PVdb(`=!41g`5}->QPmh
zys&t6u>!Q=-lODhrW%e)l+8PFO9L~#`58mQ0pO49$%ASaejVon(I)UK2<SW9?zY_v
zsET2VwpE14wQ&0G_mw`SHLbU}{eDL@8+<YpgXS-6@^t?Yo7JX0-)cnV-KRjO;i5&>
zaLT10;XA+L#WCiRotEczC!vHLFXh^GhU2e+#}du0(PqqgFuNSp2DN%Ftgp{3LIX2K
ztvcMDU9i|XB6+?@#n1eslhi7W8*#(yk+c!>0nd8yMyS^1#;q~Zv1kiG7&NJ|+0IQ@
zZC&}y+}B{J8(egA($^<OT7_4Cr9f9@q=0eK;Ux&#Q1ywq&_zbL=7i4e{`?MD*tn;$
zA^yB!S6FLdt9z{U7ZyyB_&w!JA5)%dtPJ@n+OKs-BOw4;dqK#`2&d63#zwA$EUeU8
zLQIT=g)H5W1k(B^N3SYjLDTKR*n7WpCSFyaV)h7hj`M*7J-NNMTqmr3Q-j_fy^G%G
zPPaT#-r%!uguIp=I*c7K-ghSlUhGOC5}~Rsx*W^bTm`W!UlLA(!eb((>T64fH?F60
zEMbwX;M!in>M7UY%EhdN0aE+s#ooQ6B3XAFzzK}Udyf;Xuc*fBSaF6F;p{k3o0`>_
zTcp~$i{&{5b@s2fV}tkRBM6TueRBtQVsmy(C`x0(Hs2U8&B1VC2NBsB75gs$@NoVC
zv-=~)iGr-Cyba@Y)BV^V%Bw2F72)9z_G+k$JlF>3!%UN#HBT2e*W4P7?$keKSmF{B
z{R2H44cBKCF1CwSRic2BgVja~r3SF$FQ9`P6@YJaOlMlK=&#h>pHW0~zP-B>R9n33
zyvHYwQ*0rSVF8+U1NWC%A-$x^Ug#f>y_y_h#}6dH-EqYW`-J1UkR2ILbeX=s2x?Zj
zH=NWsOX-p=o>%zv8a0IQ(=JYGW08)ct1DBlCx~`ea_#;^8{2<MsW!_MiVTsnV)E<Q
z@{1@82lsF8jh0dGw+2&xqkwk41>!J2qIkWX(cS-1IGY%3e@1Yasg9VK)Mn~1(Fg@}
z<g;5WY_5ZJTXIoFecdKtQ!bY#7UO%o@s@6%-g^VW#tZhBIyRMy40asOGY6?Pi_G8;
zztCeYNrV`w@{d?~VBj3kIrI}+ZB*fFbK3T`I3HKp+<Y$EeDxLd1vA>TI})xxc~KQP
zev5pPKow6vlt_!1IAhp8QD}SXm%Mj>HTgcNllU_(vR}|UnijBXO|em{O^s4r9>P-|
zDr99bv*Gqp@0kzwNx9a1a$J<<0FqI&372<9ci<MK1_JR10=iBq-gxuAht3@4{iBi%
z_2rrs*R#=7$(5OtLF}D?4=$6}HN(8UZ+qD)-*@AD!_bq^`vr^qFofj6E;Cy}QJSfP
zu<=JZlZp8U!d&-{h0oUnYSxP(K?zRZO-x9R-jlnTS47_cf*-fMGAynuLoSMW4i{SE
z<JRvj^?HBW`hw(IF*Q)!<&~?v*APZCS_^jvA>2=z@XMa0=~PkPV*lVe9PxKuo?pDg
z%z(jVg<K#b>z_kEI*7-Up`hCCE51Ahv;PV3_x=g7q0pBM@D3}`z6Hb5XhAqCSDWAH
zX*8G%2H;=!f8=j*xS_E@zgo9U;qfKP>Xr=|GRSb*stk6lHt-F3;JfIz|6XKxwLGU$
zYma)G`4^~I5%N>0pOfS4-!L%w2tQ*|skIjLD{B6+x+X)DmGS)mQZ?JS4nytBn9|S?
z?{nA=+?XR3)9toQqsgOZaM!_|(R8~}mE#Q2;d^$!k=Pf-GfKIhJ>+ZJ$2xm1L)|m?
z0iV_0ctvVY&Oh@}z1de2>}B71acL-1e+DKW)$oFvHt^1k?YWAt9ZTzo!#s(7@Ij2;
z5UzT+n6GWmYEGqq0CANpwtZrQ3puylM}x3^&hIe1;i)5(chFdFv*KO|X5Fj(Miw@4
z*BR9rrMl~$J9LDz)QrfT3J-AFIM5{2SwuHIPWkHR;o5_lfd=Y!53lufc7wZj_D9L*
zM!R#axvJ%gMsYC*dcFYbZ}%TNH`t)j>!xw7D7lZ|c@g81$Ah_i-XL%;nA&=oBTwhj
zlVovjt<!>0JHL^Ua*LlS>u^-@8j9oA5rrggG~tljq=XS*`$P*iOB$70xQsqpkeN8t
znVlTM+CA+-A$O;1Xuw$@P}mGZM0pnw-No>BJ$&`i(X2lyC%gQVoRl$<ld`*#OHKTI
zf|noN0Xwng0iS8<Nqh#FPeZDy1}BH#TkOHfuJPfSvS-US5)%*L97pD#Vrt^3uihY7
zeL&reHtifJPxczy_&DAZMV>}h#T+`n$DPvR7mVlj3ELIWg}fxW83>DQusV~aKWdw`
zS>s783f0NhcGU+O*cK+Y@xe~MKDN@Zcp<p$Ay=U?yiM_JE;&FN#dD==;ehLXKHun7
zkhvwVd%0;kC{)Vj=L%v)%88PIP-#+MKP41-SY%ig34Fq<NhmnUXCpN=b_6C7`EG;b
zvUYwg*GFx&t$Vr>Ou(wV*C6Tr_||*%){3v2=2(@hbgq9*=#EUqm=WW-;R(a~o}APM
z@ZlJ&KApAWYz+DgwD@deMV<}nF&*N&5C*wsw&NYFy?m~~1+%Kdx5HZRh}hfB5Vl>u
z%C>cEqE%Fm<P_2(wVB~4bA9EFT+v+h*;rY8KB&Lnpj?d=aA9WzFk@k^yQ3}WU14Q5
znNY0%;fGnc&Ed)o`}VNzc+dT+HTv|*?o?_Z%E9Rdo0Ki2hQ^a?1j3tN6scgOPiip7
z<@LfxT)|vOUrTkQJeAtxK(>`n-HPT%Qju_$bbeJdJmx|YY=43a(S5-sZnB~3z_)`R
z-~ZgB?Ek>j7NqH(Y-oBG8fNl{CqwCR<f@p76Kzu<J_o4hLEe*3ozP#OrjU0!1&#AB
z<8|&}34UXQ<*?pSoRZgx98NJJj2W>3#K?7K1SSJIk(nkkqhMj317gVW1O*=Xk~W@c
ze`FE_0+DKs#hKbJmR0We>S>!UZ>LsWCqwBnEBY(}FMdBeG{bSY7L<@mmOK~q4ME@B
z-kv3^o@ynPKpTJo#cxR}8GoV7viUHXC5;H%gXSAk4yLYj42N&P&(glqJ?_MN&q1#i
z3l-KIwWcwr+aM;JrEK9q37syXM^v>`w~}`ZzyA&?iRjYz53z)=%R~eOo_tEt#1bLi
zmkg`5AkQQ3YQj^dRx})4t`s_lG&Ochji03O)*s-0Gx?o%5$-OSMI~8#*a6xL4|RA&
z2Hv{k>JSleY<oV&L=6@Tj5SS)Gq)h0M434EbBG9&(do}4OMWqcbSZyEw;fj);6BIz
zl{Cl_YE==AJ)-n)5=Wuas4?=;s=I8<6E0Ta$a$h}W%}w|uJ40dqO`ZlUdx-aLzt9r
zXL@QpSglAim>-9E!2>S~IY!>`(gxqCTug0+eae$?S;|n=tMl>q8lz`vt=~8(Ug}ZC
zU}HoY|3CKLF}{*->l*FYwr$%sI_TK$*tT|@9kZj3ZQC|F?%1|FdDG{d|9PJG-tYI*
z{kDI5SJhrMYt_V9bBv`PugSeDWit{X^6~zArcDj|+c$Tk`2#&^dD*_M`}!J=I<!!C
zo6w`QGK-a4n>!nfurG*wa(pcWbc?p4lwmUugq*k<Naxd?^Q0EQMA$UX(NcN(`d4tW
zDlhu7g^FO@2YMT=W=tKo^E`<>US9XJfZqJ7;c=wjlBYHteyw#sbs-v*Z=0~^@?m^<
z{4cgHDmB~usIZcbgU0Q=keSx~c(fNuz1xB+RL}POY;%F_I~5{&C={<ab255x^=P$z
zACd!&XHgfn8BV>}$7f?5!fuN^QjQ-L=N2xDD@SXkjFk-=B^w1~UI^zQW%2LfE=7jF
zSJjrkmfIOlUSNA)?jKDuAd;GH6RF3^p!2Dq-h>5T(OO8!{f@g}K#_!V{<?{Ow%!7a
zawG4nw!&|7J&Gx3!X6ytJ0T@!M*qs|E_Ip0!PCHo{mNO@Gxqg$rbfp=*Y#AT<+W(G
zWZWt3q!;OWQhU2YkN{<@NpZ_6Q7*++MA(Ku6xg1)vjyp5sXDk|jlYPEhB7&5?o@NN
z#-yA&tvI~+b=&%_e78wlZu^$4*3TI<#73YY_r6uVQoBT>n(>Fr=~!+q0rT10xZ{$E
z;#L)1s54Q!MZTW6lB{ZuVeK-4_^?;)6~aVMQ=`9;oH66h+T(CmtWYf85WIv9vhAKK
z=iCFrs%!7hhx?~>NGGc!^$M+46q@6WBY^`>#Ed=4qptMj24^Z*yerT1O)L%`bB-cE
zJ=IEr&~>plko*xMhE;dT*D8V8c6+L-KfAF#9pV*Qow%>4tjLRbTvcsO>}?#?VM^Vi
zXTMt@=$dB}c<PWg`O+&a1(6034&Dz_6+wMkB;?2hGt|nLBz;QY+LtPa56;`;)X@P`
zS!*UeSL4^~r;mmX?Yu>yd-W?dW_;23Gcen|APpy!#tfB-uZa7^btXdVZXXsdHY!LD
z>+okI%i(?8UG?Ven<DkZZ{#vT@P;~)gWq=pDmf(|@PM=Ze57&t5bIw<Ix57LTmAWP
z8_vGMIk1U?ucGMZqqIe12em*8fzR-^B`<cKuc0E3CWl@Ua^RnzI6D@nal7DiL)xAU
z6EjbQfbnq}GHf36FIrxuojUp%OhEx*Sy$_*Pl=ljE5))}rjFL?!8CvzL^d=Ao^BBl
z5%`@b&_Y6ttNpDx`<)&8>4hnkbEpo_FE6W2cE8&^$C7BQOVorbNezVX(Tsc$MrUuQ
z+suDASM7W7`@^f_D@+Z_@H;NfcJNM3cfY38{fh-$->gP@HL!{5o_&~-^ES?Om@UO)
z-rRRp{|^he-SzZ<!~fl9ZJ|_!iICNFq^6>RKF~5br1)Q)EI!b=*1H3r?1>3^a^(tk
z>!AqN;vODL306#PLn!Gvp)!-=ev+u-8aA5oKi)FK5&anTY;$oka7nR5VSJ&XH*h_@
zw)m!}(4n~j3~micW(DRmxPyb5+yxBW?4Wsi_{M`<ja>cS552ndsr{N?`Z~=041O4x
zLEtl{^=~^pdxl)?;OB<d7&<E;vnATAX>H|)(`k?BN--&Dql1|8XniS?=2fZ)=87_3
zh}f?9)F;){%A%Y9W;jWc2%t!dDmRsV$A8h-3nBKe+8S+*cS~n7H**5yJ1~xni%HTp
z-)?dJ%%V%<h3nwqVoF-m7+IHPYf^sSd77XTN`*__BZ)01e|do*<!4WOivp|Rx4~jf
za*KbsEuoFF+DIe;^!3*JU>X=*lA-ZwG0{222lrpyv^YTdgI{fD4sCszYQ3SEoXrQn
zP|;EyK#kP>Q^$<7f`9U3@^f_vZ+v*l-xL~4dK;AU+fc$;W`zl2rS|$kP`NQAc$l*w
z<t-bm_1u-|4sky}PTokJ=PSevF*Ybs|LUM|68V_#IcxmLIb_fXSJE-T0rsMeH{1Q(
zy5@IJLDP#O?of=bY$JJpsvD=9xQr|bI!*`$CFoBUu(@0c`e+C!;_GChXI@1ya4iVj
zNxvwTA26qIV^>S9U)NU7KR6+e*-nG%PiA6CRnL!D^`4QDI=G!6@zzU>ECS*eeP|2I
zIg~u85e?xq))g$78++Aj&Xzi@CFzC9;P{rk?M-tHHo^#S#$Z6a5tMGNI4lVlGjKMw
z;LxzW&M!eS<mmt&il?QU3C;0oegk#l*l_lg99h#7I_<iD8)MUcc<t317)<6a(7~*7
zobx)8dH~5pvPzzm?$=|Y$xoD<l-Bd%9&TB9OvvbTks0eEQ|B4mRSxBna{je|Tt$Dn
zb<(%!uI@=+{@E^^qynliMbq^0a#}5fK)`#aVugX#7ztk<XL-J;JXI;AD8$oTRp~s-
z`7d((sp5O>HGgx}vF+2i^4p%G?n?gg>9uDxVTKg7z`vNn_)s7y?l+IkF|-3~ViB6g
zG}QD7<;Gq^--qv{M{B|GaZ$|RW$xk6cXvzeWG|${){9j|&xq^AXbFf6B88vXD2cU|
zJ*HQq<asOSY6Xp1mSrAvC-QBm7CsM_qVpGmWqamBp^E;~${qDau;K|z`!2UtbsB$@
z;QdW1|CTOmKc5A?*1f^o?3q=7PR|I7zK{NCghHUMnkKEn$@>+Ym_Ef{3Xy)$eQDM%
z90mnFdrDU7tsr}`kqe6%CZ&5WaIz^?9Oy4b69XpNGMz~u;DkP0GyDcJKrlJBWOyE*
zbUdAG)|wXg=E+MJ^OU@hIL&Z65~7XdJ{MXz5Z3^)OL(1S(&|fX=R?}MyC0v)|B5ak
z)#l1BBnSrrLV6^td=G6akU<Gi?x(-;j!u4ah_b+ImerwIY?2y04X^RWKSn0&CgtI`
zFK~!v^mwz21SJ(j0}*!v+udD`6-+p^Q5Hb>FB08;#@_~$--6n_6iU6&X<1Y>ceVaz
zj098A)-F>q>Ut`~=$i~^i(_)UsXG;?J69J9S%(5_@-jTKeLt=R_|B!iF6HAVWMfRR
zRn{G<uSDldy?xtGOEG^hytv-Eyoqm+;Mbg*xIJ=h>>HhxU86m`{!J&d7HLjUdB;B=
z?|kZ~<v(rxdA-%_$BEknFI=P85tTlV9>W2XLb^v;(F}76SL)Gf8!g$sq|RN&(pgFh
z8t>2q{#g8vfpNxTZA-2DloK64r_GXlk2%j5Ji;L<83DPA)Td+s-&+Ow+xFwY@I?Dw
zw$@O7qoYi=dYgKd>^Ewj`o8e#_&%-2s7sj)=8AoTgoJp|d1@X)o{8;e&F#or>a3Fg
z(99_Q(#-0#8kA&z=Alv__Yky0N<kl9WD@XYzg{T!5q6@v0p6kuVh#-2(51dM%k#wG
zR=GG)XqfG!u5&-Ez#N*8yC=As;Yv+E9$69zOx2!hI(>dh1vutpAy4lrK6;!u@Eal0
zRfi2n3<|le#3n7qzmdP@KkG=mw!f-#pL*nNPkIbj#R7P;T|O8mW-o{)H_PU)5By2D
z`R5m%|6<NP{$IC7cFW&SzgfQjZ7leI5I7xH{}MdT!#TkI9{hh%hlQWXKRKE{O;IVb
z|Nm+Kw%eykw)6y}3JX6uou7~VlSn!!;odvs{JiJS&vBXVhdLsuc%6vt2D7zY;X)q0
zPcPJ(!mZvm<XY;ppUus-nZL<3ZV3Jh>3`Y!lV<$M@ioe~PEPJQCf}mjqF1JTj?kxT
zHQ!(nCxFPIc$SYpOz|QVouRdt@sYd2pgN0h8Wz}XioaIAjA~$~C{K?1_uKmKr>o@o
zxeiysZ(GTs2KoUCLRH7g?A0;xj~0M)++j`c=6J}$nJ#)S+^jMR^aI4V#QFGyL@1AE
z5_WQA7Lu+J*>O>?c!b*Rz^m&7<+BD{OzybMc!aQKqB6j<%0#+^`@ta@4;xZCg#52h
z{RlDSy>ad-(t^UnzJpT)gY06{gZ!EAQsSD-eW3f+Qy~?1_~^^$&^N|B*qlpdV$kEr
z1UpnbWz=t2*@%;(|D9RX{(o27yE$i3Y5uZHP*r)JoHv~KJKMgT2f<#ADMSjT61YEF
zhNE1&b-dnw_i^a~d0L(6aQynlT!NUeR4qBY0-@=q;@(h+Vzc1;k*$aQx*^+eK2Ny&
zI^4U43}}5a>6N{E{mz8E)$icOKU2<fK`@7$8}gj?KIt=o0592?NzdOv8|?XHEPwjL
z<E}#80(n0qxtnPakA~9)-eu=ua5VZN<N(3=x_6~=rpm2`1XgYhlg^OMBL06djva!)
zU6j+&z>EG;wz)Y2eaf1jk0DA{e-bXPuY>u+1BVU9x$<Al*OWRfeJeUUp$-sY`&T=m
zu6xT&7b=KiH}rWttOrH*c+%aJ5f|-Ofm&6D(Vv=2_NO{!)I^?)2J-DicugC>5QH+-
zAQY$90l?$u1xL51S<=r8)zk(yvbRsCeRq2HKCZ!%iZQ1PrBo{f`tGsMd`;zArb)=J
zy@@VG_cwkgTjI?2E5~xm1iLt@*Mu0q8^e9o-%|WP9%2gqFI|~!RoOZhd<+SM>hMe=
zbo+<?J&FWMDDDRLhau^ADyXfKE}#-snjeR)hiN~_*{E}__POTzIwd$+>P4SG=gy~?
z3LIN%fstWGs0Av4>4IEBgLg=t|Dohi&3vbKVtnQ|Xuw(x0}0ak?pw)W31zuzZ@+Iw
zo(P8j5Zth@mgNzjGf~rH8A5S19|BDOcxOhQcQEq?lV}<nTJ_h}V2%i!5+V#SnSY4<
z|MFhRQJ*1e?AM024#lTy<F+&_zt{zSL4@PLX9yKU4-EzbRni;y$=#07<)>fsxhqwP
zJ2NkPMIa<y^LDvJI}1NA&h+=!tyE4m<OB1=J7KE9p9B)6GEc@2l>D_EP`={SywqQw
z5mK^sgvYa)B4G(ys2Ndz<x@j?!nqNtR`-#VRLN^&+SWMh8>g1#mZ*IF{4c(|azI|!
zZ!=9wAoU$bY6A=CQP}@Bwa2Fen0}&MgryDiPYtNRp(SIAg0Ig`Z;rB(Yf7fB?QxtU
z>Gx2HjzBI~>xQ+nZz1BMUk=*uMO?7gCIFiB0Y^w7C5kH7TcAu1i?+(G+jie5mAPv?
z=?=OR;k$+XJv>*o_Rm9@9tw9N8bH~@4`4Z|d#XA!<wjbA0w;#IcSAxV(wBR?aeGNR
z3;<x>^EJOlL%yelaIiKOL`y!r<o-`w2xR;5X<oKA&qgQNtxYN=@q2gSfuCV-&Pspw
zF-QB@?1mFXLvwv+TtJkuSGh6!5zl&;EPLAZjFqVRGRlEP+mHLBB?MTI#aNY5ejC)(
z6N3kpeAlOAdYZ#(5=)l~1HD%k9<L6$=>#wyo)5gyHn_mIJ@V+B#OR^SacrWquq;+n
zb^(IvDXrM(=o4uAiGgCaM-`xCzH&ip8qkcQA+qpa3$6c&W0}W)l?09%D(+Q4KX^f4
ztBv=~zcW7Yj)R)NIE<74uAw#B9l5O-*2HG9Vi2!qC2K@s`#=n;1_q4I9n9NtJ?b9(
zbl+B3?R2(7@Nh$Rw;>t%YhCEPBq5kPfGW_z@!d=yz8|ZD@aGmfY>+wk<zdiv_O&ES
zfi=s-s-sf_Gt=piVewAWFcbI-$Oy(1g87=SI@lWjw?%XQTC^M37%IDEKx~Krg)pGi
z$xB+A0et<Vh02VcKXnp$%gwF=$ldPfbDR(Pt!%o>FWRhe(u+?o<FHlLq->%68{I-M
zkR$#@6T@Tn<#5n5yxCw8E|tPOcVr2v7Dc3i_+a~`gS3j-s+fX>DA;Of`&$1xZEHjn
z<dG8|9#K>i+1V8%w`3%ca~q|_SsIT2G%?s_2#)#U70+0$p;QgiJ^t>0B?p0Q*?))J
z710><ISI(N@)}@a;R9MZOOmSzdPRzQ>U}JB*f@()t>>lFf+0?kwwb_pB8oVO+u_GB
zkvZGB`ot!xX<)Fh(M{iE`1_xqiIs}L4i0crIj1P#i#V7E=;k`?eaG-68BI;{A(-Pp
zmBsTK8=}GEpQEkt8w`*CwMh7{;graOSL9sLsbn=)efq6TN>F1XG!hLrq3--=9-dgG
z9aB4@5nt%UfEH?(N-|i*Ov`Gv-5(l5JeT1CY*WD2Nd80Ff@dBG&3>cYXNaPKq+bdY
zzT+4Nn8utRPH>U%)uiq`6o5#PsD%HCuYqHd!VG}q%E87i*)4W7WIA1~M|VF@Mxtn2
zHL%CViZG?eX;pRBY{#f+ApKrHx(_EK<9yv$TYf_HNa9B~EYw9=v8L8=Yh8lPJxEgC
zp7obLg<dV6Zkxb+?f-_tPk9r-r-fzbX0*TlT@KX@qAyZ#%`|AIwW<4d6v0ggVqnm4
zv<l0>gRb_Dr6HTLdR8)DM6;8H9(X}tQS#m5kLrIN`KR*3-z?6lseMr!CW#4joo;5R
z+y8?4uH!>e-pe!Cdbvd9e+~{ny(0eU3@u=I^j8bzg8(EQ&EwmJ$4-tZCY72Xu;PDt
z0w?Lu{!|_tbcO`fl4$VAL#X%pF`{YgnQyz&AC{81ivR0w%n?8HWOD@_tFQleg8BC?
zr4s*?F@f2h>-i`0{P&PRwy?j`teByZ^8fuC+Fv$1z`@e+e`QktPSJYO#e|!)xSdzO
zS?7UI$%E<&sA57197~u_$@30ZsEv+QuBYr`!<}GnlLvSgs+;-BS9tv+AJl^*@i`it
zUzyrC6iR;3ExHP@Ja}ir-$;j5bceVaqu~^&RQ4!usS*p4<eDm(V)LW`>EWA+--p=6
z*9hzhqWZJoHQjZzUE|neb47mVeysIJ2*RoVR*-moYvx#5|0hjILY^VXr=Y)+{{*j9
zq=f+)D~^J#lOOmH&m&V)Au0ofe~3OCYqjjgQ!Oo%*u~2-bz2okXvt{mZBhaRN9$PH
zRA-gr!af0_JuGyB#umn6uobNp2Xr3gwA84~^*4X{p?bvq*sE>m2_meR>Vj-nI{WFV
zZ4MQpe~dM(_<5Vx^>cBbhQ((BdB~oBuo;Z;g^IUdjws;MTh$`1Y^c_3k_Ry#<gU5V
z;Q!cWlAapt@9kW3AST-+7$lftcz~Z~b^QIk&R8yeQY%30waLicsmQ1^DW)^oV8v<V
zzV<?ETj11j?}{R5AyVbRA{-%wg3c4E>0C}Ya2%cHTjSiX#0J@6L3%|P;@NsMX6qZ1
zBd#5%iPbn`$sGZ@4mCTC6St1f&ABx@sc<q5{UVzEbOE|#NU=59S}6<xui4`9HqLVo
zCa2kdMhYPtaeQK@X6d8McfxXr7^2l;>sT~Tj3v$bHJ2psBX4T_r#a8$#*I+vJz4N#
z(HVru0BDwBZbq-Yrrgm#2tyPdU2grZ3ttCl#kBl8|Iy*OGWgW<c`}G!@=5N&krw7{
z-_ebM_wjTGTj;#EwNZ4L8HS8`px=)Sqe(%*9#ZPx$&F$}-#_om+=JiyelfT=JiL9#
zkkVpQ2CtDBQ*hD6xtCNhe)_i8soD9R?q;t`0BwGw3&nn76LI|eL3*f~9}Ml(ZT7MA
zQ*m;)>NH!&>@`<VD$TBujHaRPvfzhrw68bh96Zya=zHo|OICW9r&01RHpNzxZTaO6
zOqHrPjHOK{0qudX^muwfCwAX}Ja`+S8p4PMcuZ6KUgJ8(IORqc^;JntI-_aO^xh}S
zUm)BqCwQ436B^v)lXj{<$+LF0F0QigX<9X2D!8NhKFEHxle>>9dt_K@?l+H_>)|yM
zL_D3W&|R&JfvFq1`wHANd*JAYX!4zVu3rz5nzjcg$xiR6;Qtvpw;QBEETa17y?r+U
z<qf+MvimZr50j|{K9TM5kWG=6h>q|kNT73p8$!tfG)zUT|E2O+aTovQu_+&sWn~})
zScTn&tpb)4zQV`EQL{ZL?`W+^59{a-J$R<weMcqq+@*Z_+|ljGHIbQ`7*u~qk1g79
z3@L(aC$FK}_0eLO6dl8}cU)TOOodctq9Fz|zo8o^+X~~}TQ`=8*MqF@k4jd-t_x<Z
zu0ADixf9_r9%#fqqs{@S6p6$Y4|lo0&;Vq*Xe~PHY2P^HN5B`4mGsaYqM(k7O_=cl
zi;!km16Wm=_g`z#L(}(q;ny5sDKdiuYc~us;wMIp>B$nM`Fr;Kq8BaM^!#9L%Y+K$
z0u^}bev2Hjern7I8#Dp;{IhZgC99*o^T|)odB3!fwh)Si!V{}pxa$M?O$eXgEY4l`
zW=_ig<8!y}&_30rUT~}tWq-~gGjjx^jTcXg$!F;>AOB+aVf80#YqA7bbd%cXT;mln
ztspSzATBa)hW^M3HCaCb32(gYe>8B^EE$J`YO?9=iZ+bK=0gl#Qw;+W_&~iG(n<H;
zNU&`!xsm4u2dZ`Z1=@eF6jhJs!gW6h^CKwRNqrRRV+>>ZB%+7a?n?G~Uuyfj9b{-W
zkK)Dh69F8t5Cd$d@z0{p0_(}FOdfA=(%$yjP3yLdTwiw*qNYSAXXGccUIZ|0<igyI
zC?C$`C8OT4w)5(FNtcHio-!@d_-uI*_jqbe%u#V&@uDdu@U8}#;NmX#V^e&m2gCI%
zw^BWkh5UG7<~1mDWy-%_-9CtxXM@eM(?e{^uSFWAW=B!Oj{chO9-QhKvcT!Wf<q%^
z;bw+&_RB^v{|Oh>^lG>;!#JWRbo+6p2W5yZf%RTRk-9;5Tp$bzB6`^g7ZgBDEun<2
zDlRTTzwE7njQ2Ar5<NLa^%(F2S^Bc`(TU+B<M-Nl2xU-^(A1Hcd2xs5?c_SkW*1le
zGJY0pVJB5+bT?F|7`~&^8t+-Sf~ZI-BH3k5Om93%97=8}gF=7IWw*Gz5+<gAeGdR9
z)>soy2mkjS8Rs7qu*x~uN^jusK)iAd<$Liwn>S4@Lof($TilNlX}&<U&3Ad<1<{Lj
zLX~1g(QsED_3lTGAj*x{Y@-YAR&yv>n>UsMYwNwt)i4Gq)S28=p@hgYmIeLT-x>bB
zt=~v*F(^hDXN<O<ULB+^nW<05YrXqpmwhPV>@MsIg5lqlgB{Jg9r6Z+T{kS>#H-3#
ztszhqhD0wnVCIW~Vi}lC78P{8fwtX-OQohq3<NXwXTI3Tw8KpZe9HEvqE_EQ$`&rJ
zsu;x0#CYoHRIxc6K|5%f49SvdG+GUNo{n4c>)DKBF9D=Ch%U)kCa2Bij=bHlxXD-t
zjF}M4tMnBH_hgJo3&Pu|F~fuev5|Ks-0H`%Fkq|s^!MOh9~b6(sDiRfh-vJe{G=U8
zEe<Ylemt2Vbjg@JqdX3=_|cY$p=dPKVs}lzWsI!wH&%j+G#0R6(qKzJIQmDSTfAPr
zF_bN62XJoC4?*w(sosyzMO{gJkeHqiEKnPxaZy`V&OuYsllPSt@AXb<&l~eSbTySw
zR0Oj_md9LkrGmTumWckiKl}AhUb{vXBY|w!M^tI|zVxei1TnoRu=MyhpvG`?#LW$P
z{gy|>*k2(O@ZSh&LJFn%x(MBc>Io}ffxQB|m%=p}7-e|4$aB{0MT+?0`8kz6v3#go
zTX=w~KVdyf6rlNG_mXnv$h}X5QuT7maemNnhuvQ?IK>>Nf0O0%+;ePbHxVFcGepk2
zZKWgd94)((Ul48(3IWrD^RIChpz2_2?dJ3cf)*;%o)-1NA;U!UuK2VCuGxIN;fJpX
z_0#UI!j@Y<z~7gzd4_DN2h!Rv0b!g7^+X*x&?%6sp`w``4zP`qBd|M(j+B+y7_GCK
zuB;HQjcVNOm##iF6i8xxUORUe`$vtGP=BO0BM|LckLr)4@Ym}wPyOGa-@z`2I$no+
zlIgvJQYlN#_m3iHs(cMIPGYw6rSj{$A&eg@dX`fk^VY&;u!Z<hby7M4T)U}+rNGr?
z3NlLjj;b)UOiy8VuY0W(N#{eurv%Wps-MB44D^E6X~Fiiri~4ZF&ouFCW#P-7u5JZ
z>rPZ-BopUo{IMJ7r-Kns)g@Ju=LOh`C=SD(5=ZQnUc~B0Pc#|{GijbKkemzJfv4A^
zpQ-i)i|1=d#ll2^@CmpU6-)!>)ziI;9tiQ9*H=ty!C0HRK-8}YG4`+czCw{=hq?JP
zbbuRkrs2{0h!L69aIMX3sn;eH=mZIqsio5J6Cv1L@5Y{C_olvjJd+vcIeGY~IFp6L
zQ%7D3EG;a*!H5RYflKX}!deb&u5%Fii%r6t6WYv`JKV0x=Kjw5?<Ov)$df_{k#lY)
zdOn0>uxMA;)^Kq~bUV9i4qp@nKLlj0PLwq;gUzw<C4|?y(&UkdcfS7)&KhR?$$ARj
z<#DMG4xb(FIX~PZLBj^bI%PxpoY!BZ0?2w$TGXH&;I=D8vzy0JS|*VV0YN;oX4ycA
zmp}{$B0)5&DCez^U&|S_;O9O;5gzP@Bd0{Wf!>!vP_5{pzRHS#9sVJA_mF%IaKRjY
zB9pdP5U|y}q7w-lq4;3OD%cW?yD=DEi@{z2bXYxsZ-{T9t#X(<+3^BjsTY&6L^W_@
zqdV|<Y32jU?sP}gj4aS_5WC4Pj#dS+A0knyE3|u*Da3}h1)z!8a$Im=trJl1#04&1
z@2Gd+R{LdbLsGM|BmJ`aXoiVmJL?J4las~0)99#Q#lRbtqp<Wn2;F1hhpr2Wzyt$L
zS80p?_<Kb|JBV)7TI?MR7@t~?Gn4lb9O1@{E&myCgWuCH3(D^VMtq_9wOG@rBy4FE
zh3TdaFd<V_Ah_BCQ#AUi!PuqC1|1)GnOjwY?aIs7AWs)OMT#uA!MNQ0@u|OYCsK|q
zR3gm*mW4^Hu}Z>Dikdqj^{9}wWvmmp$>j&++I&aMf2kLA9i*!+Fr00L!$wB|)sb7>
zrLnn5>J_Dsx>&I|IuA4K-AxphWNNTB3ISkkO6g8YyZq>aw?@Py6{x}VYJR^eDJ2=V
zr;j{gV{y0v=UyWUgaV-@tDz?dx*pjZJz8HxfNl`go~s`zEdlJDq1;`tAqcD`FlO(E
z^CrN<_4S~SeC4z`6P?I-{nF;Cljn~|W!lk*_=;34igF94OGcTS+k%bYngUH<Dyc_7
zfNFXe@tCb8yeP|eHvKzb*r0{zPrDl_ojo$^t9z);1UUTJA}-KYx5jYVDk<ex|I{en
zFHG7`C81sxPYA@Eizq+k_$xP8@j`d-25ZFar&ekgpbZ$7HC;iO&GxC`*H`lVTxV?B
z9kIm)w+(e^pM4W?b0C1~-g{AljitoEe0eT7X4o$+CTkyJX01us+TZ<5$N?Wj%qv&z
zC%69G<IsXT;r740_Fq^1RWd*a+Mac*gD0lvJmSkr3V4xfu=C+=+(|t$Vry}{rc&t7
zuws+lAG_kFBlk+BfXoMXnYD)H+7DSAzFq*ms*Cbifw}4#23muCj1Bc!BlKd!@MK?K
z&;_tKO9{cUJ13yH3ACHh6Vf`ipr5J*?IH&S912g4MNVh9=@7<LP1=w}^2CCoirkpm
z=1;y3<#a<B@NVw(I1VE>2%ffCsYI)bTKG-w^(Bc`0EL;siWZKg*qqPhWE~_o{!h(a
z#-YRE@>B@}O|XQDd2WO0K*}m9)}#+9d2*i&S3smGj7{QkZ-EL9kF9JH&B%dNN@*Ld
zp=5WA#qT19HuyAvUiYL(b8kM&`E@mOaSj(jQayHT#YPw_LphaIX))&>D}jr)6BI=P
zbUG~UNj18BwJvdpsVv;8K`CV#d<|)Z8ZDfWA~`}THZ)R5E~a(}!n%%&$kp|}$8HAE
zw%{I*k54LD*T<g9Ti0|7eY+h%hV0~i=uZG3JsY|MxdZ`Dim4<y#bU)CU*S?Wilf_h
zc!|y*ATcgtaZb%KBs=e8Rlxc6Hc;P4l)LWvXL)sxiEsW)kuUkGYd4zrgJ5us?H?rr
znW`+ziF-A;ERh&VUWufwpIz35`%A&}B|B3>S&N`uF%|x*q4b@+R{3Vl-q**6M5OZZ
zk*%@(5gg`l$bwIfJ|EZhpAD}O?b#k+-NT39Hb-33k0p&UOt(#{8bz5i_~4f$fAGP(
z<sB;VLJ3Roa&w0mKb#J;w5L)5mz+H&xb^$^zk_=II~DjlsTf29(E4=1`R!B49Qa6j
z5XTIKC>wDOYfjs-SS}l-m~V5XuD-Oc2|QehgP$3Mo8U;q>9iZYI!D!5oqx~d?LxAj
z>VP}%2b<}eNBnVu%FBKLcE;-$^w3?|lR2!IugGVwS*E6mLlAY=hmWo{2a`|Bq5VJ*
zqA_aR=(YqiK$ST>mBYC;B1MOcx&cY3uALeCJD@*;hMFo1y+L@Ix0%4)qMC>W!{XFQ
z>8pG%QyJewwReuLIubF-0l1*wsa#8IDA_<is@ndFsw8O+(4vG<G^?c#D-5`7EoKWM
zd;BNdsqO*dE+eWw1BryD9No$q<AxP&#&AD!OE3_-!Gi}ei$7%YG}UCtJj_UfzOQcs
z2dBGwXd2IbTl9=b^Yv7F0hxuxqAX6MoP^a>*wqZt$|_=l*PGb%O6BQKs+bEZwHBh~
zhnc=33Tq5ePxg`N@=Js0t2(15T1LbVuOa$qKpeD(mk9;#^1E;dgD7OoP?Cn=Kn&TT
z!^0M5$J>!tv<=1=E>hzVoCs-YMG*>=((_{D*`otsS%RL&$E^X1BDnvry5w+%Pi-A{
zYi`e%pU#@BUC)L%r0wpan(fj)O*?Wv1j|r<j4nSceQ9>e2L%_@zbn5=Hi@Oom(AH6
zS@Pra^CQ<=3q26=fD|{W)NFNKI~c$HK60baXJO>K0TX<AlM~P339R1q!W+J!pQ+S=
zZrvA@eMR~ZwrdR~M4b`rT$f)!ab8k0&r>JkowPcYQ<5}cfCNLig|~>_U6S@f$5Iz5
z|An$tB_Yt-G<2~RJwGT5-W(|$uEG;DT(q?pvx#hA9mf1aC0i{*dZLopP74@x0_hPd
zk;iFIu%V}52Az{U-j(}ebhIUR+fs%8+{oS=y{@C91B(E(_0xv;6H0;S!>x9!%)Ius
zNpb7|f3aRjHsA*RPoQ_WMTyI{*Dp0YcC35;#XogY`)d7Mb5BZV?q_!0eRq9(n`mxk
zHd-W~j*5edidr;l@k3phJR0gVOW0aPHe~WFzC^OJw%)!_U<7iZj$|c9laI(K_N1?0
zr194xosB{yK;Usf@!~8Hnq2`>>EZBp%eKs=!a_0y5hWIECdeO^70qA}30{JsQ_vPL
zEV&6X!k{*E0lnwJ7PIy+Yh<rVmq+1}bW8w%>nF=T{%Bh}!glR}l#(&<DF*9>F*CZq
z+h!1_ZV%k;G&aE)K^uGqG-u?y{<Wt~IAch)6x?!o_)%+<#55woEYA!|JLg4DI{E7D
z0SB@oKRd`plh>YEYEPF0U&Fm?E)n&rN}2&|vXpg#L<X`JvHNV_8?0u#L|$b#TV|)&
z%up*Xp5Hry<Kgs<ycLZoFM=?a)0)dTf57kIonv%G4$+RRt@&D_)uw3SmK+4cvyHH%
zXyYRSALL(!Y(BOP%rm)^1UhZ`1>#_vHH^>>O=8H&&0_*FKt81Hw^Fc?P^P|-<eQ22
z#$_*JNUdZ-56=V5hDXPMXv9#XU}Z(9)`exd*-}Nm<?`d71RoA}afc>r55C-4X)#yc
zg#EtxZ3*|kP*?L%z3#<1P_hVXUQNgrvWAUasu{yK-|=Fyg~Cjo+I?P1p=MTpM^2Ps
zil21kx*f&V?t1kFPK5jY;FoW;M$LncT20Wc``MZ&M`xg#G_wwS9BHWW85!VA^abNf
zXQWHYrgx)$n<H<`5mC?_#-$iQEn#jrG^xN{aV8ZS9-`oCB(p`TD3CRVB6_8Bq1kro
z&h#-wudD9X`i&Fna(ko0eD1S@w<9NRfK(h%1?}1_E~8IEud7W)JAwvVw}^qc&?8vF
z@YZo=I5YQ3A2qf;&l|Tc!{KlT1e7zPl&jl|uZNf}1Aqhh?(SifkH{(28!-h1E<Y4a
zSe)glEM$)e;xW5E<!8zAM8zDvP7yQ1V@2vHp{MCHBanHg8riw<VB3jZ^4@jgLTc*L
zPBbCn^n0>_bTy~To=!sFcR3{SnMivn#~Wt6-^0ipoKdK0X@eRYIp~j*jKKc*T|Ij^
zUmsTf#)M{1z)Gb5R2+Al{J~K>peC#va*g(2s?}E4a>t@*;&`kd`LU8*2JNcJLnG~Y
zOj~F$pN!H_4nec|MmvZTZz4kKL9a*Ze&9$0tVGmWe;eDGPz={AY;l>cIv^tHHlNOp
z6bnNfZL(QmHG8_+&Mzx3$7zvg{F|QlaFF)Ud&z2#XsD^>rac%-h>Po*Oj<Kh;#VsU
zW?*9RW^UdyZpc9ot|9$~z;Y`H4e}kNQKi`GbpPD2<Ozu-@F4>ytv&yV5Q?NdUYBr%
zkSiqe4?H_Wr@mBG7G!T$QsD^)!VDdKZ;J()79fp7R;J2#uNnGlaEiW>$VJ@HXNSxL
zu7=_wDV>uH2IwnIvfqAz=#qz7b@<Hj-6vhl%FE);X|5F0Tcb1bY-_Zo+FWPM3Q!fO
zYdp%KF7f(Mg`PGW9dC>2;<AM>3q{N18f2QN7Oh2-T(l$+ZZ`Sx!(FDBtXWQ0DZ@0J
z;=UlN?;Fk5cjEOlIr8~hh5Qf-BWE*&Nu4&Q%t<ICM(mT??G+>LeLgHW!ptvXpNhcz
zoG4lZM12W|gh6N#CDJQF5C#POCU6F#1@$fds#C(ur_iTRiKX9avl6)oaU=HX52G+s
zCOEX<Ckm6=6yeNv*INqGyCbI?flCyVSKu){LgB)?y7;<!dPe5vQr!l;^_yq@HOh=X
z$Q-;$3~L%2lkL}<Z0ASf$u!V3EXk|-)>YHiB3;ZJk4>_NcIG<K&DTQ*C#zA@O*I~>
zb6uu)<^&`{T-=i93R|9&2Qwfn)n@7AH~*pw_<?v5J>uY&vr`XPbrMa15B^z<r0xO_
ziPC#w4k)H@zN9w43P-6a-T5&mMv2=~QC3)X!;<>^4lO>2P-JgiAhggZ#;D0|EM5Zh
zoiG=R_$U)V*WiZeGo091rJX1qC@^2-{8zf9;PTB>ZA50i5tp282L6b=Eh+4R4gB$K
z&KmWdKJAuxpJK1r(_15f0tG*1nh;!CI!zk4kd1W&v>#|hO-lc|R)b>x#abAWYLk&0
z!xvYItkXyelfSbQPxn)-<Uxuh4ueUc8~WEhJYBNmbSXDyp1!eA!H)m1nxr@VsPG*9
z$R6fb%WwUnFuUuy&+~W0A`8{&0djU#wjGS6LumgEOjk&x#FcRGy_78$e`8HIAfQ!3
z?x;Cpc4V876VtwRxmW#Z9|h?Uc_cC!Dir7qw&)i_s`{NgfdYC_l1v$G6!@eeUF;L#
z^J6n3kwB6^<i3MgOnW5?U81bNB!gTkPb`mB<ArY2a?Cz~;)L9S=6>*}sAlZ&_T@&O
z>h{hJeZGv9%EYoxpb%VgDG}w0q~+H(JhU`=R3pG-5_RL~7}qZnA3&XpDXav5KUZ)*
z5aPDZSe9*N(vEQxs;EYD0=4tfAGXOh&+*`nW&wpJ#^XxBCCUb2)+nhWwJP4@K+yha
zE$U8xPG&*eYEzdhW#~ep;Kwl26dTj3s#KrE8C`k*9Y+(1p_zO>oLEky>6rQBcVR9W
zjMKFD1pfSi@B3e$`TPC@OyLLW1bm?aG=Fi~AeY*5lkBn4vpFeBlLRmqz(GQ()YaIT
zM_HJl$gMgrx(m+>m`Q6@0G^H4G{stUGwuBB3C)8t_BaNs=-WMUZaFh{Qd2A!i&T}Y
zbnJjzF@LI;rBobgjEid1OhZ#uB@-Ba8@Lpn$@Q7J7Bm&q9XuagM?uK!hunSV8rsHS
z`=Mqsh)wcsE|4$l*f%lD3lIFXb_-GV7`3{=1);a+oh0>_45~+|-9Z*dY&|a4?+m-I
zC|2b(e*2t1<l1zz#v3RjOwgW<zy7%Ki2j5j{+(?%LxU(l+oN1{XvOsSV+P7C{RTx(
z)r#G8L;i#H@?;)76l%~=fx?p)3<Mk-He{xw(Z~GCAsM~p`6tb}dL-_F+1?B$OZ~@W
zOW^_HZ{(?RZvG*M;7io;SiAoei=VU23uOy%<rTks|DWl&6^a}ezKsC0o&4V`ej+3!
z;C6T9*LYT$8VCP#?qBTWKP5t-PT1dvg6O@$`Y%Z3zm>y(5SGGE(7{7)`w-~-_wD}&
zc=`YQWPb<{FaKwM${P1O7@}K3y!nYlJ9ay(Lm|L9&=^wpyN#W$MIyi&`|xAVJr@Ss
z<P7(!wE$7^pK;QW_H2rINLYA4e%|EOrEma4*YV)~-GS4?b2a#_`yERarOO|Czrc3l
z$8PYGO-|2&=cncfHZ*cz1oyA6WK2nhds)6Pnj4>L)r;BB{Ol^XDH0jG&f^PP2>-H6
z;2JE59Z5%JXrg=QXPre#%+Q4}W98ax0>w06tWBOH5H0W;OWG_?mmor`rji!3J6l^a
zr&}~;Adgxais?COUgP~JSg@z|Ap!I8d#9~TG?U*AHRPB7r4RaW0gBlQ47WEUn%DeD
zlqQ=KCGw!;b$id)N8<LTB&3#s*2lPW0<teHVWU^=;|DvUG2I)}ztJ&Ylr7A@HFq1&
z=}%ag7o7Z2yeLigooYHidJ*~P)X`~4@~z{L{_M<F*+37e+YZceDg50*83Z!8cR?{-
zo>5z&q$=>2c_8Mj6Pt5n37EA(LvP%(GBq8Uuj#?P#W77jYekY_I*K@qdxdO$&qZNf
z9{+3**<!nDjMBz}PhvKG1VbO(H2y#sT9~m~Dh2n874aNmg;>`#!4acS6qiQUkacyF
zgmu*TeO5)Oy#2z?)1q2<?FI1lr7_SfKl{bPCa$qpaAET#`d0IgE);z<PDG`(Ms8s$
zL#aLUy&^I3_hpV#cIOP!nM7tZL3lA)R5RoYfPu`8T?MylGz=P5-)0+%7udWKJnA;{
zFRmD(c6-_UcV+_3AGO(WQkF%Ih5Vcweb~6;HFEV`&}}SP8GALYBrelQlqd8Hg`O0R
zQUrncxS4D9xMA?h*hG1Q%?7@qEKx!s?UmnV)J~$7FU;=DJz#v1U;D<=59kKdt3oAt
z(4D{{6PmZfxb69uhLG4vlZMB>b+#GfFSil$DVp}oO%cA78Mn9*29Nf8_l`y~Gsi&n
zKN`OcG+A!I5n$e?>z-({$&16M)7R>8YC0L|4zL$-;kg{Yk~NZ@SS%!B<O1Znf)6a^
zVf%BcQj_up>mLe<j|ymds;&J2YQr$lGy>5}oElrZ>XlpOUkf#rDZ~HPLH|Na8NuI8
zCEWB_Jt_Y6jROp*&GrapKs2<hsgkz5{<k!SARye*o3jqH^9Aejle_R{*Kd@)Z&A)N
zG$kci)-pHC$!aL3KN`sx0|o~RTP!*)Sgh&kDySw;VNB!hetrjplv95)_$~@vnz+B;
zXRKn5hqu*s6iIZ3izLD)zRPzxqUa|52z07OitpT!5Pw<|t!@l$405Pv7PibUFeZiJ
z{KavvHvl*;`L^7zT}4dVuUb@&;_hblwN^<*J^Co;faE^b6?<byLKDE2K$>jURu}ST
zAM8HxK4UCxEaPR=G#sc|YHP%#GB1!wO4c{8>sS9Wbnv4X#cQW0-2rQr%}sO+?Zxby
zDlS)j6M(<SSp_!(ug|}TUD@1d;;W_VhNebtO-Q9KOsgzXVK9W&6=N_0g<eH>I7xq`
zY5MNqkNmEP-zKJU90dW5tB_WW*CJ46te&B5qBgos$nFf!7*)3IhBH0yN60&1Au(s+
zeffHh`f$Ehi=p8;KhX;7dzjH&O&=#&;&HUPI!F<OeBRL_PYa&s*r#@uBYn-C$hFRB
z3nB?vC*ijFMp!5AP=})aW@sn%Z3T(!#qztd&YEAHR}*}Z=n>+|R~`c*Z~pP)T+v^e
zkvEtDx_=+_l{vIDoDxtn`0mcdsP<D{89GGNNIR1=Q3Ot)NnJcYrNYFZ$9q+kpWU2v
zow`(`I&j9)3ZyPBFlCQ|2WNz)j5u#EIzU)Rldd$c3R3Ghow{<dXXqCmgYUXU#HcA}
zUL7})M6we&c*{JfE~Kv>hm+Hd(IpzVlp4WYM6_BQ(~qortT$ghOV27PM>|4z^%w{D
zx{%yl$mfv#8doP_Uo{H!24)6&>fo$$As^jeGm9xC-35@cb^0k7$)ZN5vR<D3-z3{G
z(R+S22!A!BX`oeXaN!`PV1R4X=E)TB**-Nwvi%A($IAM%wpRF?F>cTw{+XgB<enjj
zHh6-&i8-l(pk=biy7@Q_d0wT>;Gj3dLPI#KMP)c}mm{c8nJ-*C+IWc<9L-HRy4(i0
z0Dn1uO}vx%?4<BE;y!K~n8h+B4{pu8Dt@Blm5`ZURKl)z2Y02Y0wrwZ1Y3BogbWQ$
zkPz9J$enNOWdz$qdvfFrDEku6C1J3TUm;-2ezVv}%e9o_DkbSi`*QqjYD4v!t2C1%
z!X9&qPf-C+Z$#TZhtp{U#R%aUnPLi6u!GqQ_`<zb26Jkhq<U;*nJb~-M$@|;WoRIU
ztAb;s9<%=Tjr--Pzc=9kos8$Zvsh2qi_I@h;6w$g*Rr9onJ2~qBRiKicOE$zMk|JE
zjoY1YTn-gFyE+7p<p@)GVB{4nJZu04LW#RL5;skzp_V_SHW*o?je0sn{P@q@Hu&`P
zm6FA=t%F~nf)@(x$>k6PuBwGa9iWgQ7(ONTG3v4+vSJc~2{K%C*4F4)s$w+Gn1yh=
z2zv#D!+LO2CZ{U~%=~k5HVxJq+hz78KY4WF=;}}p&^dcX7jb`_h$eB3Y@hE!DPr-x
zWSi!;%|gBllBY74f8Pu)lWe$h6tPs`y%|6K+2krZZYVU;s7)?;IZSl=*x#i_-R5Ei
z#?^?p!p<aT?dss*C>2mmwFkT(nWhUI8v~_aUt+-bLD>?a<m1%1YaA)K{H6tbB7iTt
zG!%1XnOwrfzC$P}xGc&rK<+rljgL=?gcb0GTK75P+xjBlJIrV)XBqb33)Me1iegsF
zyNjJ+G@bts<n;S*-t&9rI`VHd+el0tFVd+W3&i6xo-2?MZJf;DGT9r6@7uXU<!Q)9
zUtBbOxw3KRdbt0CP4|ajrrh>ZXd1kKKH@o|R^s&1<1#;I8}}k=F4`1)gM}y-5wSOd
zL1-%x$YOzJ7X_EjEAQbzI3x)%1F93c1LuA9l-QjxzS11-qC$4sXV-Anf>)ak=eX0O
z=y6||btKSBWF32QHRsG^{7py$U+;s{so#93H}L!?&Ex=;9H-%3$F}tH3q;e<LH<}F
zlfM2Fv5$25kDx@&t1Xq1>j(haY}qdztE>I7C1z^?k;3QNU9-O+98$I6UFWF+e$3}>
zhD9Q8NQPBULF_go9p*Rkq7A!$gp#ooJ{i{&9RN>(1(i%BEN3+9ht?!<$a1Za>Ba85
zh0Xo|^R+KYW|aN@Px)zld2}{v;DlBVcd3W9n`WHZN5(yGwPMP@?Qp$bbhb|^psv^L
z<s99aqy`Ar0|`pQ44XF)>hXy}fko(-Q#rBdYQ(y>tPZ-)P+fl8`VBX=Tqy3A{EcRg
z9=5%S(oN6+sQ8`D=DqDwB>jH0MAA4H8;)#UH)LB;P!jiKvPMSi96>**7@uxzm2AcV
zXC?_^#@a7>FNomZ6n+MT>z{OO&fea0c-+M(*}R_k;#bv#)?I<#5fJvAI)~<w93m5b
za-F+Kda1eZVXW5ZdyDPqCFP(fCWF6Pu<e1)!KOe1lq4^*B4*p=o%6{BU~)|`jjc?<
zHnLxl73g?PgbVP8;m#a2rkTl!1m#0{1RjX0`w}h%#q6tT>Gc}GL$4O41zd1_54wX_
z#6TU4rrV#2ywLRttdJTr*Bvsx>V8i)Ws?t^_x2k~JvG@rEF3<*G3>Y>^8u93Uv1PQ
znRt83t<N)jf$H9j97&hEnhT0oQl;GOHzypvfD;Z##58!XL$mj3mq?nTuN2>4i>c@b
zJZ6igE=samEH-t$fo^y_*s9J4e_2Be-d53(FKA1X)?%4k=)CStcvbeeqU&f|1I?k=
zfmf6uc&P9tvZnRg{yi$F`Ecf~6aq!|-GH>H<62NMl-j{*laL&JSft*S@2taDshUJ%
zpF*goI~Xe_+p?#R%Rpi?1!KA41mi4{PCVHbJ=^OBB_8=?tk!%N*QfCrUpqu=-d!&A
z^^iZ>;g2J@<nQ3uLxuno6G|srK9iq0_{Fi=VPzy}Eb6|sXMdiRia!EV4W3W}vq~!G
zap`?dG42p(hgYWwLnc4l+m*~<%<?6lfXu;xQvWG{ws`-RNW6i&zy1Oj-J!y2Y8aG?
z+47iO`qWHJ!+e)BeRf;IPC%865y?bxG%|pHv$q2+FFF+G9{`ShSICt@CyVE*3p}ER
z$?YN8b^Rsm8POUF&amG=$*lFPs~&QfZat_Vnf~COzJlh*=q>i+9b%Hb?-xYVN!XKR
zyiRYwuuJ#Ct#j`;lxBaPgGvv?6s@r9$?C(a)kUHiVEBB2K>5{?Io(X@q)Cly6F_#5
znwBkPbe6iA^b~p)#FN73WvV|fLT`JgN1Aq|&P2ErNHnDQBlh(rbmuu=XnR&s{ijs1
zxuLCA@J(E;rl3FhSiVrNiq^%G%l;{JQ~B@=(dJ-zPUYaz<z(-2Dbh~gjaLV|J8j1T
zML1bKk@aukg4MnuLRU|j<>!59pWSXy785=ax)-Ww{96b~(*{W$At>5q=)#Z?VWpqe
z0blpH<$d?Gq9dL90aN2wH)GYz#tX&Ry!#^XuPqSSzQ!b^9q`NV+xP{|S)uL+3IX+k
zSa^ckfN4L3fm7$O{+NQ=dHq6R>Yr0{C}2bUqT&q#vgY>vZ&)cPP4*&_6&`|ruAk8!
zduwgrzE{(Q#n1=CCM)!K%`WJdM6U%8lS1V!#h`gOOGB9wzJTNs5%rW1Zex3WpdCqJ
zP6Bqj^EQtN()e<zI_S+tRJ@EHl8TuPuj%<e?%1C89XK)J8~f8cb9U0z<hFOo(>`G$
zh2Eh;vf4p=iY6d1uk{*D5~vFlg!1am^+n?6f3uW7-Vau>7AoijP8)fO!b3u>8IGq`
z@1B1(pZzntk@jbZPpRy*MmZ<UGl!`6E|9@6w@K6lVG^WM#3zm<%>;<V6b>6H5*lZh
zf8{jHr=)@!%(dDX>rDw1)6{@abz}6{+c3ZCiCd(`*+7ZPc|)a9Y5!@o>GWpAhi_oh
zLNs;1Vqq@;F=$%I2GNOV#&dmy$`efAnk1WYn^%zkWO)cfZM$Zq`Rb+FwwmjjL&a?3
z0bMpW0xH9cX-*(!+I;!hYDx`{?*j#ow<+ur3Yl*+=jgIqopyEY<Izwv99-Q6(&&ny
zj@}Vit&ZPAAa^;GmR>(9+6l8um>xVLOr@GEwf!8sDrz?(vJ*PEd_N3vhj3l^tPlDc
zQ-9UFAZQxVfT7A5yBTJllM^Nw)nw$v<z4Y-kAwfun1YXxVvLcq!C)rD?M(02;2f;j
zK`1G&-L=>h5~UR25@uI4P^$jQ<I+y^#*zH|cv7T~*UH+T{{^x+ps-PUIe3gvHhfcZ
zF;jdXr0ALGpXvn>oSUQramEAVFVt2|W+(z~_HeeM*<_Qh<axa_7&LyAOwLlx)^wFv
zUNIXfty})^o7qeR!}y^}_>soI<XkSxa2Gq!as!flU?6vKE4JDXHn{ErdOhp+RweCl
zdLo2_Ef?V?QUoADOIx$%p+8*EeW!ENU)bf8<mnFumpuOpY~7v(Kng)>DTQ&55?0*h
zB9zlxgRHnB@B(87dmu*+qZP3XLfPdCqE$`O_52H$BqWXqxrRcp0@$Vc`Ao4C-*Q~D
znPv{i(Tz9lH`cKTQ_I<QZ*<U3Jx6*Dj9n<9AZ9K}^2*s(MMd_ZY;X=JZymhl8GR8x
zIwyp}P8<1#AP~`l{;_W%ZDZOarR%$b;y;Y1auqIP3+YC(;t{z~K>K6HSW}lJc`XOV
z`r!oM^+C;Gtgs?}D!Bzwj112F2+u~qFA>0&RsNv~Y$rN`Q51<G@`67ONq&`6l6mDg
zU&sqChzCQVnd@Do0|$F`3F%CRf5`HlC7e!_mS>OvG=cnSyAux2VY4b9@k|sEd#M*N
zV6fcG;BX!PQK8^#J|Xg0gDk3y$duEhX=o6=x??<$`5V{|;aZcJyb~i$M_rOFQY{iy
z1Kkk$^JP&Gd$XLcOP~#eN_WlpWBi<jj}3fI$l_k@7cm(vCCpPz>$VgUjOdny4no#g
z%(@Z|rtD|Km*HxD)GWzNumhwhX#UJQ0CRsui@VO2?PgT3A#gqH(p5uvD5+QwdOlo_
zrtg8Qj`$)T?Qvg3C$>RFs^-v!_H3Qr(LIT+Vr8bb)kfl?tyj=cQg=EI`Twx@RzYzt
zQQK%jut0G4;O_438r+@W?j9_-2MO*HJXmmdcZV>zI}A3Q$=*BJ`}|+kxjLunTznT$
zHPi3(+r8H6?zNuvbax%4#`43m_Lt%vljS%ZaONv7kQkfYo2Okm=XG+R^4pY8R5pC+
zLDcS(KT1`v<GRrhqs3EsOyCucPoVM4iNxIOV5}pxGx(%{g&1AyxhU?T+#=G>%Dea>
zZ}kbKHvEyzMTXCHwt_rXClJ`R_Nos;E0{c5@&o8DQF;$jo7Lx&tH0OeHd#ozLvQPa
zb?vrM8ZLF?j0Ye(klvYcj9foRxa6FDY7~OD%y~O_m}e{|;T9B{7u6or<PeD;l=9pY
zE+^45H-Se;*ic7=X@S8Gn`q@l^5xb9;`Kf%Zoqb$_BLg&(N@Eo>T|aMS>$?h1UgF!
zLwOC16Y>J197B9G%$<OLP{B(0*E18xu5-Ide<6OI+3!2UUXi-Z*Kr;m6lWK;*$EqN
zpP#mzQIw_244RlRAdW(G-agHJDIjhc#{^|nRyR0HScD2-f2c-hzd@KR(?da>Clq~<
z=uWt$J3zNm&7>8ZVuW#&Y!ui>`6<%>McZO1X?*#|Co}j#jyIwCH=z6d=>T1BLG92<
zA@hCbFI-L_Sb(fVesm-T%lH7Xz}PEJUU>8a>*^ahj-tu%Oz7n;4LNTRws7K1o@#z6
zi97)mM86lYMu}2J+Gl6S1B<mWBJN^EfUecs)5`{7JsK2QTMX`&>A;n-*B#m6{Us=R
zVXYkRLDyPrvt?ig$@f65oNb=v;(np`B*H9906b{=c)?|beL0vhO^7Zd0;U3_OcJXS
zQGQv<KuX9WJOV1x%9QXQ*e;W7)hZsdlQ>jKx4Tp7f?dnqn2)#wZ2|$y)i*Ys>#3U8
zR%bAepOrIsaS`mxrmAyy@o35>E#yNpsl-vqNbl?G7S814Ab1dMLX=6~6)O}O&#%=j
zDk_OcK5}VA+Dwq@w6Z?$IAO5e&?RY;XWr1@k=T_dZoiV#kYuFA*XbbKYcw-lkGb1S
zb4Rx1oliugxCt1H2qc@YjnSr^biDSk@wy~-IR&5Mrg173*T|nJL&QyIi9~>a5-4hE
zcTM4AVP{b~@jY*Aa(4cMPLz!nDs?5PPlY(apx0=52j(!ejpq%*b_in6%+;yz_&lyp
zb79u4AqxZvA)ILOQ=G~-RGHgtA(dFGWo!%i$9+vk*_nyW#LX=S10R8hI*U(FKtc-(
z(9C;fzx<jPvF}o9zWJ!hH1Lawr)4o&Vjb(74)Z%(z|H(P?<i7BbZnHQGL&U=65OJ@
zp51YJW<Nt1uBOk1i$9rDx0>SV=H=XtJ9`5ojbnahUR0Sl&ZCHF@8r5|ps+FF1nYNr
zhZ=6u+8a5m@e>-fzEhZoe!2#VZ6n<yN1DGA&QN3UBf*ka*Dju$%<2%?U-GbyIM<8q
zf(3K8?-0)i#`zwyswLrECL=|13l_RmBL{0E*xF|6IvQm5!VvWq-6z9~Z29>YKM=pn
zYR%4}fzJmt%ni-j{h>Rt%K^_rWeG~&HZvZ(hO(&H#F8UK{zPyu87EY{{XLZ4iDxpD
zM+S)$)<3N(Dg!T-uMjuc=8Wk#r_n+0SKO&reIfHJ?lce<BJlx%K;Q#=Dbv-GF4M^2
zWR)8_O}s%3`D$lPsV|2uunph3s^Im-p6Vvfr+P1hKEt0397dPBZ%BUPL(pniy8!kE
zq`FD+^?#P{N~kIl$@Ya**ZXL4TaCEAPBBR{cnrbxQOca}*@*D7s}&NK_7z71QOHz4
zl_4PYK9yGhwrYGMNL;Wz*nuQ(sNw<8SlM%t1|p?0-smx>u4M{Z<s6Ab%_#^H)nuZV
zToPeF;FZfz`UGs^uQr-OeW&04CZ7Jdy6g)g<A(_N(|OU4qz)r!sl2>IZ@PCpj=!ot
zT@GBGQ|LL-&^QQa(b9eY`txv_OWTmMd%BP4VnV(*;52mdB1_(*38_iD{gFEm{a~>A
zFxXS&6avQ}Sln69jAEGn0AKF=w%IlYvZdj1$oGAr*w$9#E)lBY5HB{FoI)1UH)0Fn
zvei!Ae0<)-hyoFGbPs(fQ|XVLH3Co@KJA2l?qmHqhECFE0hoK=B1}^GEohw9v7>t;
zvm_%q{UnNCnfHpBlja7l!k4BB>je3VC!r_iej~$lC3(qz_hvZ3IqaGRv+Fvq#}-u<
zg^%M^gL#b6RT{g}?pfEP&O+D8xr-cJiHN=y`2{IO5-?bn>XdNmt$n#ue|3oi&vA$;
z(^7CsH$7xNk!~cn?`PtzwUnQXvf=@<f^tV<Fb`k$kZ+L9u){_%Oq0--(8NSUVcr#D
zjZ7s<xm~ZTELMMmmX`GIot_Y7wvu4vnolC_C?b@R6lBxSSr9zl52TT#|33F2l_&4b
zl4tn4CEoX@x=6<luB=YwGv_B+28Jhoj69DXGu*V?Vu*bWQzfJ+<7Bh6Hptx9MkS#!
z1Nq!oljGblksCn7tCSe#n2vqagTn=kjgx0W=Lh$mOKR}#8z5UtgH10w1fox&U!b>l
zP4k6Gi+iGVkyjTmc{yx)xqa!{mzxkPbQC4_5CzVoj>E@)z+c_+MY(H0#}z6=-wF3v
zbR47DRLc*9`yQQd7P(>bIlueNH7%MDQCOE!gZ1&&GFE*;uJd%my^BOIlKxR005jl*
zJ(Z5A^=+a6%|HA&5*f~4j}*q}vKrna=c>(PyNz0~K8gJISpbvU8J{$&zV7E)2to4_
zYIde0zWGKYj1#ZIJSof>;<6v-{YsmDpR%q{Zoz0o-)f|kzurugvZ81v2<dx5%cF6R
z@iNxx6pC7D$UeuezRP(Y3`CTN!R}_lS1Z2Xr27=%PT<5(GpAm%zsM7X8~$!)md8E6
zQtK&|HtgMiT@6h0f-nEi<cU7XZq?M^q$NyV@}}GxU*Ep%JS-FxM_Ua0YIJK2l25xA
zW#JWNRAM4NEHc)EYq6L?R=kwJ`_T8Dkta#{JshZLacMdvgY|ca5|Ag>-)EDFIXGU6
zW4J6ALuDr8U<V)*Q9iu3TDJf4!|`nvH+X+fGG8?EE{3GA#@E<dM{26lvQYl`DmUA}
zgKY(Eb1SPj89STOd)Mk>cVg|u>F_lAjNlojo$;=7_rf-_{&uxOyMg>O+pe$+Rusbz
z;+UAc!D0<TWf)Csg?d6?SJ84omEEyAu13(tTQeV|?cB5IMUYXJMWh(VWW*J?o6;MI
zt-qDO{wn=;av5eafWV53kUv7k$vYbEPFQ%Dn{4+BoSh5e?43Hj?*W_KJet?0k2c9S
zy0)L@#b^pu*N9e7=9jK>bLj7>Yw`UmdfqdRNh*8c1d@mt$rd}K=1`4Gb>G+Ne($43
zK}L^J62!_O!-Y3^z;$Qvz-oKK*&>THIwj`2nTM+*x<FoD<V2pT5gQr2-L?ZG;ApXY
z6=>Z-e7UqELOubAU9Z<6UQhEvlMF_?k)bxpNDl?o8X#w!(C6kRY9zAAOp#3Lc`$p6
z$dK~|`3&aPV~VpYfLHd|?F7LJq-cI#;1>xfbM^7ABQ1gpP`B3khnd9$_5`h@5dWBW
z!8*o#%E3*-9J<-+ux=W}=?Xlqx7JYZc;7jbO-cC;f;y{(y1G@fL}4;#sW#8#DO<C6
zLjz?nAVgP{G}Prki`myz=c}l=BC`3N4n{?b(`$W*C0vPu+ZamaY|dwL8=Y2*OA2$|
zbINhM5`*_zj!R-BrLBYic2J;78;k6*k{DS~gfCsn?Qm@m#hGSmwj>=UJx<OkFS)oB
z2eq805QBic7sS>$SQOU!MU1R?FJUegKiN_-AAS={$cBrw1$(@G^E~HbT!B9p{vyQG
zlk858_YKP>Mwrb8oWeGaZUSzQOEhcuzN)s4a(*QZ60<o&j<QL#kW)%!L86Ho1F;2O
zi3Bu1c9<e#h@^veol9BQSC#O|(oB?n>!8+EXr8WFcsN_)!-_Y^$JBh`Ofjz!g!OR7
zGZlr5JQ2__t?Ddr6e!2k-{+5h%1IWkCKmjOnr2<-MKUS8{ax0Xk(U_<mnUgKO)sQ2
z#ZtDCIFfvfh)5EL0iPd=z!%HRMcFa(lhTj)NLtEZ$Sv34A3wN$G&gsTkH^qGn#S%G
zJn$%OtAVy)v2AQ^cfd576|vBr3W~~UDculVynQ0b+a7v-E!~II;+h{WjD0wbMvhms
zk+MX$NSU6x&Bdm~nR;5dkJSzrYI5w4wDG*P1s^~B&9G`R3HVhcwLQVdP*^hu9hq*R
zrAzWjS+|*!GN_160ro93Ar}N^*ee~wbvO}^AS=!)h20#9-Tno>q|?Q-^}^Ef)VgZB
z@}XW86{4Uky$R!~FAQ{|<*r{t;#5QDI-KGLVU@mK(|+`Edd1j&$v_g_&!!%mmJ^ap
zmRs8Tg+yPAht{0NBWazj%F@rB95U^0Cr|m^8>_}rGuH4q?yxZmWh{{@JHw7yblmTE
z#^X90TcAFJykg2nORS#0=hkCQHbzriEb0Eas=W2(?;fMr4X=C+eDIK>!hT3W--LKM
zEw!g!+jwzxC8U`+yCS4H)ep)`2XuXvibyPcAB1o@x7?<ygVi-fw(fIX#UYSVWt2=K
z!HDZPz2Kw3!RY6>wA+-@!dm9Y-X$^@*}tbaVo=!@ISoR@!3uw>T6Gcu8sJ#2PxvDT
zym*TYhGG8gL;W;}e5F&usZ)-J<!2*^b)rDVDeR~=GR$;I+{%^?fPP>yCNG##<BJkG
z{^++VJPQ+S2z%0JEL>tqM_W(M)`N(c>(b!#F&3~WVqg_YUhC4(IF!*jbO5RBPszDl
zCgI(@I5IMnK#Db74G=T_8l$R(zB1cbblc0Z*yi96J{h&xtTeD_Aj8pMf1E$-E`zDY
z+8}-hfmt^(I*WxmjwlvCHODuh8tWQ~Yw`p3$C5|BEp0OGVgIEmi)>v^kerL_wSrXK
z(fb<}Ir9g$n?xhBl2HyH9A6$NemN8KN-S#)3kiI*Z`KOReKkfq0mrN@M!Y4QUam-3
zw6JX)64c{$_8gq4<6qXuf(}RzDSpb`)5U_Ywj(u~jb8AMzT;Uw^?rx*XtXi2QO&SF
zmKe;Z?MZo?-;vTVX3A_B>}cc)%c`yfr#j&?&cYoC3a-t0pJZ~9I!(>sLm6zx%ugLT
zoq9?K>l{;Q%u6Plx+0+m#caG)?q3dF*53>7l==!z1kA+f>vK|m>nI2QZ+3N-^Mz5>
z+?Lhz_;Vn&Vk(u$batJ%YxKq&3enV&e!qzNdxL)<9w05)`2}iB0?fbwZa{j>D;+u+
zc!}JLkMM%SCSpO|eP#uHb)L=W?r?a4;_#uJJt};YA~NO+ML*uFKZzbBAjl14v5dOJ
z=gkZ7SD)unaW&N@q79J;Vm>J&OP9M)9?}gZ9@gr9K)Q1J$P)F8;S`-jh9l3O`i?}Q
zAM!1HY0N>^VLG7yJ8G$6qp~mR$59Md6Hc1D+f-KGV1;RPJ*gdy!{W)$H9QBi=xO~5
zQml-UZ$%=%%+EThtdzHUKfd)~4qR6`AWLRa`G7n?rfX-%)^iBp(DLqw?xS4`d*K}V
zVl1L%viY%2dRAqS87@(V-Fih%kYXC&-2^SAO^Px-!j){uI9(aa2owgDwn<459^9;@
z^+AicRGK7FnyB=>UZ1hCjEa}aXnBc}R+`T4GlvLCgPC8?cKX<fptUTGHA9Qm<J0Hg
zfjkbFkyM34qaO$U;)fox67P@hmC?+rv*VQ2X-s{666put9ngyD(7x;Yto42sdHVn-
z4u#XYj`I!FN}&i4{h=fOAJUHl2IMHwf_@?P1mG_sQ6n0}wv4%p#v`TIjp9hV{(brS
zPK&Rvhi(<2Kho|(@zur*#~&gSe!vRMFM^D3f5Kfbsly7%WQGSa%KJU`A%c?!p0#aU
z58s<A{i8E?lYD`hENZu~@#yQ7f|UDyrd-;E&`|01xlLfGQ<dVLzZ4Eb@;}`JlUf>o
z?f-f?nRM*qhIm1Mggh1Tj>f)67UYzO0KF)oE#a;3_BUwGEvV*|>-wMo4UQra)y#HE
zO7m5!7%v@WIcIaqzv#ykXI)$@^j=Q?hu-vLKnmt!z1*BT?tp9dhYhofT<GRYC0E*J
zC|n9(?6Bu_J6#QV_Q&rDVe@*+$?K6ANLJN^aWQ=G#W}pC#B*(A*rYPq*tv*<(QbwB
z1;AJHZLw0iJ=LP9gE@eqh$YaUvW8P0iXlTVlFzHkc((?@!+eZEwYm}KtuM+EdlhNX
zTk`#Dnb$PF)Naq`%!p(=kzZZ3$$6m?LWavlflui-R7Upvd4>t(>v}GXWE_QGdF<8&
zYu-ItCz$P)c{SA);qvwW=6Hc4$uTkTHjwmi4*N*3@R+n7K=0r-$+uKXIL_$wGnk<h
z4K%@5_DungyX-8kZtn)ap^&p_A&S?g2ysxAX*J{E7@;Tbe1$p4a!enYH<_2Ng;Vyt
z`YwM@;>k9FmYzbF(O>pKUxhoKuV%Z5Enijswco=zJN^(|{wPbYx*E<~N0qXaSz_*T
zJvXnyb5X@zad}aaZ+Hi;*mO$SWOpi_Cj2sZPC4umtV5{q90#Iz?+h^I%rpsz$6Ec%
zdkeW>Edv$g&9tP!%i$j#{cwdn=l_Se_ERwYlLBRGLyoHc&Yq+xOK>dW+ZF){o6se$
z^Hmer@Akdrk40N!-*|p#ho7_Kx=dQQ#8InOD^Ww{bvs@2Ah<M3P^n@n(U1Ye&N63M
zBfqv%M=!HrUt4^k?TR?K(az0EIHZmm_=$II%45<Su?D|$km<eMZJFci3-_&HiVgX>
z=2Ib5zP^~7=A$-3-F8rEU3G9m0^V2gm}$IHdW!LGW%4gGAN2T#)Tz}d0{dOeUDXm0
z)%{W*FU_l+8$`9^WAqWL*icmix)W5r7IGBeqsLzr%82_W;tl1*1$ebVSkYJ!yXR%$
z)x@!jfOldD6ohs`ScTwr^X@G@o=Xw6H4yRyk<TW7Y7izhq}aD1o6(+5PYW6jTt?I9
z7QVzSVVs4KRl$~a$<OK!U5=-wHxw4CKBTJ%DEuHur>blaY<DjBN3uU*S4|-+zmv2K
zrJe8o%ABnb2Gp8Q0D6!FgOidlcKHR6jB<@Mj%%fK1|!UjVxRW_aY@<m_OhIdO&(K{
z<?4EI!O>+JTdE4wrX2d%{AN54A)dr{tFL|TdKd>O1C5V1FzyuE;f)xM$)Q*Z2v>sD
z(yy5BnzYXA)bq$r&;>laX-|FcnHSMBdcViE3)k0^zhhWqehl!Qnr}gYnXeEN?|dJ1
ziW~SDz*esBjGQUyBD{OyJGfxsK-Tr?0BKaHD*0FsQ@bE*HFVCpF;8{j)quL_`Oj_P
zNwTv(Ndv-9K`n3xT2T8uAEBGM)eN`35yh!g38m+%Tug4irixe!QWOAU*1I8|!ySb@
zn#+Ak$%E~%Uk}R>M%xtYO=;8Bg^M!Wp(N;=c5fFdP2$h+<u&YoRzcn`7n3)F0Pis4
z$CrW*d^(BCNC?Fd?R97DKY2!xO{sv&5H+-qkG87ns%BF)e6c@r$SokmS(@8tvOpKH
zQZ%`l&!42mfF)wWxr+%C=?Xv5Yy%;otE!V$?^%py@<En9E^HQ`P=1i|Mp@Zle#<I(
zBP{>%ouB428bFpN*TEt@e5ROqIRCYddU@yOC>%N#4wLl-gv-?(a#%wrW?{?)?O!yo
zzd4bdP_Iu}yi^Q#qa7eYEwEAypVhW^fvZ;&Mmxhv;G_!9y6>Le_ww-5NM#%}nO-MI
zMzQZ&A@97<HxS@^8)IX|(&J~&r@oCzjhE%js9j!M?J1gA1+r4er++@xzu$iu#LeJs
ze{<%4&V#xZE+?N3+t;L)3K~b8O{kB9vNvG-Le3Xxpa8xRUF*H#OBezsvC>X<uQg)_
z+(cLHIk0tLa)<<XqV4w0@DZCuNrbqaZM{-QJe@zYWbFqvm5`@8Tg~<k)Vo!7NL$}N
zEIf6Jvz{nPeKFso+*HpEy}^|lbbJ3MEVUg=prJQ04?<ROG11pRpu4vbU|?m+`nEPz
z&>C{y?-`?^e@DpjD3I5DVj#a(!swB7!|-TRPH6qpl{p7-MO_S6;!wZj1JklxvSc9!
zw7f6m6%k?Vw!Owy@tX7({iym8EF))8m{I>jVzGP8tx(saTy@$H8O`uW{7vW|?gRp0
z&hQ}DE{Hy8nY^#NDH#;}6zV@N)Y0DdQ@54igW`$Uzy}p3GgI$T{U<0t-6j<Oa-xuL
zgD4)iOU2BszEoCDTh$k};nfG?jFJAQ($_Wz@bYRr?S3zB=@^l^eP>QZe~8mH(>>rw
za?%aBhi)+&FPnHcuABZy2vNevd94rL9`c(Y2KJ|-z(ik89EWv$FjGC^Q-Cf-ElVvj
zCMGm5FE2U<2FgJT3kI?-JoU;lIqaRlE&94<Gv-E{gJ50px_IM2M`xF>xspyb3Ms$o
zptPK@RwjS{gC_CaDD&*$(Pl7B0p&*_y9Ky-CxW{EhH_tCquEY#M~5qg?@DHX!AI|l
z-Rmr-?SUS0W4P1oMI>SR6{Eu_oO7kjzNS`f%_XjGWnwN>R2Y@c@h&(SWhJ|VK<?Pl
zu1<zchiYWW2C@S>)ms@&tKqohF9^JM>gRC>AF4_Rt_RM<?oMr|zUc`@5ip}6#k9f)
z<!h7X-ASzyVT4UTd2w<5$jK!mpkyRN<tNpcAEvQVdCTjqs2N9Fg1z{fVOlPsCq|0w
z+m!>!DFn^1OLcjfq@Ex2cSVcy;irTBMet3#AIJKJ%_(vk+Fv&nBN<c0ca`Qp=IBl2
zdK_-eIn<UHt4Iv3)qe;jzar|N1o0cCw83+rAeIbGNT|DEP(X5ZFL&X*Cdd{Y-8HDW
zbAeVJKXte~7ZbZH4L-2va$rEZrT58Y92OA<*ws1aIf5_7iC)J*+vmUK2moIetrTeB
zzY_ihmwj~=KU$$YPhRs7qr>T68n%No@=u0*P8jobILV)ak*|1tf}y-&ynW8QU_8Ko
zC@3fa;*pqL(+M0UAL52#IY0WFvb=GrOOdat`|K@LavmOW-Wh;NMADG-4*Ey|d!+-0
zC)87PzMi+A|7XPTzI`t5eiVx6Bgv?GKny>0clR=4gAHl6VWe`-MA+uy{j#;kX%aux
zKJZn4C{W~sa->Xj7QR4VPH7b>Doizj9j-h(YD6DCJcic(wQ=^MK)1wfBnGx98eKZH
z$3uw8d5*xj$^pupH6;G=+#pw4@WW@G1o1w4+`*7(j2JlY8isH;S65*P!lrz`D{dMI
zfiTB57}0hhWL@1rY@2;vyy=XA5mFv_-_r><dfDMO_!_tMp21^h!J-)4cV$hK@x?{Y
zUt}80YtZLh5me(ibPp{R3#%1BC_F+Zm5@bJ&SY@MS%pCkTPhY$(&7{j9$HovV!GC2
zq|P_J@wz*EgQv&ejPRjneF@4+RKsV9m|&{o<x`w%sKag>)DP!zN{f{Eh&Om0La`=a
zH3cV8Vz$>;vck+H4J2I-B``nW!kAO?lB^QMWqKiw3<mzNTSaXZ%!Q}Z+>&@l-T&sl
z6Y<;E2aZ?rRxzACV1Mli3&k*5NW%Q#<|x!;AjaruzG8p5{zxqcS+T?v3U0h|V3ZPb
zD@E_o@wk(r9Qefg^zkgJ!Tp`MSn-r*tq&=xv+Q7Va@hVNd^P-85ECc7jb<a>eG<EA
zCQr;_UH3;@Ehv}%O#begr$l>Z7Y}p`ZvtJ>mV7`r_%6i@o(w)OWc#*Obd~`su>`fz
z{xKr^=tpE7M1r1OgpqR@5e#$}E;%(VT&r-gG?*%dpiQlm*s*lPoRVhf(u;vODQ|p)
zWuAg5BQBC7D=|@V%x~7w*NKQ8rQb@#+#GS>&`dUukKgH8;=0*t2l!r4Q!$nWRni2}
zWxIq$hhV6mEQW4FIHeaFzRyc`H)PGwUEP01S>p0=;P&J8!`#8t-{+!(Ya{YSYPmh@
z12fx9=F6-nrIHmk6hs|1TR6`_mj(`o3$Y$v$87i$l-6Vi;0YEzKFevj44ZHJEm`?m
zRM3>EXE{y(J<wT-#~XTO0TdN1L#}n#JC=b{9BVxDAU{~H(K9mgW{H}+`qDaNevNW7
z6r+Q<q8cJ($uUe?MsjuhX3^t)mR!jAxkEB>>@tmfWZ(KT<zNvls%_%M48A7e-oLvn
zei8|H?!R#rUjlTD_mjU%GQQK0NxZCdG1~_F(gs>jjJ{7#Pup5rTHmQvio`w#2M13P
zk~O%+x#Us(wTBMOI;1?pT<Ou!(Sdh&zq2lNS~E+9QhFcaVg@r@Juw#qO!`QsEPER3
z>3HE%B1g!=%A!>6*d170oMRsg8w?EXEM<TS%`+L~XC-9kcpYZ7fugtanPl(SD1)ML
zr0yDg(`<t%t)ThlfJ8x&3+l&v%VSP4qxk}9i_M(i=_#zW<vNk&A&cI^Vi7{FSF!vK
zSgW?P4o-Ffx57|iF+*ZO>zHr6>O}|UP1U|E_4ITQKtxMsvCw8kAU1|up#^_IgF!}9
zJTb@U;ip2?Z=m5?@g!xLC9)#XXIFzR;SZc-`4ms{W>}U68GY`xUZ{H~k<RV=`~sA<
zfoM_rLWtM;cGZpU0p<?qfvs&nF^CW{HMq1Nnmd&%K1*iXaW&n&LOsyK|IkArtW_MM
zBjkO3w2qR?E*&P2@)l--=^Y*i1o37(?DbpWI|X_aQD1thl-#i}UgWuE_T}LF++6L~
zSQGQGSB`=C=CUqUmLa4th$P|XV-+<b4i4{eX^pFW&!|bNS@>9t_&&QhNnU>SU38~I
z^h|2dWb#D!l7J-TVnQG8=ECPD2%Rk;8(h`SFKl^NGjIo(ZBp&5CBj@~eRZ3LE>@gO
zQs+uF+aKQLKU)Pt*lYsx(BNP1wokMorVc<mpL8S)^l!`&ru3lvKtQpmtFDeCr=+B;
z)T*UO{s9+O#^gtW&tTUI-mn>eS>SV!rB}5h+9$W8nE|C93w1!VuD7)z_{ga-%-JF1
zD6y>>2TLfMG6=>UWlXjc!5jMM#__Wk)gol?j;%l_m)^I>rCi{AhYk4Jca_gbL;~NM
zo6`b@w*MlL>yko5Wz;MPR0rutL`Fhkja!#{_4F0^2Kl>A88KPpa#k;}R%ZuV!=t`U
zlHpui*nAX^-7FuFYP|$vdy&7<B7;hit0~AjU9v{g%%Qr1#MnAML0edF4Tp@ZPX~QB
zu+AUcMUWC7y~*vatFJ0;)xt?M7QwCk#sWtV?S@R9Dd_wr_iJ)WymQmjNMX&llp@aP
zJ~Oc^vR`DMB4T7LEJ=o=%I<Z$TkV{VhZUb0^c@68NKo6qs4Sb)_TXHv8g6(Q(;e|`
z7X866V0wTry06fidi)2%U)btHwZH1v)-*pkJor+U>BZ2H$SUJ+OB;CF45>q#AN~TN
z9OPlE`}%L_xVD{=!r#dhd_Ul<^qf%!B`s6)HzH&cjfqvgeuj)he=IZ=llitF1|4qv
z_MPk#eVaN9)lif2BdR4@UGid)L(i8Sq#mi};xKA3v|HxMFU()dLznKiM$SK4CVf%1
z6K>Y4jziq;^CLrjY$k2lB5QnGdQn#kw4<|A`kz4TsSTD19{(R;^X1j+0P441GNu4H
z)gdtshSM*qiXUfC?K>`Tm+KsDC=`cN4%ycXWGo6;Qd&6XT69md3!dwX#EdjboZ0y+
zlg%r0xzE@XJCcF*b&jN$RpK!EzmcL}QC`_E#AEIPY@%SipaVL9wmR!*a)P>=zzb4e
zQd~deUsn=bZu|L_J5Jje^cVO4xS0R$4%4ND$UxSoRc^)q&r0{FU*My9z`RTjJf(Gl
ze~`cb+paT*ieEYK3aJaHKfm}-`A-f}FqE-kBjoA+A2a|+<ZTaOe&CjT)6PC2>aKRf
zcXz;QhWPd~88RvbF?8j-2$DdmAi$?PeHiq3`0g7xr~6Wrfv}ELG04}_$UpK>-{CN&
z#<3!;?Om(#tGc>sEKIU5_=1jB%Dmh&4+YlLTE5*@K9`^BJ+5q2x7TN}w@r9~w=k0$
zLPmW;VS>1e{L~h;&Zyiz0gL^bwE8V<fi0*NXM^Is_Z`)lId4>p;0din=dUtDNH<If
zieTO{zDzvu2dj4hbzeVoZk5$2J3B@HstWwrF+QXmth<6152b|R3W{cOk+r2IHPGz`
zFGO^7bXRCKRcj|*p3@^;QP{IN0%UTClPDV}XNBWf@n3BLS1?Nne#MQ}>3BU#2^9pg
z(CB%kUJGVV%IEz2Hqv-}+IG91caqTga;Zc-t~A<d>02HCyCJ}FBww&a`fH3b(2;jL
zJyH{?K?Lk*#$ckH%O*Ns6b^WAy*#YD7k{T3E<m++!2jJJE3DUO-OKd6#jCKY1Q1tO
zS5q4cMBcZj(NF~574ysDE}*9-P3<r0O8n>B*EYI7P67h6WEFFC<&G!jK5nG2u(K4t
z{Uo<;^7dpT;Hd2HJ{S%V8;bncikQV=fmjKB1z9cKTl8TgRV)p;QV%man#7+Run>3;
zSfBUMb9dIYO%l$3ySbcWyIt<#X0Kwx$B4SVv1w#as`Q}sw~7`$VLeP&J<SgBaRO|`
zUtLW-EzJk3UW|+^XcldS?4;`J#?U^P=4ti~RSgxeb4ZcW`d}po*985okY73t{B%dG
z8_*2{?zSr2YisC*@PhiFBgj(_5o_;VY|<IqFU?^GJP36LR|^a;HU0hhm%@K*r4<4!
zC=DS1+HcAIF8F`pSM`xX7@qWc`q~lXZmd;+NvbMp+XoBQNQ4l~6Mx6=P0Y7wMo^-W
zc{8WDh<{!$l=R+EM3Wq9(-ho62TF*(c?_Q7=XXmhaY%f5J|mxbvlovI5T@3ba57IS
z(x3BO2ap8#m(`85R%q+sDqx61-a+d{eB$D{G52#5Q0QPINa@GQs|qZrj;~<9zW7;t
zYJ3~?`(-o{p9Z!gx(^1yoi0I#kRPL;nlGwQHa9mh_Ti%_Dl#suA=lPvFnOGXMoHDV
z5PTUJ*z$i`hYv4Mr^!x=D1Prh!o0qU>8wZZXzfXiDSr0eqYCp!=*fMN*es7LAAckM
z8ILCuXa%XA+V7V3v+>ie$aNU{x}xr#m&O&qc$CK0c^N<J&hu3>mUjEc-&SUgyofkt
zW$m=v2$q0SBCKKD5*-Vd-)0C9=>JmT@z5vB%+8B7GB!PVa~3OjowR{`=DC(@p{Wmd
zy7rXQ$R;J)#D~)H6bsVN5V+;Pu-~{;VjK2xv0i^U<n9%7QBPly6g7WpIrGwM-E)xj
zd0=Ji=kz-lIbL4C<rKTFqkn7@wd`>troS=l&3*F-ShHWo@=n7d@jFm<IYAwo<$tLE
z7#C7n*J!N|H>$XYg=K8C00L%jxYF?K4ghrg4~IOyw^1+Otd1_nR%EnktkQDc|1-;g
z#jJ@1k(Hx|W#cypw#zZ0S0Yo>)95MLk1nk*p&-+z8o@gaz)Uft_+0@1R1F&;(R1fU
z?1q<Hfmm-{7LsyNXtJ2<aMK`*>4&|0hEr<4l;S2220{P5<xYTS<%JIlt3OOkMign#
zbZ$~dIp4G`&#90*<%!N+>GOqJv0EQ#{nTUO=x)GWa2nmDc7!=+!~&=gp?Y`31?5XL
ziQ6^621m!q(RbHz=X$Yi;A{O9#CaXA#~_{$ARQe&(1CyP3fX(zS7V-Zzi+4_iodWI
z$Hbj`)@HVVw0~zbF73O-Ugd$ivelb)%EhyYVaudixTh&=g1>P0))z<-?JZ-uT6|5Q
z;sX<|v*+&JD`N%_{9}sYpV)(w#AY0Ez{A=PQj7~XO~=H@hfCl&QV>P(A)c{U(f_=0
zi?@BVf*8I>3>;UyfJ7aAEBQ<F(zI6!^{l?^%1#`xa&lrtlHed{J1@@9Q{YKGBTofn
zQypsRr!DYL+e@!O;`EZ$i|-b5MOe<Vj>y6@^KxbzTiYH@I+LrD%#1X7_7!qrVqq2>
z1P-YxN|o9u0VwbQFdNOh53;iO?npNSD@4l#FPBSGi@w$5SuHUK6{jmRxW2a0%nX4X
zd@Oi9<p+t>c6;j}kFlv355)ATSjB-S4a|E3^{lN!5xx$|)b%e6RTbojE*yQ;VV7~8
z1UTURDrU^}b~OSOoKcm#T#Ga4oLJ~D7^S#fHS!A&EyfGIJHT(*Z8#O(*LOI+4C@i*
zDK42B7*(=I@FqF*w-&@(J0p!^xHmST0HP18zVtO3G<~#lYLIg(I2owFC%Pl>1n5AJ
zbB_Z4f+qG=U1j|TGQiW-MLf}SH1M$Fz6)4X<!gQI$`)QiPoB5HU(MKT<WAzQVIY8J
zKA{(bgVL<<l_ZPDlf+9Lb9awot7&gsQq<j^Z51~%QiD=#SIjsjGb(Wa+C+F<IZbE9
z*y>uO)nV60ZgtuoWeW5x3D}N*b2-_ByqEP7#N~a^Jl|B`+X)iAm<-RC!Rt*>RoAdU
z-n2^M{`d~DpGaVu)SLxn!EUrq$X}=RR?2{H+L=8o-7-q>xgq~TGN!TL-seHt=jV=P
zDNM`O%YE9jqp2N*zKvD5J3_<$(2mD8dnh3LMOCA<0K@ORGAp;;<Hf+=m#?mob=Ph^
zY6I9tdjT>p1~|BjW@Kwe2tHyA0IU^mB{aO9NA<F!UT%BmfZ$W<r~yk@FF$oY=UIQG
z5nx`y*m$|k1<vj<3}ndZ+;OZ%95s3Y7=51CxmH`tS<s2l8(ORMgamJTLx7v+m|Io8
z&qKiPJ!>>oMXC4%u?A1iBNtcZd&bqZAIMZWdH-@c{#t7AB*3caLFRz~tA-=yQ-OEI
zjJ0k?bUJ5N^b2}btbx~tj!AVD{YP`VzVB=SBh#b8gJ~<;CYP5@Ku&)^{Y6jqn7sfd
z5pXdSkly|vn`gFZ<Fils;^yP?jdYpOhYz%JW+2N+0Gua^GyvubqS<@f_`egp_zH|A
zdO83G_yZ%k13k9feVP2OC_5Ok9@`8evVl__xE)WWLoO8;(HqEuFRX&N{=f>+?-{y2
zH}xL0%ywh1hil6?cefDyJ>JJiKXP*VkqSHwm0j2x+&Q$~vx|~g?`<_raQ3&XpDX!{
zr1P3cK;FN3+4Axk(n0Fw^d0MQR0g(B&SDl9u#>g!)`01Yl6QR_PZfB~ZPn;V*<8r6
z8H1ivxZ_(bd0V84y^8#-X#Qs_21FarF+JMmsa2A#kI|1?HL?6C{+nO3fc=dAYzl6S
zy_{q01MBlU*zMKm_TD2($C)j-FP@h&K35uo_%L>Y+C173r6Xt;FYWgZPfLww;aN#X
zp@2xH&}SsYzKINjh}X;;))XPM`@rAxb*C2!71^g7fs?(zbd@CZs!Knu66!0Cg1$f*
z(OK9V{>&+g=v<eep+jVO%?GK-`uAgNDbK)xt&qr+t*3*%Ed&3TO5os`4@;#Sy+rM(
zQ2O=iYBvbD@^YN$=m`|@*-Y#}e|`a-^$rMJKylL(gl{|z#)iMskBtSL67`0_?`>T>
zD-OW;|IBpU>f4Auds;q=2?h1S07_Z006TkGVMu;gsy-t~Pa+xZOqc}EYc;{)W*8xQ
z2-9WqH@yZZA6DpZb_VauE>Z+JQ5AI)scp_GfeFt9%1@T`WY(`kDCVn5xE*%`p(+@9
zCtivfdpkV!wMFmApL>h5qU|3;v%`ybwCdEXfxE>;TRj~Q_dpPm4~KxGE5qlytgAAE
zMq0qwz}92CoN2YAfWU)6c9h_Yq98`c`L*Wt$zh}*C@b+|=lN2drw=~OWb@ME={i&Z
zPY~46znx*OCB_OUEUxN(d9D(~6MUKw#1OodW$cI2N<jtvWS!{qx5SG&!^AmG1^3eT
z+W8_#@NNkREd0vlcP->|#d|BMo1KC|lVw2gmvVlsBmvPRN*q-!QzcKWznnzFOxUmt
z!^*|?@`keM8EL(mbceb_*&_t;3^LYpE$04w<&OqF4=NW=U$M5FdpNf`Tt?nG+OQBV
zV=*&N;rVYLwKK2Zix=l<K^AoE$!@`bG&OweK9cBrow~H1k5&z2`@alq@f%!gYOgn-
zKjs^4s{1@_`155=udF|HQ*PyVu;9y+keLhId!u9v=5pB&U#hk|RwR}1D*td5#I65q
z?`OpzvOKati19`xHEt`J$mghiKf$sb^Q@0|y^a!qh9wROPm<o=TaaTl1X4Rf67+xY
z(iLb&_LqPz?&+Ck0s*9+hB}-`zGnNKhHL^G{9Pp)@=vDt*a**jHsZcC$zLq2Go@zC
zW%yn003VP#Mzb(3CM0$N?*2bV04Jht7m|t!g|>{wjud_%ECHgI0duqFM<D4GWDQnQ
zO9^}Qi`YR#e+&>y@LUr=q3>|^rUqF2a--Y2gSU>UC$nyBZSFIdB7k}}kG9sP&HHU~
zhBS~C&6qFI%GGGj(ndP}x2qnYEz*frUazXHP=>NN1RM5)eK<hsanfk#a-(-|+#sT9
zXSdGHUV35rfuCE@awe@7KKmsJnAPZ~^|Wd)fCG=<TVr1(HL=~A(f&m$7FI0LtFf@J
zDfR2uBvR}T`SV#nD6R&>!>JF->v~W234Iy+Ds&o+C04ZQ20dkZo;-So>?1h&Z<9T?
z_tzJ_uf<v)c|mGVp|O5C_)7~!@G7+=qAuxkx#ak$q|Gez=>F2yP_amuYxnuFMB&-M
z!^Df^H%<`w4(E&O9%oAV8F2|8xo2OKJ`bS8qK8snTibW8T>^%dZrzrQ1!mJ6_Kdsh
zG{T1P*==d6oZ%xxW699_`-@yAvF-V3y4|+abu%y*FVT5(@TfS&OE-9mZE4TdWoSH{
z+*_tsCNcdtW7`<ow_M|v?t#%SAmgXV;@vzVUd<3ZPKqt4_-E^dVn7I1W$#`#LCl8t
z>1X^|HcA+gh`Fx616lA;SbPsLk8Fo5Bxna2B}9&lY>mvTWn&ZRJFtN+cu9}qe?bYd
z#b2AFrC;wMCL$q0ie%>J#=&CLk5qiR5+pG1cr@QK2hHF04Q1T}fr>ACVI#IAzP3Z<
zb&er*(s<<b+Cg=OBhhOl;<8hmi$o`HBmoP4d#o32XIzAjkIg2+R<-0c{q1iCNENc9
z-^8|3gBtJn+7oKXzkX*JLmIg5HLbg)8>Fij@3qQhGS_RejzlW3JW5N+Qq<vUy#Tgj
z&mK((crpvH^5Mu<ATaZ<V4i^hL5@Be8a@j;4*=9dwwhYWn4#$Xu|D9cs_Y<ARGlr!
z_^|&pc0|coIQ{@@E%V)aVDkaHIP%-kfz(q0W(tT3S|q{mg6)@+JHU#K>=<{yky4Kq
zOmv3Q41HA|{l|~P7_pT!La@{?#CKko%LoTReSf<4Gh6S%aNU>*pTj2LuD>s470X4_
z)ID&9vhK0(TDA4+`9)S=QJhCH;%B?U@|LHiKuel&YrzFw;kdzXuQsZa2Zf1Pm(sy+
z6g)W%le`+zoaAX-&kfyDe9G>?E$(<Z+Vb6Sr}o=k*&qlF6<aQ{@BNxmCAN`&7OsNi
zD=+7J3xC1;a-*@8NIKEa*zux4GM*8$aj$X~Zek#SEZf*G9(FoQG$z-Iy*JRGXZvCe
zpl!eO1`KqZ@NS(otc5Z9`q<0GWW<Ktat?6%%@IXsKdt*?Y&`J$GiN=o3lbJ1-u6d3
zPxM|7x%V~t^;sKhEEqpcZg~2)Ug=S8tr=W<)XA3B>-kAO_SKAA;DvKWkojI5fp34l
zx~Ngi3hw}JmZ20E?0CCTgFuRIeH$JthON&xkAOFdis6qpeJQ>}r5?K*r_srkgeQ0<
z17cZATmmQ@2XY(Fg|YpTFGET`UShcXA-e@u^zowc)*|VxexLz^x#dxJ!mx$26+FS0
zlouu4=62*3#CQF#`#c|x=Ya88yMUGY3%-jHawRWBi6s(wQ|m3KsCUN^2KPmhy%&a$
zBaZunAmFoq9V1T~=GNB4y8)u8yMDawo0|v4>)xia84^I|)IuwI$3326Z}xp}@O&z!
zjsZH#W7WUVf<74TS%}QYW`&T*0l=~i3J-THtKfUCY4pcFuNDL7i9m)=07gG1+?GO|
zH0;RmTa^pWb#JQnZCgR~4bXM$z{GQ6cKEa8I==rC5y+|adBKkc)ImAX_t@@X&-Wy5
zAJMnQr9z!BxZIn|2`cr_$iB8fIJwxp11$j;C*1od{C=hYda}=A!>_OaksVv?EE@bc
z8#h5jk)R-=F#r2_q`vl^XUBsk*$Y?yqs*!02Hy4iIRi9<7o829Y)`OzC~EJg=fW{c
zIi@X~NP{@QPimvMn>u#Uzpif!-GQGnp&!ne<LYgq*s4!6N2|wr!I}L7)Bo~fZHg9c
zw05Ecorr%5?TmMhlzvl5Zepx|AE@hM@zQVhb;a+tR%7dUYt2#Y5zEihUZ)jkP-(r=
z)s&hMe~Rp^{G6SU8LhK?xrLc!ss96C@F^aAHA=^(SgWIj#xZK$$TA2}TKsv--XAFb
zyoiUESi4N<NMSclLmM~Lcb}S?7W?(65s<!7O-r~zD?^{Sj&mZ;^?vLm4!@6$)6#bT
z#fum;-Qi8*_kc$f&A7aP7JGM7a1%JgSvdftFO+nwc`5k4?0`c_M@W77n4yJ{jw|Mw
zX2^E#fzYidUZOqw-8^oFmtAb-VRwP?j(die0`Q3t1H5T|ckcd;n+tv?3+*S?9k<pS
zoZQ?)G}r)Fus88j07Ytrla14we@!eZCZ^w7|0?a#$LVBc`a!_bpTVF#V;*p_R4bY6
zdo|?ad_sBZh?$ok4M@M%(xjSyH6H$jZ75#ayBI%xFp|nn8nce@JQ-HT*<8b=uAyK9
z_`&il&T{iIui={^!RAS&k!20n0+rKZ$q&=3uYm0Aqyv*6j?$D;l15Ie$4GKpWx?Y5
z5N8%<+a!}jbq-=xAA|_^)A=v+^bKN?Fu~5g1=~;eSB}R(N6TgHEt8IC)7CR0K{U$x
z!fs1U-gWbwo}H7Hf&gA>w5bo=+T0TlLVB9vW=+I|b8e_>Bw7>e2{0O-hn{Eo(|{X}
zKG`19i|#Nw1*kq*FSp})<yMeG>^#J9ftw$P0BH4Qd(K?n)5oqdtWoF8OX}zq<@Vwp
z+u1a0?lWS?rJ+B5%CM8^wb#?|h_OGwrW^%7q12*y)OCUyR3{$H<Wo`IE2fqnZjtRd
z&rwtua*0n{t0pd)MPa7zMF^lo`^l)0rf_N<UNcn+1l}KD&#*&7>-pw52$?!-KC*(E
z62~qWK@STB&C(at(ufi{l_(yErNwp82RZm0Hw7R(YXlf@WJL%YP<VQJ+Hdf3WAL)?
zz45q?6kbLbS;mCUs=8wzb5;C=KXC6Z@Oi~S7c}MwVp2^e+S}mC9KRal76_i(=v(^U
z5mojVNEdJ@{K`n|=q(l*kkhK?y0UV9KUv)LaEz>r@dy_Z+@tdP+FH%TqK&bW2l@^Q
z*=EG9t+!#4i1ONZp|WV>^wNoQ?{62Tr*WL{(@y&esTGtk#i8-=#06TsMZVaRgX(VO
zO=~Jz1eaYlrcr$_ZlRncVEpvRE^B8V$h(6ms&u~`CG_8DdA^|YVm3`nZXYjX{ZJ;u
zjm`vR@5D;!C&I2`F(~w6ja#aCX2QkSn@W81NDtF7Qa*d&JDc`qdOkk3igM&$zON`|
zEIta?J7^+4v1F$4>7Q<KmEM~^aycE6E(~S)TvogVnBoORNZq=#^&wa?`afP<Jl#e%
zr)5n!dsU%F{0FcML1rQ@M~;i>2QP6lBudD5bzWtnS#A1sE&WYq@zJg3o71Qh)G;i8
z>hi~2ht+gIXZRRFLFJEZ>w|k<pguK2mT+`E&FP%w>bDI!c8+k%n;|mvZZ8$x3j7-C
zLgy5=;PTCuT+>FWo&|E}X)!w^--nHoJ-dBwr@3Nwf18;u<`z`9$icCLyWmQ+_n)6h
ztXX+D3!SyQvH35lXvED)W}>?hqXAMR0GX7!0D!%tO2-UGQ1g1#HQPSn^m4unD{NAp
z;#tmMk!$9)8?9YNmdLCM&QW?@!H?-RkjWpY*ajU86-Sfo?}1YSi)@gnjxDmsWmQQp
z41)Te_#{6rgMv_pTDEjAOvd(R3R?tgCD?SF;2^k?VHcOHTJ+s)KLlHS4DmfM-1*_*
zR=+o{wPrx*fbL~G*YwtJZ$(`XkFi5NVqZebYdCgfBQcip=4o3GFn$MI`PZ?-hQL1I
z`WHI*<7EgDkbp7c(2!F)y#Hd`e?19CekN~z$Fu+BGQb5&#jvT!^Ojw_D}QSFQ-~(A
z@IR`F63YDbj$)`Y8@vE8an%+9pYT;cREm-JtI2uyGGcuqJHO$7aw!ZD>u$z-$ra8Y
zAsY~0H`xAooJUwmF1Ph(P8CWXsgc$(vas)PJE7#t@dcf(;+m`^wwj<$Qu~MkzuW%_
z8NlE-9$4Nhn!sO3DFR8gHmjzB4+pmEn4o^;R~fD(1-fd+4WI}gdw%BPUR_y^RK92-
zie}6d1x~LVW8W+tFDK8xqQU`J6&2j^OLI&R^z`%>mm`b==jRU7!M0r81emWOJslmH
zlarGHz;HBbcUyXrPXzfFY9p-77_w7J<M{5Hphj9=q2-2E<m`y0#hG^dmW0ha+<&B0
zA_Mjn%D!u6P?0L>z?#bc?Ccb}zP={wR?*>JT%P6N;E*UAWZk4)zqOF_1DfVyv*D~>
z2U;NCHnnTxv>Z4*LjA1+r8mEHB1Fs`E|H^-EHr6nZC#eMtuD@^qn#EM`|qM=2-)!F
zwJh;UK=Xzrq#F}N*#gSx&vH8|Yb{wdF6??M2T?<TpFKE_Fg~M=zYStB9$fe7ps{OF
zROc<RA^7^SYQ|B_6RF)UrK`0+CLmOZd@c~2Br<*RujqakTD=3y5SNyTa^a6b{*@T}
zWlYpy0nmmNY%xRpe)@MvK8p>`da<h;DpdY)t$rt8a+JYMQiqcs_;-l?erpLcxI*jl
z&J5k(2<D%9!A%5DH|Pm51OKxbCcosT8Nl82=jq=z9UucvU1?I25ybw_X7vB6um<Aa
zRNwDbFhL}VfD=c`QaptJvl-F9Dl~!G-TrL_zl8xtSVKO&H7bmA;rpM>z!e2o*bg^4
z#Qr}d1x{e0b;}SRc>EUKzs+F(46ZO5BQ^1NChp(y3{Kln{IA0POjrM3DlADNCpR~D
z`U8)^-_}rq0?7wGD<#bRRl*Pr9OkWxIS_zzyHJqHDJj;(UlsEIHZ>av2*NiUuT>>2
ze<hZ8ab>H1sZl5dSqRp`&MszXXz15Ya+Pvvrt0o$5m;W_U$qM*k>q%Gmg8ikrA7EY
z-iCx5B_$^%nn5<a0vieatEDO?h`G<N0z0RtmFpTB`b$-cjU62w#koov>UjA7HoIzW
zSRsh?w6wg!Lh|UhU&-voSMbZgO`3}U8&iF9)C{;b*nozH270eVgMWtLT-YnL;9pDo
zEaR_awa)E$6N(fp9Roe?+kg6O0*Tvg4R!bfnCVK2Oc7iODUmadQvF_O52JI5^N&p*
z;=cCAsW<|-@BU7o|2F0lbMVMMYP!yJ|38Nm_%~?X%?y6#>;K2V4)6j)<keZS8=n8Z
z;O{X4cJ{zS_kUmWze4-}iKR6_1?;%CC+*EY9`hI+4E&kN0|;V-t`H}(Yt4UolZ)z*
z$+->>8<UgB2n7Y#nK4A~&5*n1Cg>QkuB)F2kdO=Q|Fb*@r6M<@{xy6!UcVm1C95tK
z{)`=s&~;W=Sg1K~E<K>a%6hPBmC&fJoa38mYdf_%`-LqyLVa85<$cNn+a+QMy8l7j
zLGa7(A^0nlRRgbiJ{X^TmVS-3^Y>t<g>V}Iz{x8}<P3l1=xfZ<UtDZ#?4{j-W&EKx
z?iKO&*YcCC)x)?jGZT~Ml&#zOc?(Oc7{vJA)0mijEBjc)Olw<9=>q0~HXgzkjz9B2
zRHqeqxNDFCHh#@X0j?ykO07{HN#$hlfX`~b&jNVE<+LTC+vLY@7Xi!g1=esHok3Pb
zQ`5UYFD4xi96ftWbKXrbG8_t6;$zs8Y755?U$^BE+eq~~C>r>`ySWoLFxOy_Z^Igr
z3%@4%GpppB{+b&eX$)V1C0+sv5m#TdyPJxxh1c#zUm5XkJvB{^B9q$>R=e!<!0s$L
zxk_BSy~rX_9m&>!BH@1hx<V=?1x{p;r|UkXFEy#b(aw+9lF(dcS<)qXOGU-e*NJ5u
zd^TCW_icYXzjvPa84Gpmn-4GlIsxjxxH53aFMm-^_^2SFr%%ViGxP{?!r}At9c=+c
zVTNR5L=;*4Cj`^Wt`dsol68%Pt14m$iON#%H-cMGIqN<ZLK?v}{~)v71Sr$xu+Q4p
zg(6RsZEb~<jgR2pe7)M6_UcZAL0lD<lAQvM{Abpr1^YpjLYr@X38V9w^i{yf$8=5#
z3c%=&tfSU$E^@t_<+J8SV@nG!w3k<+DE6R1;vms>jQLfwFzo8{=elGiMAJ0w0<GD!
zE;)4fr1h((^S;!qblJ3lt9;TLa}EFF!&7NXfYz_b`Y#(_33x>shbe3E%2YgPApe9a
z$h&PO_*{P<nD%Q8G(>=W?-JJ{9^WB54J*=1VYe26h|<-Sl_drd`tX3tJo1JJ@nb?Q
zmT$hmXpd2Qd%yMn1=~O*zt%hjkz@fP@$pR{4oKmNz5C*s3+FZHMoiDn#?0(oH1y;*
zrCa^S2p9n)U<8c7mLk9y#rVfE2?EE-Dn`T8?a^>cljN7JLcoM@6(Ig;1dM<Ycr^qt
z^PHB`7_@>fUAdCT-N9YE0}?nOLfBkdyO%V9B5lw%Xj!6W6`C0>kBj)(aspD=Bd?=3
zw4N|c!|Jbt5ikNqzz7(D?Lq+S7}nHZ8XJrLuCD0Q2k+P{onT@!kCWx;%VTEwIUjE>
z0w#o;i?3rh0!CnmAONjn<A(+fZeurZ##86cYOUZzG7CLCFc<^9y~$w=GoO&N@{q_|
z`H2c26F&neCagUjoh3r3v{s0GRyeti&IlL*BVYvT1Oc{QI(=z4E?pmsw&oT&RnwaK
zF0HB8Se3R-5;<hsB-Y|*s~5&ILee7g%?OuRqV<Uhm`(U&LbwT_I!Ys81a=kz3`)#$
zvh~Bot5@Q=^XJoEf)DN69|v~tPU{7^XF<+hwv~hF<!oS2z<X)ZRPL;zaBhr%5ikNq
zpau|NOvIYz+W5_wl0{8tYg?MMoS2!8vB`-<09j_yCP!->ZLNtQvZrpZ9I&wlAA-oF
zCKH{FT02i5&iqLybZxUIT+@5%;ExGm9Tc*&XatPF#t>k=;EdMfy*NA^XGg9?cUwn1
zcIa^ImU$?HRn`dVaN7fGG%&;IVxxL*JF)HM;RG0gtwJDaRn+!Zg8Czi%PVO3V4Dz_
zxHX+TU^A(TSL_ZEz@GNoYYA`7&Bnyctr(U`DdQL8R;!3&mq=lkw24WJD5A(DCu1@9
zFxi=uhT6wBo1Kz9Tg9xukWC2JkDZ@10!Cm5BT#N4dR^N{Ja_&=jOv@Ug2(pmO`15&
zL-U65)dU3uwX3ZdK$%VTAX!bN<Fpuo$|3*-Y!vxJi$YsxUJ71FAC|Q#+_N3?Rb}*a
zCDYrHj+K}DU`r67+#!HCH@l`K7K}*{xdU2WG05_YmgY2>${0GUeRb#LZF^FV*&v3K
z(k8N}F54+JH_9`2sZOIw#MHE}vnx795Zg8B2}$HT@435_2;%nC^(_H*6JKINxQXC8
zY9n9-Y7+qlGlVM!v0+R^FI-3i)+755#QuQ+4N@{6)ipx32{&w3&x~o0%x)M!7nT;R
zB}gUZKSp5ZA%L*lqz~(~re~*PM%otoCWLX?Kf*E}erIwBTcnT6WUZ2Y7;zF`65>mO
zynfsUKEIo9eF*uP+c){B<`GcYvfh45BoA^&9b}2cK24|=Qx&&!*xi1+zCa-P@Eqju
zx*Vk4(pE}Lc%Vs~o}G!|Yu8dG>yQa5PSnsK^4+OP&|=(cDeAZD*lm#S<H&^YK0xv<
zM!*Qv7Xk=a5UbPLPU2;G5oO?c{n2B|aSXy#HEIQO39+vs<~9tHNe;8Lm7(#s5!ew3
z(4^BIsQPB#QMSIhI(|cBa4u#SG$FJk2Urrulj)sI>)J&O=?{9PS?QIAg>}XdwqjM5
zJQO21BSPyx=hqXmB|=J<;<zQDeng%nrzF(RNdrXuOtQ7Lwxo3Q%Of%*fj~O4+24BK
zpCa;~szHEqT+qY>j@PC|<Q_h7AolIvl_ptpUCD{1KIh2+G=4ak!CN<4L+UgHk!_uB
zPEW^_2w_oIqBIFID`z#=llGByhnSh-v<8pcyA%ie^%AJnykqsd(?$PD2$&GMA{YT9
zU<Aq#K#-cy!1KHu$6Oq{mfU1Na_~@cmA$f7u<ZV7JDgu!kN~JbRRbdf=N+^2)s|SN
z#|RjK2SNbh8PbJd%bKf~E?tTn(^E+U*rkc9f$pAkjFu2$h*ssAglPyPLOLW7ryT=5
zy)me5a<cXi=N|<6jNH#5Mc-=;Viw|wm$h9m%GtU3xOi<eE{<MH+MFUCC9lier~Vbw
zLHej35!8LVc16DgchW`QTdkHC2^{~qF9fI;)CaVD7e+^7m$sSM+uxri9PUQQ@-zh3
zA(D(+)Jf_pT0hK8sT+_)w1gA4W@K7=D-lNSXCf4nQ%GY|<9M`>$&^$RA-nb5P=8<a
z%A+Y0rPML%H|;3D^S&}w2RE4z)<GdVi$=f*+#doA7UMEedFthtG_!eA16g-GeDL5M
zWbpoC+P=G(QAN07mNgB&+m{r-*$5bc3L=0I3!$QopT2l8&W&76u^*JD<NY$lLkkF5
zTphT7T!Qiqd3L-hp?OqZA1_O*Qjo(gImePVMMM%0kF3Q)O9RQvT07#SFUi6@*9fGA
zV;qIBFY9&1e_>=KnFyj0giLZL{VIX@7MB*~jam1LsE*6o$YpIsfY5(vP;1Nj`qM;~
zUX+CY{GRl%|I`culpA$rM3WF`_D=2JpS04H|NWF{zK1w6Iiy}Uscuqdsi%Xzw1!A^
z4<eX8B8X_rsqdJX^1<x%yxIx-A0E(hkAdF4lop<aVCHx6yWWEdVZGM?=idkzfrJ19
z4w^y8;F!!@I$PW0qy{oJ(OsD_uVSo{h^8@;1^T$~##E*j(p|-nI%!6rDiFxp4Aw5+
z(1g_s7tSX$IVOEh?%gL-yxoa-Nq$x+1m%^4t6#%f04E&#rHw;KMvKC_u4^K2Bje*S
zdUIUluGqsAv(i2hH10>Eg7c5;*aM;nnL`^x-%_kwoK<{NiDZuJoA(##Xb`b%O3tlX
znwzxFku{AiB87#P2VoqtfB-)#rz31buv?@w6GO~e%L(a9etb~%2tcwRW#=_Hz*ZBK
zE9SxrnhbbQ0+#QmR#P7cdCG%t2qNaCXb`EBn3tkCq;5^=nD&BJ5z|#ZOg<bQ8cJ&!
z(T-=0bc(pn|CkWgc?EFxjerrrIt8Z;3u%8r1f`~?#yG4Q>)l$1P&1@Tc_7Tp&m{p6
zg1e~SdGJgZ{l^Fxfto@9O&h{A0j=Ki7cZm<t6r^>dPoyidt{1-P>WIKnr*!#M5ApX
zAOu6UFc&>2tsdkM@5%Ig9AhDIR`+rrCU=myX7z{kCpf7=!-s%fn4_}3YbO29+CtV_
z56T=BZ6$=Yc)lq;kM<FvenDpKq<Lmmj&P(YL}-T;CSoX|eW15T`@0Ur9ue4f#Yfun
zCliE}8ULwD1gI+)Why$RI)ztmNEqe4(Xv}zzf+B-Zh(Tm2~1>A_xAQLCqDqJVWn<g
zl~#OKV<VFnPoJBPD{4ze_w0?mnoL>NBt_}*6i2=OF(Itil6St1fDu?h04{az>gBY~
zhQX}Av%6UHpgS05Ru4og4_4U$v!jJsPLZ%$Nq3dOShL9~7mU`*#6|_Owc_--%|QSH
zM0qvI?f$$RT%m0_efd&y)-ouK$Vqu@#0)NLIPSNt6Yql77SiXX^;r_0A%~cJCT*d}
zAts<`0w))zrEMw9|HviUJ&ZsbarvmqMt!5dWQ&__3F44bw2NpKStnRLQ{0Hyj%JY;
zLvWj<HH2{XMOO?-yK_k9d{?Ed#LRF+!uz$G6EUbYl1HTh9nf{wlVN(g4EZfd@2<}Y
z;;Q*W-D2(F4H2+&S4XtpU`y;5;bO8Nm)T|~w!D5b8NsAPzciGXR1eEMnMoDQP^s%o
zew+|tJg&Cn5Me^-T3`f>KwTq%P;ql=I=Qk&xIw@g)C@HymuXhBhR{KqnFUFbjlg!l
zf?^G2(@9;0KrVB<<KpUlwV=#(0zw(b`TkYW_-7R$kjo}HX;E3-l+b$m(y%lxqiKEL
zu|0cay)cvn-SrCDswOEw`lu^y(%iMl8Upk9gR=uMB5fUOs4@GSlQxglfb@+`4I+6;
z)1rtW<g8PDBzwYPii+ER&JiD^Ev^01z2$YW{Fr>^^<m@{$04i@!^zB*8`l##gdk$(
zhsVgYe;rP6lE$)GX)2uG5D%SPv0AYT3b2loKpkNWI(PMITDx}yD;rH-thb)77fK}~
zg<Qv|cU`KVC)@TX?e$r$DMTxc3G4G(i;L;=se^~oqyuTK*D=$CaJ@Co&lv$DQ1b{d
zU@-H1RRRc`;d0EZA~W7;P)Nc?Z43{jk{Nu$VrhoIHd3CF>^~bofO^YTD7a+D#s2~(
zebikAX6F&O`Nj+|dD@eJ#AHVjrZ@0jKUz5iiqcYfsjMg$JTzX_whd>b6-4vTI;n%0
zQR1ypA(!t)QjiH6b%%gqDkgWw^f@5SPBI~tiQSa?M#$Uz!lLR?;i(kY{zD>YnCH>Y
z5CiGPloWwH^*vcK*R{1met&vS&+-iBtS6)u+#?4wtZgi`hU3Xh7Q(o<e^(+I9CzrG
z%}|LWeH2G}_gXLXxlKiY$*7AWgBLV;(WA0CI54<UH#YUf_lP{#u{^oURut5ob24eg
zOD}ciC2cLmTEvsu8l#@;jtSvCDpDmb72T}<a!~Y;bzR{qfvMv#0+m95!GeJTfhP-C
z2+qkgiI=>JKvSu7R4SesxqR37me%wzyN@#o20VwIi9pt9vmWM}v^qDYCT03Jo7T=O
zEib0Jki14p*x?)D9f7+?F4)-z4#9}pVPSgf>ql;tSpcQq;TXp(mnEoT+Q!-^%tMcB
ztrP3&Si`p&YnpQ!Qko!EN(UyNn36*J*vbYnh$$&rX!a6pX_A&s_tJ0Xyny0*yUdj|
zl;WdqqIHA-U%7rGu8cEjCubp-Zbj3T#-y3t)!mi0uHarYKxhvMsXmv!(+Q6C&sxNc
zMrFUjn~98Z)mO}#(Y&1;*q6#LkE@k^<AcYR>(}DqQX+rH_v}lP42=CaYdWp%TX3jE
zeXEu<KX@)T_Jj%H#_+rA(=-r-O$O|S(t_}GGo4+j!^`*FH4<Mi0!Cm{5ulCE$y|iB
zEk#=`$W%6^Qe$1egtMtBUpsP$EHn6dLtke58Qk(<xb{;%TWbg)fFqcrIeKyUVsel$
zqk4>BLmg<56A<)0Sx}!<{bs{*G(HH%2=fTr2tb&0A^1ZWd5UKs9eHM5KOHKBK%!2m
zODV|)iZ|mus<m^ML<AxBSSzrf;G2)1NT!smgQ6X0Ek}itbI)jUy10oof9<VJ(NTJW
zw4gEE%zg#=h<D(n^4Q+JiI}pj#bs$t!H3BY%v!0p+=KSJy90+Jo#~r>=bCkmP^43)
ztU6Bem*R%GZf5$^i|gPIctQr5fP6vbm#oV}yNu`CY78p&VoWR*K6QezpUIAwr75I8
z%v$<tO#f!4$%L@N=+Za}p{&?oHJk2mo(_nLmrZzh_3AZ06;955MMr~3g72!kEfA~%
z#6Nc&0%<Tqh?c;^F(LwMW+t>h7LE*RsSVJM+i?-E!5LTXw?r1`Z<0Bfz8!W30xJTH
zNZ#`oF2s46KIM(RS=$9^pxmj`6gwqPJx*g#V=*DgJ$L|Q9nGb&Ye{nmDa7#tW_Z*g
zg#MjK4D(pL6)mECY^4m?dZAHd9sK#ss-5E8V))v%r2S$X?$_R@r}iI64qqTUoXg~E
zE7DxvO3L2{Zl&$zi#k<)<0c)08T}XOK)a15a7d=4Yzu@26%VCMe$ij^xi-<5>TWXq
z7j`^Tt_?@_;u@xnxqg%MTI%OF3F>u4OPv5y>hUvY&x)*HPxbcb(4M4)qmGx?p>@4v
z6CR?xA+Xc|(wF<xG|8X|nY~)an%eFryt|sCG$E`|=}>v7SajelP-T<M(d02po{VGy
zLc?KzW~OhbzfZFey=jKFQ)`u)<!uX%1ha=*IcG(hia|<mRioxOcZ^)4G4Diyph89N
zXm$Vs)N|HUp)FD6PlEtjmP-;gc6ay6tgb7y&D<`kJ<GUgXDtMqP-6;1{;G0Bu67`+
zIDL#WeDLIlMv3yKelo+2bC5pOSu`cB%`J%-at*-;!FgU<LbQr#6X#?Ch#Pjahx3Yy
znf-HDt|q4*%<lKf!3b@GF<_^R17LvwOS=G*)IKO{0Nvo|TL_T)TO1UmT-y2uIbtDt
ztPpMqZ%i-2nz9>{h6`;(yUOZNX?-B;my7fi8)p|O<L~x|1k)BLBfk?<KNVjx3&nFK
zrmWz|RuyOr*>0z(*IGlXNj(Jqo07vC8?L7mBYPotv4)KHfrnGHiUedGiY>n@o%El3
zB0$@r?m`Bi78$&#i6#1?hvcyn@3nan<DQXh<3-G%>DN-FQeIL&so%)!5W;#4CWI9z
zbvhEvcj!`B1b#v8p)Xt;O#=dEA4diTS7uz9#d_)T<+M<|Pp<9v@7^U%L|^jm#pbVc
zOj{A?_?pysX%GkqXcHi^>@h^ZqzG5No$YNUvg*z<0pmYA3V}QbAOJ%GS)+os1;OIX
zmCNyP^T9MLU9B^n<%Pij4VlI3ADSP`t00A}8OyWm<@fuzHW8rjraoSki6QKRNko3L
z_uHYtfuv!|q-S*wsqfsI`g{p;OkA>o^G%IQ)cK|5`FQ#2m85l~P3)5ckA4Zz*<^8r
zK&_6r27ZGZB!TS}a2%B#>?HnHB8Md|cbh2QN4~(6fL4~H{G0J~W=38*_09MSc}eY3
zrjFd(uXcJ^vH_kw`5;WMkknE_ikMUMb^oUX^GaWarjO0Y`P@>uPA~~3r%G%_PW|Sa
zy1ra`kiHP&cvkhB@*hxpVO?gQ<QxbLWs(TOHY1(u56P&;_D0pDUed?VmYzF*Ud~yr
zrLpIvoB>fD;9l)@S55woKzbP`S%+V*!Gv%FC7&AxLfF);8QC9SN}h|DYC0;n(AXlQ
zdC0R+yo$jAuUQPb%tWwBW@p<-GJ`mveRy!MOou?+bOwCNJBalp7tJGq;flEUu&>dG
zW+)LF5en!i8NgT!%<X78=`at;Z7`d|l1B@b>p|boR67C)VYobhNFK(Xc<H4y0Rkz!
zF2N0#)DIs#nD*F8!bNIFRh%QWZDzokt-U@ul>|}DrWU20P{Xg{gga^Xg8)4_{WpRu
zW^<G&^%5cM)PaMExbd6Mnn87)kR5jHl>-IH$}O4RK@8b$Agwdhee8ROa}!Lb_sNuW
zNcU!9$RI&fj4cHXTJvpHb25#2Y6H)nJD1j-F-byRu+YKr5@d{RW@z_}eT>-!Qg_b+
ztqHB{yvPW6vqp1fR$40kM)R6UH)Mr#ypw$cA3Jy`;m<or1A+3qYni1x{3j!jd$A-R
zl}>^s_)^Y^h^I0T5m&vQl9MIm8_Y|w#9~Pg+VYE<v}fWTGQLNX@@!C!Ry<Aat8%Bd
zmS4I_-?{yeZa(A*jT?1=bmAlj>#Zyc=KI&1oLr|fh7S@?mPOOVhthgo{m=6vgQJr-
zQ(8}GohO=G#?xvK<R4j_w60*GJn@^hTd%={aGfPjm8au?B;jKBv=;U=pfaP%2CLl?
zFd<P?u(TO#={=~}S#Zlha9Wze327u4FwSXT6ts(&s2viSM5tp1j81`uxH5C4cdk_6
zd!(Ib2y`;6TR?Ci4hDZb(p}aDo#Wbj4HFg`I0GR8&0uQqI>zNQCM}011|=*XjCOUn
zE9ppg`;QUW83@o$(TMQPx~!S`S+&3BxS<J~r_Y~DUjEWzbJ~&ap>^F)JKRciNE1#$
z*dUr2aQY)G5_U_Vryp>reFP{)J~Qga5q#<AA$P~*g%Y87#TnA8WR>R@^ic%KEEH1I
zr?qRW&tig*b!}*~W*6s^Yj(`?`bWExDHU%2c^4W2Qj^*PaVcT<H#)sa;wpTZyfTi0
z4g1@XUd+WH)QsPZ(~QflYVXZj-$%aE+P##!5I)+fL(4kIA}t>;u2|C0rihadfw<W2
zB@;W^A?BY4M5fU|F`n}wZpK*d!>o?r)|p^f_n%aswcQ0JM0qm7*GFG1d?D?*oREKz
zxiG1RuyY;FEgv>5XKRn6@;-^#HD$u}&FVX;OG!4<d*(Emkk*opUQ6ksyQYqGXbHgX
zzTV{d6301>vLYi*4@wMk9*C2QywYYtT<6xRe`%BhQU#uCRNVz<`kjlTBWc2jF{VxC
z&d0Sk=0PbBh^O>OdahdkfCn05>IQiu&7_?Va(%r96T$~9`CM@rG;XOvv0?1lt0S77
zYK_+(Ihtl_xkiIqDA~N{#>lH^P{aY@d#wi5^CFX&{;-Y%8~DrD=aNl40|<M#VDsK4
zM-h2|$_<%#)(oo4sqw1g;F|$wR{K&hQ-<>Z$RLfF&?O<Dr=vFwQp}LDwt<d`MgmDC
z-F(hzrkH0QJ8~qMBasFNBd`+@KqJm%%?p~~L10V+hs=<kxo|!?++Z??nP>t6U3uHy
zZaf&qXqgB^c-X^aib<yZTAKtx#No)=L;rTC-0y!-1Sneqb#SlNQXv38sPLM^9`)~x
zB}`gUm(fV@*(EbNX3Fv6I5shvgy_6UIGaunN~3}{0PS;2a%5E6f&gJv@l{j1NK&4#
zB2Bad1llx4HaA9>#yuuOi}AV`_eg&xYhc84jam!Xq%oD>+)EqdJj*;<L>B2YSd+##
z+aK`FI|z_bj%l03O*tiN8=WieNVoaV1`#OWE^sc#IFWFbu?j5J*Ma4}R0e2mvC?8K
z?xfliT0|y8uHBqSUQG`T4Hf;S%BzxrdO*2TcSr*cg_xkn0U?3CWLYnXJT|H^=(4uk
zIIlK$K=L4ymR(xLgFg!HAy4<JLr9z4%X{!%OM7Mf%99hkk2;y_CUK?oDPHPq5j*RX
z<)v6edUX7zh@du|7olc6>Cs-4$E6u$tA-p8aaMbv4bz8GPgpvY(ynu~)lTK9UV{nY
z1C%_Kh6+O?!A0~lGCyG!m306|)Oj#d%RrI|liJf=0~HYy70lEy_hEL5J%<>qh=XHP
z^6WdbcUONJfSJWj<}4c2TJ*^cFu#TYig*i`^P2q-xkC#G;Y7IQJS1?R8ZYaNAf2R{
z0Wo({5J+ZDxF2BvB1p$Tr}+nG&cq{!4khy;?&n>+)4>Sr6a;9y0}`;&@Sl?lYCJej
zix8rEJ1_Gh+60?J<B<`ek2aXwdo^G{deC-YdVWdT5c(%3gXn8gBd>-;It?2}Ae)uZ
zccX=(kIp1xJ(1^rJjJ01G|VMa%EN6#X+q(q>JeT^(>l1c)L}Yl2+*42B#rGW5*gBX
zf+m46jJjAIL1UEC0!C;yne1fJ_Mn7oh;44iOoV2wD;gyxN5O?`Fw7NBdJ502?88SK
zXh&#o>87&GuH;+~gTn&aE5(sV%Zzu~BR;Gk0tsgdO(FHs#X-WKvk)T45g#VrA%ca>
zGZAB2D)98Vvxz{RI(Sgp!tN9YWtz*6=++Z5L8JVys((H&WdilG&?2+Es4dmOwC+^(
zlqE&i)%I|XGcHS&i&7vkX}M2UXe>uc^5$LSurwB^jxyPUsWj{SnD}S1XID?L2PyBP
z4`F+b70sB^vrJpia|<G+Ga5g}w6uuH#iUhLedgYMeY>Ph-IL@<(oqY6G9>NDwfGAF
zd)hAL$~ewM59GF9g9+h%mOK>+G6)G`hU7V!l`$Zo6=WSo8jv5bQRD#=Z6UVnH`M4x
zGy^j#p%d~(r@^`e_C`6Y86wCVvpd-&tR)Rb8o8A?Dl-I-2F!qmlK?uo91m+3hD1DZ
zX`N<u)d}$a)LH7Akn*T^_DLA#empJVDHXDcsRcyw$(LW&@mw5MM?j|v9z3_vjxr^{
ze~dsCAi&_pz=<$0D03ZVaPbI;u*j_9^RfzHtrhKwwoAKYP^kuDn1z7e&SH~h(mbMp
z9D)7bbIDZzypwR>2+*%nPZ<xACs6uugqsb9978cA6q*CZHi#c<390{R2bi!-LZT)c
zaW#*3Q|j2DoOJMw5KY<`8}c|q(ui@p>mg&-VVT$-+qW;FwXEM@2ab%bDd=~`qBv2E
zkHrH8E*z)vljm23)nj4>ie}Xt{PRH&ctu&3WS$&Hu_tF|A_GkNT~vRM+=CqT=;6aj
zJ4YNFnFOcSpsgbg91B7~_iM6$sJA~gUB(aU6IyIOX>FrqOB}b*-ma*vv9A3ok<}~e
z(;<ee>&=P?#vtll4op<gN4%(Y@T`~2-s~^m7)xu+(Rz2Zw54|1t_cn_mIUhRk|r={
z>u45Pdr92LqkMKrHpEf}MFvZZYK07@%#jbt?QAbW{*d8QP`=R6VtUV*UJYY;k+7}(
zYeIORcvEp`95k+%<b80rh}9`+_h_^<h&;1;pV8fM8_(0(Fk1;>+kb0UYWUeyhZ$EY
zC<Kqe_>zwKO{c*o)H+PR5fbQ7Xtd09Kwz<nKOl_;>Fm_(DA#!3y<7sPj!E}$Kbp_o
z8r<0o_L4eC1k7hOQ^ne(6WS|@&WN<<L7(^?j6f|Tuu`9u2~4(oX_IP0nDty9yPh-$
zOxhq2GkHQAqwO-$k^}8wI|A*G_KP-Sm(q<;Gjd~G!tefK0*C%#I}+x1RulpHVage@
zmS?#u`hr!FF}^X-piP4`QRipo2h$|swURYSB8Xad4mo5(kq_Dk*0AO!57^hxGBAtd
zU~9(<#=hm$PH~h*V9j4j1Nl=Z{ubj|I<e}{{kEO^y>C_Y{<%#EB$-Eb01fhCd^o7@
zWH}GcxtIiJ-RSZC>O&<{t;h79dX>o_mSt$%9~05+R9m7BQvGtB$zum=d^v}Vg&8sv
zGFXk#r{mjUOwL?z{D<i_p6ZDUdc(V@)5wdbC9mQ*Cz*(f@U^$Ks13{OwB$Q9;3ym*
zM@y4v^m#V@Q4ECw1Z^76@{QFAo{W(tu~s9U8<Bg{OSbS2=_N1VGAzOmw&28hlqopQ
zqKpX%!*o<%e@qDPqr4$jm`vhP>8b`i_6s^DyJ-eT8Wtfp=KF~56}RMPF;ii1XLgk}
zArLt<b1Z;H#f|A2W-WAHgkqs|@qV6zz(HK8^w@T@Pfw3D1(>y{<`>#LrI$vK-}#Ef
zlumF@ZtMuUCrU!VxzUj{TZP7w8LlJRfE4ejn51P5Dh-V19gIM&BS0IYE;AT25K`YU
zonbvL<}+z?Z?#V*Om<87#ae&?oS9PwSK7i>2WFsYkGtd;fk_-(v5!fkiN@cpa;r;Y
z^WIkw|6+alW(zR6-W0;qLK<h#s&s3dN#t;DFqtRQ9*PaZCz2MUAdnq$me!rLj0lyO
zr!htmCwZX05;l9xU`XO!XgFB!$MN0Xne&?x=0A0TK(3F}aR?a8d01j|S_**YFJ4HK
zA7~39jSoT!X`9Gr)VE9qAD2G{;z27#9bBuv<#XkeG3}DIm|(#d1jG<$PfW-Z{vbNj
zWDV^L(gV>$ZtRyViCHWYG{}d@Y2-0|ls3}E7=f<|(lalINlZ9lO3K6{+C!EYF{#5j
zB{<2wq%Wtjnkz^eft6qS9L#4S`e+Bq3)n))59}I<M^q+Q34lv2<ZCl9Hz9l#RB1ez
zTs`^nOUV@TlxEuTrbNTagy~hHxbMq!3{>7UQ0W`9H9oBMOXpQlG22Y*M|8}h|6*Zr
zu_p|T7c(6`X}~RYG<o(bHDH~)-;nRj`D8GM9Oljl_vFutBx6p8CUKWKDuiK770AQ(
z%mUwU?tGsScy$D_z?dg%sQ(BHhlU2z8k13J-!S9J8^L4N!{E7J<ck5AL6iYzYlB*@
z-kD~W)gB?Pkl3sh+1j-DZJU7rlY`VN9G6iyaRdXc%6;}`yfep{$EiG7LVusz1=<Sg
z8zyeWvIUvDO--a_5UnH4nzU?7lPj#jO-mmn6eEODUlTb*bEvSkh@4ZfzV9UHY5XG%
zcoWTzbk-M}pW2BC<o3fvKU%TFl541+&kqkv(>9W{YL97|5HeX-2HXn=dVa_tbr0{=
z^uw<|cB~+krOC#7J<qk3G${^_Y3oO{WQPfVyyjv_HmUvqZ6=eDcrL{PtV8#){TX>+
zVkU<?8s&H)cxe0(GI^fB-+Vn0)>0nIWyy47mHtU%uF{Og6d9hpAUi__F>y!Ji$xuB
zGTZeWm-#qEIz3mVdD@C(nGmjlGK~WDJ^}Ae&t5p62CT;q9Zs|CoTp*r2E*@4h8%Au
zV#LikNGKgqgFY#!!ru{;CIWw{*nF~(u<Fiq-~Il{&yr^v5Vq@(L$o3^E=+}RHh@r&
z_EJm>mJ3g7yd$TjNZs0REx(rExAvVrYXr6)fh+{)cF+3V{hD>%CoMi^+^n^wEfnjk
z(2iW!dW1b`u-WR=(k&pYpuNGQ6^8_QztQA~K<(IVY^zJ9vhSl$r3`c5TG`m|FSa~c
zQa;Wg{4x$;;iAMP4Fy_?+s-kjlV`^>+OxO2ts|{NVymTYdBx>9mO&7hOw{9*2}Go^
zleSB{z$+?gMi6!|0&5|V+LkU*Pq6wRyr8w?tleW0{t;;kSyxM)qMF{VCUKq*dwQOg
z?}^9dl#hCzCjB3<{^fUMxeyX}e6JJ~1M_L`P$puS<iLuIZBkgvi=37$w@T?$QdZJh
zOuguYuI0G7PRORG9H;hOcF*d2xu==}{StC2=|<BzC$fBV`c^WXr7xnq3g<C>X^S^Z
zMd=Ij*j`O}+3K{I5UxU;$^sc=;5aK&foIQONb2}U<Y0ov^=ci!s^~WKv%KMvE*ft7
zN`G(v&Og`sE{|ia>koR4Mn)>oKAh033g$wWu3sxQG}gMp8|Nm|HMAsjd=OY{+mjic
zW?*t2R=>B%+3K@JXOz$K?iAE`E1j?Wj?Ml~=qVdnnA+_3IsVEbkn3F<B-KYS*rJhV
zU$Q*N(?>9ii}%Ov3N#g*2(T6g2ROJ?zbZ2$+T-2Y;C7|e?|pCt=mF_Na0ib7nEI2F
zC(8$qZR1a@v<sqQj41Whi~*Qh&oAssOCIoei)9IBZkTPoeDz8!U0F^Z6S<EG4E96B
z#1wLv$D1PBQoQTv|4CnpOGFb(n!AlRyvM-^lp{cYUQP;GKR$Ejw4BWxN$dBhOLrp^
zIBpr!HWp87-Qa!^OV*k*PHZHsv^Cn9{$YiJwvax6I*#m$@_@i`Zj1T3{O;Ai^Lf5k
zw~u?>TmIa3A2T5Z=|dAs-dQ7=oGhx(As~zH(O#=qC?L-#^WPFiwUWop#Mp$e3|$%*
zWDrvrHk!vw0Ov7}9xTo3teCTuJyfTMd6tTSySt-ZCUOI5dkch5Tqa)}8%-Tlht_H^
zu+wR=ZUcASd?T!~rADh}a$t8|(q?3mlp1Df(B~Y#)3-Xg)KSq9>XZDNa-wukwHC!n
zhpcpB&e5PjB26qP4-OkgAlHeNm|mqm<no|mZDeX8*VmUWU5aNep4Y5nu`Y_q5cXz5
zz+HLQO5(QWKoG=|X0nqP)Uh_1?M)@8IIJUNON|w08e5YbzokM5Q0JKSh6Ez~U>ZhQ
z79n+p6?#);qM`n0(@Z8KXcIWXIJkQ-?YqmiD0p>*9J2HP2N;-ivId@e8D9|GFxzAD
zg^wE5?f&ys+Iq@`?g1Ha13z$cFai&Pz-m&6HtwmjcwC>2BkJoRV0l6?$D7*f+`K%}
zpHJ)6SjR{Gt#sc@8^Zw&?IO!Un35OcTTV@Vd{a)Wn?EDZ{AdX&6Uv5u1Wh30U)sKn
zYv5LzOsiy%ura#7z2#&=Si+x1MFpavKO?uk*c!7p44y>O`iv48+}`4<p10=)RLn*-
zX}wh82!}N!*R*v80w}Y=Ga7`a<(-v)O+Jm2PB9P6d>7XWBZUSLCK@a=YY5mKZKVx=
zb&m7-`LuVA%8L#Vx8W-UOVMpa$WMu>z#jw<I%x988XJTVggEekFyoL1fhTL7EAYy?
zh$7=kX2CYqBaTaTin31|`>IZ?6_QX%ol)5k7vE{db{+MGcQd#%0JT5{^&5>jYZ91w
z+~`d3TIqj~bL5Y{3jv&sms!`vK2{IQ+=;Y0JQxDhm6ag;whO^x%ZY*zqM4=-uIBR0
zX@k7xKCwfaYxAKGWC=oYt*<d7yMu=$;=qkH^h_%5)^-+n{N?_%wqEr*3w${EpfTt7
ztdvpdfO4YjrnK+a9c8%sM*lVf_dp<%LdNpbGI?ea<9T`Ur0$-SoR~a@s*a~RrhAZR
z*rE)_FZiCo!C&(3z6pJA>Wj+aEjzqNj&{x^dS>KHw1HT|w8<=-a_W{`dQgsd_DU{A
zF~Rsx`9K8KVcfOPcu-`LG*Rk<nrj$*6GD|dg~{N8Da&&>Ns)keNR{XzHDbK=r2+Rr
zYe=2kp9fpCb##ENTVi(iusTN86|#QmmTb5oLbo(qhA_h?2L|yJhfd^ngvYDZ9h_Qm
zYRm}QxJ_oZne|X~!e|;Hj+7ydo${iCNO9yBZP9mrZz8VB5FO8?OlhZY&BP6DGRp#R
z*3+<s$q5Dtt(|FVf}m_s0&Da&E4Wf$N|OqZvE&&|LNVUaz?yS&GNYSSU3+EFb_^O6
z*o+sa608Gckl@2$|DXhp`bD3yfKaaIheQS+mT5Wlv0C~JaKoI4K8=Z!3nGLA`i;p9
zWMcbh%_~c%TF-zX!Ub(Qby6y8`k6EdrE6Q=&ybcxeoFldb*&acd7qxs%sKjP_Th!>
zEyteJrf63XIGi;h;Ei9Ij&l;O+qG{R&YGyxy<MFepWD)s4)CDugT&p+V|;2lm1FXh
zsPenpeYJq4)3`kd(B|2=yj6tb`HRCbp*o7^btb(}Xv+fD6;hw6kC=+GhcwQU&`j~H
z>)a-l8`!FU#u@?HN<ZaHXHVKj0!0G-b&?I$M<kh3<x{Buf57sqQ8EQq2=rZqIlZga
zLfsQW276q@Uzec%g_q8x8A{g19aUvQ0H_whuG%XW%?m7PiG0)O@@B>e+65t;OM-h6
z*wt{r7J<GP$d^+?P6NBnLmJbD!Nf_>3zpQt(q4=rnK<pBfoF2aM%<X4=5>n*{=Ap8
za9<87ZTZIrzH^MZTS=Xa;$sF1Vsb+oKsp9outNfw`6lH3ArVT*3u}Oyo1{%rN^@N4
z#yb8(4a!6%<4R{wJwZ4`i$ALm69?=M#X1270XpMb^1RElJhwV<hPWvs%$8Z>*QtpF
zw6v^S!Vw08c@|bzKmUr~dI#^FUnsmh;zXu!C0<(7^@<0!{seU&m*faB=j7M`tT2bC
zouEBT{o5K?ZGB3s_l=ALcyykWV*>W>Vj_WZ21DvpB8H_trc(XO-O%8D)N}fnSJv>m
zJym_@%hR6w=iH|<*$3$ZSNcfWJL`flFU51|u-2^ep$$VK(ST<{i8sYu9ywkJG?<M_
z<CuuO+IW6f^&#UFRXYOonOH<UDhDxV<Y$8Qup{y=%|tI|q4c%fb6QSlkbBS$7VFGw
zW8$XT@xNF4z#U7hheXaFI(R6x_wtF}wd8_(#kbbA@;<(poNG#Q-gQ|uj7uJQPRmCK
zQ?kgZwNUqj5H&N~N<4M;Y%0_fvIjr5XKzuFG$54^T(wrX+nwG#FoPii6rEyjkO(vk
z*qBh{2Fp1D=V{pa7&8FOf;c}T%@3Ll26#v#9WDbs9v*3&Y5j@FA?vuX8&4)i5_~hU
zNO6|lk%R)pxf0eCjCK8vTMDv)Hk6PrK~@l0*f<u==%i*25oE{{`R<kQI19<u`*;RY
zg2@T_Oqh`0HQ%3Jv*Z7O3yqC6ym|9#ftAXcJwPWkyFWQ2t${GRH9MEgk*Qw=!A5(-
zn$(uGac+y&r*e(@Kz!L_A?K(!GZOBpH#g)Cf8^#;G7s-fUJl#SI)i;OFM$M*rh91|
zD3o-M?%Si8Vd@+n=yDyehC-vRksh|exF*vj+7jl<r?ozsJ+-KZw7+Ufb2Z?W(?C7I
zgDk=wlM%FMCJorz6-Qb0F=(qePVHI`QqKsfPNyUNS>3iv_vFj@`)=isdX1tmQ@^*;
zZ{!De&^Nf{O}ViGp${Jt?zGt%wf}J}EhdXT7D1e~hxD<j&)2<>Lnb3JEd_UAyP(Ms
zNF{p^7CrC|0?b+2as-fDm_U3)q~oI2y<U>TF2<G@G}%UdWXz$j-J`yNWi(mF+46+e
z(F^H2(Gb#K9NoJwjsKPECsU8Eeu;O$83@G9(x|JFJ@Gz!Q^(!fix>$eT~B{&>rY)1
zLIg(k)O$jE3^J?msJ4~ZC&7vHOY+!OD)-td(JD)ACe(S5N6078u=p@&=X>~_Lq5&|
zcNVS?wm8lo8YLZXF^i0ukv0pLMh?4u$N;wFxL-zaW7ZkLjWvA;dXNd;lj7pVrL^TV
z6!I7Jq)0FK@xDxE(HfvxW`+>6&`fBVrQWAmLd-$SNifet7FnMPVVqx<a|jJ0A)#jl
zg#7Y4`34ipfHEPZjd9hfLs}p(Xj!LOi>flF>>+(PBHFF;M3aDtGMX;TLQ*_hds?jC
zNTsK9xmXJ^FxMaALqIIdnjxC(m!`6mnGc;idp99eQctpgzgCg(7Ay<~G!T@%Y^__j
z<s5YvjM1JS(VkS#XoF?)bWYpp(9b=rS#Ew;YT(?KOm4zUsVz)0;H~b7m(HX<2Ars4
ztN~^(ShW5K1Lx!^le)q-BoG+xqdw=}EcJLQgF6Com7O470)ivumFiO2bxe{7q=|QD
zr!tUJK07UBY%s-MRDS?Io$6Q7cB9QdI8aOq()Y5@A^kq&@Uq5pHqxfwMRV9Avr;s>
z!`H5*j)1bEy(Wxz8febXmLWj>q|anLIxh0Tq|orSvD7Cp@yj*H;Hmuwl8ke&F=WdU
zT?a3spFl34PXzPaudX-ixi3zW%j!EQSBO7roG*@yYGP_q=L!oU9LXKml93thH%aJ~
zj8bc%?g$|RJw$<mF7_C_kj(bjR^otWatK95s<oo5{`96nz9jhM)KU&Bh7@XS1v9!+
zcq(tyX?8{plaS+s3}E&bF_6lY4M<tLhzSS83qfI6o3_%ZS#!v}2yTf?$Yc--k%hQ4
zot$DXUO)$sOj`8~;bV3>t!XLEP$%!HBDINhif}SJ#UPPGO1tuy18IenKBG<p^CwJ7
zA*-aJo&x0#Ho4=b%%)Ukmo>Y3P5W9R^d=j8-G|n95aCW`2FdP`S6ejBJfG`E#`!kV
zB{acaB(Xg33lfQod)hn`3Xo6s(?rY5jPI!G%pnmdHmvPXd95|Wn_^Y`O^P4yxvG5S
zuc@kI@MhiMK9Lyq4`njsC7C-BaEL&irLO04sj9?pabmy#LPvdMO*xYXOk7dATw{DF
z1UzY+CH$eeqAgz(=|Iyw(5t#CD+SEio3yS3M_Gxq5doD(&!b@=E&_E6?5V?eEyOI9
zzN&ONJwknNRUO0878ViQPZ}vl*25NY-C565<Td^$<w#f%Acq28I7KQC%7ng@$s5)i
z-cX-hnCY|crmQto*CBsAjgvC)<r&QN!Oy`6Yy<)7Rc^z{!sMW=fYcY@yo>q;A!I!{
z+CqoTMxdD3XQ|M*WC;2J`r+*1_(9&DrjFIs&<E#<YRVPoL04rhGA#K3c?B6_x8yy>
zRVJu;H}XlIpsU4cy1F8SG+s=k_-0m@y<r#}*l-@ZZ${uuNgkvE`QD8oPz?8qqcrfB
zsNR~9CJ{>IRESc#MaTJhzFBLADF<dl4KbL6eKre+#Gw&_D54$VdG2R%IObo?5**O%
zl?ReTN5BWtfb$T&E-fHt&EjEc1R$5pNFh)YCv__i62w&qj-^<6Sdl^+4~mG~xKNNw
z?nwe*>9(Ezg<wXfnFdcZfp`=YNkLne@dD5NB{NKfKFDCg7<^aYyp45!F4u)SFa-Df
zOzAt{2ktq3tOM9%3M~VsAP^=7mWM=`2Ksta+2?rjH!%|j_2>3m^40431|KFbSQ|}S
z-~*8$j|kJ4*f6kV6VjY=@|3a4=XUxx^^-QtBmtx%*E>iY6GsgGIL_i2Q}*0HfGM6a
zsY74}-id(d8$y>W2sM~zm|)VYbX+*vx);u*hc<)Ifslii9D>xT-$~;|q1-Ei9Z+Z~
zd!;;*_nckYAA(pi*;X0R&(r5a(jkVJh%YbeZvCe$9gIMw5y;~Y?K~+KN_~jQV5N~>
zJ3jhRNH}9TN&~h8dBcg5N!DUQ|9;12`u?;vn7-+wCq(YYH3ncggkphs1|^rU0|6Fi
z$R)^}S?;4A)beCg-4H?wi~$@|n=@Ju@}kzzKm;DsIvQpYlBtdgI}b8zS394r76jHR
zr_|_G&IHPvfB?`TvcE^iX*ORo@XYulyg?4pAVT(*muHi?M|r%&fUrS8P-ag`7L%h{
zqT@l^$Mt)40_E``{pF4W^4TUqk+h_g@}5$f(+hXVAM%zlptI$eb)a;vd@v2AESQ)<
zumxMTZa{n6DYx`lfXiBxyTOv*akuOF{ObD>_QIVtO9<PCAo(g|v^|$(4v26+b!H~5
zw>vO6n93+UlOxo3@q6{zvKy-4kbLI>^I>g^@$7{Q$rKk2(^ZuNno;t;N2Hhu3uZ>C
zt1Ecv_<nOpIj<R3#gW=*sZOkU|2CW?kF;q>7pB97X0OobQ7;aw4&Y3N_M6wIvX+_q
z5g?{9Jr)VUJ7(S#8FO~l!Ip>A7Rqp9Y`S|$sY?CKjLfHLMLZ9oWRrEY5O<W--6PsD
zSITQxsz=IM(je-aK7@%nOnX^#%*;MZ2pIc^*ce>((7_071_IQ@RJ&ZqHUr*!#tH89
z*X$7Rgtm_R{TH53p4|8Ace3!fTbY#lVfqyM3i@u=17Zz^XJY#GKAE1Mlye{^|B*{@
zXoXBdUvh`@L&brtSgWBf2qBG>ih}U{oCKklH7gFgM=(m>%v7)rI}-uQenDnNNVY9%
zsBJ2DOf(Uu5aQUt_166C$}x?<ct*}6WS)hfhB+W+i^*(DqyZtCd*}?Z^Mm_FPn}Py
zk0tE^<VYvd<NPfbbnZLOD!q|>(m9eRu)<^DWv#OqkrsvZR|wLWT@0u^SntD!?L+9i
z5qJ~6Dkq5aX5&KqMY&7sBBFm%UdrhFUy|E!CJnGApuQZICsESIy_6Sqg5P)=ZD`Bn
zusRDQmjm_xF|8duefe@4^dL602R!DnJq6}ZgZ+I;<I*Mb+)O}HzLhoN;g|pp<$+%e
zlm!ySJ^6Zmjz=-0<aZiS!IF4%;m#-WlUw+$bTH#f9?&w89<+da`}$LzfC#2~NgkJr
zx=DY~QZfaHhz#jo@TA^M%K;L7N};8?O|Z*RqrMjcOQBU{-E$5I9ym$LFcS~N2C_4!
zI>+P*Rt~GnAwOS_-w;FA9n$wOzVk_wzB<n&u(7JgTH!qJbOh3PqJDXo`ou>M9+J1u
z3-JZ{2VuLKwB$tn0P;raYXt`5IRXCxQ`!~`bA9|3%*kS7S$#f}(kC?DGeO#{KAH)9
z`V<_;rDv;Qyh=H!+@IScPvzpQx|kq?2%`vfmnHD*>)$1|zb|Qd7~CCpHUcHtH3{$#
zK!jBUTC`7Xt(XjIpBm1pE)><FtWM}YGzLik*2UE%<v|5l?kDyv1fo$O&Yjc{!I6$L
zYvh@2!+8^J4{ab+s#{w=3`sM;N5V4#8|HO9LjiyXvu<FXiH9KDlAu>6O#^d$d!<=M
zIDcN&1f=_!3+K~%<CB_5B3<N@awH)1>tsrQI#I=cAUh0luQ_@&dBkH27uLanIT{r{
zXh!Kb`LGra(-^ddJWHM-&6E?{d@MkQ$!{t9w>JRi?CrLMCW~j&1dE>UP#s8`VVz^Z
zCGNt+YWs;HdCQx=<1hlVVfqV*9_3u*H~mdH<bGu!)eGu!vP@7Oi$0}9c<)vxQhWtg
ztLuFFUG`khaz}b!ino9~y`$`wx<4#0n_OO$3FlKe)jdK6zzFPI1n3)CzscksmOhyM
zpC28GWqk<9bLAEp9AhTR#2b^-OqjAHfW8-*gzqeuWCvI2+zy0rC&{6A6c1tu0|153
zT97ARdMRxp%C-`R<tzg8Fifb@;Bm*3{;`u0plug5qhw;V%9||L3vrJdp)T|V1xd+I
zZn!g0d~`wx+XyU>!j@(n%hYxND~J@rJ=%E8<XDe)MMMy@T=LBND@^Zp_x2=B6zwx(
zoNe#HVZ#`20Lr4|i*m<A`0>L>v<dOW7?U@{Gt#O-kPc!#s(^+NBEy6eYY=NCAQ(f=
zj;TLn@WfjhPM8XfR<SJyBoQoF+j;r=s+?tz^sT7wNlGYVBBEV!oQXg6pV?frY7kV`
z{z4iFU`oB<HCq|-;7|RfZL(J-rb5gt^ZRb~GNqGzD$rlB-Z0;r@~^so&j5(ZZEg$s
z-b7&1wc<>UlV4knO-@rSeP_H<A8yQQspy<mBd~4+=tmh(9@U4*TAaY30mKgk0aJU%
zANo+1|1gfHemY%MAD+L}_p;*vH*#<8PfC|}+}DmIgoyE&K@o5_{gmv9Da_X$Ig-qI
zC{&Zd1W#T6p-!ZVu?mHvGss;+aWUPy>b~{<B<AdJ0`sqNtvP~t-1)}!#=f=Bk>=b{
z(xGC?#@Z`9aj`cfrj(dkun!*VcM$wpdkKp`*e##2uO!BmLSa#Z0opM(x_$cmLNYIT
zMxG}bOjw&hIkNU~vZU#))O)ug9)x5*l*eHWii=C~xT--Dvqa2!AwUrM+o7nTdgP7(
z7ML~`(<kLks_19go&_^L%xoZ>({qJZoOhr(X5TKzDQ10`Kn|#$V6LmtSLwqWXE8u;
zRsA4)w`4lR`;W+jWw)@o7a6<*jM9&C!6Cu58nm?@TH{>Gv(n+PaRiLw#xZmZMxa&@
zU~D5`t-<)z(0gafi>t*1UYal}>!Z1r`-^(&es>%pq+roRFhl$DrAspRx)^<06Z5dP
zl|aaV2y#y@>^rN7e;I+zM}U3@^2EAC>LQx7qcUMmlJDlfz9Mf(ZAf{*qZgeg!aiF@
zU>3^WVDpO$DSwA{4<sVUEF2v(1hAGSV;BtROXxcuK6oHGV}T^GK7l;p&6Y*xn8mUn
zopa?Rw<2I~awL>xUJFb5ahj3|4dq%sIId0#*Qm>dr%Qg_8B*LLmXO88MZHJ$BCml<
zTf@i`BzwqVp2_4L<PfYOhpfdzdkE=fdXLzXNvRHU`tE#NWqvU>pcTc56y~C6D>w6f
zl}WW@F#<-w2pECY2rvevf3F;#(yeQ8fwj)9j&~>i-cf{*@@Ab2v)nJr#EZqG2PKfQ
zVPu<B!r3HkCl;jhR6_`;w}CWZwv1+kZ5PI5){GGRpqhxS&h-irR68RNm=%s{ZyvVt
zxUPNt=y-eDJGEey87cq(Ax}v}K~zq6Z^{pL{AiH4H|MR^I$P39`gd#d`D1(b#*3FP
zrR^x_Umoi?Dgx6bB6B@?>cmVXuQS-{vf0S{a+#3NWlUre{VIr8zP48UnW(XM-kL#V
z5i*4fnWmOvzeeKY4b*q~Wa?1fCV*`|Al7XAaeibZ`i1TOf!#5rb>B=VP?reFq*Q5D
z<Q1FTqi#b!F)zXd80{dxd6$C`Fak!v2-GeD_Zr7)H&>NS`HmulXe-!E_(^#d8r8lb
z4{7bkA+7ac%}On4B`RCQj;-1dNCL5hPfXFUT~B)>%9|zTl+@K~)JS9^n8_XOjJ*Rd
zjE*ECgmVx)c@1c7;Gj(Y5Z-e>SBRk6XDtUXV4Wb|BhQbHD(|Byuap~_D?F#-h$gL(
ztKp0m#dLpV1+gQ%ng%W1C;T9sNfWM@pjm7b;bKyxM{VIi?ACgZ1+8bCNb4DK<O8O7
zrR{7RP7a9nY5z_%n6#Tr))I*&Ud4BRsV>r-)5I^zjJnMh5ie_<D2~U_PMQoBSoyCJ
zFak!v2<&VGb_5}0V8=}KhD_CPGmArj$K_Uizk~;bI0S|V5fpZIkvn(QfB^Lp^E}K(
z5kjwMFSst5I6oxQ=4vE`nFyi<9KA6f7iHQvHhD8S-8ihZbZC2U7L$Z@<t?>40ZqGm
zHL_3*<#9i0Ku^S^6Hckvw~zgb(2PE!y-a&WQbyJP98y{KcXt(@H+8SWod_gEO1RK(
zQ%}lK!UHKAJ0Db?!Za7tO*R_8F0<-$(ipyU^-6L~gehmA>RYe&hw7B$7wRW*t$gl$
z?H#{zeQeZ=8yX770@E^Ey)I2XCabJt#L-S7uXjA@A4b3k7y%<-1a>9@JAx1<GAM!J
z56+yCGlcngt(?bT-jxURa)D!K7Nc`jiwK}0LHNZjGJ@<GnIck`kIR9{c9FuQH4&J!
z83boOi&_JQHV|*2S7jcGfZitp^w@zz$xCF~l0fN3y<K-$(@D3MB7si?EKBc-xT^?A
zhXhenRH|a31~fo`NR1Tf2pC-{R+^BAD9F;p5Q>z5U_cUxw9soH0TOx&gm&ZIZ|`;4
z@BVx9%pdtZNuHVWo-^m1nasRrpNns5UH72edX9A?ex@@Aw9H6Yz5IHw*T9i>#Ua~|
z^4$O3E}N;5@WmFZbB50a<%GmKJTutyqrZfwak}3L9a6n3p2%$3CxPg_DE+U+cVBAE
zXwBS+e$3wgc^vMu6JPqub>+8c<;<d_=7Rl{ob<wT3-<fNLtSm;{ljnJl8c+aES~;1
zLB~gD!Jd;!ggl^Nucv^PR76s%qKs48zPzEmC1WuDg@ip{)P33P#};n_V9)PuPQITg
zKft<Ld;^lC6yBt=Kjd<H-K_{(UFu%wC1GievJAK15Dh?O^{4ddIK_@d=hG>``wY9l
zyax>;vG0q^u;gRM0_yCCUQ+E;A78weVk~jpH}v{QDW=UeHZNqcWP7Stn3!28M9e$t
ziMV)W!_Mxw?B|b*N_lU~)8c9Xkei31J@>ctuycE5!1CR}s+I-98fSfcPbLSfnYudP
z&s4nbo-Yr<)hcSa=t^C*6+8e`EI#UUDn-rc@J;An>=+Fv#6H-cyJRKinvuQp#T@!P
zCdT8t+tM%Y^g}m(-*Y}uXus^MkD#U-#jm{Y+Wp?$r9FXJsUkIeGFE#HJ9hR4`_=<D
z6Yn+DW!GHo-^6Nap`y}_=8(SUO``ntvtGlRjU6&CUkLEihiH6-ho>wriBHD}c<+>q
z1X#Y~pFg-kEz3}&jULPMyWof#cJljDLsM%j@=9=mLP7JVPx$y98dZLTz+B8Sd_<Dg
z8Wp;)maueoPXY0W9=<~Fs%*JRn@H)0tuXoSZs$LS(hY6FKyqMVr2}R2PYN=V_Jiki
zu{b)Fn=`&JVTF0ASqM1i!1nW8`X#f%79etzDxFpyqHyllc;We$vtFm#<h)ESKF@>j
zNnL35Kv}gOU%XQ+&Z{l+!lgdS)FVgl?G0YI3lveVS@VK?SX-O_(#cF2Qn!*mG}ajr
zbf{IUiiw|XeWQJ|sq5{vn`&J)vHP3((M|MNv~SEnbK<e*$A*QTnp#|0Pw)yVG>-E&
z_4I)cj29ff(;BvNe&wE4N++q`O&)!%JT}Y8IltR{^DjCN6FDUtc>GhQ1%K<f{e2HN
zE`3HhLIxHp`QL}Xlwxe2#60m2y9NVv3X0(QlY<iIeYnqGo<I`x%xgnFnaSkAJq-oL
z#P|nm63)ewZU}X+OX}@}3R%+f-(79&jUF_z@%b$y-urcGlx*;fvnN35P2pwFWSZ|{
zF=AD0F0$)j@@4bZL3iWyqz5v6$7K+0M{L0C(>N)wC^%^T{fEWgL*ldb*IwKENIS^;
zP20{({>5>1U7c6QOfaC+I&^#Ut7qDtBt8Aw?E{i@&<EAyoB0pL-gKO+5(5uZ?760&
zT(h<O+Utz2#pKe*R$ai;q*El@Z@@C=G5szRTI@HOF#`>Q(?^OGe3V~*Z|B}kR(^C*
z3?R1&?vnoF)O|1DAG+l=`Hq7xbPX)M>;t@;^60*{QoTmlU(r#oZlKzxe$SeB{XNu)
zf;ClM$oMe49v|)V3-7q~h)bcY6RPr$!<+vmwEOT2zjv~j$Nq_Sul6?eQ_a5$eHu6r
z1K>Cm1Y1$P`2$BTI6k`USi?Ho#4kPhutLM9fB)k{8RXFW>xNgb?;1@{B;cMd%8JDY
zFdo=t$$Gv4sSAA*lVF(u73am{1>iPFYMfXS#m(KvHTnA(OnJ{^b=I-0$EJZ-0xun_
zKTL2q@769D5omj$b>7?7WwP}zAba$G0I4+!=T>Mr8e4sfw>Y6R@pmjtj)&jwlG2!^
zvgg40ml0>XPHQ%=?~^vR$nTs~(c=vE$UINybKAR;CYYCnG}*K>O3+HS@}XyI&wWOi
zeGfjXxZb$fn-^?g6+QNNPo${haP4|L0d`@^*5w`i2kF^=yMHd@$)Bi*pU78sn7SEZ
zW5ut*<;bbn<9Omm$83ZS|LOcVCpYg#1H!q2)sOWN)`2<La!I&yoF~f@Fe?RmEtrG!
zdWC+GnkO!A9<Sn}DpyOch)cg^o>5wwut&f2X(PsW$$-n)@h7(mw{n%{4{06W4JZmT
znR!fGuZ!}R`?x2bUHMNx#*Y~kwyVH9MZESLBI6~xDg{+UO*rM$!GG1%l9A_*RL#AN
zHdf><PzY;)M%4VoZTJUIZ03>p;?uE5gjp=rLsj<G5_)n)5C53bz6;>ZP<%UmqJJ#A
zz<;Rfkm$}|;ot{b&@tthnODtd%Luctx%Kl2Zzr$%S;Y@VYs3yK*;Y;QA1N@=r8+0~
z3ikYqmthQx^j6uj%Kxcb?qxT;!<9SdLKXH_OTX*I!VhN=`&QU(IyrS5r+SLtPh$Ux
zc0;Pto9QEuYl@WPGfLmVLM~g>tGa-<j8J3ci^V-+qoQK4kr!v}X@hw@<VSzm$6t#2
zao!;&^tP^y8dYQZ>PvWLg!Ot*GJerMvUn0(`CKejHLBQRbpO*8>Pi5wv@)0%gko3z
zG}=Ekz-4ENdGb<UXz|5^rTSvYTW}O+tuu8h=Xtz;P+p+Gf+}3BcIBgC$t(RUit3o-
z<>K;YFU};bAR_Pnj|%@9P(LsKxQY_^0lFg){OOBJTi3@-auLPEy)v%}Gug^6N<M*#
z9$&l?D%Jk@n^YTiQBQMP%9&OLte<wQ^j)qASo^ZH)ZgD9=;-L!O{de9sSE6cKg-ws
zueosh`goQ<bzFJ!XaKh?c-k+0&#SI{a@*V)GD;i1RC4smO_f+)?cO55U@X7oy97@M
znd8j*Fdl~sdN$WgzaI>Ht8=)gjm{!BHq}N%EKD@Irb-sUVh|b5X!dfGkma+2#K>&F
zEH8rBH~rMR4<S40ey4^{)Ha)>Z@_;gOf0<wZI=Uj*M{*x#@6O4afjWmH#WRA&#jI#
zhL<QuMY2aiqJMm_7_~89$yAt(is%W(-KxPHJRbYE7SphzdO$SJHPx>E7bircLe$#C
znfjgW4Qw>`cOhrC*N(VcH}IT+Zd^l`<g1h6G!Nzz3{2qMDWhE7?kdSGGq6TDyuE1<
z6~&olm)3LU6!xv{I7LY+)UQoGiFT}4*^FFQ8jW0Ani!c}N7n)um+%jx!aaSnrRQm5
z7it%$H+ykTb@lvL-u%?Yg9SC@r+mKM7dHiyH{^F_1$Wk{h>g)+^!P|kNYCi%{CFvL
zn{x(lvEt$qwLZP!E}7MS%A3Ok8V8>YZ_%Yl%;mP1mq9cA_WS8NTA#s984H7fQ=9u%
za2dH&Q_;8rWV&ILcnxc0#d5+Wb>eBACOh<lx^w{2Cz1MXqd;xNp~<%Nm5I>HpW3i4
z4*&>IMVtZ!L9o+~0BpEi`|uk3LO3=;Yc1bh@@R)4$P-2!@0~>z!=r0M0{sH-$irqO
z*3ar$S#P#VK41|z1S6C8(3rqhX~;vZa)yZCtQ<dFvb^M?)h6|aKnrLhmw$R^8#K1P
zJU`A+n>aZ3tQ+0$pe4FPb^qdmz3jyKXtr3*$UyzEb@K0etTN!m0~@}_gI1o@Z}K#W
zMxA)%0#E}IPm8*3BmDpp^B@eDXKcG;9Ki)FAtyOfZd+Dh8E3yS7Cyq6kz4yNx7nkw
z3RzjUf7h}oWq>im*)Y3s2`qtM=e+7oyqo7ZSNWPpR`^V;;n96bA=TQ%I+?Ve(BUFA
ze2T||hq`xk(#a|Xo}dYas{<;_^x&j^zpU!;g>~}{Hp>B)CKB)DD*M3$kyUd%NP(@@
z!uQgTjSGDyPjcUpM2{+zgpccZ1G8?IZjom6z+W8xrh=CZ`w#lxTw+I3d4nQE?veH2
ztbyEH3ZO?lpY+Jhp6XG=j$Y^Ra=&@(Jw^UWg8sdm=Gpx%AcC2-oF!VMdGqXZs*N7W
z9x57cuZsJ0u{1m%RoC~qN<qbj_vcoMj6ug^$uD3X`&hC}!T}(fIoG324v3y3CC*Fr
zWzyi;(xYq(A1z};vB3WKah;tyXbIMI(S+RSHCw7LX_?Z~hc&ATJ-IQPgNx>AfOrBK
zUQ&g<yYUj?iOOeBkhYUkh&;Z80(TI(ENvJ{cf2BsNt``%$8008)D)I15?{RxCgccT
z_wrn~!DmT!%cOuHB5nx1J9i0E3_G*zeg)yOx;e_4CivZdfGc?^BqGpaM5?h`X_bCC
zJCra#vPx@YLl33YIZA)VWlEr7fODt#`pr+eggF7OBdX~5bfoMcVOG-$1^svmV6wOn
z#qb~?SvG~cCxke6{4H4$Rs$`!69-}k*WPfi=x&`H9X!F#gO(SiVC=21sbzz=quWhd
z8x2mj2V#oN-)`)o%xI*;s!Y$Rgv@lScX^LWEH;4|x4l^f#b2X-o^L-aN|q;TtS{?G
zj|X3tv@wMAVYWBWrSDy;W{6by_luDIltEkFo$?Uy$W@e)SfHzjrTnurjBhE1QG|~W
z=X+8oEB;N3B@3h#<maqbiR$QpXd0`wtN<JBQuST42gGY|L?6B+j+>p;(Zg-H`Q*80
zOWM9(FaB&OkH@G^FXux+H;HaUIl+-sp5Nn^&F<DttzFBIL91(il<QC25)hN~@fb}4
zL)cOvsw*o4)f1JvYj!B}M3?rhiZrk5TaR}xLyA&4H%r5ZV970~Z`r!Yh(vr$9#H8^
z!Lz)h4fVvrVqPQhvv_&YmO>dC+|M;>Y&&DfIwejP_PDcxkn`+w9GDYeLx`lC7YFQ`
zB0k(I>6f%xj6Pl^I>}*~{iq;qR7UbeXY{QU-y$Ly0s?tKkQmkF>e!`k59DIw;4v%8
z!cMtY@qpt+aykeDZ`R3)L7IISBcqHuvQmW{HoEUYscxyRLs#zZigvU?_^HQ&zb?LW
zO?7UG;mrBip-Rl~GN%nbv4+S8_{`CB+>3(yUAWq*GJS<?>P=$Kke1RNaFBL+SHZn0
zv(^LM)->VBW*{A!wXS^Tba*W>_s)yIMX2Mkw=5gRm{2Uy2y*v6z+?_bt*s*?O|GcH
zA(5;Du!3CocI1;S4BrGP_P)WLC^5Tw{xUv!ojcfXcs~KTwwXr4Y|HS*%g9Z}N$l3D
zyvV~6_c~BXuytKn<Syvu54egqF!Jf-O24^Kig2xFb>=c5WebwRbgv0IQ!8z(;4LZb
zG5@k|oT|d7lvd?tBE11MD4oQ=2gpNbAK#z3>iDI1#i|-%igZ}GU6gNTtF_zGLS^`~
z_D9I9G6*sh+*-s3D02C3@fN8IF0oRsNgRB(w!|?PI49}>e|XG?(7Oyi3MzvoGGpBQ
zfPC48qtcquse0|k2ou=M0{IQXBMYfBmA?IwiT){gas%nOniyA*u0tuJXh7y@dIW8G
zQD*S9F?sk<Hb4uxZrjpr-RB?$XIk!L#rngvM4{;`DzZhbS{3!&vXatU2aV~CPZ7rG
z;qKdFL@;pls}m92{C{^t-PFK|_=PHjC3d5_Tk0wU7Z6wb=qkj14th(6Pe~$Uzf}R0
zpwhl9i3B{QyO&T*%;aQ<xuW=>qR#Il5?FTCF=A`~Ka}Bfz~6VA1j#}-OKKtB7_7P9
zZTAzHzl_>)49|t+o+(gZ(#!Hfir0Vmmvn@GY(VI>)xem528a)Z@f3}a_u0(NAxlw2
zVvD{Z3`Mz$RG&s{*!G>iS-5-htML-}G6TXU2b%7_wW7y)+)XjiN-Q&G`xg&ZM-2GZ
z@fjxt-5SF1<)pPX3bg|v>a<Ko^ZFhuxH`P=nJqcsw~+CB>a;1`zhix3S>DaR#S;~O
zBmO|&C6f1SOZqUP`X~er0I@86bcF|DsEyfyCdo4n-csFELvq0Uz-FsSs}kAdU7jxz
z*;J70g_|?^rj+c2m)Bk?LZ^)hPwvg4eRoFasp6K_i|$0&t&U#xw)=Z;OKn0+8$c|c
z7=^mkxB45dLmZOqn-sO$iMCQ>OX_SarPs~c>RBxsy-lLj=Wah$kP=kLROJEq^PD8V
zSUFq^0-pqF#zZJVYAIM-&kkvnEbIF)V3CZZgt74HvZnut1G+qvIBlq)HW@^e)g*OB
zd~gSD<b7vW_kE&w)<YJg8QS;MAeg4@uGptd$-<XevvpzyqB!H`JptAL<G>*7mgBqL
zR!!2u8r7{S(ue|<dGb9XQxgnvF5YF<6+-%PYvPoSgJ>X3B%nxDmzW*}ugeV2fvgqf
z48&P$RU$F=cXx_d=WFgMMto{KKhA5Am@zcBm)YPdc2w2l4diXG{`rtr$1eaI&mJIt
z7}T@8esWgZtYxP6KiWly{BW3f?s`82IeJzkDfC38huq>0`+PenFnUrO9!Yvs$td&F
z!g?r9`3vMRWM4`f1c40^+?u;vB(%hSNVaD6hRo}3Q@ZOV`U_~`L|JEkg)Sp^msFNw
zuA|=*yAQqYZb{5}sH%X;uu9=m3?e(3Cr)om4ZQ|IERxF>?1S$qPVE8YCxY&o=XMy*
z0sGSn_cg<3FnJd{{HgM|uppK)B_}n!P<_P#b-#RfCNOk#JWF%cv%o05Aipv%KUMR-
zNF0e#Euop3x$YooOt&_`B%-NTBe=MgA3rE^yP*qso$Fxx_B7t!pYr}<vWN+djt>ij
z)Y2ZcAf%;rNj;>=$dS;Z_oG$2#0eJEe-cV2BrUIh$DfRS?`zR+hmtN^mrU8}(F_85
zM71F)EIVxfnGnUPJ0kYv9FhkT3{J%e2QgedMIv!MbQOve;4Hhb=9YJ}v3XUdfxJwl
zH_Y_R-&P23_(%D9paNi=J}7{~D$qi?W!tsOV|tR9tg46bPY;uQ)@_-~`E@D1S_5#v
zmw^hWhKV*iBHkW8A9_11@c6qF9pDV_=}L+eC6wJUdLgQc&oFQ7Ngr-^3Q{Y?+wre3
zaGNAbQ->;chvqm6re*kjWp&g-^N8s>w+6U@05QF1x>0N7NjnEF7by}uV{%#n!deN)
zuBN*A5{w~{&*WLkI68a58&<YE)zmXrjBcT-cvN%Kn~h#(E|L!g;uN`CWIG)}Wo!_<
zwR~VG)w(p{c=8>QfbXYC&{F9rZ4zID($g@?_SV_Cg%@$J1HxFXS(4`Mbv=C#H{{7>
zsbS<@0dz=7qeD4E#^}g+WT+`*%L1K>H1?1I7)OvE7Z<2^nWktOCxI=_;9$!$EjoM?
z)mpWRagt?GP6&}l0msjq9pdKi&o)j@m=-;3Ay^NPhvhfu1-qPR=n#L_tx$7FZQ18)
z3}YZSnIfF4yGqtb2Q3uldqgPIC*osgW|GO7gd`^Y@?9j@*;<|N&HXU%3?ty%+iN}7
zDoZ?)Tdtv|VYdH4(}=<dDIJi`omB=-B$74Ri^EVjRN=V$$sw1LB=Lin2i7;QkBJ2e
z0o2sbmz1R5LMMADWTw>hgi7uiL8PAn|2~k?!oX2D7_S*yxFsdY{O8r?8-8Czj8;=9
z`Kn%v3>s%Ql9d^kU525zr`OjZ?dA5vM}7^@A*M+RR;M@h-XsJSzgKXH%N%1Q>8v=x
zvLc6%1TE@>kv=48R;PlznLjTixbG`3#7N!t$n}ltF%s)K<Ct4NUHw7_Qn!&oE>nvv
zDsHD5BaN04X{<n4xG}7GeM!WzS|@TL_hAce@bcCNXbOh2OP7^q<E=J2w5xEj_(bWb
zMCf{v-!L>aUl%u(PR;(rhZ4CAa6pwO!nBC#2^2FRXg!fuoW$YQNzL&Z#XDi&JN_dh
z+2XGdc%M;{N1abh2@Ugzoa30Y+QD}ST2=$yPLX{-&OedzQZ>^w##R_>Ef?mwi339l
z4aiFk@Gdw6fo#2F{UiN2*c$sAWbB4zit&@q9%$6fG0sCxqQAQK$<;*b-j*N?dOK6e
zvm&^M73fW3I)(NWzxPFr$_El682NK8)@+M6CF}jYA9gvGVll~RwyL$-m~AA3k(gPn
z1K+%9p`Hq&z$UhvnBEX$N62CcHh3+gSOHU)<v>b;hLJ*lT`dkRL~g~%60cNM18Cm6
z)nnE$w%jtd*qJR9dSWA@iEEt@Y#1jI?c(f10F7~RqkY>R3FZGZRC_gRUei0g8q*1v
z&HTJh;35t|Zd`5h7%b=_?$*&2MS$k$@^fH#QVIu%*C{vvv41`7D9up{FF5O2LHr>1
z4Gk4v^s*;UYpDu&cr#qJ=C98}cV(lFsv08BwWVlNlE<<IJd$Id1#96viy*}XKdYP4
z&>o^aN(JG<z#iiHx~xQlx&~YdZDs`hW0~!}J8-5bX^6N`ea~XG&X?$rQZ_!&3ZQq9
z4mi@X7eo}3kqQ&}st#Hru(&A!h!W;P>B<VKJ_cbAucR@2=daf7Qbdqgm0L{PXyU5n
zHDWrlIKn(+tju@_W)4qzvY9U#R>8`e&8<jV>|J@E!kU&Q2NeG!x8ph_nc9j`U%DKe
zl--TvR7b#wpzOh~!6D1PL-th&6y|bnD&+h1Rxl2*)&z=jp|Gv~vD#h3U<v8-(cAYC
z3#u=o-d*$|%-3BH8Tq<xD{?kG+^^Sz^C5%paeoABB^+aq9fbE)*YDnCVjk$1F7Ft*
z=Qm<!l*ZksAg?=eMy30V@zHaQ)ZuMMrdoCy@LDc3z8d43mjXlWt$ea82!VfzHIHH|
zKp$jj;vDLaV(4<P44K7wGh+4U4JSI(<kaXC;lU9ook{Q2=Qxef<mS=X-J@_xYv@#>
zJB@)OO9j^9%))5H9fHzqt35TWqjzs$IdOZp2RNv2Ha-&*T(ant9WFa-5Hf~lp1I?1
z7)E(ke+1+xR$^a+fiibl<j@iS_NAbE^FO|#euZtj<#I6vyfR}GT&_+8RZ>tQM(TaL
z19_ex5E`Zbnc_M2gwIG%yKXHOs>{8A)mH?97pLy>pjXBZ#KIm{!AQoRn=#*D@^6j5
zju?MM_H7G)-YqXvZ0&l}VE!Qcx4=qm#gQ)OQcljj-78DWL!qyl#u8^7r9O?eg%hGK
z_U=YrHTJdCCRnxp%)(7M#T|VXsQPc_0hWpF0F=(Fc5Uq1Q~3XUls&q%Gq<-?oR#}5
Rcn|k=`GVE?l5?&P{tL`XFDU>3

literal 0
HcmV?d00001

diff --git a/components/engine/docs/sources/reference/api/docker_io_oauth_api.rst b/components/engine/docs/sources/reference/api/docker_io_oauth_api.rst
index bed939f7d1..d68dd8d36c 100644
--- a/components/engine/docs/sources/reference/api/docker_io_oauth_api.rst
+++ b/components/engine/docs/sources/reference/api/docker_io_oauth_api.rst
@@ -21,6 +21,8 @@ access you must first register your application.
 Before continuing, we encourage you to familiarize yourself with
 `The OAuth 2.0 Authorization Framework <http://tools.ietf.org/html/rfc6749>`_.
 
+*Also note that all OAuth interactions must take place over https connections*
+
 
 2. Register Your Application
 ============================
@@ -34,9 +36,10 @@ following information:
 - The name of your application
 - A description of your application and the service it will provide
   to docker.io users.
-- A list of one or more redirect URIs that we will use for redirecting
-  authorization requests to your application. These are used in the step
-  of getting an Authorization Code.
+- A callback URI that we will use for redirecting authorization requests to
+  your application. These are used in the step of getting an Authorization
+  Code. The domain name of the callback URI will be visible to the user when
+  they are requested to authorize your application.
 
 When your application is approved you will receive a response from the
 docker.io team with your ``client_id`` and ``client_secret`` which your
@@ -85,7 +88,7 @@ link in your application to an OAuth Authorization endpoint.
 
     .. sourcecode:: http
 
-        GET /api/v1.1/o/authorize/?client_id=TestClientID&response_type=code&redirect_uri=http%3A//my.app/auth_complete/&scope=profile_read%20email_read&state=abc123 HTTP/1.1
+        GET /api/v1.1/o/authorize/?client_id=TestClientID&response_type=code&redirect_uri=https%3A//my.app/auth_complete/&scope=profile_read%20email_read&state=abc123 HTTP/1.1
         Host: www.docker.io
 
     **Authorization Page**
@@ -95,7 +98,7 @@ link in your application to an OAuth Authorization endpoint.
     be presented with the following authorization prompt which asks the user
     to authorize your application with a description of the requested scopes.
 
-    .. image:: _static/io_oauth_authorization_page.jpg
+    .. image:: _static/io_oauth_authorization_page.png
 
     Once the user allows or denies your Authorization Request the user will be
     redirected back to your application. Included in that request will be the
@@ -152,7 +155,7 @@ that you must then use to get an Access Token.
         {
             "grant_type": "code",
             "code": "YXV0aG9yaXphdGlvbl9jb2Rl",
-            "redirect_uri": "http://my.app/auth_complete/"
+            "redirect_uri": "https://my.app/auth_complete/"
         }
 
     **Example Response**
@@ -199,6 +202,23 @@ revoked access from your application.
         Must not include any scope not originally granted by the user and if
         omitted is treated as equal to the scope originally granted.
 
+    **Example Request**
+
+    Refreshing an access token.
+
+    .. sourcecode:: http
+
+        POST /api/v1.1/o/token/ HTTP/1.1
+        Host: www.docker.io
+        Authorization: Basic VGVzdENsaWVudElEOlRlc3RDbGllbnRTZWNyZXQ=
+        Accept: application/json
+        Content-Type: application/json
+
+        {
+            "grant_type": "refresh_token",
+            "refresh_token": "hJDhLH3cfsUrQlT4MxA6s8xAFEqdgc",
+        }
+
     **Example Response**
 
     .. sourcecode:: http

From efaa1f688ac9525a90c33053e2158047141eb66f Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Fri, 28 Feb 2014 00:32:58 +0000
Subject: [PATCH 311/403] fix docker info with lxc 1.0.0

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: f30f823bf50de6581f547aee842286584c4b6990
Component: engine
---
 components/engine/execdriver/lxc/driver.go | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index f1c93af789..8f8dcbda17 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -206,11 +206,20 @@ func (d *driver) Restore(c *execdriver.Command) error {
 }
 
 func (d *driver) version() string {
-	version := ""
-	if output, err := exec.Command("lxc-version").CombinedOutput(); err == nil {
-		outputStr := string(output)
-		if len(strings.SplitN(outputStr, ":", 2)) == 2 {
-			version = strings.TrimSpace(strings.SplitN(outputStr, ":", 2)[1])
+	var (
+		version string
+		output  []byte
+		err     error
+	)
+	if _, errPath := exec.LookPath("lxc-version"); errPath == nil {
+		output, err = exec.Command("lxc-version").CombinedOutput()
+	} else {
+		output, err = exec.Command("lxc-start", "--version").CombinedOutput()
+	}
+	if err == nil {
+		version = strings.TrimSpace(string(output))
+		if parts := strings.SplitN(version, ":", 2); len(parts) == 2 {
+			version = strings.TrimSpace(parts[1])
 		}
 	}
 	return version

From 3516355bf5478e880154ed74ae7e60ac40dace6a Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Fri, 28 Feb 2014 01:20:10 +0000
Subject: [PATCH 312/403] fix fedora tty with apparmor

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 6104f9f9495678549ef8fc5aa716a3cc893add8f
Component: engine
---
 components/engine/graph.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/graph.go b/components/engine/graph.go
index a16a6ab7f7..43af2c278a 100644
--- a/components/engine/graph.go
+++ b/components/engine/graph.go
@@ -257,6 +257,7 @@ func setupInitLayer(initLayer string) error {
 		"/etc/resolv.conf": "file",
 		"/etc/hosts":       "file",
 		"/etc/hostname":    "file",
+		"/dev/console":     "file",
 		// "var/run": "dir",
 		// "var/lock": "dir",
 	} {

From 85a42bc9ac69b6021f3dc5b31c3f98cc00e6a5f0 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Fri, 28 Feb 2014 02:40:15 +0000
Subject: [PATCH 313/403] remove WARNING writter twice

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: f67e725e6866f277f706820d4c21b1d0cb2acc80
Component: engine
---
 components/engine/server.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/components/engine/server.go b/components/engine/server.go
index b47e1989a8..1771bf0b5f 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1631,11 +1631,11 @@ func (srv *Server) ContainerCreate(job *engine.Job) engine.Status {
 		return job.Errorf("Minimum memory limit allowed is 512k")
 	}
 	if config.Memory > 0 && !srv.runtime.sysInfo.MemoryLimit {
-		job.Errorf("WARNING: Your kernel does not support memory limit capabilities. Limitation discarded.\n")
+		job.Errorf("Your kernel does not support memory limit capabilities. Limitation discarded.\n")
 		config.Memory = 0
 	}
 	if config.Memory > 0 && !srv.runtime.sysInfo.SwapLimit {
-		job.Errorf("WARNING: Your kernel does not support swap limit capabilities. Limitation discarded.\n")
+		job.Errorf("Your kernel does not support swap limit capabilities. Limitation discarded.\n")
 		config.MemorySwap = -1
 	}
 	resolvConf, err := utils.GetResolvConf()
@@ -1643,7 +1643,7 @@ func (srv *Server) ContainerCreate(job *engine.Job) engine.Status {
 		return job.Error(err)
 	}
 	if !config.NetworkDisabled && len(config.Dns) == 0 && len(srv.runtime.config.Dns) == 0 && utils.CheckLocalDns(resolvConf) {
-		job.Errorf("WARNING: Local (127.0.0.1) DNS resolver found in resolv.conf and containers can't use it. Using default external servers : %v\n", defaultDns)
+		job.Errorf("Local (127.0.0.1) DNS resolver found in resolv.conf and containers can't use it. Using default external servers : %v\n", defaultDns)
 		config.Dns = defaultDns
 	}
 
@@ -1659,7 +1659,7 @@ func (srv *Server) ContainerCreate(job *engine.Job) engine.Status {
 		return job.Error(err)
 	}
 	if !container.Config.NetworkDisabled && srv.runtime.sysInfo.IPv4ForwardingDisabled {
-		job.Errorf("WARNING: IPv4 forwarding is disabled.\n")
+		job.Errorf("IPv4 forwarding is disabled.\n")
 	}
 	srv.LogEvent("create", container.ID, srv.runtime.repositories.ImageName(container.Image))
 	// FIXME: this is necessary because runtime.Create might return a nil container

From d1105407b3d356694371ca89e110b96fb3cac563 Mon Sep 17 00:00:00 2001
From: Brian Goff <cpuguy83@gmail.com>
Date: Wed, 5 Feb 2014 23:10:57 -0500
Subject: [PATCH 314/403] Add ability to force removal of running container via
 docker rm -f

Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
Upstream-commit: d78fcb32ffd4736462792407abe734b51b81367a
Component: engine
---
 components/engine/api/client.go               |  4 ++
 components/engine/api/server.go               |  1 +
 .../reference/api/docker_remote_api.rst       |  5 ++
 .../reference/api/docker_remote_api_v1.10.rst |  1 +
 .../sources/reference/commandline/cli.rst     |  3 +-
 components/engine/integration/server_test.go  | 62 +++++++++++++++++++
 components/engine/server.go                   |  9 ++-
 7 files changed, 83 insertions(+), 2 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index 2ea2dc44ea..4e0bfa9f02 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -883,6 +883,7 @@ func (cli *DockerCli) CmdRm(args ...string) error {
 	cmd := cli.Subcmd("rm", "[OPTIONS] CONTAINER [CONTAINER...]", "Remove one or more containers")
 	v := cmd.Bool([]string{"v", "-volumes"}, false, "Remove the volumes associated to the container")
 	link := cmd.Bool([]string{"l", "#link", "-link"}, false, "Remove the specified link and not the underlying container")
+	force := cmd.Bool([]string{"f", "-force"}, false, "Force removal of running container")
 
 	if err := cmd.Parse(args); err != nil {
 		return nil
@@ -898,6 +899,9 @@ func (cli *DockerCli) CmdRm(args ...string) error {
 	if *link {
 		val.Set("link", "1")
 	}
+	if *force {
+		val.Set("force", "1")
+	}
 
 	var encounteredError error
 	for _, name := range cmd.Args() {
diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index b6beb45403..e994e3af33 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -606,6 +606,7 @@ func deleteContainers(eng *engine.Engine, version version.Version, w http.Respon
 	job := eng.Job("container_delete", vars["name"])
 	job.Setenv("removeVolume", r.Form.Get("v"))
 	job.Setenv("removeLink", r.Form.Get("link"))
+	job.Setenv("forceRemove", r.Form.Get("force"))
 	if err := job.Run(); err != nil {
 		return err
 	}
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api.rst b/components/engine/docs/sources/reference/api/docker_remote_api.rst
index 3733effaf8..e1071bf085 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api.rst
@@ -51,6 +51,11 @@ What's new
    **New!** You can now use the force parameter to force delete of an image, even if it's
    tagged in multiple repositories.
 
+.. http:delete:: /containers/(id)
+
+  **New!** You can now use the force paramter to force delete a container, even if
+  it is currently running
+
 v1.9
 ****
 
diff --git a/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst b/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst
index a6eec3551f..ed63525e7e 100644
--- a/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst
+++ b/components/engine/docs/sources/reference/api/docker_remote_api_v1.10.rst
@@ -597,6 +597,7 @@ Remove a container
            HTTP/1.1 204 OK
 
         :query v: 1/True/true or 0/False/false, Remove the volumes associated to the container. Default false
+        :query force: 1/True/true or 0/False/false, Removes the container even if it was running. Default false
         :statuscode 204: no error
         :statuscode 400: bad parameter
         :statuscode 404: no such container
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 83161e3898..3cde1b39b6 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -971,7 +971,8 @@ The last container is marked as a ``Ghost`` container. It is a container that wa
     Usage: docker rm [OPTIONS] CONTAINER
 
     Remove one or more containers
-        --link="": Remove the link instead of the actual container
+        -l, --link="": Remove the link instead of the actual container
+        -f, --force=false: Force removal of running container
 
 Known Issues (rm)
 ~~~~~~~~~~~~~~~~~
diff --git a/components/engine/integration/server_test.go b/components/engine/integration/server_test.go
index 1247e8d2d8..69a90527bf 100644
--- a/components/engine/integration/server_test.go
+++ b/components/engine/integration/server_test.go
@@ -199,6 +199,68 @@ func TestCreateRmVolumes(t *testing.T) {
 	}
 }
 
+func TestCreateRmRunning(t *testing.T) {
+	eng := NewTestEngine(t)
+	defer mkRuntimeFromEngine(eng, t).Nuke()
+
+	config, hostConfig, _, err := runconfig.Parse([]string{"-name", "foo", unitTestImageID, "sleep 300"}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	id := createTestContainer(eng, config, t)
+
+	job := eng.Job("containers")
+	job.SetenvBool("all", true)
+	outs, err := job.Stdout.AddListTable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := job.Run(); err != nil {
+		t.Fatal(err)
+	}
+
+	if len(outs.Data) != 1 {
+		t.Errorf("Expected 1 container, %v found", len(outs.Data))
+	}
+
+	job = eng.Job("start", id)
+	if err := job.ImportEnv(hostConfig); err != nil {
+		t.Fatal(err)
+	}
+	if err := job.Run(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Test cannot remove running container
+	job = eng.Job("container_delete", id)
+	job.SetenvBool("forceRemove", false)
+	if err := job.Run(); err == nil {
+		t.Fatal("Expected container delete to fail")
+	}
+
+	// Test can force removal of running container
+	job = eng.Job("container_delete", id)
+	job.SetenvBool("forceRemove", true)
+	if err := job.Run(); err != nil {
+		t.Fatal(err)
+	}
+
+	job = eng.Job("containers")
+	job.SetenvBool("all", true)
+	outs, err = job.Stdout.AddListTable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := job.Run(); err != nil {
+		t.Fatal(err)
+	}
+
+	if len(outs.Data) != 0 {
+		t.Errorf("Expected 0 container, %v found", len(outs.Data))
+	}
+}
+
 func TestCommit(t *testing.T) {
 	eng := NewTestEngine(t)
 	defer mkRuntimeFromEngine(eng, t).Nuke()
diff --git a/components/engine/server.go b/components/engine/server.go
index b47e1989a8..73767efa70 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1703,6 +1703,7 @@ func (srv *Server) ContainerDestroy(job *engine.Job) engine.Status {
 	name := job.Args[0]
 	removeVolume := job.GetenvBool("removeVolume")
 	removeLink := job.GetenvBool("removeLink")
+	forceRemove := job.GetenvBool("forceRemove")
 
 	container := srv.runtime.Get(name)
 
@@ -1740,7 +1741,13 @@ func (srv *Server) ContainerDestroy(job *engine.Job) engine.Status {
 
 	if container != nil {
 		if container.State.IsRunning() {
-			return job.Errorf("Impossible to remove a running container, please stop it first")
+			if forceRemove {
+				if err := container.Stop(5); err != nil {
+					return job.Errorf("Could not stop running container, cannot remove - %v", err)
+				}
+			} else {
+				return job.Errorf("Impossible to remove a running container, please stop it first or use -f")
+			}
 		}
 		if err := srv.runtime.Destroy(container); err != nil {
 			return job.Errorf("Cannot destroy container %s: %s", name, err)

From 40daa424d620cd7cd0248b083846042aeb022496 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Fri, 28 Feb 2014 19:06:36 +0000
Subject: [PATCH 315/403] fix EventsListeners in docker info

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 0ca7df046bec20e86f3df3c7c4391b120c392b07
Component: engine
---
 components/engine/server.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/server.go b/components/engine/server.go
index b47e1989a8..6b0a415b5d 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -825,7 +825,7 @@ func (srv *Server) DockerInfo(job *engine.Job) engine.Status {
 	v.SetInt("NFd", utils.GetTotalUsedFds())
 	v.SetInt("NGoroutines", runtime.NumGoroutine())
 	v.Set("ExecutionDriver", srv.runtime.execDriver.Name())
-	v.SetInt("NEventsListener", len(srv.events))
+	v.SetInt("NEventsListener", len(srv.listeners))
 	v.Set("KernelVersion", kernelVersion)
 	v.Set("IndexServerAddress", auth.IndexServerAddress())
 	v.Set("InitSha1", dockerversion.INITSHA1)

From e7b76315fc79caade3f485e042f54c9230c72e3c Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Sat, 1 Mar 2014 05:12:21 +1000
Subject: [PATCH 316/403] one ponted out by lukaspustina, and one that I bet I
 added

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
Upstream-commit: b16f46635459b9e6f58a733e39ccb21c767d8e33
Component: engine
---
 components/engine/docs/sources/reference/commandline/cli.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 83161e3898..564ea8a034 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -185,7 +185,7 @@ Examples:
 
     Usage: docker build [OPTIONS] PATH | URL | -
     Build a new container image from the source code at PATH
-      -t, --time="": Repository name (and optionally a tag) to be applied
+      -t, --tag="": Repository name (and optionally a tag) to be applied
              to the resulting image in case of success.
       -q, --quiet=false: Suppress the verbose output generated by the containers.
       --no-cache: Do not use the cache when building the image.
@@ -1224,7 +1224,7 @@ to the newly created container.
    $ sudo docker run --volumes-from 777f7dc92da7,ba8c0c54f0f2:ro -i -t ubuntu pwd
 
 The ``--volumes-from`` flag mounts all the defined volumes from the
-referenced containers. Containers can be specified by a comma seperated
+referenced containers. Containers can be specified by a comma separated
 list or by repetitions of the ``--volumes-from`` argument. The container
 ID may be optionally suffixed with ``:ro`` or ``:rw`` to mount the volumes in
 read-only or read-write mode, respectively. By default, the volumes are mounted

From 40e0f3f694d39b4f699547e98c3590771ac7347f Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Mon, 17 Feb 2014 15:20:28 +1000
Subject: [PATCH 317/403] add some info wrt backup and restore of volumes

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 5fde31ba9cca63a6bdf0a11fffa64aa16229ef66
Component: engine
---
 .../docs/sources/use/working_with_volumes.rst | 44 ++++++++++++++++---
 1 file changed, 39 insertions(+), 5 deletions(-)

diff --git a/components/engine/docs/sources/use/working_with_volumes.rst b/components/engine/docs/sources/use/working_with_volumes.rst
index 9a27e4b929..df45d16ba2 100644
--- a/components/engine/docs/sources/use/working_with_volumes.rst
+++ b/components/engine/docs/sources/use/working_with_volumes.rst
@@ -7,10 +7,6 @@
 Share Directories via Volumes
 =============================
 
-.. versionadded:: v0.3.0
-   Data volumes have been available since version 1 of the
-   :doc:`../reference/api/docker_remote_api`
-
 A *data volume* is a specially-designated directory within one or more
 containers that bypasses the :ref:`ufs_def` to provide several useful
 features for persistent or shared data:
@@ -24,9 +20,15 @@ features for persistent or shared data:
 * **Changes to a data volume will not be included at the next commit**
   because they are not recorded as regular filesystem changes in the
   top layer of the :ref:`ufs_def`
+* **Volumes persist until no containers use them** as they are a reference
+  counted resource. The container does not need to be running to share its
+  volumes, but running it can help protect it against accidental removal 
+  via ``docker rm``.
 
 Each container can have zero or more data volumes.
 
+.. versionadded:: v0.3.0
+
 Getting Started
 ...............
 
@@ -40,7 +42,7 @@ two new volumes::
 This command will create the new container with two new volumes that 
 exits instantly (``true`` is pretty much the smallest, simplest program 
 that you can run). Once created you can mount its volumes in any other 
-container using the ``-volumes-from`` option; irrespecive of whether the
+container using the ``-volumes-from`` option; irrespective of whether the
 container is running or not. 
 
 Or, you can use the VOLUME instruction in a Dockerfile to add one or more new
@@ -118,6 +120,38 @@ directories`` refer to directories in the ``boot2docker`` virtual machine, not t
 
 Similarly, anytime when the docker daemon is on a remote machine, the ``host directories`` always refer to directories on the daemon's machine.
 
+Backup, restore, or migrate data volumes
+----------------------------------------
+
+You cannot back up volumes using ``docker export``, ``docker save`` and ``docker cp``
+because they are external to images.
+Instead you can use ``--volumes-from`` to start a new container that can access the
+data-container's volume. For example::
+
+    $ sudo docker run -rm --volumes-from DATA -v $(pwd):/backup busybox tar cvf /backup/backup.tar /data
+
+* ``-rm`` - remove the container when it exits
+* ``--volumes-from DATA`` - attach to the volumes shared by the ``DATA`` container
+* ``-v $(pwd):/backup`` - bind mount the current directory into the container; to write the tar file to
+* ``busybox`` - a small simpler image - good for quick maintenance
+* ``tar cvf /backup/backup.tar /data`` - creates an uncompressed tar file of all the files in the ``/data`` directory
+
+Then to restore to the same container, or another that you've made elsewhere::
+
+    # create a new data container
+    $ sudo docker run -v /data -name DATA2 busybox true
+    # untar the backup files into the new container's data volume
+    $ sudo docker run -rm --volumes-from DATA2 -v $(pwd):/backup busybox tar xvf /backup/backup.tar
+    data/
+    data/sven.txt
+    # compare to the original container
+    $ sudo docker run -rm --volumes-from DATA -v `pwd`:/backup busybox ls /data
+    sven.txt
+
+
+You can use the basic techniques above to automate backup, migration and restore
+testing using your preferred tools.
+
 Known Issues
 ............
 

From 319e82a27b481783a119751b11362553b57eb7c8 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Fri, 28 Feb 2014 15:39:24 -0800
Subject: [PATCH 318/403] Check if the command exists before dereference

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 5ec68197056fbb63abba847b61bf447fed955359
Component: engine
---
 components/engine/container.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index 7e15761c37..ede3cfd79f 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -839,7 +839,7 @@ func (container *Container) cleanup() {
 	if err := container.stderr.CloseWriters(); err != nil {
 		utils.Errorf("%s: Error close stderr: %s", container.ID, err)
 	}
-	if container.command.Terminal != nil {
+	if container.command != nil && container.command.Terminal != nil {
 		if err := container.command.Terminal.Close(); err != nil {
 			utils.Errorf("%s: Error closing terminal: %s", container.ID, err)
 		}

From 48d86198db94b0a50c06b1164ec3c04d1ab90bb4 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Fri, 28 Feb 2014 16:35:43 -0800
Subject: [PATCH 319/403] Make the chan for utils.Go buffered in order to avoid
 goroutine leak

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: d3a6ee1e55a53ee54b91ffb6c53ba674768cf9de
Component: engine
---
 components/engine/utils/utils.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index f24e17c38e..7fa046c48b 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -33,7 +33,7 @@ type Fataler interface {
 // Go is a basic promise implementation: it wraps calls a function in a goroutine,
 // and returns a channel which will later return the function's return value.
 func Go(f func() error) chan error {
-	ch := make(chan error)
+	ch := make(chan error, 1)
 	go func() {
 		ch <- f()
 	}()

From 9a5ac39c28ac4333dc0d2f51579463655313fe92 Mon Sep 17 00:00:00 2001
From: ILYA Khlopotov <ilya.khlopotov@gmail.com>
Date: Fri, 28 Feb 2014 08:08:01 -0800
Subject: [PATCH 320/403] Support json output in --format flag of docker
 inspect

Docker-DCO-1.1-Signed-off-by: ILYA Khlopotov <ilya.khlopotov@gmail.com> (github: khia)
Upstream-commit: e07920f680a829724f617819f0c5715ed9b5194a
Component: engine
---
 components/engine/api/client.go                     |  9 ++++++++-
 .../docs/sources/reference/commandline/cli.rst      | 13 +++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index 2ea2dc44ea..24ba6d4914 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -37,6 +37,13 @@ import (
 	"time"
 )
 
+var funcMap = template.FuncMap{
+	"json": func(v interface{}) string {
+		a, _ := json.Marshal(v)
+		return string(a)
+	},
+}
+
 var (
 	ErrConnectionRefused = errors.New("Can't connect to docker daemon. Is 'docker -d' running on this host?")
 )
@@ -640,7 +647,7 @@ func (cli *DockerCli) CmdInspect(args ...string) error {
 	var tmpl *template.Template
 	if *tmplStr != "" {
 		var err error
-		if tmpl, err = template.New("").Parse(*tmplStr); err != nil {
+		if tmpl, err = template.New("").Funcs(funcMap).Parse(*tmplStr); err != nil {
 			fmt.Fprintf(cli.err, "Template parsing error: %v\n", err)
 			return &utils.StatusError{StatusCode: 64,
 				Status: "Template parsing error: " + err.Error()}
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 83161e3898..dd9ecc0e3d 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -805,6 +805,19 @@ we ask for the ``HostPort`` field to get the public address.
 
     $ sudo docker inspect -format='{{(index (index .NetworkSettings.Ports "8787/tcp") 0).HostPort}}' $INSTANCE_ID
 
+Get config
+..........
+
+The ``.Field`` syntax doesn't work when the field contains JSON data,
+but the template language's custom ``json`` function does. The ``.config``
+section contains complex json object, so to grab it as JSON, you use ``json``
+to convert config object into JSON
+
+.. code-block:: bash
+
+    $ sudo docker inspect -format='{{json .config}}' $INSTANCE_ID
+
+
 .. _cli_kill:
 
 ``kill``

From e8666de76866d03838d04828323029f85b09d58b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Fri, 28 Feb 2014 23:29:00 -0800
Subject: [PATCH 321/403] Don't always just append env vars, replace defaults
 with ones from config Docker-DCO-1.1-Signed-off-by: Michael Crosby
 <michael@crosbymichael.com> (github: crosbymichael) Upstream-commit:
 b02b933c6292c539833c15c15299628ac3360572 Component: engine

---
 components/engine/container.go        |  8 ++++----
 components/engine/utils/utils.go      | 19 +++++++++++++++++++
 components/engine/utils/utils_test.go | 18 ++++++++++++++++++
 3 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index ede3cfd79f..8dd672d0f9 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -507,10 +507,10 @@ func (container *Container) Start() (err error) {
 		}
 	}
 
-	for _, elem := range container.Config.Env {
-		env = append(env, elem)
-	}
-
+	// because the env on the container can override certain default values
+	// we need to replace the 'env' keys where they match and append anything
+	// else.
+	env = utils.ReplaceOrAppendEnvValues(env, container.Config.Env)
 	if err := container.generateEnvConfig(env); err != nil {
 		return err
 	}
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index f24e17c38e..fe9fb817d5 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -978,3 +978,22 @@ func NewReadCloserWrapper(r io.Reader, closer func() error) io.ReadCloser {
 		closer: closer,
 	}
 }
+
+// ReplaceOrAppendValues returns the defaults with the overrides either
+// replaced by env key or appended to the list
+func ReplaceOrAppendEnvValues(defaults, overrides []string) []string {
+	cache := make(map[string]int, len(defaults))
+	for i, e := range defaults {
+		parts := strings.SplitN(e, "=", 2)
+		cache[parts[0]] = i
+	}
+	for _, value := range overrides {
+		parts := strings.SplitN(value, "=", 2)
+		if i, exists := cache[parts[0]]; exists {
+			defaults[i] = value
+		} else {
+			defaults = append(defaults, value)
+		}
+	}
+	return defaults
+}
diff --git a/components/engine/utils/utils_test.go b/components/engine/utils/utils_test.go
index 78f4ca2bd2..ae19c89668 100644
--- a/components/engine/utils/utils_test.go
+++ b/components/engine/utils/utils_test.go
@@ -480,3 +480,21 @@ func StrSlicesEqual(a, b []string) bool {
 
 	return true
 }
+
+func TestReplaceAndAppendEnvVars(t *testing.T) {
+	var (
+		d = []string{"HOME=/"}
+		o = []string{"HOME=/root", "TERM=xterm"}
+	)
+
+	env := ReplaceOrAppendEnvValues(d, o)
+	if len(env) != 2 {
+		t.Fatalf("expected len of 2 got %d", len(env))
+	}
+	if env[0] != "HOME=/root" {
+		t.Fatalf("expected HOME=/root got '%s'", env[0])
+	}
+	if env[1] != "TERM=xterm" {
+		t.Fatalf("expected TERM=xterm got '%s'", env[1])
+	}
+}

From 197f474b34be599d888943cf5e04604d942033bb Mon Sep 17 00:00:00 2001
From: Barnaby Gray <barnaby@pickle.me.uk>
Date: Sat, 1 Mar 2014 17:33:54 +0000
Subject: [PATCH 322/403] Add fish shell completions from
 https://github.com/barnybug/docker-fish-completion.

Docker-DCO-1.1-Signed-off-by: Barnaby Gray <barnaby@pickle.me.uk> (github: barnybug)
Upstream-commit: bf6adf952b573d10d5e2eb1a08e382ea6182a5d0
Component: engine
---
 .../contrib/completion/fish/docker.fish       | 257 ++++++++++++++++++
 1 file changed, 257 insertions(+)
 create mode 100644 components/engine/contrib/completion/fish/docker.fish

diff --git a/components/engine/contrib/completion/fish/docker.fish b/components/engine/contrib/completion/fish/docker.fish
new file mode 100644
index 0000000000..2629533aac
--- /dev/null
+++ b/components/engine/contrib/completion/fish/docker.fish
@@ -0,0 +1,257 @@
+# docker.fish - docker completions for fish shell
+#
+# This file is generated by gen_docker_fish_completions.py from:
+# https://github.com/barnybug/docker-fish-completion
+#
+# To install the completions:
+# mkdir -p ~/.config/fish/completions
+# cp docker.fish ~/.config/fish/completions
+#
+# Completion supported:
+# - parameters
+# - commands
+# - containers
+# - images
+# - repositories
+
+function __fish_docker_no_subcommand --description 'Test if docker has yet to be given the subcommand'
+    for i in (commandline -opc)
+        if contains -- $i attach build commit cp diff events export history images import info insert inspect kill load login logs port ps pull push restart rm rmi run save search start stop tag top version wait
+            return 1
+        end
+    end
+    return 0
+end
+
+function __fish_print_docker_containers --description 'Print a list of docker containers' -a select
+    switch $select
+        case running
+            docker ps -a --no-trunc | awk 'NR>1' | awk 'BEGIN {FS="  +"}; $5 ~ "^Up" {print $1 "\n" $(NF-1)}' | tr ',' '\n'
+        case stopped
+            docker ps -a --no-trunc | awk 'NR>1' | awk 'BEGIN {FS="  +"}; $5 ~ "^Exit" {print $1 "\n" $(NF-1)}' | tr ',' '\n'
+        case all
+            docker ps -a --no-trunc | awk 'NR>1' | awk 'BEGIN {FS="  +"}; {print $1 "\n" $(NF-1)}' | tr ',' '\n'
+    end
+end
+
+function __fish_print_docker_images --description 'Print a list of docker images'
+    docker images | awk 'NR>1' | grep -v '<none>' | awk '{print $1":"$2}'
+end
+
+function __fish_print_docker_repositories --description 'Print a list of docker repositories'
+    docker images | awk 'NR>1' | grep -v '<none>' | awk '{print $1}' | sort | uniq
+end
+
+# common options
+complete -c docker -f -n '__fish_docker_no_subcommand' -s D -l debug -d 'Enable debug mode'
+complete -c docker -f -n '__fish_docker_no_subcommand' -s H -l host -d 'tcp://host:port, unix://path/to/socket, fd://* or fd://socketfd to use in daemon mode. Multiple sockets can be specified'
+complete -c docker -f -n '__fish_docker_no_subcommand' -l api-enable-cors -d 'Enable CORS headers in the remote API'
+complete -c docker -f -n '__fish_docker_no_subcommand' -s b -l bridge -d "Attach containers to a pre-existing network bridge; use 'none' to disable container networking"
+complete -c docker -f -n '__fish_docker_no_subcommand' -l bip -d "Use this CIDR notation address for the network bridge's IP, not compatible with -b"
+complete -c docker -f -n '__fish_docker_no_subcommand' -s d -l daemon -d 'Enable daemon mode'
+complete -c docker -f -n '__fish_docker_no_subcommand' -l dns -d 'Force docker to use specific DNS servers'
+complete -c docker -f -n '__fish_docker_no_subcommand' -s g -l graph -d 'Path to use as the root of the docker runtime'
+complete -c docker -f -n '__fish_docker_no_subcommand' -l icc -d 'Enable inter-container communication'
+complete -c docker -f -n '__fish_docker_no_subcommand' -l ip -d 'Default IP address to use when binding container ports'
+complete -c docker -f -n '__fish_docker_no_subcommand' -l ip-forward -d 'Disable enabling of net.ipv4.ip_forward'
+complete -c docker -f -n '__fish_docker_no_subcommand' -l iptables -d "Disable docker's addition of iptables rules"
+complete -c docker -f -n '__fish_docker_no_subcommand' -l mtu -d 'Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if not default route is available'
+complete -c docker -f -n '__fish_docker_no_subcommand' -s p -l pidfile -d 'Path to use for daemon PID file'
+complete -c docker -f -n '__fish_docker_no_subcommand' -s r -l restart -d 'Restart previously running containers'
+complete -c docker -f -n '__fish_docker_no_subcommand' -s s -l storage-driver -d 'Force the docker runtime to use a specific storage driver'
+complete -c docker -f -n '__fish_docker_no_subcommand' -s v -l version -d 'Print version information and quit'
+
+# subcommands
+# attach
+complete -c docker -f -n '__fish_docker_no_subcommand' -a attach -d 'Attach to a running container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from attach' -l no-stdin -d 'Do not attach stdin'
+complete -c docker -A -f -n '__fish_seen_subcommand_from attach' -l sig-proxy -d 'Proxify all received signal to the process (even in non-tty mode)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from attach' -a '(__fish_print_docker_containers running)' -d "Container"
+
+# build
+complete -c docker -f -n '__fish_docker_no_subcommand' -a build -d 'Build a container from a Dockerfile'
+complete -c docker -A -f -n '__fish_seen_subcommand_from build' -l no-cache -d 'Do not use cache when building the image'
+complete -c docker -A -f -n '__fish_seen_subcommand_from build' -s q -l quiet -d 'Suppress verbose build output'
+complete -c docker -A -f -n '__fish_seen_subcommand_from build' -l rm -d 'Remove intermediate containers after a successful build'
+complete -c docker -A -f -n '__fish_seen_subcommand_from build' -s t -l tag -d 'Repository name (and optionally a tag) to be applied to the resulting image in case of success'
+
+# commit
+complete -c docker -f -n '__fish_docker_no_subcommand' -a commit -d "Create a new image from a container's changes"
+complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -s a -l author -d 'Author (eg. "John Hannibal Smith <hannibal@a-team.com>"'
+complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -s m -l message -d 'Commit message'
+complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -l run -d 'Config automatically applied when the image is run. (ex: -run=\'{"Cmd": ["cat", "/world"], "PortSpecs": ["22"]}\')'
+complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -a '(__fish_print_docker_containers all)' -d "Container"
+
+# cp
+complete -c docker -f -n '__fish_docker_no_subcommand' -a cp -d 'Copy files/folders from the containers filesystem to the host path'
+
+# diff
+complete -c docker -f -n '__fish_docker_no_subcommand' -a diff -d "Inspect changes on a container's filesystem"
+complete -c docker -A -f -n '__fish_seen_subcommand_from diff' -a '(__fish_print_docker_containers all)' -d "Container"
+
+# events
+complete -c docker -f -n '__fish_docker_no_subcommand' -a events -d 'Get real time events from the server'
+complete -c docker -A -f -n '__fish_seen_subcommand_from events' -l since -d 'Show previously created events and then stream.'
+
+# export
+complete -c docker -f -n '__fish_docker_no_subcommand' -a export -d 'Stream the contents of a container as a tar archive'
+complete -c docker -A -f -n '__fish_seen_subcommand_from export' -a '(__fish_print_docker_containers all)' -d "Container"
+
+# history
+complete -c docker -f -n '__fish_docker_no_subcommand' -a history -d 'Show the history of an image'
+complete -c docker -A -f -n '__fish_seen_subcommand_from history' -l no-trunc -d "Don't truncate output"
+complete -c docker -A -f -n '__fish_seen_subcommand_from history' -s q -l quiet -d 'only show numeric IDs'
+complete -c docker -A -f -n '__fish_seen_subcommand_from history' -a '(__fish_print_docker_images)' -d "Image"
+
+# images
+complete -c docker -f -n '__fish_docker_no_subcommand' -a images -d 'List images'
+complete -c docker -A -f -n '__fish_seen_subcommand_from images' -s a -l all -d 'show all images (by default filter out the intermediate images used to build)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from images' -l no-trunc -d "Don't truncate output"
+complete -c docker -A -f -n '__fish_seen_subcommand_from images' -s q -l quiet -d 'only show numeric IDs'
+complete -c docker -A -f -n '__fish_seen_subcommand_from images' -s t -l tree -d 'output graph in tree format'
+complete -c docker -A -f -n '__fish_seen_subcommand_from images' -s v -l viz -d 'output graph in graphviz format'
+complete -c docker -A -f -n '__fish_seen_subcommand_from images' -a '(__fish_print_docker_repositories)' -d "Repository"
+
+# import
+complete -c docker -f -n '__fish_docker_no_subcommand' -a import -d 'Create a new filesystem image from the contents of a tarball'
+
+# info
+complete -c docker -f -n '__fish_docker_no_subcommand' -a info -d 'Display system-wide information'
+
+# insert
+complete -c docker -f -n '__fish_docker_no_subcommand' -a insert -d 'Insert a file in an image'
+complete -c docker -A -f -n '__fish_seen_subcommand_from insert' -a '(__fish_print_docker_images)' -d "Image"
+
+# inspect
+complete -c docker -f -n '__fish_docker_no_subcommand' -a inspect -d 'Return low-level information on a container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -s f -l format -d 'Format the output using the given go template.'
+complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -a '(__fish_print_docker_images)' -d "Image"
+complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -a '(__fish_print_docker_containers running)' -d "Container"
+
+# kill
+complete -c docker -f -n '__fish_docker_no_subcommand' -a kill -d 'Kill a running container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from kill' -s s -l signal -d 'Signal to send to the container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from kill' -a '(__fish_print_docker_containers running)' -d "Container"
+
+# load
+complete -c docker -f -n '__fish_docker_no_subcommand' -a load -d 'Load an image from a tar archive'
+
+# login
+complete -c docker -f -n '__fish_docker_no_subcommand' -a login -d 'Register or Login to the docker registry server'
+complete -c docker -A -f -n '__fish_seen_subcommand_from login' -s e -l email -d 'email'
+complete -c docker -A -f -n '__fish_seen_subcommand_from login' -s p -l password -d 'password'
+complete -c docker -A -f -n '__fish_seen_subcommand_from login' -s u -l username -d 'username'
+
+# logs
+complete -c docker -f -n '__fish_docker_no_subcommand' -a logs -d 'Fetch the logs of a container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from logs' -s f -l follow -d 'Follow log output'
+complete -c docker -A -f -n '__fish_seen_subcommand_from logs' -a '(__fish_print_docker_containers running)' -d "Container"
+
+# port
+complete -c docker -f -n '__fish_docker_no_subcommand' -a port -d 'Lookup the public-facing port which is NAT-ed to PRIVATE_PORT'
+complete -c docker -A -f -n '__fish_seen_subcommand_from port' -a '(__fish_print_docker_containers running)' -d "Container"
+
+# ps
+complete -c docker -f -n '__fish_docker_no_subcommand' -a ps -d 'List containers'
+complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s a -l all -d 'Show all containers. Only running containers are shown by default.'
+complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -l before-id -d 'Show only container created before Id, include non-running ones.'
+complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s l -l latest -d 'Show only the latest created container, include non-running ones.'
+complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s n -d 'Show n last created containers, include non-running ones.'
+complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -l no-trunc -d "Don't truncate output"
+complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s q -l quiet -d 'Only display numeric IDs'
+complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s s -l size -d 'Display sizes'
+complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -l since-id -d 'Show only containers created since Id, include non-running ones.'
+
+# pull
+complete -c docker -f -n '__fish_docker_no_subcommand' -a pull -d 'Pull an image or a repository from the docker registry server'
+complete -c docker -A -f -n '__fish_seen_subcommand_from pull' -s t -l tag -d 'Download tagged image in repository'
+complete -c docker -A -f -n '__fish_seen_subcommand_from pull' -a '(__fish_print_docker_images)' -d "Image"
+complete -c docker -A -f -n '__fish_seen_subcommand_from pull' -a '(__fish_print_docker_repositories)' -d "Repository"
+
+# push
+complete -c docker -f -n '__fish_docker_no_subcommand' -a push -d 'Push an image or a repository to the docker registry server'
+complete -c docker -A -f -n '__fish_seen_subcommand_from push' -a '(__fish_print_docker_images)' -d "Image"
+complete -c docker -A -f -n '__fish_seen_subcommand_from push' -a '(__fish_print_docker_repositories)' -d "Repository"
+
+# restart
+complete -c docker -f -n '__fish_docker_no_subcommand' -a restart -d 'Restart a running container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from restart' -s t -l time -d 'Number of seconds to try to stop for before killing the container. Once killed it will then be restarted. Default=10'
+complete -c docker -A -f -n '__fish_seen_subcommand_from restart' -a '(__fish_print_docker_containers running)' -d "Container"
+
+# rm
+complete -c docker -f -n '__fish_docker_no_subcommand' -a rm -d 'Remove one or more containers'
+complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -s l -l link -d 'Remove the specified link and not the underlying container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -s v -l volumes -d 'Remove the volumes associated to the container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -a '(__fish_print_docker_containers stopped)' -d "Container"
+
+# rmi
+complete -c docker -f -n '__fish_docker_no_subcommand' -a rmi -d 'Remove one or more images'
+complete -c docker -A -f -n '__fish_seen_subcommand_from rmi' -a '(__fish_print_docker_images)' -d "Image"
+
+# run
+complete -c docker -f -n '__fish_docker_no_subcommand' -a run -d 'Run a command in a new container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s P -l publish-all -d 'Publish all exposed ports to the host interfaces'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s a -l attach -d 'Attach to stdin, stdout or stderr.'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s c -l cpu-shares -d 'CPU shares (relative weight)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l cidfile -d 'Write the container ID to the file'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s d -l detach -d 'Detached mode: Run container in the background, print new container id'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l dns -d 'Set custom dns servers'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s e -l env -d 'Set environment variables'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l entrypoint -d 'Overwrite the default entrypoint of the image'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l expose -d 'Expose a port from the container without publishing it to your host'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s h -l hostname -d 'Container host name'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s i -l interactive -d 'Keep stdin open even if not attached'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l link -d 'Add link to another container (name:alias)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l lxc-conf -d 'Add custom lxc options -lxc-conf="lxc.cgroup.cpuset.cpus = 0,1"'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s m -l memory -d 'Memory limit (format: <number><optional unit>, where unit = b, k, m or g)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s n -l networking -d 'Enable networking for this container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l name -d 'Assign a name to the container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s p -l publish -d "Publish a container's port to the host (format: ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort) (use 'docker port' to see the actual mapping)"
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l privileged -d 'Give extended privileges to this container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l rm -d 'Automatically remove the container when it exits (incompatible with -d)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l sig-proxy -d 'Proxify all received signal to the process (even in non-tty mode)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s t -l tty -d 'Allocate a pseudo-tty'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s u -l user -d 'Username or UID'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s v -l volume -d 'Bind mount a volume (e.g. from the host: -v /host:/container, from docker: -v /container)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l volumes-from -d 'Mount volumes from the specified container(s)'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s w -l workdir -d 'Working directory inside the container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from run' -a '(__fish_print_docker_images)' -d "Image"
+
+# save
+complete -c docker -f -n '__fish_docker_no_subcommand' -a save -d 'Save an image to a tar archive'
+complete -c docker -A -f -n '__fish_seen_subcommand_from save' -a '(__fish_print_docker_images)' -d "Image"
+
+# search
+complete -c docker -f -n '__fish_docker_no_subcommand' -a search -d 'Search for an image in the docker index'
+complete -c docker -A -f -n '__fish_seen_subcommand_from search' -l no-trunc -d "Don't truncate output"
+complete -c docker -A -f -n '__fish_seen_subcommand_from search' -s s -l stars -d 'Only displays with at least xxx stars'
+complete -c docker -A -f -n '__fish_seen_subcommand_from search' -s t -l trusted -d 'Only show trusted builds'
+
+# start
+complete -c docker -f -n '__fish_docker_no_subcommand' -a start -d 'Start a stopped container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from start' -s a -l attach -d "Attach container's stdout/stderr and forward all signals to the process"
+complete -c docker -A -f -n '__fish_seen_subcommand_from start' -s i -l interactive -d "Attach container's stdin"
+complete -c docker -A -f -n '__fish_seen_subcommand_from start' -a '(__fish_print_docker_containers stopped)' -d "Container"
+
+# stop
+complete -c docker -f -n '__fish_docker_no_subcommand' -a stop -d 'Stop a running container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from stop' -s t -l time -d 'Number of seconds to wait for the container to stop before killing it.'
+complete -c docker -A -f -n '__fish_seen_subcommand_from stop' -a '(__fish_print_docker_containers running)' -d "Container"
+
+# tag
+complete -c docker -f -n '__fish_docker_no_subcommand' -a tag -d 'Tag an image into a repository'
+complete -c docker -A -f -n '__fish_seen_subcommand_from tag' -s f -l force -d 'Force'
+complete -c docker -A -f -n '__fish_seen_subcommand_from tag' -a '(__fish_print_docker_images)' -d "Image"
+
+# top
+complete -c docker -f -n '__fish_docker_no_subcommand' -a top -d 'Lookup the running processes of a container'
+complete -c docker -A -f -n '__fish_seen_subcommand_from top' -a '(__fish_print_docker_containers running)' -d "Container"
+
+# version
+complete -c docker -f -n '__fish_docker_no_subcommand' -a version -d 'Show the docker version information'
+
+# wait
+complete -c docker -f -n '__fish_docker_no_subcommand' -a wait -d 'Block until a container stops, then print its exit code'
+complete -c docker -A -f -n '__fish_seen_subcommand_from wait' -a '(__fish_print_docker_containers running)' -d "Container"
+
+

From d9902b0a95989296913b985f7ba1407011e20226 Mon Sep 17 00:00:00 2001
From: Brandon Philips <brandon@ifup.co>
Date: Fri, 28 Feb 2014 20:43:08 -0800
Subject: [PATCH 323/403] fix(api): serve until the "acceptconnections" job

This fixes a bug that I encountered when using socket activation with
docker 0.8.1. When running the first `docker run` it would return:
"create: command not found".

The root cause was the socket activation code path was starting to
listen before the "initserver" job had finished. This meant that the
"create" handler hand't been registered yet leading to the command not
found error.

In log format it looks like this:

```
[/var/lib/docker|9d2e78e9] +job initserver()
2014/03/01 04:05:35 Listening for HTTP on fd ()
[/var/lib/docker|0d71c177] +job create()
create: command not found
[/var/lib/docker|0d71c177] -job create()
[/var/lib/docker|0d71c177] +job acceptconnections()
[/var/lib/docker|0d71c177] -job initserver() = OK (0)
```

To fix the issue select on the activationLock and block until the
"acceptconnections" job has ran.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Upstream-commit: 8d2226b7e5a5d5334f80d3ec03313fe2cd3210a3
Component: engine
---
 components/engine/api/server.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index b6beb45403..7868600314 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -1079,6 +1079,11 @@ func ServeFd(addr string, handle http.Handler) error {
 
 	chErrors := make(chan error, len(ls))
 
+	// We don't want to start serving on these sockets until the
+	// "initserver" job has completed. Otherwise required handlers
+	// won't be ready.
+	<-activationLock
+
 	// Since ListenFD will return one or more sockets we have
 	// to create a go func to spawn off multiple serves
 	for i := range ls {

From b706d63e16e0eac004b655ca3d554205a72a11bf Mon Sep 17 00:00:00 2001
From: FunkyMonkeyMonk <monkey@buildingbananas.com>
Date: Sat, 1 Mar 2014 20:43:22 -0500
Subject: [PATCH 324/403] adding note that host-volumes must be defined using
 absolute paths

Docker-DCO-1.1-Signed-off-by: Will Weaver <monkey@buildingbananas.com> (github: funkymonkeymonk)
Upstream-commit: 3ddfbf68802b7a62dcdefd46decb3f7f6faebabe
Component: engine
---
 components/engine/AUTHORS                                   | 1 +
 components/engine/docs/sources/use/working_with_volumes.rst | 1 +
 2 files changed, 2 insertions(+)

diff --git a/components/engine/AUTHORS b/components/engine/AUTHORS
index a54c6337cb..df091d5950 100644
--- a/components/engine/AUTHORS
+++ b/components/engine/AUTHORS
@@ -334,6 +334,7 @@ Wes Morgan <cap10morgan@gmail.com>
 Will Dietz <w@wdtz.org>
 William Delanoue <william.delanoue@gmail.com>
 Will Rouesnel <w.rouesnel@gmail.com>
+Will Weaver <monkey@buildingbananas.com>
 Xiuming Chen <cc@cxm.cc>
 Yang Bai <hamo.by@gmail.com>
 Yurii Rashkovskii <yrashk@gmail.com>
diff --git a/components/engine/docs/sources/use/working_with_volumes.rst b/components/engine/docs/sources/use/working_with_volumes.rst
index 9a27e4b929..2e3b36ba2f 100644
--- a/components/engine/docs/sources/use/working_with_volumes.rst
+++ b/components/engine/docs/sources/use/working_with_volumes.rst
@@ -90,6 +90,7 @@ Mount a Host Directory as a Container Volume:
 
   -v=[]: Create a bind mount with: [host-dir]:[container-dir]:[rw|ro].
 
+You must specify an absolute path for ``host-dir``.
 If ``host-dir`` is missing from the command, then docker creates a new volume.
 If ``host-dir`` is present but points to a non-existent directory on the host,
 Docker will automatically create this directory and use it as the source of the

From d89cecd319521110f96b7b7316fb06abd3f647ad Mon Sep 17 00:00:00 2001
From: German DZ <germ@ndz.com.ar>
Date: Sun, 2 Mar 2014 13:50:34 +0100
Subject: [PATCH 325/403] DOC: Fix switch name for tagging images in build
 command

Docker-DCO-1.1-Signed-off-by: German Del Zotto <germ@ndz.com.ar> (github: GermanDZ)
Upstream-commit: 62b88cd61943bdc025a989bc3e113434d9c44880
Component: engine
---
 components/engine/docs/sources/reference/commandline/cli.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index b221f0de6b..9c838bb62a 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -185,7 +185,7 @@ Examples:
 
     Usage: docker build [OPTIONS] PATH | URL | -
     Build a new container image from the source code at PATH
-      -t, --time="": Repository name (and optionally a tag) to be applied 
+      -t, --tag="": Repository name (and optionally a tag) to be applied
              to the resulting image in case of success.
       -q, --quiet=false: Suppress the verbose output generated by the containers.
       --no-cache: Do not use the cache when building the image.

From ccaab9867b8367161fd4b1afd9833e299f0698b9 Mon Sep 17 00:00:00 2001
From: Lewis Peckover <lew+github@lew.io>
Date: Sun, 2 Mar 2014 14:50:16 +0000
Subject: [PATCH 326/403] mkdir /dev before doing mknod

Docker-DCO-1.1-Signed-off-by: Lewis Peckover <lew@lew.io> (github: lewispeckover)
Upstream-commit: 6d55a9d7ceec7f9c114839f9c380321a93291aa5
Component: engine
---
 components/engine/contrib/mkimage-yum.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/contrib/mkimage-yum.sh b/components/engine/contrib/mkimage-yum.sh
index 0e4e8ea1d7..f21a63a225 100755
--- a/components/engine/contrib/mkimage-yum.sh
+++ b/components/engine/contrib/mkimage-yum.sh
@@ -45,6 +45,7 @@ target=$(mktemp -d --tmpdir $(basename $0).XXXXXX)
 
 set -x
 
+mkdir -m 755 "$target"/dev
 mknod -m 600 "$target"/dev/console c 5 1
 mknod -m 600 "$target"/dev/initctl p
 mknod -m 666 "$target"/dev/full c 1 7

From 69c5fbdfefc652b73161d2c850abfc8643eba21e Mon Sep 17 00:00:00 2001
From: James Turnbull <james@lovedthanlost.net>
Date: Sun, 2 Mar 2014 10:54:43 -0500
Subject: [PATCH 327/403] Added documentation (and some cleanup) around small
 patch exemptions

Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Upstream-commit: b187d7ae41a1f946d536b42108ec082541883d26
Component: engine
---
 components/engine/CONTRIBUTING.md      | 11 +++-
 components/engine/docs/sources/faq.rst |  8 ++-
 components/engine/hack/MAINTAINERS.md  | 80 ++++++++++++++++----------
 3 files changed, 64 insertions(+), 35 deletions(-)

diff --git a/components/engine/CONTRIBUTING.md b/components/engine/CONTRIBUTING.md
index c4095641cb..7eb20c473a 100644
--- a/components/engine/CONTRIBUTING.md
+++ b/components/engine/CONTRIBUTING.md
@@ -117,7 +117,7 @@ to indicate acceptance.
 A change requires LGTMs from an absolute majority of the maintainers of each
 component affected. For example, if a change affects docs/ and registry/, it
 needs an absolute majority from the maintainers of docs/ AND, separately, an
-absolute majority of the maintainers of registry
+absolute majority of the maintainers of registry.
 
 For more details see [MAINTAINERS.md](hack/MAINTAINERS.md)
 
@@ -170,10 +170,15 @@ curl -o .git/hooks/prepare-commit-msg https://raw.github.com/dotcloud/docker/mas
 
 * Note: the above script expects to find your GitHub user name in ``git config --get github.user``
 
+#### Small patch exception
+
+There are several exceptions to the signing requirement. Currently these are:
+
+* Your patch fixes spelling or grammar errors.
+* Your patch is a single line change to documentation.
+
 If you have any questions, please refer to the FAQ in the [docs](http://docs.docker.io)
 
-
-
 ### How can I become a maintainer?
 
 * Step 1: learn the component inside out
diff --git a/components/engine/docs/sources/faq.rst b/components/engine/docs/sources/faq.rst
index 2b48cc564c..07055941bd 100644
--- a/components/engine/docs/sources/faq.rst
+++ b/components/engine/docs/sources/faq.rst
@@ -189,10 +189,15 @@ How do I report a security issue with Docker?
 You can learn about the project's security policy `here <http://www.docker.io/security/>`_
 and report security issues to this `mailbox <mailto:security@docker.com>`_.
 
+Why do I need to sign my commits to Docker with the DCO?
+........................................................
+
+Please read `our blog post <http://blog.docker.io/2014/01/docker-code-contributions-require-developer-certificate-of-origin/>`_ on the introduction of the DCO.
+
 Can I help by adding some questions and answers?
 ................................................
 
-   Definitely! You can fork `the repo`_ and edit the documentation sources.
+Definitely! You can fork `the repo`_ and edit the documentation sources.
 
 
 Where can I find more answers?
@@ -216,5 +221,4 @@ Where can I find more answers?
     .. _Ask questions on Stackoverflow: http://stackoverflow.com/search?q=docker
     .. _Join the conversation on Twitter: http://twitter.com/docker
 
-
 Looking for something else to read? Checkout the :ref:`hello_world` example.
diff --git a/components/engine/hack/MAINTAINERS.md b/components/engine/hack/MAINTAINERS.md
index 8944fbee1a..be3117c864 100644
--- a/components/engine/hack/MAINTAINERS.md
+++ b/components/engine/hack/MAINTAINERS.md
@@ -1,22 +1,24 @@
-# The Docker maintainer manual
+# The Docker Maintainer manual
 
 ## Introduction
 
-Dear maintainer. Thank you for investing the time and energy to help make Docker as
-useful as possible. Maintaining a project is difficult, sometimes unrewarding work.
-Sure, you will get to contribute cool features to the project. But most of your time
-will be spent reviewing, cleaning up, documenting, answering questions, justifying
-design decisions - while everyone has all the fun! But remember - the quality of the
-maintainers work is what distinguishes the good projects from the great.
-So please be proud of your work, even the unglamourous parts, and encourage a culture
-of appreciation and respect for *every* aspect of improving the project - not just the
-hot new features.
+Dear maintainer. Thank you for investing the time and energy to help
+make Docker as useful as possible. Maintaining a project is difficult,
+sometimes unrewarding work.  Sure, you will get to contribute cool
+features to the project. But most of your time will be spent reviewing,
+cleaning up, documenting, answering questions, justifying design
+decisions - while everyone has all the fun! But remember - the quality
+of the maintainers work is what distinguishes the good projects from the
+great.  So please be proud of your work, even the unglamourous parts,
+and encourage a culture of appreciation and respect for *every* aspect
+of improving the project - not just the hot new features.
 
-This document is a manual for maintainers old and new. It explains what is expected of
-maintainers, how they should work, and what tools are available to them.
-
-This is a living document - if you see something out of date or missing, speak up!
+This document is a manual for maintainers old and new. It explains what
+is expected of maintainers, how they should work, and what tools are
+available to them.
 
+This is a living document - if you see something out of date or missing,
+speak up!
 
 ## What are a maintainer's responsibility?
 
@@ -24,19 +26,26 @@ It is every maintainer's responsibility to:
 
 * 1) Expose a clear roadmap for improving their component.
 * 2) Deliver prompt feedback and decisions on pull requests.
-* 3) Be available to anyone with questions, bug reports, criticism etc. on their component. This includes irc, github requests and the mailing list.
-* 4) Make sure their component respects the philosophy, design and roadmap of the project.
-
+* 3) Be available to anyone with questions, bug reports, criticism etc.
+  on their component. This includes IRC, GitHub requests and the mailing
+  list.
+* 4) Make sure their component respects the philosophy, design and
+  roadmap of the project.
 
 ## How are decisions made?
 
 Short answer: with pull requests to the docker repository.
 
-Docker is an open-source project with an open design philosophy. This means that the repository is the source of truth for EVERY aspect of the project,
-including its philosophy, design, roadmap and APIs. *If it's part of the project, it's in the repo. It's in the repo, it's part of the project.*
+Docker is an open-source project with an open design philosophy. This
+means that the repository is the source of truth for EVERY aspect of the
+project, including its philosophy, design, roadmap and APIs. *If it's
+part of the project, it's in the repo. It's in the repo, it's part of
+the project.*
 
-As a result, all decisions can be expressed as changes to the repository. An implementation change is a change to the source code. An API change is a change to
-the API specification. A philosophy change is a change to the philosophy manifesto. And so on.
+As a result, all decisions can be expressed as changes to the
+repository. An implementation change is a change to the source code. An
+API change is a change to the API specification. A philosophy change is
+a change to the philosophy manifesto. And so on.
 
 All decisions affecting docker, big and small, follow the same 3 steps:
 
@@ -49,25 +58,36 @@ All decisions affecting docker, big and small, follow the same 3 steps:
 
 ## Who decides what?
 
-So all decisions are pull requests, and the relevant maintainer makes the decision by accepting or refusing the pull request.
-But how do we identify the relevant maintainer for a given pull request?
+So all decisions are pull requests, and the relevant maintainer makes
+the decision by accepting or refusing the pull request.  But how do we
+identify the relevant maintainer for a given pull request?
 
-Docker follows the timeless, highly efficient and totally unfair system known as [Benevolent dictator for life](http://en.wikipedia.org/wiki/Benevolent_Dictator_for_Life),
-with yours truly, Solomon Hykes, in the role of BDFL.
-This means that all decisions are made by default by me. Since making every decision myself would be highly un-scalable, in practice decisions are spread across multiple maintainers.
+Docker follows the timeless, highly efficient and totally unfair system
+known as [Benevolent dictator for
+life](http://en.wikipedia.org/wiki/Benevolent_Dictator_for_Life), with
+yours truly, Solomon Hykes, in the role of BDFL. This means that all
+decisions are made by default by Solomon. Since making every decision
+myself would be highly un-scalable, in practice decisions are spread
+across multiple maintainers.
 
 The relevant maintainer for a pull request is assigned in 3 steps:
 
-* Step 1: Determine the subdirectory affected by the pull request. This might be src/registry, docs/source/api, or any other part of the repo.
+* Step 1: Determine the subdirectory affected by the pull request. This
+  might be `src/registry`, `docs/source/api`, or any other part of the repo.
 
-* Step 2: Find the MAINTAINERS file which affects this directory. If the directory itself does not have a MAINTAINERS file, work your way up the repo hierarchy until you find one.
+* Step 2: Find the `MAINTAINERS` file which affects this directory. If the
+  directory itself does not have a `MAINTAINERS` file, work your way up
+  the repo hierarchy until you find one.
 
-* Step 3: The first maintainer listed is the primary maintainer. The pull request is assigned to him. He may assign it to other listed maintainers, at his discretion.
+* Step 3: The first maintainer listed is the primary maintainer. The
+  pull request is assigned to him. He may assign it to other listed
+  maintainers, at his discretion.
 
 
 ### I'm a maintainer, should I make pull requests too?
 
-Yes. Nobody should ever push to master directly. All changes should be made through a pull request.
+Yes. Nobody should ever push to master directly. All changes should be
+made through a pull request.
 
 ### Who assigns maintainers?
 

From 1c9accc81848bad3482284c48fbd158614c526b4 Mon Sep 17 00:00:00 2001
From: Ian Truslove <ian.truslove@gmail.com>
Date: Sun, 2 Mar 2014 13:32:48 -0700
Subject: [PATCH 328/403] Fix minor typo Upstream-commit:
 3de1d25c11c592510cd1be3c8c2e7fa754305484 Component: engine

---
 components/engine/docs/sources/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/index.rst b/components/engine/docs/sources/index.rst
index df111f6aa5..a89349b2bb 100644
--- a/components/engine/docs/sources/index.rst
+++ b/components/engine/docs/sources/index.rst
@@ -17,7 +17,7 @@ Common use cases for Docker include:
 - Deploying and scaling databases and backend services in a service-oriented environment.
 - Building custom PaaS environments, either from scratch or as an extension of off-the-shelf platforms like OpenShift or Cloud Foundry.
 
-Please note Docker is currently under heavy developement. It should not be used in production (yet).
+Please note Docker is currently under heavy development. It should not be used in production (yet).
 
 For a high-level overview of Docker, please see the `Introduction
 <http://www.docker.io/learn_more/>`_. When you're ready to start working with

From 536d686ec45dc193bf931b1ccf732c791c503ccf Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Mon, 3 Mar 2014 15:09:54 +0200
Subject: [PATCH 329/403] bump go to 1.2.1 in the Dockerfile

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 4a688d6864e0a42b5300754a077f7c0fd45a0929
Component: engine
---
 components/engine/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/Dockerfile b/components/engine/Dockerfile
index 8eb2459215..9271aa0d02 100644
--- a/components/engine/Dockerfile
+++ b/components/engine/Dockerfile
@@ -62,7 +62,7 @@ RUN	cd /usr/local/lvm2 && ./configure --enable-static_link && make device-mapper
 # see https://git.fedorahosted.org/cgit/lvm2.git/tree/INSTALL
 
 # Install Go
-RUN	curl -s https://go.googlecode.com/files/go1.2.src.tar.gz | tar -v -C /usr/local -xz
+RUN	curl -s https://go.googlecode.com/files/go1.2.1.src.tar.gz | tar -v -C /usr/local -xz
 ENV	PATH	/usr/local/go/bin:$PATH
 ENV	GOPATH	/go:/go/src/github.com/dotcloud/docker/vendor
 RUN	cd /usr/local/go/src && ./make.bash --no-clean 2>&1

From c8d0d20361d40c063dc75a38e10a474452a62304 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 18 Feb 2014 11:41:11 +0100
Subject: [PATCH 330/403] runtime: Fix unique constraint error checks

The sqlite3 version in fedora (3.8) returns a different error string in the unique constraints
failure case than the one in hack/ (3.7). This updates the check to detect both, fixing
one integration check failure on Fedora.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: e8af7fcf6da03da65a379c12c90e6626c31846ae
Component: engine
---
 components/engine/pkg/graphdb/graphdb.go | 16 ++++++++++++++++
 components/engine/runtime.go             |  2 +-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/components/engine/pkg/graphdb/graphdb.go b/components/engine/pkg/graphdb/graphdb.go
index 9e2466b692..46a23b1e7b 100644
--- a/components/engine/pkg/graphdb/graphdb.go
+++ b/components/engine/pkg/graphdb/graphdb.go
@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"fmt"
 	"path"
+	"strings"
 	"sync"
 )
 
@@ -51,6 +52,21 @@ type Database struct {
 	mux  sync.RWMutex
 }
 
+func IsNonUniqueNameError(err error) bool {
+	str := err.Error()
+	// sqlite 3.7.17-1ubuntu1 returns:
+	// Set failure: Abort due to constraint violation: columns parent_id, name are not unique
+	if strings.HasSuffix(str, "name are not unique") {
+		return true
+	}
+	// sqlite-3.8.3-1.fc20 returns:
+	// Set failure: Abort due to constraint violation: UNIQUE constraint failed: edge.parent_id, edge.name
+	if strings.Contains(str, "UNIQUE constraint failed") && strings.Contains(str, "edge.name") {
+		return true
+	}
+	return false
+}
+
 // Create a new graph database initialized with a root entity
 func NewDatabase(conn *sql.DB, init bool) (*Database, error) {
 	if conn == nil {
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 0c2c17d7a4..6cebab6e1c 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -396,7 +396,7 @@ func (runtime *Runtime) Create(config *runconfig.Config, name string) (*Containe
 
 	// Set the enitity in the graph using the default name specified
 	if _, err := runtime.containerGraph.Set(name, id); err != nil {
-		if !strings.HasSuffix(err.Error(), "name are not unique") {
+		if !graphdb.IsNonUniqueNameError(err) {
 			return nil, nil, err
 		}
 

From d1123e2435b8007fec919f21e77c9b2bad2292c3 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 18 Feb 2014 11:58:38 +0100
Subject: [PATCH 331/403] aufs: Skip tests if aufs not supported

This makes it possible to pass the rest of the testsuite without aufs in the kernel.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 9e28c3e3f86664ef8f219f11ef19c74a414346a9
Component: engine
---
 components/engine/graphdriver/aufs/aufs.go    |  6 +++-
 .../engine/graphdriver/aufs/aufs_test.go      | 31 ++++++++++---------
 2 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/components/engine/graphdriver/aufs/aufs.go b/components/engine/graphdriver/aufs/aufs.go
index f2a88a7ace..a15cf6b273 100644
--- a/components/engine/graphdriver/aufs/aufs.go
+++ b/components/engine/graphdriver/aufs/aufs.go
@@ -34,6 +34,10 @@ import (
 	"sync"
 )
 
+var (
+	ErrAufsNotSupported = fmt.Errorf("AUFS was not found in /proc/filesystems")
+)
+
 func init() {
 	graphdriver.Register("aufs", Init)
 }
@@ -100,7 +104,7 @@ func supportsAufs() error {
 			return nil
 		}
 	}
-	return fmt.Errorf("AUFS was not found in /proc/filesystems")
+	return ErrAufsNotSupported
 }
 
 func (a Driver) rootPath() string {
diff --git a/components/engine/graphdriver/aufs/aufs_test.go b/components/engine/graphdriver/aufs/aufs_test.go
index c43bd74038..6002bec5a1 100644
--- a/components/engine/graphdriver/aufs/aufs_test.go
+++ b/components/engine/graphdriver/aufs/aufs_test.go
@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"github.com/dotcloud/docker/archive"
+	"github.com/dotcloud/docker/graphdriver"
 	"io/ioutil"
 	"os"
 	"path"
@@ -15,15 +16,24 @@ var (
 	tmp = path.Join(os.TempDir(), "aufs-tests", "aufs")
 )
 
+func testInit(dir string, t *testing.T) graphdriver.Driver {
+	d, err := Init(dir)
+	if err != nil {
+		if err == ErrAufsNotSupported {
+			t.Skip(err)
+		} else {
+			t.Fatal(err)
+		}
+	}
+	return d
+}
+
 func newDriver(t *testing.T) *Driver {
 	if err := os.MkdirAll(tmp, 0755); err != nil {
 		t.Fatal(err)
 	}
 
-	d, err := Init(tmp)
-	if err != nil {
-		t.Fatal(err)
-	}
+	d := testInit(tmp, t)
 	return d.(*Driver)
 }
 
@@ -32,10 +42,7 @@ func TestNewDriver(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	d, err := Init(tmp)
-	if err != nil {
-		t.Fatal(err)
-	}
+	d := testInit(tmp, t)
 	defer os.RemoveAll(tmp)
 	if d == nil {
 		t.Fatalf("Driver should not be nil")
@@ -74,12 +81,8 @@ func TestNewDriverFromExistingDir(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if _, err := Init(tmp); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := Init(tmp); err != nil {
-		t.Fatal(err)
-	}
+	testInit(tmp, t)
+	testInit(tmp, t)
 	os.RemoveAll(tmp)
 }
 

From 5f84dbf6b977b0caeeb619dc6ee0f267dc520955 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Mon, 3 Mar 2014 19:17:28 +0000
Subject: [PATCH 332/403] prevent flag grouping with --

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: cb3d27d01bbf696929b4d77d10e47eca2693e3fa
Component: engine
---
 components/engine/pkg/mflag/flag.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/components/engine/pkg/mflag/flag.go b/components/engine/pkg/mflag/flag.go
index 7a0e8bfb79..b5c5fa9089 100644
--- a/components/engine/pkg/mflag/flag.go
+++ b/components/engine/pkg/mflag/flag.go
@@ -772,6 +772,9 @@ func (f *FlagSet) parseOne() (bool, string, error) {
 			f.usage()
 			return false, "", ErrHelp
 		}
+		if len(name) > 0 && name[0] == '-' {
+			return false, "", f.failf("flag provided but not defined: -%s", name)
+		}
 		return false, name, ErrRetry
 	}
 	if fv, ok := flag.Value.(boolFlag); ok && fv.IsBoolFlag() { // special case: doesn't need an arg

From 11719ff90ca517bba4ffa102fa54378d93790315 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 3 Mar 2014 11:31:37 -0800
Subject: [PATCH 333/403] Update readme to remove .nspid
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 2f35f8e2a88a378d7ff8eacf5346f9711a59489a Component: engine

---
 components/engine/pkg/libcontainer/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index b81401cd09..103253150d 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -87,4 +87,4 @@ nsinit exec /bin/bash
 If you wish to spawn another process inside the container while your current bash session is 
 running just run the exact same command again to get another bash shell or change the command.  If the original process dies, PID 1, all other processes spawned inside the container will also be killed and the namespace will be removed. 
 
-You can identify if a process is running in a container by looking to see if `.nspid` is in the root of the directory.   
+You can identify if a process is running in a container by looking to see if `pid` is in the root of the directory.   

From b49fc1301ea09f7f5256ea3ee650b12e32cbeb56 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Mon, 3 Mar 2014 19:57:05 +0000
Subject: [PATCH 334/403] add warning for deprecatd flags

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: bb5ed452241c37ee9f2f3ebd02a2a5e1764334ad
Component: engine
---
 components/engine/pkg/mflag/flag.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/components/engine/pkg/mflag/flag.go b/components/engine/pkg/mflag/flag.go
index b5c5fa9089..6fe3e41b23 100644
--- a/components/engine/pkg/mflag/flag.go
+++ b/components/engine/pkg/mflag/flag.go
@@ -803,6 +803,11 @@ func (f *FlagSet) parseOne() (bool, string, error) {
 		f.actual = make(map[string]*Flag)
 	}
 	f.actual[name] = flag
+	for _, n := range flag.Names {
+		if n == fmt.Sprintf("#%s", name) {
+			fmt.Fprintf(f.out(), "Warning: '-%s' is deprecated, it will be removed soon. See usage.\n", name)
+		}
+	}
 	return true, "", nil
 }
 

From e09257e20a4fbc635355a6bb28867f15b761a942 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 3 Mar 2014 12:15:47 -0800
Subject: [PATCH 335/403] Factor out finalize namespace
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 5465fdf00f3ece165cbd3bb680dcc571e81510dd Component: engine

---
 .../engine/pkg/libcontainer/nsinit/execin.go  |  5 ++--
 .../engine/pkg/libcontainer/nsinit/init.go    | 29 ++++++++++++-------
 2 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/execin.go b/components/engine/pkg/libcontainer/nsinit/execin.go
index 55f7b9695b..488fe0e248 100644
--- a/components/engine/pkg/libcontainer/nsinit/execin.go
+++ b/components/engine/pkg/libcontainer/nsinit/execin.go
@@ -5,7 +5,6 @@ package nsinit
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
 	"github.com/dotcloud/docker/pkg/system"
 	"os"
 	"path/filepath"
@@ -73,8 +72,8 @@ func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []s
 		os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus())
 	}
 dropAndExec:
-	if err := capabilities.DropCapabilities(container); err != nil {
-		return -1, fmt.Errorf("drop capabilities %s", err)
+	if err := finalizeNamespace(container); err != nil {
+		return -1, err
 	}
 	if err := system.Execv(args[0], args[0:], container.Env); err != nil {
 		return -1, err
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index cc481e2cc8..565030f252 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -64,16 +64,8 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 	if err := system.Sethostname(container.Hostname); err != nil {
 		return fmt.Errorf("sethostname %s", err)
 	}
-	if err := capabilities.DropCapabilities(container); err != nil {
-		return fmt.Errorf("drop capabilities %s", err)
-	}
-	if err := setupUser(container); err != nil {
-		return fmt.Errorf("setup user %s", err)
-	}
-	if container.WorkingDir != "" {
-		if err := system.Chdir(container.WorkingDir); err != nil {
-			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
-		}
+	if err := finalizeNamespace(container); err != nil {
+		return fmt.Errorf("finalize namespace %s", err)
 	}
 	return system.Execv(args[0], args[0:], container.Env)
 }
@@ -142,3 +134,20 @@ func setupNetwork(container *libcontainer.Container, context libcontainer.Contex
 	}
 	return nil
 }
+
+// finalizeNamespace drops the caps and sets the correct user
+// and working dir before execing the command inside the namespace
+func finalizeNamespace(container *libcontainer.Container) error {
+	if err := capabilities.DropCapabilities(container); err != nil {
+		return fmt.Errorf("drop capabilities %s", err)
+	}
+	if err := setupUser(container); err != nil {
+		return fmt.Errorf("setup user %s", err)
+	}
+	if container.WorkingDir != "" {
+		if err := system.Chdir(container.WorkingDir); err != nil {
+			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
+		}
+	}
+	return nil
+}

From 04d68b69ad86cd32b906597d76d8d4a304a14c33 Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Mon, 24 Feb 2014 23:10:06 +0200
Subject: [PATCH 336/403] handle symlinks for Docker's root dir & TMPDIR

This removes the incomplete symlink handling from engine.go and it adds
it one place in docker.go.

It also enables handling symlinks for TMPDIR.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 611acf7a7c1c3a6796e862fb94143890a9aa4573
Component: engine
---
 components/engine/docker/docker.go            | 24 +++++-
 .../sources/reference/commandline/cli.rst     | 12 ++-
 components/engine/engine/engine.go            | 14 ----
 components/engine/utils/utils.go              | 21 +++++
 components/engine/utils/utils_test.go         | 76 +++++++++++++++++++
 5 files changed, 127 insertions(+), 20 deletions(-)

diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index 5dda9d269e..6c6411bdd7 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -78,7 +78,27 @@ func main() {
 			return
 		}
 
-		eng, err := engine.New(*flRoot)
+		// set up the TempDir to use a canonical path
+		tmp := os.TempDir()
+		realTmp, err := utils.ReadSymlinkedDirectory(tmp)
+		if err != nil {
+			log.Fatalf("Unable to get the full path to the TempDir (%s): %s", tmp, err)
+		}
+		os.Setenv("TMPDIR", realTmp)
+
+		// get the canonical path to the Docker root directory
+		root := *flRoot
+		var realRoot string
+		if _, err := os.Stat(root); err != nil && os.IsNotExist(err) {
+			realRoot = root
+		} else {
+			realRoot, err = utils.ReadSymlinkedDirectory(root)
+			if err != nil {
+				log.Fatalf("Unable to get the full path to root (%s): %s", root, err)
+			}
+		}
+
+		eng, err := engine.New(realRoot)
 		if err != nil {
 			log.Fatal(err)
 		}
@@ -91,7 +111,7 @@ func main() {
 			// Load plugin: httpapi
 			job := eng.Job("initserver")
 			job.Setenv("Pidfile", *pidfile)
-			job.Setenv("Root", *flRoot)
+			job.Setenv("Root", realRoot)
 			job.SetenvBool("AutoRestart", *flAutoRestart)
 			job.SetenvList("Dns", flDns.GetAll())
 			job.SetenvBool("EnableIptables", *flEnableIptables)
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index c8d8a75832..153bc5e74d 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -112,11 +112,15 @@ Using ``fd://`` will work perfectly for most setups but you can also specify ind
 If the specified socket activated files aren't found then docker will exit.
 You can find examples of using systemd socket activation with docker and systemd in the `docker source tree <https://github.com/dotcloud/docker/blob/master/contrib/init/systemd/socket-activation/>`_.
 
-.. warning::
-  Docker and LXC do not support the use of softlinks for either the Docker data directory (``/var/lib/docker``) or for ``/tmp``.
-  If your system is likely to be set up in that way, you can use ``readlink -f`` to canonicalise the links:
+Docker supports softlinks for the Docker data directory (``/var/lib/docker``) and for ``/tmp``.
+TMPDIR and the data directory can be set like this:
 
-  ``TMPDIR=$(readlink -f /tmp) /usr/local/bin/docker -d -D -g $(readlink -f /var/lib/docker) -H unix:// $EXPOSE_ALL > /var/lib/boot2docker/docker.log 2>&1``
+::
+
+    TMPDIR=/mnt/disk2/tmp /usr/local/bin/docker -d -D -g /var/lib/docker -H unix:// > /var/lib/boot2docker/docker.log 2>&1
+    # or
+    export TMPDIR=/mnt/disk2/tmp
+    /usr/local/bin/docker -d -D -g /var/lib/docker -H unix:// > /var/lib/boot2docker/docker.log 2>&1
 
 .. _cli_attach:
 
diff --git a/components/engine/engine/engine.go b/components/engine/engine/engine.go
index 68e109e7f2..685924077c 100644
--- a/components/engine/engine/engine.go
+++ b/components/engine/engine/engine.go
@@ -7,7 +7,6 @@ import (
 	"io"
 	"log"
 	"os"
-	"path/filepath"
 	"runtime"
 	"sort"
 	"strings"
@@ -90,19 +89,6 @@ func New(root string) (*Engine, error) {
 		return nil, err
 	}
 
-	// Docker makes some assumptions about the "absoluteness" of root
-	// ... so let's make sure it has no symlinks
-	if p, err := filepath.Abs(root); err != nil {
-		log.Fatalf("Unable to get absolute root (%s): %s", root, err)
-	} else {
-		root = p
-	}
-	if p, err := filepath.EvalSymlinks(root); err != nil {
-		log.Fatalf("Unable to canonicalize root (%s): %s", root, err)
-	} else {
-		root = p
-	}
-
 	eng := &Engine{
 		root:     root,
 		handlers: make(map[string]Handler),
diff --git a/components/engine/utils/utils.go b/components/engine/utils/utils.go
index 0a80ea877e..07b8f6a3d0 100644
--- a/components/engine/utils/utils.go
+++ b/components/engine/utils/utils.go
@@ -997,3 +997,24 @@ func ReplaceOrAppendEnvValues(defaults, overrides []string) []string {
 	}
 	return defaults
 }
+
+// ReadSymlinkedDirectory returns the target directory of a symlink.
+// The target of the symbolic link may not be a file.
+func ReadSymlinkedDirectory(path string) (string, error) {
+	var realPath string
+	var err error
+	if realPath, err = filepath.Abs(path); err != nil {
+		return "", fmt.Errorf("unable to get absolute path for %s: %s", path, err)
+	}
+	if realPath, err = filepath.EvalSymlinks(realPath); err != nil {
+		return "", fmt.Errorf("failed to canonicalise path for %s: %s", path, err)
+	}
+	realPathInfo, err := os.Stat(realPath)
+	if err != nil {
+		return "", fmt.Errorf("failed to stat target '%s' of '%s': %s", realPath, path, err)
+	}
+	if !realPathInfo.Mode().IsDir() {
+		return "", fmt.Errorf("canonical path points to a file '%s'", realPath)
+	}
+	return realPath, nil
+}
diff --git a/components/engine/utils/utils_test.go b/components/engine/utils/utils_test.go
index ae19c89668..444d2a2428 100644
--- a/components/engine/utils/utils_test.go
+++ b/components/engine/utils/utils_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"io"
 	"io/ioutil"
+	"os"
 	"strings"
 	"testing"
 )
@@ -498,3 +499,78 @@ func TestReplaceAndAppendEnvVars(t *testing.T) {
 		t.Fatalf("expected TERM=xterm got '%s'", env[1])
 	}
 }
+
+// Reading a symlink to a directory must return the directory
+func TestReadSymlinkedDirectoryExistingDirectory(t *testing.T) {
+	var err error
+	if err = os.Mkdir("/tmp/testReadSymlinkToExistingDirectory", 0777); err != nil {
+		t.Errorf("failed to create directory: %s", err)
+	}
+
+	if err = os.Symlink("/tmp/testReadSymlinkToExistingDirectory", "/tmp/dirLinkTest"); err != nil {
+		t.Errorf("failed to create symlink: %s", err)
+	}
+
+	var path string
+	if path, err = ReadSymlinkedDirectory("/tmp/dirLinkTest"); err != nil {
+		t.Fatalf("failed to read symlink to directory: %s", err)
+	}
+
+	if path != "/tmp/testReadSymlinkToExistingDirectory" {
+		t.Fatalf("symlink returned unexpected directory: %s", path)
+	}
+
+	if err = os.Remove("/tmp/testReadSymlinkToExistingDirectory"); err != nil {
+		t.Errorf("failed to remove temporary directory: %s", err)
+	}
+
+	if err = os.Remove("/tmp/dirLinkTest"); err != nil {
+		t.Errorf("failed to remove symlink: %s", err)
+	}
+}
+
+// Reading a non-existing symlink must fail
+func TestReadSymlinkedDirectoryNonExistingSymlink(t *testing.T) {
+	var path string
+	var err error
+	if path, err = ReadSymlinkedDirectory("/tmp/test/foo/Non/ExistingPath"); err == nil {
+		t.Fatalf("error expected for non-existing symlink")
+	}
+
+	if path != "" {
+		t.Fatalf("expected empty path, but '%s' was returned", path)
+	}
+}
+
+// Reading a symlink to a file must fail
+func TestReadSymlinkedDirectoryToFile(t *testing.T) {
+	var err error
+	var file *os.File
+
+	if file, err = os.Create("/tmp/testReadSymlinkToFile"); err != nil {
+		t.Fatalf("failed to create file: %s", err)
+	}
+
+	file.Close()
+
+	if err = os.Symlink("/tmp/testReadSymlinkToFile", "/tmp/fileLinkTest"); err != nil {
+		t.Errorf("failed to create symlink: %s", err)
+	}
+
+	var path string
+	if path, err = ReadSymlinkedDirectory("/tmp/fileLinkTest"); err == nil {
+		t.Fatalf("ReadSymlinkedDirectory on a symlink to a file should've failed")
+	}
+
+	if path != "" {
+		t.Fatalf("path should've been empty: %s", path)
+	}
+
+	if err = os.Remove("/tmp/testReadSymlinkToFile"); err != nil {
+		t.Errorf("failed to remove file: %s", err)
+	}
+
+	if err = os.Remove("/tmp/fileLinkTest"); err != nil {
+		t.Errorf("failed to remove symlink: %s", err)
+	}
+}

From 4d3778ca3d820fb805b889566a7bda0c2ca4b4ca Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Mon, 3 Mar 2014 22:07:42 +0000
Subject: [PATCH 337/403] fix warning can't docker run

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: e23b4e5d15da3e04692ac44370b1945a875206f0
Component: engine
---
 components/engine/server.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/server.go b/components/engine/server.go
index e6176e18bd..ffd09c7c32 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1669,7 +1669,7 @@ func (srv *Server) ContainerCreate(job *engine.Job) engine.Status {
 		job.Printf("%s\n", container.ID)
 	}
 	for _, warning := range buildWarnings {
-		return job.Errorf("%s\n", warning)
+		job.Errorf("%s\n", warning)
 	}
 	return engine.StatusOK
 }

From d1e812bd95e9116b4ae7d591d107f23b605a7d76 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Mon, 3 Mar 2014 23:26:46 +0000
Subject: [PATCH 338/403] remove warnings from makefile

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: b9cb95c0a07e421c8cbf83fa79aaedead809c802
Component: engine
---
 components/engine/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/components/engine/Makefile b/components/engine/Makefile
index e15ed35fda..b3bea8a31f 100644
--- a/components/engine/Makefile
+++ b/components/engine/Makefile
@@ -3,7 +3,7 @@
 GIT_BRANCH := $(shell git rev-parse --abbrev-ref HEAD)
 DOCKER_IMAGE := docker:$(GIT_BRANCH)
 DOCKER_DOCS_IMAGE := docker-docs:$(GIT_BRANCH)
-DOCKER_RUN_DOCKER := docker run -rm -i -t -privileged -e TESTFLAGS -v "$(CURDIR)/bundles:/go/src/github.com/dotcloud/docker/bundles" "$(DOCKER_IMAGE)"
+DOCKER_RUN_DOCKER := docker run --rm -i -t --privileged -e TESTFLAGS -v "$(CURDIR)/bundles:/go/src/github.com/dotcloud/docker/bundles" "$(DOCKER_IMAGE)"
 
 default: binary
 
@@ -17,10 +17,10 @@ cross: build
 	$(DOCKER_RUN_DOCKER) hack/make.sh binary cross
 
 docs: docs-build
-	docker run -rm -i -t -p 8000:8000 "$(DOCKER_DOCS_IMAGE)"
+	docker run --rm -i -t -p 8000:8000 "$(DOCKER_DOCS_IMAGE)"
 
 docs-shell: docs-build
-	docker run -rm -i -t -p 8000:8000 "$(DOCKER_DOCS_IMAGE)" bash
+	docker run --rm -i -t -p 8000:8000 "$(DOCKER_DOCS_IMAGE)" bash
 
 test: build
 	$(DOCKER_RUN_DOCKER) hack/make.sh test test-integration

From ba4d7c0ac6456a298ea01a830974874d94dbeef5 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Mon, 3 Mar 2014 17:48:35 +1000
Subject: [PATCH 339/403] it seems on MSWindows MSYS bash, echo n puts a
 literal \n (not a newline) into the commit message, so lets get more
 primitive

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 43feb84203d5c0ca3b2cb110a96b3dd0ec3a93df
Component: engine
---
 components/engine/contrib/prepare-commit-msg.hook | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/contrib/prepare-commit-msg.hook b/components/engine/contrib/prepare-commit-msg.hook
index 595f7a783b..b5df8dfaed 100644
--- a/components/engine/contrib/prepare-commit-msg.hook
+++ b/components/engine/contrib/prepare-commit-msg.hook
@@ -4,4 +4,4 @@
 #
 GH_USER=$(git config --get github.user)
 SOB=$(git var GIT_AUTHOR_IDENT | sed -n "s/^\(.*>\).*$/Docker-DCO-1.1-Signed-off-by: \1 \(github: $GH_USER\)/p")
-grep -qs "^$SOB" "$1" || echo "\n$SOB" >> "$1"
+grep -qs "^$SOB" "$1" || echo -e "\n$SOB" >> "$1"

From 71633326e7e4408b979ff6c5191fca26f88f00a7 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Thu, 27 Feb 2014 23:36:19 -0800
Subject: [PATCH 340/403] very minor spelling

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 2e71adac9f2935abaf17741a440497e7e31388e2
Component: engine
---
 components/engine/pkg/libcontainer/README.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/components/engine/pkg/libcontainer/README.md b/components/engine/pkg/libcontainer/README.md
index 103253150d..d6e4dedd63 100644
--- a/components/engine/pkg/libcontainer/README.md
+++ b/components/engine/pkg/libcontainer/README.md
@@ -7,7 +7,7 @@ for using linux namespaces with no external dependencies.  libcontainer provides
 
 
 #### container
-A container is a self contained directory that is able to run one or more processes inside without 
+A container is a self contained directory that is able to run one or more processes without 
 affecting the host system.  The directory is usually a full system tree.  Inside the directory
 a `container.json` file is placed with the runtime configuration for how the processes 
 should be contained and ran.  Environment, networking, and different capabilities for the 
@@ -67,11 +67,11 @@ Sample `container.json` file:
 }
 ```
 
-Using this configuration and the current directory holding the rootfs for a process to live, one can use libcontainer to exec the container. Running the life of the namespace a `pid` file 
-is written to the current directory with the pid of the namespace'd process to the external world.  A client can use this pid to wait, kill, or perform other operation with the container.  If a user tries to run an new process inside an existing container with a live namespace with namespace will be joined by the new process.
+Using this configuration and the current directory holding the rootfs for a process, one can use libcontainer to exec the container. Running the life of the namespace, a `pid` file 
+is written to the current directory with the pid of the namespaced process to the external world.  A client can use this pid to wait, kill, or perform other operation with the container.  If a user tries to run an new process inside an existing container with a live namespace the namespace will be joined by the new process.
 
 
-You may also specify an alternate root to to place the `container.json` file is read and where the `pid` file will be saved.
+You may also specify an alternate root place where the `container.json` file is read and where the `pid` file will be saved.
 
 #### nsinit
 
@@ -79,7 +79,7 @@ You may also specify an alternate root to to place the `container.json` file is
 spawn or join new containers giving the current directory.  To use `nsinit` cd into a linux 
 rootfs and copy a `container.json` file into the directory with your specified configuration.
 
-To execution `/bin/bash` in the current directory as a container just run:
+To execute `/bin/bash` in the current directory as a container just run:
 ```bash
 nsinit exec /bin/bash
 ```

From 207b929d4d6d46ee480f9637a8046cb5c4cd06c4 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Tue, 4 Mar 2014 10:32:39 +1000
Subject: [PATCH 341/403] nope, echo -e isn't portable

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 4f29836f7158521f31e42ea6dfde6c19cd069715
Component: engine
---
 components/engine/contrib/prepare-commit-msg.hook | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/components/engine/contrib/prepare-commit-msg.hook b/components/engine/contrib/prepare-commit-msg.hook
index b5df8dfaed..b0fe0bf675 100644
--- a/components/engine/contrib/prepare-commit-msg.hook
+++ b/components/engine/contrib/prepare-commit-msg.hook
@@ -4,4 +4,7 @@
 #
 GH_USER=$(git config --get github.user)
 SOB=$(git var GIT_AUTHOR_IDENT | sed -n "s/^\(.*>\).*$/Docker-DCO-1.1-Signed-off-by: \1 \(github: $GH_USER\)/p")
-grep -qs "^$SOB" "$1" || echo -e "\n$SOB" >> "$1"
+grep -qs "^$SOB" "$1" || { 
+	echo 
+	echo "$SOB" 
+} >> "$1"

From abf9a1fe77b1e7f252a4af4ad4dc1fc3c1a14310 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Mon, 3 Mar 2014 17:35:40 +1000
Subject: [PATCH 342/403] make the port mapping deprecation error message more
 obvious see 4075

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 2275c83358986c9f612ebb1915c5d3392319f1f8
Component: engine
---
 components/engine/runtime.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index 846b47d04e..bfc7ab878b 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -363,7 +363,7 @@ func (runtime *Runtime) Create(config *runconfig.Config, name string) (*Containe
 
 	warnings := []string{}
 	if checkDeprecatedExpose(img.Config) || checkDeprecatedExpose(config) {
-		warnings = append(warnings, "The mapping to public ports on your host has been deprecated. Use -p to publish the ports.")
+		warnings = append(warnings, "The mapping to public ports on your host via Dockerfile EXPOSE (host:port:port) has been deprecated. Use -p to publish the ports.")
 	}
 
 	if img.Config != nil {

From 84d85e3b670977743d22278f71ba0c8063a2c4c6 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Mon, 3 Mar 2014 17:43:08 -0800
Subject: [PATCH 343/403] Update daemon docs for exec drivers
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 0f96a749ab812d76389c4a48c71ff9a01e48488e Component: engine

---
 components/engine/docs/sources/reference/commandline/cli.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index c8d8a75832..93ad61a57d 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -83,7 +83,7 @@ Commands
       -p, --pidfile="/var/run/docker.pid": Path to use for daemon PID file
       -r, --restart=true: Restart previously running containers
       -s, --storage-driver="": Force the docker runtime to use a specific storage driver
-      -e, --exec-driver="": Force the docker runtime to use a specific exec driver
+      -e, --exec-driver="native": Force the docker runtime to use a specific exec driver
       -v, --version=false: Print version information and quit
       --mtu=0: Set the containers network MTU; if no value is provided: default to the default route MTU or 1500 if no default route is available
 
@@ -96,6 +96,8 @@ To set the DNS server for all Docker containers, use ``docker -d -dns 8.8.8.8``.
 
 To run the daemon with debug output, use ``docker -d -D``.
 
+To use lxc as the execution driver, use ``docker -d -e lxc``.
+
 The docker client will also honor the ``DOCKER_HOST`` environment variable to set
 the ``-H`` flag for the client.  
 

From a4a84bcafe3f0f6c982f7a7d64935b7951f0511a Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Tue, 4 Mar 2014 12:44:08 +0100
Subject: [PATCH 344/403] libcontainer: Use pivot_root instead of chroot

Instead of keeping all the old mounts in the container namespace and
just using subtree as root we pivot_root so that the actual root in
the namespace is the root we want, and then we unmount the previous
mounts.

This has multiple advantages:

* The namespace mount tree is smaller (in the kernel)
* If you break out of the chroot you could previously access the host
  filesystem. Now the host filesystem is fully invisible to the namespace.
* We get rid of all unrelated mounts from the parent namespace, which means
  we don't hog these. This is important if we later switch to MS_PRIVATE instead
  of MS_SLAVE as otherwise these mounts would be impossible to unmount from the
  parent namespace.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 5b5c884cc8266d0c2a56da0bc2df14cc9d5d85e8
Component: engine
---
 .../engine/pkg/libcontainer/nsinit/mount.go   | 22 +++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 55c2655ab0..9ae7ec4529 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -5,6 +5,7 @@ package nsinit
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/system"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -51,16 +52,29 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := system.Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
-	if err := system.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
-		return fmt.Errorf("mount move %s into / %s", rootfs, err)
+
+	pivotDir, err := ioutil.TempDir(rootfs, ".pivot_root")
+	if err != nil {
+		return fmt.Errorf("can't create pivot_root dir %s", pivotDir, err)
 	}
-	if err := system.Chroot("."); err != nil {
-		return fmt.Errorf("chroot . %s", err)
+	if err := system.Pivotroot(rootfs, pivotDir); err != nil {
+		return fmt.Errorf("pivot_root %s", err)
 	}
 	if err := system.Chdir("/"); err != nil {
 		return fmt.Errorf("chdir / %s", err)
 	}
 
+	// path to pivot dir now changed, update
+	pivotDir = filepath.Join("/", filepath.Base(pivotDir))
+
+	if err := system.Unmount(pivotDir, syscall.MNT_DETACH); err != nil {
+		return fmt.Errorf("unmount pivot_root dir %s", err)
+	}
+
+	if err := os.Remove(pivotDir); err != nil {
+		return fmt.Errorf("remove pivot_root dir %s", err)
+	}
+
 	system.Umask(0022)
 
 	return nil

From 98c6278357119c39c5d9aa071b01dff54ce99242 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 4 Mar 2014 08:55:12 -0800
Subject: [PATCH 345/403] Add find tests and remove panic in DEBUG
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 7e52445f2f749ac66ee7734820d3558012833912 Component: engine

---
 components/engine/pkg/libcontainer/types.go   | 21 ++++++-----
 .../engine/pkg/libcontainer/types_test.go     | 35 +++++++++++++++++++
 2 files changed, 47 insertions(+), 9 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/types_test.go

diff --git a/components/engine/pkg/libcontainer/types.go b/components/engine/pkg/libcontainer/types.go
index 8c28530140..94fe876554 100644
--- a/components/engine/pkg/libcontainer/types.go
+++ b/components/engine/pkg/libcontainer/types.go
@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"errors"
 	"github.com/syndtr/gocapability/capability"
-	"os"
 )
 
 var (
@@ -74,16 +73,18 @@ func GetNamespace(key string) *Namespace {
 			return ns
 		}
 	}
-	if os.Getenv("DEBUG") != "" {
-		panic("Unreachable: Namespace not found")
-	}
 	return nil
 }
 
 // Contains returns true if the specified Namespace is
 // in the slice
 func (n Namespaces) Contains(ns string) bool {
-	return GetNamespace(ns) != nil
+	for _, nsp := range n {
+		if nsp.Key == ns {
+			return true
+		}
+	}
+	return false
 }
 
 type (
@@ -121,14 +122,16 @@ func GetCapability(key string) *Capability {
 			return capp
 		}
 	}
-	if os.Getenv("DEBUG") != "" {
-		panic("Unreachable: Capability not found")
-	}
 	return nil
 }
 
 // Contains returns true if the specified Capability is
 // in the slice
 func (c Capabilities) Contains(capp string) bool {
-	return GetCapability(capp) != nil
+	for _, cap := range c {
+		if cap.Key == capp {
+			return true
+		}
+	}
+	return false
 }
diff --git a/components/engine/pkg/libcontainer/types_test.go b/components/engine/pkg/libcontainer/types_test.go
new file mode 100644
index 0000000000..52b85a4db9
--- /dev/null
+++ b/components/engine/pkg/libcontainer/types_test.go
@@ -0,0 +1,35 @@
+package libcontainer
+
+import (
+	"testing"
+)
+
+func TestNamespacesContains(t *testing.T) {
+	ns := Namespaces{
+		GetNamespace("NEWPID"),
+		GetNamespace("NEWNS"),
+		GetNamespace("NEWUTS"),
+	}
+
+	if ns.Contains("NEWNET") {
+		t.Fatal("namespaces should not contain NEWNET")
+	}
+
+	if !ns.Contains("NEWPID") {
+		t.Fatal("namespaces should contain NEWPID but does not")
+	}
+}
+
+func TestCapabilitiesContains(t *testing.T) {
+	caps := Capabilities{
+		GetCapability("MKNOD"),
+		GetCapability("SETPCAP"),
+	}
+
+	if caps.Contains("SYS_ADMIN") {
+		t.Fatal("capabilities should not contain SYS_ADMIN")
+	}
+	if !caps.Contains("MKNOD") {
+		t.Fatal("capabilities should container MKNOD but does not")
+	}
+}

From d321be3c2815e37e6187685e2ecd37a377038a1f Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 4 Mar 2014 11:46:05 -0800
Subject: [PATCH 346/403] Change veth prefix back to veth

Fixes #4453
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 0cdf10263844db0cb4d051ac9f79051104abe77f
Component: engine
---
 components/engine/execdriver/native/default_template.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/execdriver/native/default_template.go b/components/engine/execdriver/native/default_template.go
index 91fd646c8e..8e06ff2e26 100644
--- a/components/engine/execdriver/native/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -26,7 +26,7 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 				Gateway: c.Network.Gateway,
 				Type:    "veth",
 				Context: libcontainer.Context{
-					"prefix": "dock",
+					"prefix": "veth",
 					"bridge": c.Network.Bridge,
 				},
 			},

From 37e0bed312acd78b1c9717237ed614f64f359bf0 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Tue, 4 Mar 2014 12:30:52 -0800
Subject: [PATCH 347/403] Remove loopback mount bind

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 39d58129c38e8bb868a6fd9a5620837484f6d742
Component: engine
---
 .../engine/pkg/libcontainer/nsinit/mount.go   | 27 ++++---------------
 1 file changed, 5 insertions(+), 22 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 9ae7ec4529..7ce90fdb64 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -38,9 +38,8 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := copyDevNodes(rootfs); err != nil {
 		return fmt.Errorf("copy dev nodes %s", err)
 	}
-	if err := setupLoopbackDevices(rootfs); err != nil {
-		return fmt.Errorf("setup loopback devices %s", err)
-	}
+	// In non-privileged mode, this fails. Discard the error.
+	setupLoopbackDevices(rootfs)
 	if err := setupDev(rootfs); err != nil {
 		return err
 	}
@@ -102,29 +101,13 @@ func copyDevNodes(rootfs string) error {
 
 func setupLoopbackDevices(rootfs string) error {
 	for i := 0; ; i++ {
-		var (
-			device = fmt.Sprintf("loop%d", i)
-			source = filepath.Join("/dev", device)
-			dest   = filepath.Join(rootfs, "dev", device)
-		)
-
-		if _, err := os.Stat(source); err != nil {
+		if err := copyDevNode(rootfs, fmt.Sprintf("loop%d", i)); err != nil {
 			if !os.IsNotExist(err) {
 				return err
 			}
-			return nil
-		}
-		if _, err := os.Stat(dest); err == nil {
-			os.Remove(dest)
-		}
-		f, err := os.Create(dest)
-		if err != nil {
-			return err
-		}
-		f.Close()
-		if err := system.Mount(source, dest, "none", syscall.MS_BIND, ""); err != nil {
-			return err
+			break
 		}
+
 	}
 	return nil
 }

From 26eb6d1e5d5a86567633b2f74499ac7c9db1ecb4 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Tue, 4 Mar 2014 12:32:17 -0800
Subject: [PATCH 348/403] remove /run mountpoint

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: c74a8b28cd723d6f12a54da16ff91a853958da5c
Component: engine
---
 components/engine/pkg/libcontainer/nsinit/mount.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 7ce90fdb64..6b6929c99f 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -197,7 +197,6 @@ func mountSystem(rootfs string) error {
 		{source: "tmpfs", path: filepath.Join(rootfs, "dev"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME, data: "mode=755"},
 		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: "mode=1777"},
 		{source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: "newinstance,ptmxmode=0666,mode=620,gid=5"},
-		{source: "tmpfs", path: filepath.Join(rootfs, "run"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_STRICTATIME, data: "mode=755"},
 	} {
 		if err := os.MkdirAll(m.path, 0755); err != nil && !os.IsExist(err) {
 			return fmt.Errorf("mkdirall %s %s", m.path, err)

From d5fd498efb4331c66ad537c2c6f5c1c855be6f4f Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Tue, 4 Mar 2014 13:21:22 -0800
Subject: [PATCH 349/403] Remove /dev tmpfs mountpoint

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 57a47f5bbfe6c82f3cce32aba96fb641f7188eee
Component: engine
---
 components/engine/pkg/libcontainer/nsinit/mount.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 6b6929c99f..694254ef60 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -194,7 +194,6 @@ func mountSystem(rootfs string) error {
 	}{
 		{source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaultMountFlags},
 		{source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaultMountFlags},
-		{source: "tmpfs", path: filepath.Join(rootfs, "dev"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME, data: "mode=755"},
 		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: "mode=1777"},
 		{source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: "newinstance,ptmxmode=0666,mode=620,gid=5"},
 	} {

From 876978baeaee7dde4a0619f0e0e0de788e05b36b Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Tue, 4 Mar 2014 14:18:40 -0800
Subject: [PATCH 350/403] Add shm size cap to mount
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 b07708c8de5561a43060653d4d532ee0bcd6fd96 Component: engine

---
 components/engine/pkg/libcontainer/nsinit/mount.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 694254ef60..61586bc4ed 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -194,7 +194,7 @@ func mountSystem(rootfs string) error {
 	}{
 		{source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaultMountFlags},
 		{source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaultMountFlags},
-		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: "mode=1777"},
+		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: "mode=1777,size=65536k"},
 		{source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: "newinstance,ptmxmode=0666,mode=620,gid=5"},
 	} {
 		if err := os.MkdirAll(m.path, 0755); err != nil && !os.IsExist(err) {

From eed6462b7ab65ff6838a0b8791832052b256fd3c Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@home.org.au>
Date: Mon, 3 Mar 2014 21:39:10 +0000
Subject: [PATCH 351/403] update to use --name, and add a little more detail to
 how docker start -a works

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Upstream-commit: 3acbd758d84294e3434609ae3ecf52cd5ed9ee4b
Component: engine
---
 .../docs/sources/use/host_integration.rst     | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/components/engine/docs/sources/use/host_integration.rst b/components/engine/docs/sources/use/host_integration.rst
index fb70195ffd..ed341cd4bc 100644
--- a/components/engine/docs/sources/use/host_integration.rst
+++ b/components/engine/docs/sources/use/host_integration.rst
@@ -18,10 +18,11 @@ the docker daemon with the ``-r=false`` so that docker will not automatically
 restart your containers when the host is restarted.  
 
 When you have finished setting up your image and are happy with your
-running container, you may want to use a process manager to manage
+running container, you can then attach a process manager to manage
 it.  When your run ``docker start -a`` docker will automatically attach 
-to the process and forward all signals so that the process manager can 
-detect when a container stops and correctly restart it.  
+to the running container, or start it if needed and forward all signals 
+so that the process manager can detect when a container stops and correctly
+restart it.  
 
 Here are a few sample scripts for systemd and upstart to integrate with docker.
 
@@ -29,9 +30,10 @@ Here are a few sample scripts for systemd and upstart to integrate with docker.
 Sample Upstart Script
 ---------------------
 
-In this example we've already created a container to run Redis with an id of
-0a7e070b698b.  To create an upstart script for our container, we create a file
-named ``/etc/init/redis.conf`` and place the following into it:
+In this example we've already created a container to run Redis with 
+``--name redis_server``.  To create an upstart script for our container, 
+we create a file named ``/etc/init/redis.conf`` and place the following 
+into it:
 
 .. code-block:: bash
 
@@ -46,7 +48,7 @@ named ``/etc/init/redis.conf`` and place the following into it:
      while [ ! -e $FILE ] ; do
        inotifywait -t 2 -e create $(dirname $FILE)
      done
-     /usr/bin/docker start -a 0a7e070b698b
+     /usr/bin/docker start -a redis_server
    end script
 
 Next, we have to configure docker so that it's run with the option ``-r=false``.
@@ -69,8 +71,8 @@ Sample systemd Script
 
     [Service]
     Restart=always
-    ExecStart=/usr/bin/docker start -a 0a7e070b698b
-    ExecStop=/usr/bin/docker stop -t 2 0a7e070b698b
+    ExecStart=/usr/bin/docker start -a redis_server
+    ExecStop=/usr/bin/docker stop -t 2 redis_server
 
     [Install]
     WantedBy=local.target

From 821bf64ace55b90ae7d879ea70fb413d3850aba4 Mon Sep 17 00:00:00 2001
From: James Turnbull <james@lovedthanlost.net>
Date: Tue, 4 Mar 2014 20:22:51 -0500
Subject: [PATCH 352/403] Consistently capitalize CLI options

Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Upstream-commit: 41bf38e44d8ef53468e76870182fa05c515a1cf5
Component: engine
---
 .../docs/sources/reference/commandline/cli.rst   | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index f7d474bddd..ccb5314fac 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -527,7 +527,7 @@ For example:
     Show the history of an image
 
       --no-trunc=false: Don't truncate output
-      -q, --quiet=false: only show numeric IDs
+      -q, --quiet=false: Only show numeric IDs
 
 To see how the ``docker:latest`` image was built:
 
@@ -574,11 +574,11 @@ To see how the ``docker:latest`` image was built:
 
     List images
 
-      -a, --all=false: show all images (by default filter out the intermediate images used to build)
+      -a, --all=false: Show all images (by default filter out the intermediate images used to build)
       --no-trunc=false: Don't truncate output
-      -q, --quiet=false: only show numeric IDs
-      --tree=false: output graph in tree format
-      --viz=false: output graph in graphviz format
+      -q, --quiet=false: Only show numeric IDs
+      --tree=false: Output graph in tree format
+      --viz=false: Output graph in graphviz format
 
 Listing the most recently created images
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -874,9 +874,9 @@ Known Issues (kill)
 
     Register or Login to the docker registry server
 
-    -e, --email="": email
-    -p, --password="": password
-    -u, --username="": username
+    -e, --email="": Email
+    -p, --password="": Password
+    -u, --username="": Username
 
     If you want to login to a private registry you can
     specify this by adding the server name.

From 53d25513fd651400ddd1e529669249319ad89e30 Mon Sep 17 00:00:00 2001
From: James Turnbull <james@lovedthanlost.net>
Date: Tue, 4 Mar 2014 20:45:22 -0500
Subject: [PATCH 353/403] Made CLI option capitalization consistent in
 api/client.go

Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Upstream-commit: 725c7cd08af5b895becce19e59fe98cebdc67cf2
Component: engine
---
 components/engine/api/client.go | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index e79452688d..9fde660776 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -233,9 +233,9 @@ func (cli *DockerCli) CmdLogin(args ...string) error {
 
 	var username, password, email string
 
-	cmd.StringVar(&username, []string{"u", "-username"}, "", "username")
-	cmd.StringVar(&password, []string{"p", "-password"}, "", "password")
-	cmd.StringVar(&email, []string{"e", "-email"}, "", "email")
+	cmd.StringVar(&username, []string{"u", "-username"}, "", "Username")
+	cmd.StringVar(&password, []string{"p", "-password"}, "", "Password")
+	cmd.StringVar(&email, []string{"e", "-email"}, "", "Email")
 	err := cmd.Parse(args)
 	if err != nil {
 		return nil
@@ -831,7 +831,7 @@ func (cli *DockerCli) CmdRmi(args ...string) error {
 
 func (cli *DockerCli) CmdHistory(args ...string) error {
 	cmd := cli.Subcmd("history", "[OPTIONS] IMAGE", "Show the history of an image")
-	quiet := cmd.Bool([]string{"q", "-quiet"}, false, "only show numeric IDs")
+	quiet := cmd.Bool([]string{"q", "-quiet"}, false, "Only show numeric IDs")
 	noTrunc := cmd.Bool([]string{"#notrunc", "-no-trunc"}, false, "Don't truncate output")
 
 	if err := cmd.Parse(args); err != nil {
@@ -1102,11 +1102,11 @@ func (cli *DockerCli) CmdPull(args ...string) error {
 
 func (cli *DockerCli) CmdImages(args ...string) error {
 	cmd := cli.Subcmd("images", "[OPTIONS] [NAME]", "List images")
-	quiet := cmd.Bool([]string{"q", "-quiet"}, false, "only show numeric IDs")
-	all := cmd.Bool([]string{"a", "-all"}, false, "show all images (by default filter out the intermediate images used to build)")
+	quiet := cmd.Bool([]string{"q", "-quiet"}, false, "Only show numeric IDs")
+	all := cmd.Bool([]string{"a", "-all"}, false, "Show all images (by default filter out the intermediate images used to build)")
 	noTrunc := cmd.Bool([]string{"#notrunc", "-no-trunc"}, false, "Don't truncate output")
-	flViz := cmd.Bool([]string{"v", "#viz", "-viz"}, false, "output graph in graphviz format")
-	flTree := cmd.Bool([]string{"t", "#tree", "-tree"}, false, "output graph in tree format")
+	flViz := cmd.Bool([]string{"v", "#viz", "-viz"}, false, "Output graph in graphviz format")
+	flTree := cmd.Bool([]string{"t", "#tree", "-tree"}, false, "Output graph in tree format")
 
 	if err := cmd.Parse(args); err != nil {
 		return nil

From dc81426ab372398c4a0dee03ae752fab1d5ee443 Mon Sep 17 00:00:00 2001
From: James Turnbull <james@lovedthanlost.net>
Date: Tue, 4 Mar 2014 20:52:48 -0500
Subject: [PATCH 354/403] Updated a variety of language and error messages

In api/client.go updated:

1. Made api == API
2. Restated Docker daemon connection error to be clearer.
3. Changed use of "Impossible" in error messages.
4. Removed extra space in restart error message.
5. Fixed capitalization in three error messages.

Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Upstream-commit: 9cbf22dee26e363bbe3738bbbcd1d70773d80d0d
Component: engine
---
 components/engine/api/client.go | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/components/engine/api/client.go b/components/engine/api/client.go
index e79452688d..c6c9f69062 100644
--- a/components/engine/api/client.go
+++ b/components/engine/api/client.go
@@ -45,7 +45,7 @@ var funcMap = template.FuncMap{
 }
 
 var (
-	ErrConnectionRefused = errors.New("Can't connect to docker daemon. Is 'docker -d' running on this host?")
+	ErrConnectionRefused = errors.New("Cannot connect to the Docker daemon. Is 'docker -d' running on this host?")
 )
 
 func (cli *DockerCli) getMethod(name string) (func(...string) error, bool) {
@@ -523,7 +523,7 @@ func (cli *DockerCli) CmdRestart(args ...string) error {
 		_, _, err := readBody(cli.call("POST", "/containers/"+name+"/restart?"+v.Encode(), nil, false))
 		if err != nil {
 			fmt.Fprintf(cli.err, "%s\n", err)
-			encounteredError = fmt.Errorf("Error: failed to  restart one or more containers")
+			encounteredError = fmt.Errorf("Error: failed to restart one or more containers")
 		} else {
 			fmt.Fprintf(cli.out, "%s\n", name)
 		}
@@ -563,7 +563,7 @@ func (cli *DockerCli) CmdStart(args ...string) error {
 	var tty bool
 	if *attach || *openStdin {
 		if cmd.NArg() > 1 {
-			return fmt.Errorf("Impossible to start and attach multiple containers at once.")
+			return fmt.Errorf("You cannot start and attach multiple containers at once.")
 		}
 
 		body, _, err := readBody(cli.call("GET", "/containers/"+cmd.Arg(0)+"/json", nil, false))
@@ -1008,7 +1008,7 @@ func (cli *DockerCli) CmdPush(args ...string) error {
 		if username == "" {
 			username = "<user>"
 		}
-		return fmt.Errorf("Impossible to push a \"root\" repository. Please rename your repository in <user>/<repo> (ex: %s/%s)", username, name)
+		return fmt.Errorf("You cannot push a \"root\" repository. Please rename your repository in <user>/<repo> (ex: %s/%s)", username, name)
 	}
 
 	v := url.Values{}
@@ -1588,7 +1588,7 @@ func (cli *DockerCli) CmdAttach(args ...string) error {
 	}
 
 	if !container.State.Running {
-		return fmt.Errorf("Impossible to attach to a stopped container, start it first")
+		return fmt.Errorf("You cannot attach to a stopped container, start it first")
 	}
 
 	if container.Config.Tty && cli.isTerminal {
@@ -1744,10 +1744,10 @@ func (cli *DockerCli) CmdRun(args ...string) error {
 	var containerIDFile io.WriteCloser
 	if len(hostConfig.ContainerIDFile) > 0 {
 		if _, err := os.Stat(hostConfig.ContainerIDFile); err == nil {
-			return fmt.Errorf("cid file found, make sure the other container isn't running or delete %s", hostConfig.ContainerIDFile)
+			return fmt.Errorf("Container ID file found, make sure the other container isn't running or delete %s", hostConfig.ContainerIDFile)
 		}
 		if containerIDFile, err = os.Create(hostConfig.ContainerIDFile); err != nil {
-			return fmt.Errorf("failed to create the container ID file: %s", err)
+			return fmt.Errorf("Failed to create the container ID file: %s", err)
 		}
 		defer containerIDFile.Close()
 	}
@@ -1808,7 +1808,7 @@ func (cli *DockerCli) CmdRun(args ...string) error {
 
 	if len(hostConfig.ContainerIDFile) > 0 {
 		if _, err = containerIDFile.Write([]byte(runResult.Get("Id"))); err != nil {
-			return fmt.Errorf("failed to write the container ID to the file: %s", err)
+			return fmt.Errorf("Failed to write the container ID to the file: %s", err)
 		}
 	}
 
@@ -2101,7 +2101,7 @@ func (cli *DockerCli) call(method, path string, data interface{}, passAuthInfo b
 			return nil, -1, err
 		}
 		if len(body) == 0 {
-			return nil, resp.StatusCode, fmt.Errorf("Error: request returned %s for api route and version %s, check if the server supports the requested api version", http.StatusText(resp.StatusCode), req.URL)
+			return nil, resp.StatusCode, fmt.Errorf("Error: request returned %s for API route and version %s, check if the server supports the requested API version", http.StatusText(resp.StatusCode), req.URL)
 		}
 		return nil, resp.StatusCode, fmt.Errorf("Error: %s", bytes.TrimSpace(body))
 	}
@@ -2143,7 +2143,7 @@ func (cli *DockerCli) stream(method, path string, in io.Reader, out io.Writer, h
 	dial, err := net.Dial(cli.proto, cli.addr)
 	if err != nil {
 		if strings.Contains(err.Error(), "connection refused") {
-			return fmt.Errorf("Can't connect to docker daemon. Is 'docker -d' running on this host?")
+			return fmt.Errorf("Cannot connect to the Docker daemon. Is 'docker -d' running on this host?")
 		}
 		return err
 	}
@@ -2152,7 +2152,7 @@ func (cli *DockerCli) stream(method, path string, in io.Reader, out io.Writer, h
 	defer clientconn.Close()
 	if err != nil {
 		if strings.Contains(err.Error(), "connection refused") {
-			return fmt.Errorf("Can't connect to docker daemon. Is 'docker -d' running on this host?")
+			return fmt.Errorf("Cannot connect to the Docker daemon. Is 'docker -d' running on this host?")
 		}
 		return err
 	}
@@ -2199,7 +2199,7 @@ func (cli *DockerCli) hijack(method, path string, setRawTerminal bool, in io.Rea
 	dial, err := net.Dial(cli.proto, cli.addr)
 	if err != nil {
 		if strings.Contains(err.Error(), "connection refused") {
-			return fmt.Errorf("Can't connect to docker daemon. Is 'docker -d' running on this host?")
+			return fmt.Errorf("Cannot connect to the Docker daemon. Is 'docker -d' running on this host?")
 		}
 		return err
 	}

From 59e55af69a37ff708b71d7e9b84663a361274e12 Mon Sep 17 00:00:00 2001
From: Sven Dowideit <SvenDowideit@fosiki.com>
Date: Sat, 1 Mar 2014 07:56:22 +1000
Subject: [PATCH 355/403] Closes #4374

Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
\nDocker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: )
Upstream-commit: 83de8bb842b97094651207202a5474b8fec5259f
Component: engine
---
 components/engine/docs/sources/use/working_with_links_names.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/use/working_with_links_names.rst b/components/engine/docs/sources/use/working_with_links_names.rst
index 8c654cbdbc..1b0e9f6914 100644
--- a/components/engine/docs/sources/use/working_with_links_names.rst
+++ b/components/engine/docs/sources/use/working_with_links_names.rst
@@ -59,7 +59,7 @@ inter-container communication is set to false.
 
 For example, there is an image called ``crosbymichael/redis`` that exposes the
 port 6379 and starts the Redis server. Let's name the container as ``redis``
-based on that image and run it as daemon.
+based on that image and run it as a daemon.
 
 .. code-block:: bash
 

From ecc13ba924b3cd271334f4cacea5c3ef10f3fe93 Mon Sep 17 00:00:00 2001
From: Lokesh Mandvekar <lsm5@redhat.com>
Date: Tue, 4 Mar 2014 12:54:53 -0500
Subject: [PATCH 356/403] bump open files and procs limit via unitfile

Docker-DCO-1.1-Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com> (github: lsm5)

	modified:   contrib/init/systemd/docker.service
	modified:   contrib/init/systemd/socket-activation/docker.service
Upstream-commit: 291d5e642e83ca84bd4f9b470eac8f840fecf48c
Component: engine
---
 components/engine/contrib/init/systemd/docker.service           | 2 ++
 .../contrib/init/systemd/socket-activation/docker.service       | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/components/engine/contrib/init/systemd/docker.service b/components/engine/contrib/init/systemd/docker.service
index 387be2eb1c..1bc4d1f569 100644
--- a/components/engine/contrib/init/systemd/docker.service
+++ b/components/engine/contrib/init/systemd/docker.service
@@ -6,6 +6,8 @@ After=network.target
 [Service]
 ExecStart=/usr/bin/docker -d
 Restart=on-failure
+LimitNOFILE=1048576
+LimitNPROC=1048576
 
 [Install]
 WantedBy=multi-user.target
diff --git a/components/engine/contrib/init/systemd/socket-activation/docker.service b/components/engine/contrib/init/systemd/socket-activation/docker.service
index c795f9c3b4..a3382ab414 100644
--- a/components/engine/contrib/init/systemd/socket-activation/docker.service
+++ b/components/engine/contrib/init/systemd/socket-activation/docker.service
@@ -6,6 +6,8 @@ After=network.target
 [Service]
 ExecStart=/usr/bin/docker -d -H fd://
 Restart=on-failure
+LimitNOFILE=1048576
+LimitNPROC=1048576
 
 [Install]
 WantedBy=multi-user.target

From 858eed23c25f136f736e33dbf58537fcc30d002c Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 4 Mar 2014 21:25:00 -0700
Subject: [PATCH 357/403] Update PACKAGERS.md with some text changes, including
 and especially moving "LXC" to a new "Optional Dependencies" section

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: a7f265223aec54a53c938f119275cb5fcebca4b6
Component: engine
---
 components/engine/hack/PACKAGERS.md | 30 ++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/components/engine/hack/PACKAGERS.md b/components/engine/hack/PACKAGERS.md
index b50306430b..2d2f434dc0 100644
--- a/components/engine/hack/PACKAGERS.md
+++ b/components/engine/hack/PACKAGERS.md
@@ -142,30 +142,46 @@ dependencies to be installed (see below).
 
 The test suite will also download a small test container, so you will need internet connectivity.
 
-## Runtime dependencies
+## Dependencies
+
+### Runtime
 
 To run properly, docker needs the following software to be installed at runtime:
 
 * iproute2 version 3.5 or later (build after 2012-05-21), and specifically the "ip" utility
 * iptables version 1.4 or later
-* The LXC utility scripts (http://lxc.sourceforge.net) version 0.8 or later
 * Git version 1.7 or later
 * XZ Utils 4.9 or later
 
-## Kernel dependencies
+### Kernel
 
-Docker in daemon mode has specific kernel requirements. For details, see
-http://docs.docker.io/en/latest/installation/kernel/
+Docker in daemon mode has specific kernel requirements. Most pre-packaged
+kernels include the necessary options enabled. If you are building your own
+kernel, you will either need to discover the options necessary via trial and
+error, or check out the [Gentoo
+ebuild](https://github.com/tianon/docker-overlay/blob/master/app-emulation/docker/docker-9999.ebuild),
+in which a list is maintained.
 
 Note that Docker also has a client mode, which can run on virtually any linux kernel (it even builds
 on OSX!).
 
+### Optional
+
+Some of Docker's features are activated by using optional command-line flags or
+by having support for them in the kernel or userspace. A few examples include:
+
+* LXC execution driver (requires version 0.8 or later of the LXC utility scripts)
+* AUFS graph driver (requires AUFS patches/support enabled in the kernel, and at
+  least the "auplink" utility from aufs-tools)
+* BTRFS graph driver (requires BTRFS support enabled in the kernel)
+
 ## Init script
 
 Docker expects to run as a daemon at machine startup. Your package will need to include a script
-for your distro''s process supervisor of choice.
+for your distro's process supervisor of choice. Be sure to check out the
+"contrib/init" folder in case a suitable init script already exists!
 
-Docker should be run as root, with the following arguments:
+In general, Docker should be run as root, with the following arguments:
 
 ```bash
 docker -d

From b7c44f214d279e2675221df59ea0e465e6630cf7 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 4 Mar 2014 21:40:12 -0700
Subject: [PATCH 358/403] Reflow PACKAGERS.md to 80 columns (where possible)
 and update some minor formatting

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 9a677e6a68c9a07df8591d87ba82d77934600426
Component: engine
---
 components/engine/hack/PACKAGERS.md | 151 ++++++++++++++++------------
 1 file changed, 86 insertions(+), 65 deletions(-)

diff --git a/components/engine/hack/PACKAGERS.md b/components/engine/hack/PACKAGERS.md
index 2d2f434dc0..b7ca557ae5 100644
--- a/components/engine/hack/PACKAGERS.md
+++ b/components/engine/hack/PACKAGERS.md
@@ -1,36 +1,42 @@
-Dear packager.
+# Dear Packager,
 
-If you are looking to make docker available on your favorite software distribution,
-this document is for you. It summarizes the requirements for building and running
-docker.
+If you are looking to make docker available on your favorite software
+distribution, this document is for you. It summarizes the requirements for
+building and running the Docker client and the Docker daemon.
 
-## Getting started
+## Getting Started
 
-We really want to help you package Docker successfully. Before anything, a good first step
-is to introduce yourself on the [docker-dev mailing list](https://groups.google.com/forum/?fromgroups#!forum/docker-dev)
-, explain what you''re trying to achieve, and tell us how we can help. Don''t worry, we don''t bite!
-There might even be someone already working on packaging for the same distro!
+We want to help you package Docker successfully. Before doing any packaging, a
+good first step is to introduce yourself on the [docker-dev mailing
+list](https://groups.google.com/forum/?fromgroups#!forum/docker-dev), explain
+what you're trying to achieve, and tell us how we can help. Don't worry, we
+don't bite! There might even be someone already working on packaging for the
+same distro!
 
-You can also join the IRC channel - #docker and #docker-dev on Freenode are both active and friendly.
+You can also join the IRC channel - #docker and #docker-dev on Freenode are both
+active and friendly.
 
-## Package name
 
-If possible, your package should be called "docker". If that name is already taken, a second
-choice is "lxc-docker".
+## Package Name
 
-## Official build vs distro build
+If possible, your package should be called "docker". If that name is already
+taken, a second choice is "lxc-docker", but with the caveat that "LXC" is now an
+optional dependency (as noted below).
 
-The Docker project maintains its own build and release toolchain. It is pretty neat and entirely
-based on Docker (surprise!). This toolchain is the canonical way to build Docker, and the only
-method supported by the development team. We encourage you to give it a try, and if the circumstances
-allow you to use it, we recommend that you do.
+## Official Build vs Distro Build
 
-You might not be able to use the official build toolchain - usually because your distribution has a
-toolchain and packaging policy of its own. We get it! Your house, your rules. The rest of this document
-should give you the information you need to package Docker your way, without denaturing it in
-the process.
+The Docker project maintains its own build and release toolchain. It is pretty
+neat and entirely based on Docker (surprise!). This toolchain is the canonical
+way to build Docker, and the only method supported by the development team. We
+encourage you to give it a try, and if the circumstances allow you to use it, we
+recommend that you do.
 
-## System build dependencies
+You might not be able to use the official build toolchain - usually because your
+distribution has a toolchain and packaging policy of its own. We get it! Your
+house, your rules. The rest of this document should give you the information you
+need to package Docker your way, without denaturing it in the process.
+
+## System Build Dependencies
 
 To build docker, you will need the following system dependencies
 
@@ -38,28 +44,35 @@ To build docker, you will need the following system dependencies
 * A recent version of git and mercurial
 * Go version 1.2 or later
 * SQLite version 3.7.9 or later
-* libdevmapper version 1.02.68-cvs (2012-01-26) or later from lvm2 version 2.02.89 or later
-* btrfs-progs version 3.8 or later (including commit e5cb128 from 2013-01-07) for the necessary btrfs headers
-* A clean checkout of the source must be added to a valid Go [workspace](http://golang.org/doc/code.html#Workspaces)
-under the path *src/github.com/dotcloud/docker*.
+* libdevmapper version 1.02.68-cvs (2012-01-26) or later from lvm2 version
+  2.02.89 or later
+* btrfs-progs version 3.8 or later (including commit e5cb128 from 2013-01-07)
+  for the necessary btrfs headers
+* A clean checkout of the source must be added to a valid Go
+  [workspace](http://golang.org/doc/code.html#Workspaces) under the path
+  *src/github.com/dotcloud/docker*.
 
-## Go dependencies
+## Go Dependencies
 
-All Go dependencies are vendored under ./vendor. They are used by the official build,
-so the source of truth for the current version is whatever is in ./vendor.
+All Go dependencies are vendored under ./vendor. They are used by the official
+build, so the source of truth for the current version is whatever is in
+./vendor.
 
-To use the vendored dependencies, simply make sure the path to ./vendor is included in $GOPATH.
+To use the vendored dependencies, simply make sure the path to ./vendor is
+included in $GOPATH.
 
-If you would rather package these dependencies yourself, take a look at ./hack/vendor.sh for an
-easy-to-parse list of the exact version for each.
+If you would rather package these dependencies yourself, take a look at
+./hack/vendor.sh for an easy-to-parse list of the exact version for each.
 
-NOTE: if you''re not able to package the exact version (to the exact commit) of a given dependency,
-please get in touch so we can remediate! Who knows what discrepancies can be caused by even the
-slightest deviation. We promise to do our best to make everybody happy.
+NOTE: if you're not able to package the exact version (to the exact commit) of a
+given dependency, please get in touch so we can remediate! Who knows what
+discrepancies can be caused by even the slightest deviation. We promise to do
+our best to make everybody happy.
 
 ## Stripping Binaries
 
-Please, please, please do not strip any compiled binaries. This is really important.
+Please, please, please do not strip any compiled binaries. This is really
+important.
 
 See the following quotes from Dave Cheney, which explain this position better
 from the upstream Golang perspective.
@@ -94,29 +107,33 @@ from the upstream Golang perspective.
 
 ## Building Docker
 
-To build the docker binary, run the following command with the source checkout as the
-working directory:
+To build the docker binary, run the following command with the source checkout
+as the working directory.
 
 ```bash
 ./hack/make.sh binary
 ```
 
-This will create a static binary under *./bundles/$VERSION/binary/docker-$VERSION*, where
-*$VERSION* is the contents of the file *./VERSION*.
+This will create a static binary under
+*./bundles/$VERSION/binary/docker-$VERSION*, where *$VERSION* is the contents of
+the file *./VERSION*.
 
-You are encouraged to use ./hack/make.sh without modification. If you must absolutely write
-your own script (are you really, really sure you need to? make.sh is really not that complicated),
-then please take care the respect the following:
+You are encouraged to use ./hack/make.sh without modification. If you must
+absolutely write your own script (are you really, really sure you need to?
+make.sh is really not that complicated), then please take care the respect the
+following:
 
 * In *./hack/make.sh*: $LDFLAGS, $BUILDFLAGS, $VERSION and $GITCOMMIT
 * In *./hack/make/binary*: the exact build command to run
 
-You may be tempted to tweak these settings. In particular, being a rigorous maintainer, you may want
-to disable static linking. Please don''t! Docker *needs* to be statically linked to function properly.
-You would do the users of your distro a disservice and "void the docker warranty" by changing the flags.
+You may be tempted to tweak these settings. In particular, being a rigorous
+maintainer, you may want to disable static linking. Please don't! Docker's
+daemon *needs* to be statically linked to function properly. You would do the
+users of your distro a disservice and "void the docker warranty" by changing the
+flags.
 
-A good comparison is Busybox: all distros package it as a statically linked binary, because it just
-makes sense. Docker is the same way.
+A good comparison is Busybox: all distros package it as a statically linked
+binary, because it just makes sense. Docker is the same way.
 
 If you *must* have a non-static Docker binary, please use:
 
@@ -124,31 +141,34 @@ If you *must* have a non-static Docker binary, please use:
 ./hack/make.sh dynbinary
 ```
 
-This will create *./bundles/$VERSION/dynbinary/docker-$VERSION* and *./bundles/$VERSION/binary/dockerinit-$VERSION*.
-The first of these would usually be installed at */usr/bin/docker*, while the second must be installed
-at */usr/libexec/docker/dockerinit*.
+This will create *./bundles/$VERSION/dynbinary/docker-$VERSION* and
+*./bundles/$VERSION/binary/dockerinit-$VERSION*. The first of these would
+usually be installed at */usr/bin/docker*, while the second must be installed at
+*/usr/libexec/docker/dockerinit*.
 
 ## Testing Docker
 
-Before releasing your binary, make sure to run the tests! Run the following command with the source
-checkout as the working directory:
+Before releasing your binary, make sure to run the tests! Run the following
+command with the source checkout as the working directory:
 
 ```bash
 ./hack/make.sh test
 ```
 
-The test suite includes both live integration tests and unit tests, so you will need all runtime
-dependencies to be installed (see below).
+The test suite includes both live integration tests and unit tests, so you will
+need all runtime dependencies to be installed (see below).
 
-The test suite will also download a small test container, so you will need internet connectivity.
+The test suite will also download a small test container, so you will need
+internet connectivity.
 
-## Dependencies
+## System Dependencies
 
 ### Runtime
 
 To run properly, docker needs the following software to be installed at runtime:
 
-* iproute2 version 3.5 or later (build after 2012-05-21), and specifically the "ip" utility
+* iproute2 version 3.5 or later (build after 2012-05-21), and specifically the
+  "ip" utility
 * iptables version 1.4 or later
 * Git version 1.7 or later
 * XZ Utils 4.9 or later
@@ -162,8 +182,8 @@ error, or check out the [Gentoo
 ebuild](https://github.com/tianon/docker-overlay/blob/master/app-emulation/docker/docker-9999.ebuild),
 in which a list is maintained.
 
-Note that Docker also has a client mode, which can run on virtually any linux kernel (it even builds
-on OSX!).
+Note that Docker also has a client mode, which can run on virtually any Linux
+kernel (it even builds on OSX!).
 
 ### Optional
 
@@ -175,11 +195,12 @@ by having support for them in the kernel or userspace. A few examples include:
   least the "auplink" utility from aufs-tools)
 * BTRFS graph driver (requires BTRFS support enabled in the kernel)
 
-## Init script
+## Init Script
 
-Docker expects to run as a daemon at machine startup. Your package will need to include a script
-for your distro's process supervisor of choice. Be sure to check out the
-"contrib/init" folder in case a suitable init script already exists!
+Docker expects to run as a daemon at machine startup. Your package will need to
+include a script for your distro's process supervisor of choice. Be sure to
+check out the "contrib/init" folder in case a suitable init script already
+exists.
 
 In general, Docker should be run as root, with the following arguments:
 

From 812f45a7e03026656a82c4ea82c8e4e869bfd2a3 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 4 Mar 2014 21:41:59 -0700
Subject: [PATCH 359/403] Mention in PACKAGERS.md that Tianon is available for
 packager needs

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: d9ec3a034719ac933a791bdf064afe8afb63b1f9
Component: engine
---
 components/engine/hack/PACKAGERS.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/components/engine/hack/PACKAGERS.md b/components/engine/hack/PACKAGERS.md
index b7ca557ae5..0228deb9e1 100644
--- a/components/engine/hack/PACKAGERS.md
+++ b/components/engine/hack/PACKAGERS.md
@@ -16,6 +16,11 @@ same distro!
 You can also join the IRC channel - #docker and #docker-dev on Freenode are both
 active and friendly.
 
+We like to refer to Tianon ("@tianon" on GitHub and "tianon" on IRC) as our
+"Packagers Relations", since he's always working to make sure our packagers have
+a good, healthy upstream to work with (both in our communication and in our
+build scripts). If you're having any kind of trouble, feel free to ping him
+directly.
 
 ## Package Name
 

From 172cbdf737d2c0d26aa5b3ab661e65fd3eeae189 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 4 Mar 2014 22:51:34 -0700
Subject: [PATCH 360/403] Rewrite more loads of PACKAGERS.md to hopefully
 remove some outdated information, add some updated information and pointers,
 and generally make the tone of this document less condescending :)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 615667b8831e49474ad7d255d62343c2427514ec
Component: engine
---
 components/engine/hack/PACKAGERS.md | 205 ++++++++++++++++++----------
 1 file changed, 132 insertions(+), 73 deletions(-)

diff --git a/components/engine/hack/PACKAGERS.md b/components/engine/hack/PACKAGERS.md
index 0228deb9e1..46b32cd805 100644
--- a/components/engine/hack/PACKAGERS.md
+++ b/components/engine/hack/PACKAGERS.md
@@ -1,6 +1,6 @@
 # Dear Packager,
 
-If you are looking to make docker available on your favorite software
+If you are looking to make Docker available on your favorite software
 distribution, this document is for you. It summarizes the requirements for
 building and running the Docker client and the Docker daemon.
 
@@ -8,10 +8,9 @@ building and running the Docker client and the Docker daemon.
 
 We want to help you package Docker successfully. Before doing any packaging, a
 good first step is to introduce yourself on the [docker-dev mailing
-list](https://groups.google.com/forum/?fromgroups#!forum/docker-dev), explain
-what you're trying to achieve, and tell us how we can help. Don't worry, we
-don't bite! There might even be someone already working on packaging for the
-same distro!
+list](https://groups.google.com/d/forum/docker-dev), explain what you're trying
+to achieve, and tell us how we can help. Don't worry, we don't bite! There might
+even be someone already working on packaging for the same distro!
 
 You can also join the IRC channel - #docker and #docker-dev on Freenode are both
 active and friendly.
@@ -20,30 +19,30 @@ We like to refer to Tianon ("@tianon" on GitHub and "tianon" on IRC) as our
 "Packagers Relations", since he's always working to make sure our packagers have
 a good, healthy upstream to work with (both in our communication and in our
 build scripts). If you're having any kind of trouble, feel free to ping him
-directly.
+directly. He also likes to keep track of what distributions we have packagers
+for, so feel free to reach out to him even just to say "Hi!"
 
 ## Package Name
 
 If possible, your package should be called "docker". If that name is already
 taken, a second choice is "lxc-docker", but with the caveat that "LXC" is now an
-optional dependency (as noted below).
+optional dependency (as noted below). Another possible choice is "docker.io".
 
 ## Official Build vs Distro Build
 
 The Docker project maintains its own build and release toolchain. It is pretty
 neat and entirely based on Docker (surprise!). This toolchain is the canonical
-way to build Docker, and the only method supported by the development team. We
-encourage you to give it a try, and if the circumstances allow you to use it, we
-recommend that you do.
+way to build Docker. We encourage you to give it a try, and if the circumstances
+allow you to use it, we recommend that you do.
 
 You might not be able to use the official build toolchain - usually because your
 distribution has a toolchain and packaging policy of its own. We get it! Your
 house, your rules. The rest of this document should give you the information you
 need to package Docker your way, without denaturing it in the process.
 
-## System Build Dependencies
+## Build Dependencies
 
-To build docker, you will need the following system dependencies
+To build Docker, you will need the following:
 
 * An amd64 machine
 * A recent version of git and mercurial
@@ -53,21 +52,23 @@ To build docker, you will need the following system dependencies
   2.02.89 or later
 * btrfs-progs version 3.8 or later (including commit e5cb128 from 2013-01-07)
   for the necessary btrfs headers
-* A clean checkout of the source must be added to a valid Go
-  [workspace](http://golang.org/doc/code.html#Workspaces) under the path
-  *src/github.com/dotcloud/docker*.
+* A clean checkout of the source added to a valid [Go
+  workspace](http://golang.org/doc/code.html#Workspaces) under the path
+  *src/github.com/dotcloud/docker* (unless you plan to use `AUTO_GOPATH`,
+  explained in more detail below).
 
-## Go Dependencies
+### Go Dependencies
 
-All Go dependencies are vendored under ./vendor. They are used by the official
-build, so the source of truth for the current version is whatever is in
-./vendor.
+All Go dependencies are vendored under "./vendor". They are used by the official
+build, so the source of truth for the current version of each dependency is
+whatever is in "./vendor".
 
-To use the vendored dependencies, simply make sure the path to ./vendor is
-included in $GOPATH.
+To use the vendored dependencies, simply make sure the path to "./vendor" is
+included in `GOPATH` (or use `AUTO_GOPATH`, as explained below).
 
-If you would rather package these dependencies yourself, take a look at
-./hack/vendor.sh for an easy-to-parse list of the exact version for each.
+If you would rather (or must, due to distro policy) package these dependencies
+yourself, take a look at "./hack/vendor.sh" for an easy-to-parse list of the
+exact version for each.
 
 NOTE: if you're not able to package the exact version (to the exact commit) of a
 given dependency, please get in touch so we can remediate! Who knows what
@@ -79,6 +80,10 @@ our best to make everybody happy.
 Please, please, please do not strip any compiled binaries. This is really
 important.
 
+In our own testing, stripping the resulting binaries sometimes results in a
+binary that appears to work, but more often causes random panics, segfaults, and
+other issues. Even if the binary appears to work, please don't strip.
+
 See the following quotes from Dave Cheney, which explain this position better
 from the upstream Golang perspective.
 
@@ -112,85 +117,127 @@ from the upstream Golang perspective.
 
 ## Building Docker
 
-To build the docker binary, run the following command with the source checkout
-as the working directory.
+Please use our build script ("./hack/make.sh") for all your compilation of
+Docker. If there's something you need that it isn't doing, or something it could
+be doing to make your life as a packager easier, please get in touch with Tianon
+and help us rectify the situation. Chances are good that other packagers have
+probably run into the same problems and a fix might already be in the works, but
+none of us will know for sure unless you harass Tianon about it. :)
+
+All the commands listed within this section should be run with the Docker source
+checkout as the current working directory.
+
+### `AUTO_GOPATH`
+
+If you'd rather not be bothered with the hassles that setting up `GOPATH`
+appropriately can be, and prefer to just get a "build that works", you should
+add something similar to this to whatever script or process you're using to
+build Docker:
+
+```bash
+export AUTO_GOPATH=1
+```
+
+This will cause the build scripts to set up a reasonable `GOPATH` that
+automatically and properly includes both dotcloud/docker from the local
+directory, and the local "./vendor" directory as necessary.
+
+### Static Daemon
+
+If it is feasible within the constraints of your distribution, you should
+seriously consider packaging Docker as a single static binary. A good comparison
+is Busybox, which is often packaged statically as a feature to enable mass
+portability. Because of the unique way Docker operates, being similarly static
+is a "feature".
+
+To build a static Docker daemon binary, run the following command (first
+ensuring that all the necessary libraries are available in static form for
+linking - see the "Build Dependencies" section above, and the relevant lines
+within Docker's own Dockerfile that set up our official build environment):
 
 ```bash
 ./hack/make.sh binary
 ```
 
 This will create a static binary under
-*./bundles/$VERSION/binary/docker-$VERSION*, where *$VERSION* is the contents of
-the file *./VERSION*.
+"./bundles/$VERSION/binary/docker-$VERSION", where "$VERSION" is the contents of
+the file "./VERSION". This binary is usually installed somewhere like
+"/usr/bin/docker".
 
-You are encouraged to use ./hack/make.sh without modification. If you must
-absolutely write your own script (are you really, really sure you need to?
-make.sh is really not that complicated), then please take care the respect the
+### Dynamic Daemon / Client-only Binary
+
+If you need to (due to distro policy, distro library availability, or for other
+reasons) create a dynamically compiled daemon binary, or if you are only
+interested in creating a client binary for Docker, use something similar to the
 following:
 
-* In *./hack/make.sh*: $LDFLAGS, $BUILDFLAGS, $VERSION and $GITCOMMIT
-* In *./hack/make/binary*: the exact build command to run
-
-You may be tempted to tweak these settings. In particular, being a rigorous
-maintainer, you may want to disable static linking. Please don't! Docker's
-daemon *needs* to be statically linked to function properly. You would do the
-users of your distro a disservice and "void the docker warranty" by changing the
-flags.
-
-A good comparison is Busybox: all distros package it as a statically linked
-binary, because it just makes sense. Docker is the same way.
-
-If you *must* have a non-static Docker binary, please use:
-
 ```bash
 ./hack/make.sh dynbinary
 ```
 
-This will create *./bundles/$VERSION/dynbinary/docker-$VERSION* and
-*./bundles/$VERSION/binary/dockerinit-$VERSION*. The first of these would
-usually be installed at */usr/bin/docker*, while the second must be installed at
-*/usr/libexec/docker/dockerinit*.
+This will create "./bundles/$VERSION/dynbinary/docker-$VERSION", which for
+client-only builds is the important file to grab and install as appropriate.
 
-## Testing Docker
+For daemon builds, you will also need to grab and install
+"./bundles/$VERSION/dynbinary/dockerinit-$VERSION", which is created from the
+minimal set of Docker's codebase that _must_ be compiled statically (and is thus
+a pure static binary). The acceptable locations Docker will search for this file
+are as follows (in order):
 
-Before releasing your binary, make sure to run the tests! Run the following
-command with the source checkout as the working directory:
+* as "dockerinit" in the same directory as the daemon binary (ie, if docker is
+  installed at "/usr/bin/docker", then "/usr/bin/dockerinit" will be the first
+  place this file is searched for)
+* "/usr/libexec/docker/dockerinit" or "/usr/local/libexec/docker/dockerinit"
+  ([FHS 3.0 Draft](http://www.linuxbase.org/betaspecs/fhs/fhs.html#usrlibexec))
+* "/usr/lib/docker/dockerinit" or "/usr/local/lib/docker/dockerinit" ([FHS
+  2.3](http://refspecs.linuxfoundation.org/FHS_2.3/fhs-2.3.html#USRLIBLIBRARIESFORPROGRAMMINGANDPA))
+
+If (and please, only if) one of the paths above is insufficient due to distro
+policy or similar issues, you may use the `DOCKER_INITPATH` environment variable
+at compile-time as follows to set a different path for Docker to search:
 
 ```bash
-./hack/make.sh test
+export DOCKER_INITPATH=/usr/lib/docker.io/dockerinit
 ```
 
-The test suite includes both live integration tests and unit tests, so you will
-need all runtime dependencies to be installed (see below).
+If you find yourself needing this, please don't hesitate to reach out to Tianon
+to see if it would be reasonable or helpful to add more paths to Docker's list,
+especially if there's a relevant standard worth referencing (such as the FHS).
 
-The test suite will also download a small test container, so you will need
-internet connectivity.
+Also, it goes without saying, but for the purposes of the daemon please consider
+these two binaries ("docker" and "dockerinit") as if they were a single unit.
+Mixing and matching can cause undesired consequences, and will fail to run
+properly.
 
 ## System Dependencies
 
-### Runtime
+### Runtime Dependencies
 
-To run properly, docker needs the following software to be installed at runtime:
+To function properly, the Docker daemon needs the following software to be
+installed and available at runtime:
 
-* iproute2 version 3.5 or later (build after 2012-05-21), and specifically the
-  "ip" utility
 * iptables version 1.4 or later
+* XZ Utils version 4.9 or later
+
+Additionally, the Docker client needs the following software to be installed and
+available at runtime:
+
 * Git version 1.7 or later
-* XZ Utils 4.9 or later
 
-### Kernel
+### Kernel Requirements
 
-Docker in daemon mode has specific kernel requirements. Most pre-packaged
-kernels include the necessary options enabled. If you are building your own
-kernel, you will either need to discover the options necessary via trial and
+The Docker daemon has very specific kernel requirements. Most pre-packaged
+kernels already include the necessary options enabled. If you are building your
+own kernel, you will either need to discover the options necessary via trial and
 error, or check out the [Gentoo
 ebuild](https://github.com/tianon/docker-overlay/blob/master/app-emulation/docker/docker-9999.ebuild),
-in which a list is maintained.
+in which a list is maintained (and if there are any issues or discrepancies in
+that list, please contact Tianon so they can be rectified).
 
-Note that Docker also has a client mode, which can run on virtually any Linux
-kernel (it even builds on OSX!).
+Note that in client mode, there are no specific kernel requirements, and that
+the client will even run on alternative platforms such as Mac OS X / Darwin.
 
-### Optional
+### Optional Dependencies
 
 Some of Docker's features are activated by using optional command-line flags or
 by having support for them in the kernel or userspace. A few examples include:
@@ -198,17 +245,29 @@ by having support for them in the kernel or userspace. A few examples include:
 * LXC execution driver (requires version 0.8 or later of the LXC utility scripts)
 * AUFS graph driver (requires AUFS patches/support enabled in the kernel, and at
   least the "auplink" utility from aufs-tools)
-* BTRFS graph driver (requires BTRFS support enabled in the kernel)
+* experimental BTRFS graph driver (requires BTRFS support enabled in the kernel)
 
-## Init Script
+## Daemon Init Script
 
 Docker expects to run as a daemon at machine startup. Your package will need to
 include a script for your distro's process supervisor of choice. Be sure to
 check out the "contrib/init" folder in case a suitable init script already
-exists.
+exists (and if one does not, contact Tianon about whether it might be
+appropriate for your distro's init script to live there too!).
 
-In general, Docker should be run as root, with the following arguments:
+In general, Docker should be run as root, similar to the following:
 
 ```bash
 docker -d
 ```
+
+Generally, a `DOCKER_OPTS` variable of some kind is available for adding more
+flags (such as changing the graph driver to use BTRFS, switching the location of
+"/var/lib/docker", etc).
+
+## Communicate
+
+As a final note, please do feel free to reach out to Tianon at any time for
+pretty much anything. He really does love hearing from our packagers and wants
+to make sure we're not being a "hostile upstream". As should be a given, we
+appreciate the work our packagers do to make sure we have broad distribution!

From 200f51951207cb33578d68307353ecfcc24398ac Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 4 Mar 2014 22:52:39 -0700
Subject: [PATCH 361/403] Update package deps to remove LXC and move aufs-tools
 to be in "Recommends" instead of strict Depends

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: b69f63283088e1ac744aafeb08189cb593b30787
Component: engine
---
 components/engine/hack/make/ubuntu | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/components/engine/hack/make/ubuntu b/components/engine/hack/make/ubuntu
index 23af0ff7e0..65f6b7e273 100644
--- a/components/engine/hack/make/ubuntu
+++ b/components/engine/hack/make/ubuntu
@@ -112,9 +112,8 @@ EOF
 		    --after-remove /tmp/postrm \
 		    --architecture "$PACKAGE_ARCHITECTURE" \
 		    --prefix / \
-		    --depends lxc \
-		    --depends aufs-tools \
 		    --depends iptables \
+		    --deb-recommends aufs-tools \
 		    --deb-recommends ca-certificates \
 		    --deb-recommends xz-utils \
 		    --description "$PACKAGE_DESCRIPTION" \

From 5cfec2c466c6c2ea2edce51f8a144f0c28044c71 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 4 Mar 2014 22:54:58 -0700
Subject: [PATCH 362/403] Update the relevant docs section to match
 PACKAGERS.md

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 4293a1ceb476ce4a8621ac1500a3623328fb5b97
Component: engine
---
 components/engine/docs/sources/installation/binaries.rst | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/components/engine/docs/sources/installation/binaries.rst b/components/engine/docs/sources/installation/binaries.rst
index 976e94e344..bfdfbe211f 100644
--- a/components/engine/docs/sources/installation/binaries.rst
+++ b/components/engine/docs/sources/installation/binaries.rst
@@ -26,10 +26,7 @@ Check runtime dependencies
 
 To run properly, docker needs the following software to be installed at runtime:
 
-- iproute2 version 3.5 or later (build after 2012-05-21), and
-  specifically the "ip" utility
 - iptables version 1.4 or later
-- The LXC utility scripts (http://lxc.sourceforge.net) version 0.8 or later
 - Git version 1.7 or later
 - XZ Utils 4.9 or later
 
@@ -41,7 +38,7 @@ Docker in daemon mode has specific kernel requirements. For details,
 check your distribution in :ref:`installation_list`.
 
 Note that Docker also has a client mode, which can run on virtually
-any linux kernel (it even builds on OSX!).
+any Linux kernel (it even builds on OSX!).
 
 
 Get the docker binary:

From 10b41687cf9af8b41d9a8e34f58d8a1ef2ee0e52 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Tue, 4 Mar 2014 22:59:46 -0700
Subject: [PATCH 363/403] Add "git" to our Ubuntu package "Recommends" (whoops,
 this should've been in here for a while now)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 5317ad476d9e2c39cf6379fef4ec7f8ba0bcc23a
Component: engine
---
 components/engine/hack/make/ubuntu | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/hack/make/ubuntu b/components/engine/hack/make/ubuntu
index 65f6b7e273..602d4ac1ad 100644
--- a/components/engine/hack/make/ubuntu
+++ b/components/engine/hack/make/ubuntu
@@ -115,6 +115,7 @@ EOF
 		    --depends iptables \
 		    --deb-recommends aufs-tools \
 		    --deb-recommends ca-certificates \
+		    --deb-recommends git \
 		    --deb-recommends xz-utils \
 		    --description "$PACKAGE_DESCRIPTION" \
 		    --maintainer "$PACKAGE_MAINTAINER" \

From 90b2106a7f4a24dd1a44b5ccff5977363f3a6e1a Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Wed, 5 Mar 2014 09:40:54 +0100
Subject: [PATCH 364/403] libcontainer: Use MS_PRIVATE instead of MS_SLAVE

Now that we unmount all the mounts from the global namespace we can
use a private namespace rather than a slave one (as we have no need
for unmounts of inherited global mounts to propagate into the
container).

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 757b5775725fb90262cee1fa6068fa9dcbbff59f
Component: engine
---
 components/engine/pkg/libcontainer/nsinit/mount.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 61586bc4ed..69d85d66ca 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -21,7 +21,7 @@ const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NOD
 // is no longer in use, the mounts will be removed automatically
 func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	// mount as slave so that the new mounts do not propagate to the host
-	if err := system.Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
+	if err := system.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
 	if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {

From cb1dbed1c905b1c9e89702127d31629b1b650112 Mon Sep 17 00:00:00 2001
From: "Carl X. Su" <bcbcarl@gmail.com>
Date: Wed, 5 Mar 2014 20:16:41 +0800
Subject: [PATCH 365/403] Flag 'docker-js' as outdated Upstream-commit:
 5e32c40795e527cc2e916fe5b8970b37e9485266 Component: engine

---
 .../docs/sources/reference/api/remote_api_client_libraries.rst  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst b/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
index 362fa6fe3d..46bbfeb5d7 100644
--- a/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
+++ b/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
@@ -27,7 +27,7 @@ and we will add the libraries here.
 | JavaScript (NodeJS)  | docker.io      | https://github.com/appersonlabs/docker.io  | Active   |
 |                      |                | Install via NPM: `npm install docker.io`   |          |
 +----------------------+----------------+--------------------------------------------+----------+
-| JavaScript           | docker-js      | https://github.com/dgoujard/docker-js      | Active   |
+| JavaScript           | docker-js      | https://github.com/dgoujard/docker-js      | Outdated |
 +----------------------+----------------+--------------------------------------------+----------+
 | JavaScript (Angular) | docker-cp      | https://github.com/13W/docker-cp           | Active   |
 | **WebUI**            |                |                                            |          |

From 42b0cd252947c9102f4827967a6d31f950d27069 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Fri, 21 Feb 2014 10:12:25 +0100
Subject: [PATCH 366/403] Create pkg/system and move stuff there from archive

This is a package for generic system calls etc that for some reason
is not yet supported by "syscall", or where it is different enough
for the different ports to need portability wrappers.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: d6114c0da0e844199e3d23c60a04434566fb5392
Component: engine
---
 components/engine/archive/archive.go          |  9 ++---
 components/engine/archive/changes.go          |  5 +--
 components/engine/archive/stat_unsupported.go | 29 ---------------
 components/engine/pkg/system/stat_linux.go    | 13 +++++++
 .../engine/pkg/system/stat_unsupported.go     | 13 +++++++
 components/engine/pkg/system/utimes_linux.go  | 31 ++++++++++++++++
 .../engine/pkg/system/utimes_unsupported.go   | 13 +++++++
 .../system/xattrs_linux.go}                   | 35 +------------------
 .../engine/pkg/system/xattrs_unsupported.go   | 11 ++++++
 9 files changed, 90 insertions(+), 69 deletions(-)
 delete mode 100644 components/engine/archive/stat_unsupported.go
 create mode 100644 components/engine/pkg/system/stat_linux.go
 create mode 100644 components/engine/pkg/system/stat_unsupported.go
 create mode 100644 components/engine/pkg/system/utimes_linux.go
 create mode 100644 components/engine/pkg/system/utimes_unsupported.go
 rename components/engine/{archive/stat_linux.go => pkg/system/xattrs_linux.go} (65%)
 create mode 100644 components/engine/pkg/system/xattrs_unsupported.go

diff --git a/components/engine/archive/archive.go b/components/engine/archive/archive.go
index 72bd31a281..5d6c020438 100644
--- a/components/engine/archive/archive.go
+++ b/components/engine/archive/archive.go
@@ -6,6 +6,7 @@ import (
 	"compress/gzip"
 	"errors"
 	"fmt"
+	"github.com/dotcloud/docker/pkg/system"
 	"github.com/dotcloud/docker/utils"
 	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
@@ -168,7 +169,7 @@ func addTarFile(path, name string, tw *tar.Writer) error {
 
 	}
 
-	capability, _ := Lgetxattr(path, "security.capability")
+	capability, _ := system.Lgetxattr(path, "security.capability")
 	if capability != nil {
 		hdr.Xattrs = make(map[string]string)
 		hdr.Xattrs["security.capability"] = string(capability)
@@ -259,7 +260,7 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader) e
 	}
 
 	for key, value := range hdr.Xattrs {
-		if err := Lsetxattr(path, key, []byte(value), 0); err != nil {
+		if err := system.Lsetxattr(path, key, []byte(value), 0); err != nil {
 			return err
 		}
 	}
@@ -275,11 +276,11 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader) e
 	ts := []syscall.Timespec{timeToTimespec(hdr.AccessTime), timeToTimespec(hdr.ModTime)}
 	// syscall.UtimesNano doesn't support a NOFOLLOW flag atm, and
 	if hdr.Typeflag != tar.TypeSymlink {
-		if err := UtimesNano(path, ts); err != nil {
+		if err := system.UtimesNano(path, ts); err != nil {
 			return err
 		}
 	} else {
-		if err := LUtimesNano(path, ts); err != nil {
+		if err := system.LUtimesNano(path, ts); err != nil {
 			return err
 		}
 	}
diff --git a/components/engine/archive/changes.go b/components/engine/archive/changes.go
index a397a1cf8b..723e4a7425 100644
--- a/components/engine/archive/changes.go
+++ b/components/engine/archive/changes.go
@@ -3,6 +3,7 @@ package archive
 import (
 	"bytes"
 	"fmt"
+	"github.com/dotcloud/docker/pkg/system"
 	"github.com/dotcloud/docker/utils"
 	"github.com/dotcloud/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"
 	"io"
@@ -202,7 +203,7 @@ func (info *FileInfo) addChanges(oldInfo *FileInfo, changes *[]Change) {
 				oldStat.Rdev != newStat.Rdev ||
 				// Don't look at size for dirs, its not a good measure of change
 				(oldStat.Size != newStat.Size && oldStat.Mode&syscall.S_IFDIR != syscall.S_IFDIR) ||
-				!sameFsTimeSpec(getLastModification(oldStat), getLastModification(newStat)) ||
+				!sameFsTimeSpec(system.GetLastModification(oldStat), system.GetLastModification(newStat)) ||
 				bytes.Compare(oldChild.capability, newChild.capability) != 0 {
 				change := Change{
 					Path: newChild.path(),
@@ -278,7 +279,7 @@ func collectFileInfo(sourceDir string) (*FileInfo, error) {
 			return err
 		}
 
-		info.capability, _ = Lgetxattr(path, "security.capability")
+		info.capability, _ = system.Lgetxattr(path, "security.capability")
 
 		parent.children[info.name] = info
 
diff --git a/components/engine/archive/stat_unsupported.go b/components/engine/archive/stat_unsupported.go
deleted file mode 100644
index 99f1fbc7da..0000000000
--- a/components/engine/archive/stat_unsupported.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// +build !linux
-
-package archive
-
-import "syscall"
-
-func getLastAccess(stat *syscall.Stat_t) syscall.Timespec {
-	return stat.Atimespec
-}
-
-func getLastModification(stat *syscall.Stat_t) syscall.Timespec {
-	return stat.Mtimespec
-}
-
-func LUtimesNano(path string, ts []syscall.Timespec) error {
-	return ErrNotImplemented
-}
-
-func UtimesNano(path string, ts []syscall.Timespec) error {
-	return ErrNotImplemented
-}
-
-func Lgetxattr(path string, attr string) ([]byte, error) {
-	return nil, ErrNotImplemented
-}
-
-func Lsetxattr(path string, attr string, data []byte, flags int) error {
-	return ErrNotImplemented
-}
diff --git a/components/engine/pkg/system/stat_linux.go b/components/engine/pkg/system/stat_linux.go
new file mode 100644
index 0000000000..e702200360
--- /dev/null
+++ b/components/engine/pkg/system/stat_linux.go
@@ -0,0 +1,13 @@
+package system
+
+import (
+	"syscall"
+)
+
+func GetLastAccess(stat *syscall.Stat_t) syscall.Timespec {
+	return stat.Atim
+}
+
+func GetLastModification(stat *syscall.Stat_t) syscall.Timespec {
+	return stat.Mtim
+}
diff --git a/components/engine/pkg/system/stat_unsupported.go b/components/engine/pkg/system/stat_unsupported.go
new file mode 100644
index 0000000000..4686a4c346
--- /dev/null
+++ b/components/engine/pkg/system/stat_unsupported.go
@@ -0,0 +1,13 @@
+// +build !linux
+
+package system
+
+import "syscall"
+
+func GetLastAccess(stat *syscall.Stat_t) syscall.Timespec {
+	return stat.Atimespec
+}
+
+func GetLastModification(stat *syscall.Stat_t) syscall.Timespec {
+	return stat.Mtimespec
+}
diff --git a/components/engine/pkg/system/utimes_linux.go b/components/engine/pkg/system/utimes_linux.go
new file mode 100644
index 0000000000..c00f4026a5
--- /dev/null
+++ b/components/engine/pkg/system/utimes_linux.go
@@ -0,0 +1,31 @@
+package system
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+func LUtimesNano(path string, ts []syscall.Timespec) error {
+	// These are not currently available in syscall
+	AT_FDCWD := -100
+	AT_SYMLINK_NOFOLLOW := 0x100
+
+	var _path *byte
+	_path, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return err
+	}
+
+	if _, _, err := syscall.Syscall6(syscall.SYS_UTIMENSAT, uintptr(AT_FDCWD), uintptr(unsafe.Pointer(_path)), uintptr(unsafe.Pointer(&ts[0])), uintptr(AT_SYMLINK_NOFOLLOW), 0, 0); err != 0 && err != syscall.ENOSYS {
+		return err
+	}
+
+	return nil
+}
+
+func UtimesNano(path string, ts []syscall.Timespec) error {
+	if err := syscall.UtimesNano(path, ts); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/components/engine/pkg/system/utimes_unsupported.go b/components/engine/pkg/system/utimes_unsupported.go
new file mode 100644
index 0000000000..d247ba283e
--- /dev/null
+++ b/components/engine/pkg/system/utimes_unsupported.go
@@ -0,0 +1,13 @@
+// +build !linux
+
+package system
+
+import "syscall"
+
+func LUtimesNano(path string, ts []syscall.Timespec) error {
+	return ErrNotSupportedPlatform
+}
+
+func UtimesNano(path string, ts []syscall.Timespec) error {
+	return ErrNotSupportedPlatform
+}
diff --git a/components/engine/archive/stat_linux.go b/components/engine/pkg/system/xattrs_linux.go
similarity index 65%
rename from components/engine/archive/stat_linux.go
rename to components/engine/pkg/system/xattrs_linux.go
index 2910ce5bab..00edb201b5 100644
--- a/components/engine/archive/stat_linux.go
+++ b/components/engine/pkg/system/xattrs_linux.go
@@ -1,43 +1,10 @@
-package archive
+package system
 
 import (
 	"syscall"
 	"unsafe"
 )
 
-func getLastAccess(stat *syscall.Stat_t) syscall.Timespec {
-	return stat.Atim
-}
-
-func getLastModification(stat *syscall.Stat_t) syscall.Timespec {
-	return stat.Mtim
-}
-
-func LUtimesNano(path string, ts []syscall.Timespec) error {
-	// These are not currently available in syscall
-	AT_FDCWD := -100
-	AT_SYMLINK_NOFOLLOW := 0x100
-
-	var _path *byte
-	_path, err := syscall.BytePtrFromString(path)
-	if err != nil {
-		return err
-	}
-
-	if _, _, err := syscall.Syscall6(syscall.SYS_UTIMENSAT, uintptr(AT_FDCWD), uintptr(unsafe.Pointer(_path)), uintptr(unsafe.Pointer(&ts[0])), uintptr(AT_SYMLINK_NOFOLLOW), 0, 0); err != 0 && err != syscall.ENOSYS {
-		return err
-	}
-
-	return nil
-}
-
-func UtimesNano(path string, ts []syscall.Timespec) error {
-	if err := syscall.UtimesNano(path, ts); err != nil {
-		return err
-	}
-	return nil
-}
-
 // Returns a nil slice and nil error if the xattr is not set
 func Lgetxattr(path string, attr string) ([]byte, error) {
 	pathBytes, err := syscall.BytePtrFromString(path)
diff --git a/components/engine/pkg/system/xattrs_unsupported.go b/components/engine/pkg/system/xattrs_unsupported.go
new file mode 100644
index 0000000000..0060c167dc
--- /dev/null
+++ b/components/engine/pkg/system/xattrs_unsupported.go
@@ -0,0 +1,11 @@
+// +build !linux
+
+package system
+
+func Lgetxattr(path string, attr string) ([]byte, error) {
+	return nil, ErrNotSupportedPlatform
+}
+
+func Lsetxattr(path string, attr string, data []byte, flags int) error {
+	return ErrNotSupportedPlatform
+}

From 587cb127e736eb7d9a1561aaa5f7d57891ad675b Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Wed, 5 Mar 2014 16:43:03 +0200
Subject: [PATCH 367/403] fix flag deprecation warnings in integration tests

This removes three warnings in the integration tests:
Warning: '-viz' is deprecated, it will be removed soon. See usage.
Warning: '-tree' is deprecated, it will be removed soon. See usage.
Warning: '-cidfile' is deprecated, it will be removed soon. See usage.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 35054601d868a82841c220ff474ad47c5d52e871
Component: engine
---
 components/engine/integration/commands_test.go | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/components/engine/integration/commands_test.go b/components/engine/integration/commands_test.go
index 37ac79fa46..9f7a41384c 100644
--- a/components/engine/integration/commands_test.go
+++ b/components/engine/integration/commands_test.go
@@ -814,7 +814,7 @@ func TestImagesViz(t *testing.T) {
 	c := make(chan struct{})
 	go func() {
 		defer close(c)
-		if err := cli.CmdImages("-viz"); err != nil {
+		if err := cli.CmdImages("--viz"); err != nil {
 			t.Fatal(err)
 		}
 		stdoutPipe.Close()
@@ -847,7 +847,7 @@ func TestImagesViz(t *testing.T) {
 
 		for _, regexp := range compiledRegexps {
 			if !regexp.MatchString(cmdOutput) {
-				t.Fatalf("images -viz content '%s' did not match regexp '%s'", cmdOutput, regexp)
+				t.Fatalf("images --viz content '%s' did not match regexp '%s'", cmdOutput, regexp)
 			}
 		}
 	})
@@ -864,7 +864,7 @@ func TestImagesTree(t *testing.T) {
 	c := make(chan struct{})
 	go func() {
 		defer close(c)
-		if err := cli.CmdImages("-tree"); err != nil {
+		if err := cli.CmdImages("--tree"); err != nil {
 			t.Fatal(err)
 		}
 		stdoutPipe.Close()
@@ -896,7 +896,7 @@ func TestImagesTree(t *testing.T) {
 
 		for _, regexp := range compiledRegexps {
 			if !regexp.MatchString(cmdOutput) {
-				t.Fatalf("images -tree content '%s' did not match regexp '%s'", cmdOutput, regexp)
+				t.Fatalf("images --tree content '%s' did not match regexp '%s'", cmdOutput, regexp)
 			}
 		}
 	})
@@ -928,8 +928,8 @@ run    [ "$(ls -d /var/run/sshd)" = "/var/run/sshd" ]
 }
 
 // #2098 - Docker cidFiles only contain short version of the containerId
-//sudo docker run -cidfile /tmp/docker_test.cid ubuntu echo "test"
-// TestRunCidFile tests that run -cidfile returns the longid
+//sudo docker run --cidfile /tmp/docker_test.cid ubuntu echo "test"
+// TestRunCidFile tests that run --cidfile returns the longid
 func TestRunCidFile(t *testing.T) {
 	stdout, stdoutPipe := io.Pipe()
 
@@ -945,7 +945,7 @@ func TestRunCidFile(t *testing.T) {
 	c := make(chan struct{})
 	go func() {
 		defer close(c)
-		if err := cli.CmdRun("-cidfile", tmpCidFile, unitTestImageID, "ls"); err != nil {
+		if err := cli.CmdRun("--cidfile", tmpCidFile, unitTestImageID, "ls"); err != nil {
 			t.Fatal(err)
 		}
 	}()
@@ -967,7 +967,7 @@ func TestRunCidFile(t *testing.T) {
 		id := string(buffer)
 
 		if len(id) != len("2bf44ea18873287bd9ace8a4cb536a7cbe134bed67e805fdf2f58a57f69b320c") {
-			t.Fatalf("-cidfile should be a long id, not '%s'", id)
+			t.Fatalf("--cidfile should be a long id, not '%s'", id)
 		}
 		//test that its a valid cid? (though the container is gone..)
 		//remove the file and dir.

From 18fac79f25e2d5253c01a83de4c3a2df206d1059 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Wed, 5 Mar 2014 08:20:42 -0700
Subject: [PATCH 368/403] Add further clarification of where/when the
 build-time deps are applicable

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: c41e51ce3df05553b7a4ce6960df68973a4e17ee
Component: engine
---
 components/engine/hack/PACKAGERS.md | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/components/engine/hack/PACKAGERS.md b/components/engine/hack/PACKAGERS.md
index 46b32cd805..8d9749b4f8 100644
--- a/components/engine/hack/PACKAGERS.md
+++ b/components/engine/hack/PACKAGERS.md
@@ -44,18 +44,24 @@ need to package Docker your way, without denaturing it in the process.
 
 To build Docker, you will need the following:
 
-* An amd64 machine
 * A recent version of git and mercurial
 * Go version 1.2 or later
+* A clean checkout of the source added to a valid [Go
+  workspace](http://golang.org/doc/code.html#Workspaces) under the path
+  *src/github.com/dotcloud/docker* (unless you plan to use `AUTO_GOPATH`,
+  explained in more detail below).
+
+To build the Docker daemon, you will additionally need:
+
+* An amd64/x86_64 machine running Linux
 * SQLite version 3.7.9 or later
 * libdevmapper version 1.02.68-cvs (2012-01-26) or later from lvm2 version
   2.02.89 or later
 * btrfs-progs version 3.8 or later (including commit e5cb128 from 2013-01-07)
   for the necessary btrfs headers
-* A clean checkout of the source added to a valid [Go
-  workspace](http://golang.org/doc/code.html#Workspaces) under the path
-  *src/github.com/dotcloud/docker* (unless you plan to use `AUTO_GOPATH`,
-  explained in more detail below).
+
+Be sure to also check out Docker's Dockerfile for the most up-to-date list of
+these build-time dependencies.
 
 ### Go Dependencies
 

From a9b2a5c70f353429fbeca4898fc10f5d25d316fd Mon Sep 17 00:00:00 2001
From: Timothy Hobbs <timothyhobbs@seznam.cz>
Date: Wed, 5 Mar 2014 17:33:18 +0000
Subject: [PATCH 369/403] Change mustn't to must not

mustn't is ambiguous.  It may mean "you don't need to" even when it's not a tag question.  See prose:

http://books.google.cz/books?id=otFPvwLG524C&pg=PA241&lpg=PA241&dq=mustn%27t+trouble+yourself&source=bl&ots=vjgh7n-yyW&sig=LBQAwlZu3GxI5YzvRAXFow4hE1U&hl=en&sa=X&ei=a14XU9vxB4SBywOPz4HwDw&ved=0CDQQ6AEwAg#v=onepage&q=mustn%27t%20trouble%20yourself&f=false

http://www.nytimes.com/books/first/m/maynard-home.html (search for mustn't)

We mustn't argue over grammar.

See: https://github.com/dotcloud/docker/pull/4473

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: timthelion)
Upstream-commit: 47f1609f5c491557237fd998840311cb53d95573
Component: engine
---
 components/engine/CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/CONTRIBUTING.md b/components/engine/CONTRIBUTING.md
index 7eb20c473a..c03c5d0d9c 100644
--- a/components/engine/CONTRIBUTING.md
+++ b/components/engine/CONTRIBUTING.md
@@ -88,7 +88,7 @@ curl -o .git/hooks/pre-commit https://raw.github.com/edsrzf/gofmt-git-hook/maste
 Pull requests descriptions should be as clear as possible and include a
 reference to all the issues that they address.
 
-Pull requests mustn't contain commits from other users or branches.
+Pull requests must not contain commits from other users or branches.
 
 Code review comments may be added to your pull request. Discuss, then make the
 suggested modifications and push additional commits to your feature branch. Be

From fdbd555f75b7719a2500eea8a4b510e8f4b40945 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Wed, 5 Mar 2014 19:27:39 +0000
Subject: [PATCH 370/403] fix usage for completly deprecated flag

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 089bf5e11e4284a6ed07dc165098bb269dfddf46
Component: engine
---
 components/engine/pkg/mflag/example/example.go | 1 +
 components/engine/pkg/mflag/flag.go            | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/components/engine/pkg/mflag/example/example.go b/components/engine/pkg/mflag/example/example.go
index b0d25fbfc6..352f652ebe 100644
--- a/components/engine/pkg/mflag/example/example.go
+++ b/components/engine/pkg/mflag/example/example.go
@@ -12,6 +12,7 @@ var (
 )
 
 func init() {
+	flag.Bool([]string{"#hp", "#-halp"}, false, "display the halp")
 	flag.BoolVar(&b, []string{"b"}, false, "a simple bool")
 	flag.BoolVar(&b2, []string{"-bool"}, false, "a simple bool")
 	flag.IntVar(&i, []string{"#integer", "-integer"}, -1, "a simple integer")
diff --git a/components/engine/pkg/mflag/flag.go b/components/engine/pkg/mflag/flag.go
index 6fe3e41b23..ff0de23f78 100644
--- a/components/engine/pkg/mflag/flag.go
+++ b/components/engine/pkg/mflag/flag.go
@@ -404,7 +404,9 @@ func (f *FlagSet) PrintDefaults() {
 				names = append(names, name)
 			}
 		}
-		fmt.Fprintf(f.out(), format, strings.Join(names, ", -"), flag.DefValue, flag.Usage)
+		if len(names) > 0 {
+			fmt.Fprintf(f.out(), format, strings.Join(names, ", -"), flag.DefValue, flag.Usage)
+		}
 	})
 }
 

From ceba53329c89d60dbf5eb0b03d11738adeb000d9 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Wed, 5 Mar 2014 19:45:57 +0000
Subject: [PATCH 371/403] fix panic with only long flags or only one deprecatd

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 069dc7f8c7bc3eaf61ddd926636aacce5f1ed1ee
Component: engine
---
 components/engine/pkg/mflag/example/example.go | 4 ++--
 components/engine/pkg/mflag/flag.go            | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/components/engine/pkg/mflag/example/example.go b/components/engine/pkg/mflag/example/example.go
index 352f652ebe..ed940e8d70 100644
--- a/components/engine/pkg/mflag/example/example.go
+++ b/components/engine/pkg/mflag/example/example.go
@@ -14,8 +14,8 @@ var (
 func init() {
 	flag.Bool([]string{"#hp", "#-halp"}, false, "display the halp")
 	flag.BoolVar(&b, []string{"b"}, false, "a simple bool")
-	flag.BoolVar(&b2, []string{"-bool"}, false, "a simple bool")
-	flag.IntVar(&i, []string{"#integer", "-integer"}, -1, "a simple integer")
+	flag.BoolVar(&b2, []string{"#-bool"}, false, "a simple bool")
+	flag.IntVar(&i, []string{"-integer", "-number"}, -1, "a simple integer")
 	flag.StringVar(&str, []string{"s", "#hidden", "-string"}, "", "a simple string") //-s -hidden and --string will work, but -hidden won't be in the usage
 	flag.BoolVar(&h, []string{"h", "#help", "-help"}, false, "display the help")
 	flag.Parse()
diff --git a/components/engine/pkg/mflag/flag.go b/components/engine/pkg/mflag/flag.go
index ff0de23f78..7125c030ed 100644
--- a/components/engine/pkg/mflag/flag.go
+++ b/components/engine/pkg/mflag/flag.go
@@ -290,13 +290,13 @@ type Flag struct {
 func sortFlags(flags map[string]*Flag) []*Flag {
 	var list sort.StringSlice
 	for _, f := range flags {
+		fName := strings.TrimPrefix(f.Names[0], "#")
 		if len(f.Names) == 1 {
-			list = append(list, f.Names[0])
+			list = append(list, fName)
 			continue
 		}
 
 		found := false
-		fName := strings.TrimPrefix(strings.TrimPrefix(f.Names[0], "#"), "-")
 		for _, name := range list {
 			if name == fName {
 				found = true

From 7cf0d3e449d4faab6345d4988ffd13e317bb7c35 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Wed, 5 Mar 2014 20:26:48 +0000
Subject: [PATCH 372/403] Add missing -- when we run dockerinit from native

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: c987901f8d64ab2390409018074b2f93c1718e89
Component: engine
---
 components/engine/execdriver/native/driver.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index 88253a5940..e53b06fba2 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -246,6 +246,7 @@ func (d *dockerCommandFactory) Create(container *libcontainer.Container, console
 		"-console", console,
 		"-pipe", fmt.Sprint(syncFd),
 		"-root", filepath.Join(d.driver.root, d.c.ID),
+		"--",
 	}, args...)
 
 	// set this to nil so that when we set the clone flags anything else is reset

From dae86c26a4cf9fbaacd5be0d3fc0c93d93841fd7 Mon Sep 17 00:00:00 2001
From: James Turnbull <james@lovedthanlost.net>
Date: Tue, 4 Mar 2014 07:53:22 -0500
Subject: [PATCH 373/403] Some updates to the README.md

* Updated pre-reqs for 0.9.
* Fixed a couple of docker to Docker.
* Fixed the Docker build example to be correct.
* Reformatted a bunch of paragraphs

Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Upstream-commit: 046e6604e56ec93647550630fcf729c7e5ab3280
Component: engine
---
 components/engine/README.md | 107 +++++++++++++++++-------------------
 1 file changed, 49 insertions(+), 58 deletions(-)

diff --git a/components/engine/README.md b/components/engine/README.md
index b6b77d6e61..1922be5d8a 100644
--- a/components/engine/README.md
+++ b/components/engine/README.md
@@ -4,19 +4,19 @@ Docker: the Linux container engine
 Docker is an open source project to pack, ship and run any application
 as a lightweight container
 
-Docker containers are both *hardware-agnostic* and
-*platform-agnostic*. This means that they can run anywhere, from your
-laptop to the largest EC2 compute instance and everything in between -
-and they don't require that you use a particular language, framework
-or packaging system. That makes them great building blocks for
-deploying and scaling web apps, databases and backend services without
-depending on a particular stack or provider.
+Docker containers are both *hardware-agnostic* and *platform-agnostic*.
+This means that they can run anywhere, from your laptop to the largest
+EC2 compute instance and everything in between - and they don't require
+that you use a particular language, framework or packaging system. That
+makes them great building blocks for deploying and scaling web apps,
+databases and backend services without depending on a particular stack
+or provider.
 
 Docker is an open-source implementation of the deployment engine which
-powers [dotCloud](http://dotcloud.com), a popular
-Platform-as-a-Service.  It benefits directly from the experience
-accumulated over several years of large-scale operation and support of
-hundreds of thousands of applications and databases.
+powers [dotCloud](http://dotcloud.com), a popular Platform-as-a-Service.
+It benefits directly from the experience accumulated over several years
+of large-scale operation and support of hundreds of thousands of
+applications and databases.
 
 ![Docker L](docs/theme/docker/static/img/dockerlogo-h.png "Docker")
 
@@ -24,10 +24,10 @@ hundreds of thousands of applications and databases.
 
 A common method for distributing applications and sandboxing their
 execution is to use virtual machines, or VMs. Typical VM formats are
-VMWare's vmdk, Oracle Virtualbox's vdi, and Amazon EC2's ami. In
-theory these formats should allow every developer to automatically
-package their application into a "machine" for easy distribution and
-deployment. In practice, that almost never happens, for a few reasons:
+VMWare's vmdk, Oracle Virtualbox's vdi, and Amazon EC2's ami. In theory
+these formats should allow every developer to automatically package
+their application into a "machine" for easy distribution and deployment.
+In practice, that almost never happens, for a few reasons:
 
   * *Size*: VMs are very large which makes them impractical to store
      and transfer.
@@ -47,39 +47,37 @@ deployment. In practice, that almost never happens, for a few reasons:
     service discovery.
 
 By contrast, Docker relies on a different sandboxing method known as
-*containerization*. Unlike traditional virtualization,
-containerization takes place at the kernel level. Most modern
-operating system kernels now support the primitives necessary for
-containerization, including Linux with [openvz](http://openvz.org),
+*containerization*. Unlike traditional virtualization, containerization
+takes place at the kernel level. Most modern operating system kernels
+now support the primitives necessary for containerization, including
+Linux with [openvz](http://openvz.org),
 [vserver](http://linux-vserver.org) and more recently
 [lxc](http://lxc.sourceforge.net), Solaris with
 [zones](http://docs.oracle.com/cd/E26502_01/html/E29024/preface-1.html#scrolltoc)
 and FreeBSD with
 [Jails](http://www.freebsd.org/doc/handbook/jails.html).
 
-Docker builds on top of these low-level primitives to offer developers
-a portable format and runtime environment that solves all 4
-problems. Docker containers are small (and their transfer can be
-optimized with layers), they have basically zero memory and cpu
-overhead, they are completely portable and are designed from the
-ground up with an application-centric design.
+Docker builds on top of these low-level primitives to offer developers a
+portable format and runtime environment that solves all 4 problems.
+Docker containers are small (and their transfer can be optimized with
+layers), they have basically zero memory and cpu overhead, they are
+completely portable and are designed from the ground up with an
+application-centric design.
 
-The best part: because ``docker`` operates at the OS level, it can
-still be run inside a VM!
+The best part: because Docker operates at the OS level, it can still be
+run inside a VM!
 
 ## Plays well with others
 
 Docker does not require that you buy into a particular programming
 language, framework, packaging system or configuration language.
 
-Is your application a Unix process? Does it use files, tcp
-connections, environment variables, standard Unix streams and
-command-line arguments as inputs and outputs? Then ``docker`` can run
-it.
+Is your application a Unix process? Does it use files, tcp connections,
+environment variables, standard Unix streams and command-line arguments
+as inputs and outputs? Then Docker can run it.
 
 Can your application's build be expressed as a sequence of such
-commands? Then ``docker`` can build it.
-
+commands? Then Docker can build it.
 
 ## Escape dependency hell
 
@@ -126,14 +124,11 @@ build command inherits the result of the previous commands, the
 Here's a typical Docker build process:
 
 ```bash
-from ubuntu:12.10
-run apt-get update
-run DEBIAN_FRONTEND=noninteractive apt-get install -q -y python
-run DEBIAN_FRONTEND=noninteractive apt-get install -q -y python-pip
-run pip install django
-run DEBIAN_FRONTEND=noninteractive apt-get install -q -y curl
-run curl -L https://github.com/shykes/helloflask/archive/master.tar.gz | tar -xzv
-run cd helloflask-master && pip install -r requirements.txt
+FROM ubuntu:12.04
+RUN apt-get update
+RUN apt-get install -q -y python python-pip curl
+RUN curl -L https://github.com/shykes/helloflask/archive/master.tar.gz | tar -xzv
+RUN cd helloflask-master && pip install -r requirements.txt
 ```
 
 Note that Docker doesn't care *how* dependencies are built - as long
@@ -143,22 +138,25 @@ as they can be built by running a Unix command in a container.
 Getting started
 ===============
 
-Docker can be installed on your local machine as well as servers - both bare metal and virtualized.
-It is available as a binary on most modern Linux systems, or as a VM on Windows, Mac and other systems.
+Docker can be installed on your local machine as well as servers - both
+bare metal and virtualized.  It is available as a binary on most modern
+Linux systems, or as a VM on Windows, Mac and other systems.
 
-We also offer an interactive tutorial for quickly learning the basics of using Docker.
-
-
-For up-to-date install instructions and online tutorials, see the [Getting Started page](http://www.docker.io/gettingstarted/).
+We also offer an interactive tutorial for quickly learning the basics of
+using Docker.
 
+For up-to-date install instructions and online tutorials, see the
+[Getting Started page](http://www.docker.io/gettingstarted/).
 
 Usage examples
 ==============
 
-Docker can be used to run short-lived commands, long-running daemons (app servers, databases etc.),
-interactive shell sessions, etc.
+Docker can be used to run short-lived commands, long-running daemons
+(app servers, databases etc.), interactive shell sessions, etc.
 
-You can find a [list of real-world examples](http://docs.docker.io/en/latest/examples/) in the documentation.
+You can find a [list of real-world
+examples](http://docs.docker.io/en/latest/examples/) in the
+documentation.
 
 Under the hood
 --------------
@@ -170,13 +168,7 @@ Under the hood, Docker is built on the following components:
   and
   [namespacing](http://blog.dotcloud.com/under-the-hood-linux-kernels-on-dotcloud-part)
   capabilities of the Linux kernel;
-* [AUFS](http://aufs.sourceforge.net/aufs.html), a powerful union
-  filesystem with copy-on-write capabilities;
-* The [Go](http://golang.org) programming language;
-* [lxc](http://lxc.sourceforge.net/), a set of convenience scripts to
-  simplify the creation of Linux containers.
-
-
+* The [Go](http://golang.org) programming language.
 
 Contributing to Docker
 ======================
@@ -187,7 +179,6 @@ started [here](CONTRIBUTING.md).
 They are probably not perfect, please let us know if anything feels
 wrong or incomplete.
 
-
 ### Legal
 
 *Brought to you courtesy of our legal counsel. For more context,

From c1e434e5439628c3314e4a3c26c868deaca51f97 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Wed, 5 Mar 2014 11:59:31 -0800
Subject: [PATCH 374/403] Add AppArmor support to native driver + change
 pipe/dup logic

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: cb4189a292dc181e26e0506a3a0dc67936c5401b
Component: engine
---
 .../execdriver/native/default_template.go     |  4 ++
 .../pkg/libcontainer/apparmor/apparmor.go     | 42 +++++++++++++++++++
 .../engine/pkg/libcontainer/container.go      |  3 +-
 .../engine/pkg/libcontainer/nsinit/init.go    | 22 ++++++----
 4 files changed, 61 insertions(+), 10 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/apparmor/apparmor.go

diff --git a/components/engine/execdriver/native/default_template.go b/components/engine/execdriver/native/default_template.go
index 8e06ff2e26..3458b2efc6 100644
--- a/components/engine/execdriver/native/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -37,6 +37,7 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 	if c.Privileged {
 		container.Capabilities = nil
 		container.Cgroups.DeviceAccess = true
+		container.Context["apparmor_profile"] = "unconfined"
 	}
 	if c.Resources != nil {
 		container.Cgroups.CpuShares = c.Resources.CpuShares
@@ -78,5 +79,8 @@ func getDefaultTemplate() *libcontainer.Container {
 			Parent:       "docker",
 			DeviceAccess: false,
 		},
+		Context: libcontainer.Context{
+			"apparmor_profile": "lxc-container-default",
+		},
 	}
 }
diff --git a/components/engine/pkg/libcontainer/apparmor/apparmor.go b/components/engine/pkg/libcontainer/apparmor/apparmor.go
new file mode 100644
index 0000000000..044b7661a9
--- /dev/null
+++ b/components/engine/pkg/libcontainer/apparmor/apparmor.go
@@ -0,0 +1,42 @@
+package apparmor
+
+import (
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"os"
+)
+
+var AppArmorEnabled bool
+
+var (
+	ErrAppArmorDisabled = errors.New("Error: AppArmor is not enabled on this system")
+)
+
+func init() {
+	buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
+	AppArmorEnabled = err == nil && len(buf) > 1 && buf[0] == 'Y'
+}
+
+func ApplyProfile(pid int, name string) error {
+	if !AppArmorEnabled {
+		return ErrAppArmorDisabled
+	}
+
+	f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0)
+	if err != nil {
+		log.Printf("error open: %s\n", err)
+		return err
+	}
+	defer f.Close()
+
+	if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil {
+		log.Printf("changeprofile %s", name)
+		log.Printf("Error write: %s\n", err)
+		return err
+	} else {
+		log.Printf("Write success!")
+	}
+	return nil
+}
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index 12a3d7ba8e..bd16825d99 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -20,7 +20,8 @@ type Container struct {
 	Namespaces   Namespaces      `json:"namespaces,omitempty"`   // namespaces to apply
 	Capabilities Capabilities    `json:"capabilities,omitempty"` // capabilities to drop
 	Networks     []*Network      `json:"networks,omitempty"`     // nil for host's network stack
-	Cgroups      *cgroups.Cgroup `json:"cgroups,omitempty"`
+	Cgroups      *cgroups.Cgroup `json:"cgroups,omitempty"`      // cgroups
+	Context      Context         `json:"context,omitempty"`      // generic context for specific options (apparmor, selinux)
 }
 
 // Network defines configuration for a container's networking stack
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 565030f252..48d9213ad2 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -5,6 +5,7 @@ package nsinit
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/apparmor"
 	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
 	"github.com/dotcloud/docker/pkg/libcontainer/network"
 	"github.com/dotcloud/docker/pkg/libcontainer/utils"
@@ -32,7 +33,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 
 	if console != "" {
 		// close pipes so that we can replace it with the pty
-		closeStdPipes()
+		//		closeStdPipes()
 		slave, err := system.OpenTerminal(console, syscall.O_RDWR)
 		if err != nil {
 			return fmt.Errorf("open terminal %s", err)
@@ -55,9 +56,17 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 			return fmt.Errorf("parent death signal %s", err)
 		}
 	*/
+
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
+
+	if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
+		if err != apparmor.ErrAppArmorDisabled {
+			return err
+		}
+	}
+
 	if err := setupNetwork(container, context); err != nil {
 		return fmt.Errorf("setup networking %s", err)
 	}
@@ -67,13 +76,8 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 	if err := finalizeNamespace(container); err != nil {
 		return fmt.Errorf("finalize namespace %s", err)
 	}
-	return system.Execv(args[0], args[0:], container.Env)
-}
 
-func closeStdPipes() {
-	os.Stdin.Close()
-	os.Stdout.Close()
-	os.Stderr.Close()
+	return system.Execv(args[0], args[0:], container.Env)
 }
 
 func setupUser(container *libcontainer.Container) error {
@@ -109,8 +113,8 @@ func setupUser(container *libcontainer.Container) error {
 // dupSlave dup2 the pty slave's fd into stdout and stdin and ensures that
 // the slave's fd is 0, or stdin
 func dupSlave(slave *os.File) error {
-	if slave.Fd() != 0 {
-		return fmt.Errorf("slave fd not 0 %d", slave.Fd())
+	if err := system.Dup2(slave.Fd(), 0); err != nil {
+		return err
 	}
 	if err := system.Dup2(slave.Fd(), 1); err != nil {
 		return err

From 53277b63e38abef77d43541e6179893814ef0315 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 5 Mar 2014 12:27:31 -0800
Subject: [PATCH 375/403] Some cleanup around logs
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 37f137c8221be07943babeb9b107e5aee9a736d5 Component: engine

---
 .../pkg/libcontainer/apparmor/apparmor.go     | 21 ++++---------------
 .../engine/pkg/libcontainer/nsinit/init.go    | 14 +++++--------
 2 files changed, 9 insertions(+), 26 deletions(-)

diff --git a/components/engine/pkg/libcontainer/apparmor/apparmor.go b/components/engine/pkg/libcontainer/apparmor/apparmor.go
index 044b7661a9..4b1bf579f0 100644
--- a/components/engine/pkg/libcontainer/apparmor/apparmor.go
+++ b/components/engine/pkg/libcontainer/apparmor/apparmor.go
@@ -1,42 +1,29 @@
 package apparmor
 
 import (
-	"errors"
 	"fmt"
 	"io/ioutil"
-	"log"
 	"os"
 )
 
-var AppArmorEnabled bool
-
-var (
-	ErrAppArmorDisabled = errors.New("Error: AppArmor is not enabled on this system")
-)
-
-func init() {
+func IsEnabled() bool {
 	buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
-	AppArmorEnabled = err == nil && len(buf) > 1 && buf[0] == 'Y'
+	return err == nil && len(buf) > 1 && buf[0] == 'Y'
 }
 
 func ApplyProfile(pid int, name string) error {
-	if !AppArmorEnabled {
-		return ErrAppArmorDisabled
+	if !IsEnabled() || name == "" {
+		return nil
 	}
 
 	f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0)
 	if err != nil {
-		log.Printf("error open: %s\n", err)
 		return err
 	}
 	defer f.Close()
 
 	if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil {
-		log.Printf("changeprofile %s", name)
-		log.Printf("Error write: %s\n", err)
 		return err
-	} else {
-		log.Printf("Write success!")
 	}
 	return nil
 }
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 48d9213ad2..a854f130ee 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -32,8 +32,6 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 	syncPipe.Close()
 
 	if console != "" {
-		// close pipes so that we can replace it with the pty
-		//		closeStdPipes()
 		slave, err := system.OpenTerminal(console, syscall.O_RDWR)
 		if err != nil {
 			return fmt.Errorf("open terminal %s", err)
@@ -51,10 +49,10 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 		}
 	}
 
-	/*
-		if err := system.ParentDeathSignal(); err != nil {
-			return fmt.Errorf("parent death signal %s", err)
-		}
+	/* this is commented out so that we get the current Ghost functionality
+	if err := system.ParentDeathSignal(); err != nil {
+		return fmt.Errorf("parent death signal %s", err)
+	}
 	*/
 
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
@@ -62,9 +60,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 	}
 
 	if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
-		if err != apparmor.ErrAppArmorDisabled {
-			return err
-		}
+		return err
 	}
 
 	if err := setupNetwork(container, context); err != nil {

From 50624219ad84c6bb8f4450a16e6d055188632239 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Wed, 5 Mar 2014 14:57:20 -0800
Subject: [PATCH 376/403] Generate and load custom docker profile for apparmor

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: 920a6ca54ce98673d0c9a6a9502a469c1c225c75
Component: engine
---
 .../execdriver/native/default_template.go     |  2 +-
 components/engine/execdriver/native/driver.go |  4 +
 .../engine/pkg/libcontainer/apparmor/setup.go | 98 +++++++++++++++++++
 3 files changed, 103 insertions(+), 1 deletion(-)
 create mode 100644 components/engine/pkg/libcontainer/apparmor/setup.go

diff --git a/components/engine/execdriver/native/default_template.go b/components/engine/execdriver/native/default_template.go
index 3458b2efc6..e86a99f02f 100644
--- a/components/engine/execdriver/native/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -80,7 +80,7 @@ func getDefaultTemplate() *libcontainer.Container {
 			DeviceAccess: false,
 		},
 		Context: libcontainer.Context{
-			"apparmor_profile": "lxc-container-default",
+			"apparmor_profile": "docker-default",
 		},
 	}
 }
diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index e53b06fba2..e7a722f461 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -6,6 +6,7 @@ import (
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/pkg/cgroups"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/apparmor"
 	"github.com/dotcloud/docker/pkg/libcontainer/nsinit"
 	"github.com/dotcloud/docker/pkg/system"
 	"io/ioutil"
@@ -62,6 +63,9 @@ func NewDriver(root string) (*driver, error) {
 	if err := os.MkdirAll(root, 0700); err != nil {
 		return nil, err
 	}
+	if err := apparmor.InstallDefaultProfile(); err != nil {
+		return nil, err
+	}
 	return &driver{
 		root: root,
 	}, nil
diff --git a/components/engine/pkg/libcontainer/apparmor/setup.go b/components/engine/pkg/libcontainer/apparmor/setup.go
new file mode 100644
index 0000000000..fda810b44d
--- /dev/null
+++ b/components/engine/pkg/libcontainer/apparmor/setup.go
@@ -0,0 +1,98 @@
+package apparmor
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+)
+
+const DefaultProfilePath = "/etc/apparmor.d/docker"
+const DefaultProfile = `
+# AppArmor profile from lxc for containers.
+@{HOME}=@{HOMEDIRS}/*/ /root/
+@{HOMEDIRS}=/home/
+#@{HOMEDIRS}+=
+@{multiarch}=*-linux-gnu*
+@{PROC}=/proc/
+
+profile docker-default flags=(attach_disconnected,mediate_deleted) {
+  network,
+  capability,
+  file,
+  umount,
+  dbus,
+
+  # ignore DENIED message on / remount
+  deny mount options=(ro, remount) -> /,
+
+  # allow tmpfs mounts everywhere
+  mount fstype=tmpfs,
+
+  # allow mqueue mounts everywhere
+  mount fstype=mqueue,
+
+  # allow fuse mounts everywhere
+  mount fstype=fuse.*,
+
+  # allow bind mount of /lib/init/fstab for lxcguest
+  mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/,
+
+  # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
+  mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
+  deny @{PROC}/sys/fs/** wklx,
+
+  # allow efivars to be mounted, writing to it will be blocked though
+  mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
+
+  # block some other dangerous paths
+  deny @{PROC}/sysrq-trigger rwklx,
+  deny @{PROC}/mem rwklx,
+  deny @{PROC}/kmem rwklx,
+  deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx,
+  deny @{PROC}/sys/kernel/*/** wklx,
+
+  # deny writes in /sys except for /sys/fs/cgroup, also allow
+  # fusectl, securityfs and debugfs to be mounted there (read-only)
+  mount fstype=fusectl -> /sys/fs/fuse/connections/,
+  mount fstype=securityfs -> /sys/kernel/security/,
+  mount fstype=debugfs -> /sys/kernel/debug/,
+  deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
+  mount fstype=proc -> /proc/,
+  mount fstype=sysfs -> /sys/,
+  deny /sys/[^f]*/** wklx,
+  deny /sys/f[^s]*/** wklx,
+  deny /sys/fs/[^c]*/** wklx,
+  deny /sys/fs/c[^g]*/** wklx,
+  deny /sys/fs/cg[^r]*/** wklx,
+  deny /sys/firmware/efi/efivars/** rwklx,
+  deny /sys/kernel/security/** rwklx,
+  mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,
+
+  # the container may never be allowed to mount devpts.  If it does, it
+  # will remount the host's devpts.  We could allow it to do it with
+  # the newinstance option (but, right now, we don't).
+  deny mount fstype=devpts,
+}
+`
+
+func InstallDefaultProfile() error {
+	if !IsEnabled() {
+		return nil
+	}
+
+	// If the profile already exists, let it be.
+	if _, err := os.Stat(DefaultProfilePath); err == nil {
+		return nil
+	}
+
+	if err := ioutil.WriteFile(DefaultProfilePath, []byte(DefaultProfile), 0644); err != nil {
+		return err
+	}
+
+	output, err := exec.Command("/lib/init/apparmor-profile-load", "docker").CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("Error loading docker profile: %s (%s)", err, output)
+	}
+	return nil
+}

From e217c314a6008eeb1ac0a5728c34522e9d62260e Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 5 Mar 2014 17:57:27 -0800
Subject: [PATCH 377/403] Return correct process pid for lxc

Fixes #2875
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 69e3d30bb6c5082aff2a7d5eafaf562e59246a49
Component: engine
---
 components/engine/execdriver/driver.go        | 10 ++--
 components/engine/execdriver/lxc/driver.go    | 26 ++++++----
 components/engine/execdriver/lxc/info.go      | 50 +++++++++++++++++++
 components/engine/execdriver/lxc/info_test.go | 36 +++++++++++++
 components/engine/execdriver/native/driver.go |  1 +
 5 files changed, 106 insertions(+), 17 deletions(-)
 create mode 100644 components/engine/execdriver/lxc/info.go
 create mode 100644 components/engine/execdriver/lxc/info_test.go

diff --git a/components/engine/execdriver/driver.go b/components/engine/execdriver/driver.go
index d64c08fa6c..2143cc4077 100644
--- a/components/engine/execdriver/driver.go
+++ b/components/engine/execdriver/driver.go
@@ -116,15 +116,13 @@ type Command struct {
 	Config     []string   `json:"config"`  //  generic values that specific drivers can consume
 	Resources  *Resources `json:"resources"`
 
-	Terminal Terminal `json:"-"` // standard or tty terminal
-	Console  string   `json:"-"` // dev/console path
+	Terminal     Terminal `json:"-"`             // standard or tty terminal
+	Console      string   `json:"-"`             // dev/console path
+	ContainerPid int      `json:"container_pid"` // the pid for the process inside a container
 }
 
 // Return the pid of the process
 // If the process is nil -1 will be returned
 func (c *Command) Pid() int {
-	if c.Process == nil {
-		return -1
-	}
-	return c.Process.Pid
+	return c.ContainerPid
 }
diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index 8f8dcbda17..6b68076a9b 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -166,9 +166,11 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 	}()
 
 	// Poll lxc for RUNNING status
-	if err := d.waitForStart(c, waitLock); err != nil {
+	pid, err := d.waitForStart(c, waitLock)
+	if err != nil {
 		return -1, err
 	}
+	c.ContainerPid = pid
 
 	if startCallback != nil {
 		startCallback(c)
@@ -242,7 +244,8 @@ func (d *driver) kill(c *execdriver.Command, sig int) error {
 	return nil
 }
 
-func (d *driver) waitForStart(c *execdriver.Command, waitLock chan struct{}) error {
+// wait for the process to start and return the pid for the process
+func (d *driver) waitForStart(c *execdriver.Command, waitLock chan struct{}) (int, error) {
 	var (
 		err    error
 		output []byte
@@ -255,10 +258,7 @@ func (d *driver) waitForStart(c *execdriver.Command, waitLock chan struct{}) err
 		select {
 		case <-waitLock:
 			// If the process dies while waiting for it, just return
-			return nil
-			if c.ProcessState != nil && c.ProcessState.Exited() {
-				return nil
-			}
+			return -1, nil
 		default:
 		}
 
@@ -266,19 +266,23 @@ func (d *driver) waitForStart(c *execdriver.Command, waitLock chan struct{}) err
 		if err != nil {
 			output, err = d.getInfo(c.ID)
 			if err != nil {
-				return err
+				return -1, err
 			}
 		}
-		if strings.Contains(string(output), "RUNNING") {
-			return nil
+		info, err := parseLxcInfo(string(output))
+		if err != nil {
+			return -1, err
+		}
+		if info.Running {
+			return info.Pid, nil
 		}
 		time.Sleep(50 * time.Millisecond)
 	}
-	return execdriver.ErrNotRunning
+	return -1, execdriver.ErrNotRunning
 }
 
 func (d *driver) getInfo(id string) ([]byte, error) {
-	return exec.Command("lxc-info", "-s", "-n", id).CombinedOutput()
+	return exec.Command("lxc-info", "-n", id).CombinedOutput()
 }
 
 type info struct {
diff --git a/components/engine/execdriver/lxc/info.go b/components/engine/execdriver/lxc/info.go
new file mode 100644
index 0000000000..3b2ea0d07f
--- /dev/null
+++ b/components/engine/execdriver/lxc/info.go
@@ -0,0 +1,50 @@
+package lxc
+
+import (
+	"bufio"
+	"errors"
+	"strconv"
+	"strings"
+)
+
+var (
+	ErrCannotParse = errors.New("cannot parse raw input")
+)
+
+type lxcInfo struct {
+	Running bool
+	Pid     int
+}
+
+func parseLxcInfo(raw string) (*lxcInfo, error) {
+	if raw == "" {
+		return nil, ErrCannotParse
+	}
+	var (
+		err  error
+		s    = bufio.NewScanner(strings.NewReader(raw))
+		info = &lxcInfo{}
+	)
+	for s.Scan() {
+		text := s.Text()
+
+		if s.Err() != nil {
+			return nil, s.Err()
+		}
+
+		parts := strings.Split(text, ":")
+		if len(parts) < 2 {
+			continue
+		}
+		switch strings.TrimSpace(parts[0]) {
+		case "state":
+			info.Running = strings.TrimSpace(parts[1]) == "RUNNING"
+		case "pid":
+			info.Pid, err = strconv.Atoi(strings.TrimSpace(parts[1]))
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	return info, nil
+}
diff --git a/components/engine/execdriver/lxc/info_test.go b/components/engine/execdriver/lxc/info_test.go
new file mode 100644
index 0000000000..edafc02511
--- /dev/null
+++ b/components/engine/execdriver/lxc/info_test.go
@@ -0,0 +1,36 @@
+package lxc
+
+import (
+	"testing"
+)
+
+func TestParseRunningInfo(t *testing.T) {
+	raw := `
+    state: RUNNING
+    pid:    50`
+
+	info, err := parseLxcInfo(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !info.Running {
+		t.Fatal("info should return a running state")
+	}
+	if info.Pid != 50 {
+		t.Fatalf("info should have pid 50 got %d", info.Pid)
+	}
+}
+
+func TestEmptyInfo(t *testing.T) {
+	_, err := parseLxcInfo("")
+	if err == nil {
+		t.Fatal("error should not be nil")
+	}
+}
+
+func TestBadInfo(t *testing.T) {
+	_, err := parseLxcInfo("state")
+	if err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index e53b06fba2..77461f3447 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -266,6 +266,7 @@ type dockerStateWriter struct {
 }
 
 func (d *dockerStateWriter) WritePid(pid int) error {
+	d.c.ContainerPid = pid
 	err := d.dsw.WritePid(pid)
 	if d.callback != nil {
 		d.callback(d.c)

From 098ea0f41321e21b18846e9cde8b6ab3817b30f1 Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Thu, 6 Mar 2014 14:10:32 +0100
Subject: [PATCH 378/403] libcontainer: Don't use UsetCloseOnExec, it is racy

We can't keep file descriptors without close-on-exec except with
syscall.ForkLock held, as otherwise they could leak by accident into
other children from forks in other threads.

Instead we just use Cmd.ExtraFiles which handles all this for us.

This fixes https://github.com/dotcloud/docker/issues/4493

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 5c9b28db1853cccdf7a1037eeaad372d12cd68fa
Component: engine
---
 components/engine/execdriver/native/driver.go          | 5 +++--
 components/engine/pkg/libcontainer/nsinit/command.go   | 8 ++++----
 components/engine/pkg/libcontainer/nsinit/exec.go      | 2 +-
 components/engine/pkg/libcontainer/nsinit/sync_pipe.go | 2 --
 4 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index e7a722f461..1b444c19d1 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -239,7 +239,7 @@ type dockerCommandFactory struct {
 // createCommand will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
-func (d *dockerCommandFactory) Create(container *libcontainer.Container, console string, syncFd uintptr, args []string) *exec.Cmd {
+func (d *dockerCommandFactory) Create(container *libcontainer.Container, console string, syncFile *os.File, args []string) *exec.Cmd {
 	// we need to join the rootfs because nsinit will setup the rootfs and chroot
 	initPath := filepath.Join(d.c.Rootfs, d.c.InitPath)
 
@@ -248,7 +248,7 @@ func (d *dockerCommandFactory) Create(container *libcontainer.Container, console
 		initPath,
 		"-driver", DriverName,
 		"-console", console,
-		"-pipe", fmt.Sprint(syncFd),
+		"-pipe", "3",
 		"-root", filepath.Join(d.driver.root, d.c.ID),
 		"--",
 	}, args...)
@@ -256,6 +256,7 @@ func (d *dockerCommandFactory) Create(container *libcontainer.Container, console
 	// set this to nil so that when we set the clone flags anything else is reset
 	d.c.SysProcAttr = nil
 	system.SetCloneFlags(&d.c.Cmd, uintptr(nsinit.GetNamespaceFlags(container.Namespaces)))
+	d.c.ExtraFiles = []*os.File{syncFile}
 
 	d.c.Env = container.Env
 	d.c.Dir = d.c.Rootfs
diff --git a/components/engine/pkg/libcontainer/nsinit/command.go b/components/engine/pkg/libcontainer/nsinit/command.go
index 8ddf1e7e71..5546065b6d 100644
--- a/components/engine/pkg/libcontainer/nsinit/command.go
+++ b/components/engine/pkg/libcontainer/nsinit/command.go
@@ -1,7 +1,6 @@
 package nsinit
 
 import (
-	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
 	"github.com/dotcloud/docker/pkg/system"
 	"os"
@@ -12,7 +11,7 @@ import (
 // parent processes and creates an *exec.Cmd that will be used to fork/exec the
 // namespaced init process
 type CommandFactory interface {
-	Create(container *libcontainer.Container, console string, syncFd uintptr, args []string) *exec.Cmd
+	Create(container *libcontainer.Container, console string, syncFd *os.File, args []string) *exec.Cmd
 }
 
 type DefaultCommandFactory struct {
@@ -22,16 +21,17 @@ type DefaultCommandFactory struct {
 // Create will return an exec.Cmd with the Cloneflags set to the proper namespaces
 // defined on the container's configuration and use the current binary as the init with the
 // args provided
-func (c *DefaultCommandFactory) Create(container *libcontainer.Container, console string, pipe uintptr, args []string) *exec.Cmd {
+func (c *DefaultCommandFactory) Create(container *libcontainer.Container, console string, pipe *os.File, args []string) *exec.Cmd {
 	// get our binary name from arg0 so we can always reexec ourself
 	command := exec.Command(os.Args[0], append([]string{
 		"-console", console,
-		"-pipe", fmt.Sprint(pipe),
+		"-pipe", "3",
 		"-root", c.Root,
 		"init"}, args...)...)
 
 	system.SetCloneFlags(command, uintptr(GetNamespaceFlags(container.Namespaces)))
 	command.Env = container.Env
+	command.ExtraFiles = []*os.File{pipe}
 	return command
 }
 
diff --git a/components/engine/pkg/libcontainer/nsinit/exec.go b/components/engine/pkg/libcontainer/nsinit/exec.go
index f1a4e2477a..4963f126e9 100644
--- a/components/engine/pkg/libcontainer/nsinit/exec.go
+++ b/components/engine/pkg/libcontainer/nsinit/exec.go
@@ -35,7 +35,7 @@ func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args [
 		term.SetMaster(master)
 	}
 
-	command := ns.commandFactory.Create(container, console, syncPipe.child.Fd(), args)
+	command := ns.commandFactory.Create(container, console, syncPipe.child, args)
 	if err := term.Attach(command); err != nil {
 		return -1, err
 	}
diff --git a/components/engine/pkg/libcontainer/nsinit/sync_pipe.go b/components/engine/pkg/libcontainer/nsinit/sync_pipe.go
index 7b29e98680..f724f525f0 100644
--- a/components/engine/pkg/libcontainer/nsinit/sync_pipe.go
+++ b/components/engine/pkg/libcontainer/nsinit/sync_pipe.go
@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"github.com/dotcloud/docker/pkg/libcontainer"
-	"github.com/dotcloud/docker/pkg/system"
 	"io/ioutil"
 	"os"
 )
@@ -22,7 +21,6 @@ func NewSyncPipe() (s *SyncPipe, err error) {
 	if err != nil {
 		return nil, err
 	}
-	system.UsetCloseOnExec(s.child.Fd())
 	return s, nil
 }
 

From 22c0393b79ab7da5ff1bc42347f4a5f3c1db1388 Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Thu, 6 Mar 2014 18:01:18 +0200
Subject: [PATCH 379/403] remove dbus from apparmor profile

This removes the dbus entry from the apparmor profile Docker creates.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 46fdb6af8ecc804b204fc93ab6d8d4a5f7503860
Component: engine
---
 components/engine/pkg/libcontainer/apparmor/setup.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/apparmor/setup.go b/components/engine/pkg/libcontainer/apparmor/setup.go
index fda810b44d..e07759cc64 100644
--- a/components/engine/pkg/libcontainer/apparmor/setup.go
+++ b/components/engine/pkg/libcontainer/apparmor/setup.go
@@ -21,7 +21,6 @@ profile docker-default flags=(attach_disconnected,mediate_deleted) {
   capability,
   file,
   umount,
-  dbus,
 
   # ignore DENIED message on / remount
   deny mount options=(ro, remount) -> /,

From 9f58f80f28a37bf7253c314067b3223bfc2778ea Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 6 Mar 2014 11:10:58 -0800
Subject: [PATCH 380/403] Use CGO for apparmor profile switch

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: f0f833c6d795fc8b3fb4bb379f9916745f5c7ac9
Component: engine
---
 .../engine/pkg/libcontainer/apparmor/apparmor.go | 16 ++++++++--------
 .../engine/pkg/libcontainer/nsinit/init.go       |  7 +++----
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/components/engine/pkg/libcontainer/apparmor/apparmor.go b/components/engine/pkg/libcontainer/apparmor/apparmor.go
index 4b1bf579f0..c2954fdad4 100644
--- a/components/engine/pkg/libcontainer/apparmor/apparmor.go
+++ b/components/engine/pkg/libcontainer/apparmor/apparmor.go
@@ -1,9 +1,12 @@
 package apparmor
 
+// #cgo LDFLAGS: -lapparmor
+// #include <sys/apparmor.h>
+// #include <stdlib.h>
+import "C"
 import (
-	"fmt"
 	"io/ioutil"
-	"os"
+	"unsafe"
 )
 
 func IsEnabled() bool {
@@ -16,13 +19,10 @@ func ApplyProfile(pid int, name string) error {
 		return nil
 	}
 
-	f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
+	cName := C.CString(name)
+	defer C.free(unsafe.Pointer(cName))
 
-	if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil {
+	if _, err := C.aa_change_onexec(cName); err != nil {
 		return err
 	}
 	return nil
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index a854f130ee..45ab881579 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -59,10 +59,6 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
 
-	if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
-		return err
-	}
-
 	if err := setupNetwork(container, context); err != nil {
 		return fmt.Errorf("setup networking %s", err)
 	}
@@ -73,6 +69,9 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 		return fmt.Errorf("finalize namespace %s", err)
 	}
 
+	if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
+		return err
+	}
 	return system.Execv(args[0], args[0:], container.Env)
 }
 

From e23e08e833fe5ac54f61cbaf8b026faa11caaafd Mon Sep 17 00:00:00 2001
From: Evan Krall <krall@yelp.com>
Date: Fri, 24 Jan 2014 16:18:02 -0800
Subject: [PATCH 381/403] Create a -G option that specifies the group which
 unix sockets belong to.

Docker-DCO-1.1-Signed-off-by: Evan Krall <krall@yelp.com> (github: EvanKrall)
Upstream-commit: 644acec2f7e3b144a423d0f0a6c900701abdc511
Component: engine
---
 components/engine/api/server.go               | 46 ++++++++++++++-----
 components/engine/docker/docker.go            |  2 +
 .../docs/sources/installation/ubuntulinux.rst |  7 ++-
 .../sources/reference/commandline/cli.rst     |  1 +
 4 files changed, 42 insertions(+), 14 deletions(-)

diff --git a/components/engine/api/server.go b/components/engine/api/server.go
index 7868600314..8fc6b4f68b 100644
--- a/components/engine/api/server.go
+++ b/components/engine/api/server.go
@@ -1104,10 +1104,34 @@ func ServeFd(addr string, handle http.Handler) error {
 	return nil
 }
 
+func lookupGidByName(nameOrGid string) (int, error) {
+	groups, err := user.ParseGroupFilter(func(g *user.Group) bool {
+		return g.Name == nameOrGid || strconv.Itoa(g.Gid) == nameOrGid
+	})
+	if err != nil {
+		return -1, err
+	}
+	if groups != nil && len(groups) > 0 {
+		return groups[0].Gid, nil
+	}
+	return -1, fmt.Errorf("Group %s not found", nameOrGid)
+}
+
+func changeGroup(addr string, nameOrGid string) error {
+	gid, err := lookupGidByName(nameOrGid)
+	if err != nil {
+		return err
+	}
+
+	utils.Debugf("%s group found. gid: %d", nameOrGid, gid)
+	return os.Chown(addr, 0, gid)
+}
+
 // ListenAndServe sets up the required http.Server and gets it listening for
 // each addr passed in and does protocol specific checking.
-func ListenAndServe(proto, addr string, eng *engine.Engine, logging, enableCors bool, dockerVersion string) error {
+func ListenAndServe(proto, addr string, eng *engine.Engine, logging, enableCors bool, dockerVersion string, socketGroup string) error {
 	r, err := createRouter(eng, logging, enableCors, dockerVersion)
+
 	if err != nil {
 		return err
 	}
@@ -1138,16 +1162,14 @@ func ListenAndServe(proto, addr string, eng *engine.Engine, logging, enableCors
 			return err
 		}
 
-		groups, err := user.ParseGroupFilter(func(g *user.Group) bool {
-			return g.Name == "docker"
-		})
-		if err != nil {
-			return err
-		}
-		if len(groups) > 0 {
-			utils.Debugf("docker group found. gid: %d", groups[0].Gid)
-			if err := os.Chown(addr, 0, groups[0].Gid); err != nil {
-				return err
+		if socketGroup != "" {
+			if err := changeGroup(addr, socketGroup); err != nil {
+				if socketGroup == "docker" {
+					// if the user hasn't explicitly specified the group ownership, don't fail on errors.
+					utils.Debugf("Warning: could not chgrp %s to docker: %s", addr, err.Error())
+				} else {
+					return err
+				}
 			}
 		}
 	default:
@@ -1175,7 +1197,7 @@ func ServeApi(job *engine.Job) engine.Status {
 		protoAddrParts := strings.SplitN(protoAddr, "://", 2)
 		go func() {
 			log.Printf("Listening for HTTP on %s (%s)\n", protoAddrParts[0], protoAddrParts[1])
-			chErrors <- ListenAndServe(protoAddrParts[0], protoAddrParts[1], job.Eng, job.GetenvBool("Logging"), job.GetenvBool("EnableCors"), job.Getenv("Version"))
+			chErrors <- ListenAndServe(protoAddrParts[0], protoAddrParts[1], job.Eng, job.GetenvBool("Logging"), job.GetenvBool("EnableCors"), job.Getenv("Version"), job.Getenv("SocketGroup"))
 		}()
 	}
 
diff --git a/components/engine/docker/docker.go b/components/engine/docker/docker.go
index c18a32f7cf..2aa10dbe54 100644
--- a/components/engine/docker/docker.go
+++ b/components/engine/docker/docker.go
@@ -32,6 +32,7 @@ func main() {
 		bridgeIp             = flag.String([]string{"#bip", "-bip"}, "", "Use this CIDR notation address for the network bridge's IP, not compatible with -b")
 		pidfile              = flag.String([]string{"p", "-pidfile"}, "/var/run/docker.pid", "Path to use for daemon PID file")
 		flRoot               = flag.String([]string{"g", "-graph"}, "/var/lib/docker", "Path to use as the root of the docker runtime")
+		flSocketGroup        = flag.String([]string{"G", "-group"}, "docker", "Group to assign the unix socket specified by -H when running in daemon mode; use '' (the empty string) to disable setting of a group")
 		flEnableCors         = flag.Bool([]string{"#api-enable-cors", "-api-enable-cors"}, false, "Enable CORS headers in the remote API")
 		flDns                = opts.NewListOpts(opts.ValidateIp4Address)
 		flEnableIptables     = flag.Bool([]string{"#iptables", "-iptables"}, true, "Disable docker's addition of iptables rules")
@@ -138,6 +139,7 @@ func main() {
 		job.SetenvBool("Logging", true)
 		job.SetenvBool("EnableCors", *flEnableCors)
 		job.Setenv("Version", dockerversion.VERSION)
+		job.Setenv("SocketGroup", *flSocketGroup)
 		if err := job.Run(); err != nil {
 			log.Fatal(err)
 		}
diff --git a/components/engine/docs/sources/installation/ubuntulinux.rst b/components/engine/docs/sources/installation/ubuntulinux.rst
index 4d986a417f..416d56765e 100644
--- a/components/engine/docs/sources/installation/ubuntulinux.rst
+++ b/components/engine/docs/sources/installation/ubuntulinux.rst
@@ -182,9 +182,12 @@ daemon will make the ownership of the Unix socket read/writable by the
 *docker* group when the daemon starts. The ``docker`` daemon must
 always run as the root user, but if you run the ``docker`` client as a user in
 the *docker* group then you don't need to add ``sudo`` to all the
-client commands.  
+client commands. As of 0.9.0, you can specify that a group other than ``docker``
+should own the Unix socket with the ``-G`` option.
+
+.. warning:: The *docker* group (or the group specified with ``-G``) is
+   root-equivalent.
 
-.. warning:: The *docker* group is root-equivalent.
 
 **Example:**
 
diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index ccb5314fac..c7ce421d88 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -71,6 +71,7 @@ Commands
     Usage of docker:
       -D, --debug=false: Enable debug mode
       -H, --host=[]: Multiple tcp://host:port or unix://path/to/socket to bind in daemon mode, single connection otherwise. systemd socket activation can be used with fd://[socketfd].
+      -G, --group="docker": Group to assign the unix socket specified by -H when running in daemon mode; use '' (the empty string) to disable setting of a group
       --api-enable-cors=false: Enable CORS headers in the remote API
       -b, --bridge="": Attach containers to a pre-existing network bridge; use 'none' to disable container networking
       --bip="": Use this CIDR notation address for the network bridge's IP, not compatible with -b

From e582b9139d089ad9e7b23370493808a718b05008 Mon Sep 17 00:00:00 2001
From: Geoffrey Bachelet <grosfrais@gmail.com>
Date: Wed, 5 Mar 2014 19:06:20 +0100
Subject: [PATCH 382/403] Added Docker-PHP to the list of client libs

Docker-DCO-1.1-Signed-off-by: Geoffrey Bachelet <geoffrey.bachelet@gmail.com> (github: ubermuda)
Upstream-commit: 511b57bee5bfc80cab26df044e1e821d01064192
Component: engine
---
 .../docs/sources/reference/api/remote_api_client_libraries.rst  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst b/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
index 362fa6fe3d..60095e77c8 100644
--- a/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
+++ b/components/engine/docs/sources/reference/api/remote_api_client_libraries.rst
@@ -43,3 +43,5 @@ and we will add the libraries here.
 +----------------------+----------------+--------------------------------------------+----------+
 | PHP                  | Alvine         | http://pear.alvine.io/ (alpha)             | Active   |
 +----------------------+----------------+--------------------------------------------+----------+
+| PHP                  | Docker-PHP     | http://stage1.github.io/docker-php/        | Active   |
++----------------------+----------------+--------------------------------------------+----------+

From 2ebfedab6dadf2a5f35c864fae5321de488beb15 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 6 Mar 2014 12:04:51 -0800
Subject: [PATCH 383/403] Add buildflags to allow crosscompilation for apparmor

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: c89fa6645ef87e1863ef5812bd42176f5bd987ca
Component: engine
---
 components/engine/hack/make.sh                      |  3 ++-
 components/engine/hack/make/binary                  |  2 +-
 components/engine/hack/make/cross                   |  1 +
 .../engine/pkg/libcontainer/apparmor/apparmor.go    |  2 ++
 .../pkg/libcontainer/apparmor/apparmor_disabled.go  | 13 +++++++++++++
 5 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 components/engine/pkg/libcontainer/apparmor/apparmor_disabled.go

diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index 59bd716022..7f143dd464 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -84,7 +84,8 @@ fi
 # Use these flags when compiling the tests and final binary
 LDFLAGS='-X github.com/dotcloud/docker/dockerversion.GITCOMMIT "'$GITCOMMIT'" -X github.com/dotcloud/docker/dockerversion.VERSION "'$VERSION'" -w'
 LDFLAGS_STATIC='-X github.com/dotcloud/docker/dockerversion.IAMSTATIC true -linkmode external -extldflags "-lpthread -static -Wl,--unresolved-symbols=ignore-in-object-files"'
-BUILDFLAGS='-tags netgo -a'
+BUILDFLAGS='-a'
+BUILDTAGS="apparmor netgo"
 
 HAVE_GO_TEST_COVER=
 if \
diff --git a/components/engine/hack/make/binary b/components/engine/hack/make/binary
index 93e99fee8f..344be25a73 100644
--- a/components/engine/hack/make/binary
+++ b/components/engine/hack/make/binary
@@ -2,5 +2,5 @@
 
 DEST=$1
 
-go build -o $DEST/docker-$VERSION -ldflags "$LDFLAGS $LDFLAGS_STATIC" $BUILDFLAGS ./docker
+go build -o $DEST/docker-$VERSION -ldflags "$LDFLAGS $LDFLAGS_STATIC" $BUILDFLAGS -tags "$BUILDTAGS" ./docker
 echo "Created binary: $DEST/docker-$VERSION"
diff --git a/components/engine/hack/make/cross b/components/engine/hack/make/cross
index a67ab6c28a..28424c432e 100644
--- a/components/engine/hack/make/cross
+++ b/components/engine/hack/make/cross
@@ -18,6 +18,7 @@ for platform in $DOCKER_CROSSPLATFORMS; do
 		export GOOS=${platform%/*}
 		export GOARCH=${platform##*/}
 		export LDFLAGS_STATIC="" # we just need a simple client for these platforms (TODO this might change someday)
+		export BUILDTAGS="netgo"
 		source "$(dirname "$BASH_SOURCE")/binary" "$DEST/$platform"
 	)
 done
diff --git a/components/engine/pkg/libcontainer/apparmor/apparmor.go b/components/engine/pkg/libcontainer/apparmor/apparmor.go
index c2954fdad4..d07c710dbe 100644
--- a/components/engine/pkg/libcontainer/apparmor/apparmor.go
+++ b/components/engine/pkg/libcontainer/apparmor/apparmor.go
@@ -1,3 +1,5 @@
+// +build apparmor
+
 package apparmor
 
 // #cgo LDFLAGS: -lapparmor
diff --git a/components/engine/pkg/libcontainer/apparmor/apparmor_disabled.go b/components/engine/pkg/libcontainer/apparmor/apparmor_disabled.go
new file mode 100644
index 0000000000..489484fcc6
--- /dev/null
+++ b/components/engine/pkg/libcontainer/apparmor/apparmor_disabled.go
@@ -0,0 +1,13 @@
+// +build !apparmor
+
+package apparmor
+
+import ()
+
+func IsEnabled() bool {
+	return false
+}
+
+func ApplyProfile(pid int, name string) error {
+	return nil
+}

From 24c5efffe22355f83b60c9f4fa3227ace3a1fe5e Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Thu, 6 Mar 2014 13:39:17 -0700
Subject: [PATCH 384/403] Update build tags such that we can properly compile
 on all platforms (especially for packagers), and updated hack/PACKAGERS.md to
 mention the DOCKER_BUILDTAGS variable that will need to be set for binaries
 that might be used on AppArmor (such as Debian and especially Ubuntu)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 0b23393ba1901df3d08916fa977707db58699eca
Component: engine
---
 components/engine/Dockerfile                             | 1 +
 components/engine/hack/PACKAGERS.md                      | 9 +++++++++
 components/engine/hack/make.sh                           | 5 ++---
 components/engine/hack/make/binary                       | 2 +-
 components/engine/hack/make/cross                        | 1 -
 components/engine/hack/make/dynbinary                    | 2 +-
 components/engine/pkg/libcontainer/apparmor/apparmor.go  | 2 +-
 .../pkg/libcontainer/apparmor/apparmor_disabled.go       | 2 +-
 8 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/components/engine/Dockerfile b/components/engine/Dockerfile
index 9271aa0d02..9929a10f3c 100644
--- a/components/engine/Dockerfile
+++ b/components/engine/Dockerfile
@@ -87,6 +87,7 @@ RUN	git config --global user.email 'docker-dummy@example.com'
 
 VOLUME	/var/lib/docker
 WORKDIR	/go/src/github.com/dotcloud/docker
+ENV	DOCKER_BUILDTAGS	apparmor
 
 # Wrap all commands in the "docker-in-docker" script to allow nested containers
 ENTRYPOINT	["hack/dind"]
diff --git a/components/engine/hack/PACKAGERS.md b/components/engine/hack/PACKAGERS.md
index 8d9749b4f8..3948f001b5 100644
--- a/components/engine/hack/PACKAGERS.md
+++ b/components/engine/hack/PACKAGERS.md
@@ -148,6 +148,15 @@ This will cause the build scripts to set up a reasonable `GOPATH` that
 automatically and properly includes both dotcloud/docker from the local
 directory, and the local "./vendor" directory as necessary.
 
+### `DOCKER_BUILDTAGS`
+
+If you're building a binary that may need to be used on platforms that include
+AppArmor, you will need to set `DOCKER_BUILDTAGS` as follows:
+
+```bash
+export DOCKER_BUILDTAGS='apparmor'
+```
+
 ### Static Daemon
 
 If it is feasible within the constraints of your distribution, you should
diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index 7f143dd464..73c53c850a 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -84,8 +84,7 @@ fi
 # Use these flags when compiling the tests and final binary
 LDFLAGS='-X github.com/dotcloud/docker/dockerversion.GITCOMMIT "'$GITCOMMIT'" -X github.com/dotcloud/docker/dockerversion.VERSION "'$VERSION'" -w'
 LDFLAGS_STATIC='-X github.com/dotcloud/docker/dockerversion.IAMSTATIC true -linkmode external -extldflags "-lpthread -static -Wl,--unresolved-symbols=ignore-in-object-files"'
-BUILDFLAGS='-a'
-BUILDTAGS="apparmor netgo"
+BUILDFLAGS=( -a -tags "netgo $DOCKER_BUILDTAGS" )
 
 HAVE_GO_TEST_COVER=
 if \
@@ -114,7 +113,7 @@ go_test_dir() {
 	(
 		set -x
 		cd "$dir"
-		go test ${testcover[@]} -ldflags "$LDFLAGS" $BUILDFLAGS $TESTFLAGS
+		go test ${testcover[@]} -ldflags "$LDFLAGS" "${BUILDFLAGS[@]}" $TESTFLAGS
 	)
 }
 
diff --git a/components/engine/hack/make/binary b/components/engine/hack/make/binary
index 344be25a73..b7c318e6cb 100644
--- a/components/engine/hack/make/binary
+++ b/components/engine/hack/make/binary
@@ -2,5 +2,5 @@
 
 DEST=$1
 
-go build -o $DEST/docker-$VERSION -ldflags "$LDFLAGS $LDFLAGS_STATIC" $BUILDFLAGS -tags "$BUILDTAGS" ./docker
+go build -o $DEST/docker-$VERSION -ldflags "$LDFLAGS $LDFLAGS_STATIC" "${BUILDFLAGS[@]}" ./docker
 echo "Created binary: $DEST/docker-$VERSION"
diff --git a/components/engine/hack/make/cross b/components/engine/hack/make/cross
index 28424c432e..a67ab6c28a 100644
--- a/components/engine/hack/make/cross
+++ b/components/engine/hack/make/cross
@@ -18,7 +18,6 @@ for platform in $DOCKER_CROSSPLATFORMS; do
 		export GOOS=${platform%/*}
 		export GOARCH=${platform##*/}
 		export LDFLAGS_STATIC="" # we just need a simple client for these platforms (TODO this might change someday)
-		export BUILDTAGS="netgo"
 		source "$(dirname "$BASH_SOURCE")/binary" "$DEST/$platform"
 	)
 done
diff --git a/components/engine/hack/make/dynbinary b/components/engine/hack/make/dynbinary
index d5ea6ebe54..e7a767e102 100644
--- a/components/engine/hack/make/dynbinary
+++ b/components/engine/hack/make/dynbinary
@@ -3,7 +3,7 @@
 DEST=$1
 
 # dockerinit still needs to be a static binary, even if docker is dynamic
-CGO_ENABLED=0 go build -o $DEST/dockerinit-$VERSION -ldflags "$LDFLAGS -d" $BUILDFLAGS ./dockerinit
+CGO_ENABLED=0 go build -o $DEST/dockerinit-$VERSION -ldflags "$LDFLAGS -d" "${BUILDFLAGS[@]}" ./dockerinit
 echo "Created binary: $DEST/dockerinit-$VERSION"
 ln -sf dockerinit-$VERSION $DEST/dockerinit
 
diff --git a/components/engine/pkg/libcontainer/apparmor/apparmor.go b/components/engine/pkg/libcontainer/apparmor/apparmor.go
index d07c710dbe..a6d57d4f09 100644
--- a/components/engine/pkg/libcontainer/apparmor/apparmor.go
+++ b/components/engine/pkg/libcontainer/apparmor/apparmor.go
@@ -1,4 +1,4 @@
-// +build apparmor
+// +build apparmor,linux,amd64
 
 package apparmor
 
diff --git a/components/engine/pkg/libcontainer/apparmor/apparmor_disabled.go b/components/engine/pkg/libcontainer/apparmor/apparmor_disabled.go
index 489484fcc6..77543e4a87 100644
--- a/components/engine/pkg/libcontainer/apparmor/apparmor_disabled.go
+++ b/components/engine/pkg/libcontainer/apparmor/apparmor_disabled.go
@@ -1,4 +1,4 @@
-// +build !apparmor
+// +build !apparmor !linux !amd64
 
 package apparmor
 

From ec7a1fa7d6e84a0203226fd966a8d8752aaa43b2 Mon Sep 17 00:00:00 2001
From: Walter Leibbrandt <github@wrl.co.za>
Date: Thu, 6 Mar 2014 23:33:08 +0200
Subject: [PATCH 385/403] Fixed installmirrors ref

Nested inline markup is not (yet) possible: http://stackoverflow.com/a/9645684
Upstream-commit: 188dea9e0e8b968b28a288192c357343dcc5834c
Component: engine
---
 components/engine/docs/sources/installation/ubuntulinux.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/installation/ubuntulinux.rst b/components/engine/docs/sources/installation/ubuntulinux.rst
index 416d56765e..c459f33d3c 100644
--- a/components/engine/docs/sources/installation/ubuntulinux.rst
+++ b/components/engine/docs/sources/installation/ubuntulinux.rst
@@ -64,7 +64,7 @@ Installation
    an earlier version, you will need to follow them again.
 
 Docker is available as a Debian package, which makes installation
-easy. **See the :ref:`installmirrors` section below if you are not in
+easy. **See the** :ref:`installmirrors` **section below if you are not in
 the United States.** Other sources of the Debian packages may be
 faster for you to install.
 

From a45e674934179b53de34190a50b243a95b6aaa72 Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Thu, 6 Mar 2014 22:51:44 +0000
Subject: [PATCH 386/403] Fix name parameter

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: 476c290b079d94b1da02c6e72ed15b7f9bd7fce5
Component: engine
---
 components/engine/docs/sources/use/port_redirection.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/engine/docs/sources/use/port_redirection.rst b/components/engine/docs/sources/use/port_redirection.rst
index 2612d63aec..437c909bfb 100644
--- a/components/engine/docs/sources/use/port_redirection.rst
+++ b/components/engine/docs/sources/use/port_redirection.rst
@@ -85,7 +85,7 @@ dynamically allocated ports:
 .. code-block:: bash
 
    # Bind to a dynamically allocated port
-   docker run -p 127.0.0.1::8080 -name dyn-bound <image> <cmd>
+   docker run -p 127.0.0.1::8080 --name dyn-bound <image> <cmd>
 
    # Lookup the actual port
    docker port dyn-bound 8080
@@ -121,7 +121,7 @@ Dockerfile:
 .. code-block:: bash
 
     # Expose port 80
-    docker run -expose 80 -name server <image> <cmd>
+    docker run -expose 80 --name server <image> <cmd>
 
 The ``client`` then links to the ``server``:
 

From 936f96cce5b18ec13b9d876e4bbc5857796ae7b8 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 6 Mar 2014 14:14:25 -0800
Subject: [PATCH 387/403] Remove the ghosts and kill everything
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 772ef99d2816b629d084e11fe7fba5953687b620 Component: engine

---
 components/engine/container.go                | 12 +--
 components/engine/execdriver/driver.go        |  1 -
 components/engine/execdriver/lxc/driver.go    | 21 +----
 components/engine/execdriver/native/driver.go | 39 +--------
 components/engine/integration/runtime_test.go | 84 -------------------
 .../engine/pkg/libcontainer/nsinit/init.go    | 11 +--
 components/engine/runtime.go                  | 43 ++++++----
 7 files changed, 43 insertions(+), 168 deletions(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index e0a037dc3a..a9a6ca9cf7 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -55,6 +55,7 @@ type Container struct {
 	HostsPath      string
 	Name           string
 	Driver         string
+	ExecDriver     string
 
 	command   *execdriver.Command
 	stdout    *utils.WriteBroadcaster
@@ -777,15 +778,8 @@ func (container *Container) monitor(callback execdriver.StartCallback) error {
 		exitCode int
 	)
 
-	if container.command == nil {
-		// This happends when you have a GHOST container with lxc
-		populateCommand(container)
-		err = container.runtime.RestoreCommand(container)
-	} else {
-		pipes := execdriver.NewPipes(container.stdin, container.stdout, container.stderr, container.Config.OpenStdin)
-		exitCode, err = container.runtime.Run(container, pipes, callback)
-	}
-
+	pipes := execdriver.NewPipes(container.stdin, container.stdout, container.stderr, container.Config.OpenStdin)
+	exitCode, err = container.runtime.Run(container, pipes, callback)
 	if err != nil {
 		utils.Errorf("Error running container: %s", err)
 	}
diff --git a/components/engine/execdriver/driver.go b/components/engine/execdriver/driver.go
index d64c08fa6c..418d97964a 100644
--- a/components/engine/execdriver/driver.go
+++ b/components/engine/execdriver/driver.go
@@ -77,7 +77,6 @@ type TtyTerminal interface {
 type Driver interface {
 	Run(c *Command, pipes *Pipes, startCallback StartCallback) (int, error) // Run executes the process and blocks until the process exits and returns the exit code
 	Kill(c *Command, sig int) error
-	Restore(c *Command) error                     // Wait and try to re-attach on an out of process command
 	Name() string                                 // Driver name
 	Info(id string) Info                          // "temporary" hack (until we move state from core to plugins)
 	GetPidsForContainer(id string) ([]int, error) // Returns a list of pids for the given container.
diff --git a/components/engine/execdriver/lxc/driver.go b/components/engine/execdriver/lxc/driver.go
index 8f8dcbda17..3128131de0 100644
--- a/components/engine/execdriver/lxc/driver.go
+++ b/components/engine/execdriver/lxc/driver.go
@@ -189,20 +189,7 @@ func getExitCode(c *execdriver.Command) int {
 }
 
 func (d *driver) Kill(c *execdriver.Command, sig int) error {
-	return d.kill(c, sig)
-}
-
-func (d *driver) Restore(c *execdriver.Command) error {
-	for {
-		output, err := exec.Command("lxc-info", "-n", c.ID).CombinedOutput()
-		if err != nil {
-			return err
-		}
-		if !strings.Contains(string(output), "RUNNING") {
-			return nil
-		}
-		time.Sleep(500 * time.Millisecond)
-	}
+	return KillLxc(c.ID, sig)
 }
 
 func (d *driver) version() string {
@@ -225,16 +212,16 @@ func (d *driver) version() string {
 	return version
 }
 
-func (d *driver) kill(c *execdriver.Command, sig int) error {
+func KillLxc(id string, sig int) error {
 	var (
 		err    error
 		output []byte
 	)
 	_, err = exec.LookPath("lxc-kill")
 	if err == nil {
-		output, err = exec.Command("lxc-kill", "-n", c.ID, strconv.Itoa(sig)).CombinedOutput()
+		output, err = exec.Command("lxc-kill", "-n", id, strconv.Itoa(sig)).CombinedOutput()
 	} else {
-		output, err = exec.Command("lxc-stop", "-k", "-n", c.ID, strconv.Itoa(sig)).CombinedOutput()
+		output, err = exec.Command("lxc-stop", "-k", "-n", id, strconv.Itoa(sig)).CombinedOutput()
 	}
 	if err != nil {
 		return fmt.Errorf("Err: %s Output: %s", err, output)
diff --git a/components/engine/execdriver/native/driver.go b/components/engine/execdriver/native/driver.go
index 1b444c19d1..942dea9af7 100644
--- a/components/engine/execdriver/native/driver.go
+++ b/components/engine/execdriver/native/driver.go
@@ -16,7 +16,6 @@ import (
 	"strconv"
 	"strings"
 	"syscall"
-	"time"
 )
 
 const (
@@ -109,41 +108,9 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 }
 
 func (d *driver) Kill(p *execdriver.Command, sig int) error {
-	return syscall.Kill(p.Process.Pid, syscall.Signal(sig))
-}
-
-func (d *driver) Restore(c *execdriver.Command) error {
-	var nspid int
-	f, err := os.Open(filepath.Join(d.root, c.ID, "pid"))
-	if err != nil {
-		return err
-	}
-	defer d.removeContainerRoot(c.ID)
-
-	if _, err := fmt.Fscanf(f, "%d", &nspid); err != nil {
-		f.Close()
-		return err
-	}
-	f.Close()
-
-	if _, err := os.FindProcess(nspid); err != nil {
-		return fmt.Errorf("finding existing pid %d %s", nspid, err)
-	}
-	c.Process = &os.Process{
-		Pid: nspid,
-	}
-	ticker := time.NewTicker(500 * time.Millisecond)
-	defer ticker.Stop()
-
-	for _ = range ticker.C {
-		if err := syscall.Kill(nspid, 0); err != nil {
-			if strings.Contains(err.Error(), "no such process") {
-				return nil
-			}
-			return fmt.Errorf("signal error %s", err)
-		}
-	}
-	return nil
+	err := syscall.Kill(p.Process.Pid, syscall.Signal(sig))
+	d.removeContainerRoot(p.ID)
+	return err
 }
 
 func (d *driver) Info(id string) execdriver.Info {
diff --git a/components/engine/integration/runtime_test.go b/components/engine/integration/runtime_test.go
index 6003c89b51..1e912c1bb4 100644
--- a/components/engine/integration/runtime_test.go
+++ b/components/engine/integration/runtime_test.go
@@ -589,90 +589,6 @@ func TestRestore(t *testing.T) {
 	container2.State.SetStopped(0)
 }
 
-func TestReloadContainerLinks(t *testing.T) {
-	root, err := newTestDirectory(unitTestStoreBase)
-	if err != nil {
-		t.Fatal(err)
-	}
-	// FIXME: here we don't use NewTestEngine because it calls initserver with Autorestart=false,
-	// and we want to set it to true.
-
-	eng := newTestEngine(t, true, root)
-
-	runtime1 := mkRuntimeFromEngine(eng, t)
-	defer nuke(runtime1)
-	// Create a container with one instance of docker
-	container1, _, _ := mkContainer(runtime1, []string{"-i", "_", "/bin/sh"}, t)
-	defer runtime1.Destroy(container1)
-
-	// Create a second container meant to be killed
-	container2, _, _ := mkContainer(runtime1, []string{"-i", "_", "/bin/cat"}, t)
-	defer runtime1.Destroy(container2)
-
-	// Start the container non blocking
-	if err := container2.Start(); err != nil {
-		t.Fatal(err)
-	}
-	// Add a link to container 2
-	// FIXME @shykes: setting hostConfig.Links seems redundant with calling RegisterLink().
-	// Why do we need it @crosbymichael?
-	// container1.hostConfig.Links = []string{"/" + container2.ID + ":first"}
-	if err := runtime1.RegisterLink(container1, container2, "first"); err != nil {
-		t.Fatal(err)
-	}
-	if err := container1.Start(); err != nil {
-		t.Fatal(err)
-	}
-
-	if !container2.State.IsRunning() {
-		t.Fatalf("Container %v should appear as running but isn't", container2.ID)
-	}
-
-	if !container1.State.IsRunning() {
-		t.Fatalf("Container %s should appear as running but isn't", container1.ID)
-	}
-
-	if len(runtime1.List()) != 2 {
-		t.Errorf("Expected 2 container, %v found", len(runtime1.List()))
-	}
-
-	// Here are are simulating a docker restart - that is, reloading all containers
-	// from scratch
-	eng = newTestEngine(t, false, root)
-	runtime2 := mkRuntimeFromEngine(eng, t)
-	if len(runtime2.List()) != 2 {
-		t.Errorf("Expected 2 container, %v found", len(runtime2.List()))
-	}
-	runningCount := 0
-	for _, c := range runtime2.List() {
-		if c.State.IsRunning() {
-			runningCount++
-		}
-	}
-	if runningCount != 2 {
-		t.Fatalf("Expected 2 container alive, %d found", runningCount)
-	}
-
-	// FIXME: we no longer test if containers were registered in the right order,
-	// because there is no public
-	// Make sure container 2 ( the child of container 1 ) was registered and started first
-	// with the runtime
-	//
-	containers := runtime2.List()
-	if len(containers) == 0 {
-		t.Fatalf("Runtime has no containers")
-	}
-	first := containers[0]
-	if first.ID != container2.ID {
-		t.Fatalf("Container 2 %s should be registered first in the runtime", container2.ID)
-	}
-
-	// Verify that the link is still registered in the runtime
-	if c := runtime2.Get(container1.Name); c == nil {
-		t.Fatal("Named container is no longer registered after restart")
-	}
-}
-
 func TestDefaultContainerName(t *testing.T) {
 	eng := NewTestEngine(t)
 	runtime := mkRuntimeFromEngine(eng, t)
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 45ab881579..1f8ad364f4 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -48,17 +48,14 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 			return fmt.Errorf("setctty %s", err)
 		}
 	}
-
-	/* this is commented out so that we get the current Ghost functionality
-	if err := system.ParentDeathSignal(); err != nil {
-		return fmt.Errorf("parent death signal %s", err)
-	}
+	/*
+		if err := system.ParentDeathSignal(); err != nil {
+			return fmt.Errorf("parent death signal %s", err)
+		}
 	*/
-
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
-
 	if err := setupNetwork(container, context); err != nil {
 		return fmt.Errorf("setup networking %s", err)
 	}
diff --git a/components/engine/runtime.go b/components/engine/runtime.go
index bfc7ab878b..84f11e87b2 100644
--- a/components/engine/runtime.go
+++ b/components/engine/runtime.go
@@ -154,12 +154,39 @@ func (runtime *Runtime) Register(container *Container) error {
 	//        if so, then we need to restart monitor and init a new lock
 	// If the container is supposed to be running, make sure of it
 	if container.State.IsRunning() {
-		info := runtime.execDriver.Info(container.ID)
+		if container.State.IsGhost() {
+			utils.Debugf("killing ghost %s", container.ID)
 
+			existingPid := container.State.Pid
+			container.State.SetGhost(false)
+			container.State.SetStopped(0)
+
+			if container.ExecDriver == "" || strings.Contains(container.ExecDriver, "lxc") {
+				lxc.KillLxc(container.ID, 9)
+			} else {
+				command := &execdriver.Command{
+					ID: container.ID,
+				}
+				command.Process = &os.Process{Pid: existingPid}
+				runtime.execDriver.Kill(command, 9)
+			}
+			// ensure that the filesystem is also unmounted
+			unmountVolumesForContainer(container)
+			if err := container.Unmount(); err != nil {
+				utils.Debugf("ghost unmount error %s", err)
+			}
+		}
+
+		info := runtime.execDriver.Info(container.ID)
 		if !info.IsRunning() {
 			utils.Debugf("Container %s was supposed to be running but is not.", container.ID)
 			if runtime.config.AutoRestart {
 				utils.Debugf("Restarting")
+				unmountVolumesForContainer(container)
+				if err := container.Unmount(); err != nil {
+					utils.Debugf("restart unmount error %s", err)
+				}
+
 				container.State.SetGhost(false)
 				container.State.SetStopped(0)
 				if err := container.Start(); err != nil {
@@ -172,15 +199,6 @@ func (runtime *Runtime) Register(container *Container) error {
 					return err
 				}
 			}
-		} else {
-			utils.Debugf("Reconnecting to container %v", container.ID)
-
-			if err := container.allocateNetwork(); err != nil {
-				return err
-			}
-
-			container.waitLock = make(chan struct{})
-			go container.monitor(nil)
 		}
 	} else {
 		// When the container is not running, we still initialize the waitLock
@@ -447,6 +465,7 @@ func (runtime *Runtime) Create(config *runconfig.Config, name string) (*Containe
 		NetworkSettings: &NetworkSettings{},
 		Name:            name,
 		Driver:          runtime.driver.String(),
+		ExecDriver:      runtime.execDriver.Name(),
 	}
 	container.root = runtime.containerRoot(container.ID)
 	// Step 1: create the container directory.
@@ -834,10 +853,6 @@ func (runtime *Runtime) Kill(c *Container, sig int) error {
 	return runtime.execDriver.Kill(c.command, sig)
 }
 
-func (runtime *Runtime) RestoreCommand(c *Container) error {
-	return runtime.execDriver.Restore(c.command)
-}
-
 // Nuke kills all containers then removes all content
 // from the content root, including images, volumes and
 // container filesystems.

From c896586b703689f86730bcc676fa28eed2edf4ec Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 6 Mar 2014 16:30:56 -0800
Subject: [PATCH 388/403] Ensure that native containers die with the parent
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael) Upstream-commit:
 ea9bce8724303656c87c05e9049272258c9827b3 Component: engine

---
 components/engine/pkg/libcontainer/nsinit/init.go | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 1f8ad364f4..8d3f908f17 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -48,11 +48,9 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 			return fmt.Errorf("setctty %s", err)
 		}
 	}
-	/*
-		if err := system.ParentDeathSignal(); err != nil {
-			return fmt.Errorf("parent death signal %s", err)
-		}
-	*/
+	if err := system.ParentDeathSignal(); err != nil {
+		return fmt.Errorf("parent death signal %s", err)
+	}
 	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}

From cf4ed6c8836a4707c1cdc9275e0a4b15cc72016f Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 6 Mar 2014 16:32:06 -0800
Subject: [PATCH 389/403] Revert "libcontainer: Use pivot_root instead of
 chroot"

This reverts commit 5b5c884cc8266d0c2a56da0bc2df14cc9d5d85e8.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 82f797f14096430c3edbace1cd30e04a483ec41f
Component: engine
---
 .../engine/pkg/libcontainer/nsinit/mount.go   | 22 ++++---------------
 1 file changed, 4 insertions(+), 18 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 69d85d66ca..a97a3795e4 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -5,7 +5,6 @@ package nsinit
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/system"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -51,29 +50,16 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := system.Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
-
-	pivotDir, err := ioutil.TempDir(rootfs, ".pivot_root")
-	if err != nil {
-		return fmt.Errorf("can't create pivot_root dir %s", pivotDir, err)
+	if err := system.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
+		return fmt.Errorf("mount move %s into / %s", rootfs, err)
 	}
-	if err := system.Pivotroot(rootfs, pivotDir); err != nil {
-		return fmt.Errorf("pivot_root %s", err)
+	if err := system.Chroot("."); err != nil {
+		return fmt.Errorf("chroot . %s", err)
 	}
 	if err := system.Chdir("/"); err != nil {
 		return fmt.Errorf("chdir / %s", err)
 	}
 
-	// path to pivot dir now changed, update
-	pivotDir = filepath.Join("/", filepath.Base(pivotDir))
-
-	if err := system.Unmount(pivotDir, syscall.MNT_DETACH); err != nil {
-		return fmt.Errorf("unmount pivot_root dir %s", err)
-	}
-
-	if err := os.Remove(pivotDir); err != nil {
-		return fmt.Errorf("remove pivot_root dir %s", err)
-	}
-
 	system.Umask(0022)
 
 	return nil

From d96ead649838df22a969968d05dde36e6cf67c0c Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 6 Mar 2014 16:41:03 -0800
Subject: [PATCH 390/403] Revert "libcontainer: Use MS_PRIVATE instead of
 MS_SLAVE"

This reverts commit 757b5775725fb90262cee1fa6068fa9dcbbff59f.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: bd263f5b15b51747e3429179fef7fcb425ccbe4a
Component: engine
---
 components/engine/pkg/libcontainer/nsinit/mount.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index a97a3795e4..0506b99766 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -20,7 +20,7 @@ const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NOD
 // is no longer in use, the mounts will be removed automatically
 func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	// mount as slave so that the new mounts do not propagate to the host
-	if err := system.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, ""); err != nil {
+	if err := system.Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
 	if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {

From 3e4d7be83840d54e0a96ff84bae677e74b189adc Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 6 Mar 2014 17:19:47 -0800
Subject: [PATCH 391/403] Revert "Revert "libcontainer: Use MS_PRIVATE instead
 of MS_SLAVE""

This reverts commit bd263f5b15b51747e3429179fef7fcb425ccbe4a.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 557e4fef4418a251dd3a6817b97e5c1be055cbf3
Component: engine
---
 components/engine/pkg/libcontainer/nsinit/mount.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 0506b99766..a97a3795e4 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -20,7 +20,7 @@ const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NOD
 // is no longer in use, the mounts will be removed automatically
 func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	// mount as slave so that the new mounts do not propagate to the host
-	if err := system.Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil {
+	if err := system.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
 	if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {

From 6f0ad9195cf3064c44be5f18ea2fe0d309bc8a2a Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 6 Mar 2014 17:19:59 -0800
Subject: [PATCH 392/403] Revert "Revert "libcontainer: Use pivot_root instead
 of chroot""

This reverts commit 82f797f14096430c3edbace1cd30e04a483ec41f.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: c38635020accaffa6868f19f308042be051132a0
Component: engine
---
 .../engine/pkg/libcontainer/nsinit/mount.go   | 22 +++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index a97a3795e4..69d85d66ca 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -5,6 +5,7 @@ package nsinit
 import (
 	"fmt"
 	"github.com/dotcloud/docker/pkg/system"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -50,16 +51,29 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := system.Chdir(rootfs); err != nil {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
-	if err := system.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
-		return fmt.Errorf("mount move %s into / %s", rootfs, err)
+
+	pivotDir, err := ioutil.TempDir(rootfs, ".pivot_root")
+	if err != nil {
+		return fmt.Errorf("can't create pivot_root dir %s", pivotDir, err)
 	}
-	if err := system.Chroot("."); err != nil {
-		return fmt.Errorf("chroot . %s", err)
+	if err := system.Pivotroot(rootfs, pivotDir); err != nil {
+		return fmt.Errorf("pivot_root %s", err)
 	}
 	if err := system.Chdir("/"); err != nil {
 		return fmt.Errorf("chdir / %s", err)
 	}
 
+	// path to pivot dir now changed, update
+	pivotDir = filepath.Join("/", filepath.Base(pivotDir))
+
+	if err := system.Unmount(pivotDir, syscall.MNT_DETACH); err != nil {
+		return fmt.Errorf("unmount pivot_root dir %s", err)
+	}
+
+	if err := os.Remove(pivotDir); err != nil {
+		return fmt.Errorf("remove pivot_root dir %s", err)
+	}
+
 	system.Umask(0022)
 
 	return nil

From 2e92b6ef1e56969db2e40891d9c4ec322a1cf273 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Thu, 6 Mar 2014 19:55:22 -0700
Subject: [PATCH 393/403] Fix dynbinary so that dockerinit can still be
 properly static even if it has to link against libapparmor for Ubuntu

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: be344cf0d8e4f9881724f49398603a6e3109bc89
Component: engine
---
 components/engine/hack/make.sh                 | 18 ++++++++++++++++--
 components/engine/hack/make/binary             |  9 ++++++++-
 components/engine/hack/make/cross              |  2 +-
 components/engine/hack/make/dynbinary          | 12 ++++++++++--
 components/engine/hack/make/dyntest            |  4 +++-
 .../engine/hack/make/dyntest-integration       |  4 +++-
 components/engine/hack/make/test               |  4 ++--
 components/engine/hack/make/test-integration   |  2 +-
 8 files changed, 44 insertions(+), 11 deletions(-)

diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index 73c53c850a..63edca4d4c 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -82,10 +82,24 @@ if [ ! "$GOPATH" ]; then
 fi
 
 # Use these flags when compiling the tests and final binary
-LDFLAGS='-X github.com/dotcloud/docker/dockerversion.GITCOMMIT "'$GITCOMMIT'" -X github.com/dotcloud/docker/dockerversion.VERSION "'$VERSION'" -w'
-LDFLAGS_STATIC='-X github.com/dotcloud/docker/dockerversion.IAMSTATIC true -linkmode external -extldflags "-lpthread -static -Wl,--unresolved-symbols=ignore-in-object-files"'
+LDFLAGS='
+	-w
+	-X github.com/dotcloud/docker/dockerversion.GITCOMMIT "'$GITCOMMIT'"
+	-X github.com/dotcloud/docker/dockerversion.VERSION "'$VERSION'"
+'
+LDFLAGS_STATIC='-linkmode external'
+EXTLDFLAGS_STATIC='-static'
 BUILDFLAGS=( -a -tags "netgo $DOCKER_BUILDTAGS" )
 
+# A few more flags that are specific just to building a completely-static binary (see hack/make/binary)
+# PLEASE do not use these anywhere else.
+EXTLDFLAGS_STATIC_DOCKER="$EXTLDFLAGS_STATIC -lpthread -Wl,--unresolved-symbols=ignore-in-object-files"
+LDFLAGS_STATIC_DOCKER="
+	$LDFLAGS_STATIC
+	-X github.com/dotcloud/docker/dockerversion.IAMSTATIC true
+	-extldflags \"$EXTLDFLAGS_STATIC_DOCKER\"
+"
+
 HAVE_GO_TEST_COVER=
 if \
 	go help testflag | grep -- -cover > /dev/null \
diff --git a/components/engine/hack/make/binary b/components/engine/hack/make/binary
index b7c318e6cb..7272b1ede0 100644
--- a/components/engine/hack/make/binary
+++ b/components/engine/hack/make/binary
@@ -2,5 +2,12 @@
 
 DEST=$1
 
-go build -o $DEST/docker-$VERSION -ldflags "$LDFLAGS $LDFLAGS_STATIC" "${BUILDFLAGS[@]}" ./docker
+go build \
+	-o $DEST/docker-$VERSION \
+	"${BUILDFLAGS[@]}" \
+	-ldflags "
+		$LDFLAGS
+		$LDFLAGS_STATIC_DOCKER
+	" \
+	./docker
 echo "Created binary: $DEST/docker-$VERSION"
diff --git a/components/engine/hack/make/cross b/components/engine/hack/make/cross
index a67ab6c28a..e8f90e29b7 100644
--- a/components/engine/hack/make/cross
+++ b/components/engine/hack/make/cross
@@ -17,7 +17,7 @@ for platform in $DOCKER_CROSSPLATFORMS; do
 		mkdir -p "$DEST/$platform" # bundles/VERSION/cross/GOOS/GOARCH/docker-VERSION
 		export GOOS=${platform%/*}
 		export GOARCH=${platform##*/}
-		export LDFLAGS_STATIC="" # we just need a simple client for these platforms (TODO this might change someday)
+		export LDFLAGS_STATIC_DOCKER="" # we just need a simple client for these platforms (TODO this might change someday)
 		source "$(dirname "$BASH_SOURCE")/binary" "$DEST/$platform"
 	)
 done
diff --git a/components/engine/hack/make/dynbinary b/components/engine/hack/make/dynbinary
index e7a767e102..b418fc409c 100644
--- a/components/engine/hack/make/dynbinary
+++ b/components/engine/hack/make/dynbinary
@@ -3,7 +3,15 @@
 DEST=$1
 
 # dockerinit still needs to be a static binary, even if docker is dynamic
-CGO_ENABLED=0 go build -o $DEST/dockerinit-$VERSION -ldflags "$LDFLAGS -d" "${BUILDFLAGS[@]}" ./dockerinit
+go build \
+	-o $DEST/dockerinit-$VERSION \
+	"${BUILDFLAGS[@]}" \
+	-ldflags "
+		$LDFLAGS
+		$LDFLAGS_STATIC
+		-extldflags \"$EXTLDFLAGS_STATIC\"
+	" \
+	./dockerinit
 echo "Created binary: $DEST/dockerinit-$VERSION"
 ln -sf dockerinit-$VERSION $DEST/dockerinit
 
@@ -23,6 +31,6 @@ export DOCKER_INITSHA1="$($sha1sum $DEST/dockerinit-$VERSION | cut -d' ' -f1)"
 # exported so that "dyntest" can easily access it later without recalculating it
 
 (
-	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\" -X github.com/dotcloud/docker/dockerversion.INITPATH \"$DOCKER_INITPATH\""
+	export LDFLAGS_STATIC_DOCKER="-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\" -X github.com/dotcloud/docker/dockerversion.INITPATH \"$DOCKER_INITPATH\""
 	source "$(dirname "$BASH_SOURCE")/binary"
 )
diff --git a/components/engine/hack/make/dyntest b/components/engine/hack/make/dyntest
index 555517fd05..744db3e999 100644
--- a/components/engine/hack/make/dyntest
+++ b/components/engine/hack/make/dyntest
@@ -12,6 +12,8 @@ fi
 
 (
 	export TEST_DOCKERINIT_PATH="$INIT"
-	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\""
+	export LDFLAGS_STATIC_DOCKER="
+		-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\"
+	"
 	source "$(dirname "$BASH_SOURCE")/test"
 )
diff --git a/components/engine/hack/make/dyntest-integration b/components/engine/hack/make/dyntest-integration
index b3a2d7be63..ef7e6a5a41 100644
--- a/components/engine/hack/make/dyntest-integration
+++ b/components/engine/hack/make/dyntest-integration
@@ -12,6 +12,8 @@ fi
 
 (
 	export TEST_DOCKERINIT_PATH="$INIT"
-	export LDFLAGS_STATIC="-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\""
+	export LDFLAGS_STATIC_DOCKER="
+		-X github.com/dotcloud/docker/dockerversion.INITSHA1 \"$DOCKER_INITSHA1\"
+	"
 	source "$(dirname "$BASH_SOURCE")/test-integration"
 )
diff --git a/components/engine/hack/make/test b/components/engine/hack/make/test
index 68b4c52202..39ba5cd3a5 100644
--- a/components/engine/hack/make/test
+++ b/components/engine/hack/make/test
@@ -4,9 +4,9 @@ DEST=$1
 
 set -e
 
-TEXTRESET=$'\033[0m' # reset the foreground colour
 RED=$'\033[31m'
 GREEN=$'\033[32m'
+TEXTRESET=$'\033[0m' # reset the foreground colour
 
 # Run Docker's test suite, including sub-packages, and store their output as a bundle
 # If $TESTFLAGS is set in the environment, it is passed as extra arguments to 'go test'.
@@ -22,7 +22,7 @@ bundle_test() {
 		for test_dir in $(find_dirs '*_test.go'); do
 			echo
 
-			if ! LDFLAGS="$LDFLAGS $LDFLAGS_STATIC" go_test_dir "$test_dir"; then
+			if ! LDFLAGS="$LDFLAGS $LDFLAGS_STATIC_DOCKER" go_test_dir "$test_dir"; then
 				TESTS_FAILED+=("$test_dir")
 				echo
 				echo "${RED}Tests failed: $test_dir${TEXTRESET}"
diff --git a/components/engine/hack/make/test-integration b/components/engine/hack/make/test-integration
index a60efebfc3..0af4c23c48 100644
--- a/components/engine/hack/make/test-integration
+++ b/components/engine/hack/make/test-integration
@@ -5,7 +5,7 @@ DEST=$1
 set -e
 
 bundle_test_integration() {
-	LDFLAGS="$LDFLAGS $LDFLAGS_STATIC" go_test_dir ./integration \
+	LDFLAGS="$LDFLAGS $LDFLAGS_STATIC_DOCKER" go_test_dir ./integration \
 		"-coverpkg $(find_dirs '*.go' | sed 's,^\.,github.com/dotcloud/docker,g' | paste -d, -s)"
 }
 

From 957f74b8766e7d0b478b4b89f38af2e5b62bf797 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Thu, 6 Mar 2014 19:30:52 -0800
Subject: [PATCH 394/403] Add env var to toggle pivot root or ms_move

Use the  DOCKER_RAMDISK env var to tell the native driver not to use
a pivot root when setting up the rootfs of a container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 36dd124b16a76704a88142fa96bb4bb6260dd821
Component: engine
---
 .../execdriver/native/default_template.go     |  4 ++
 .../engine/pkg/libcontainer/container.go      | 23 +++++-----
 .../engine/pkg/libcontainer/nsinit/init.go    |  2 +-
 .../engine/pkg/libcontainer/nsinit/mount.go   | 44 +++++++++++++++----
 4 files changed, 53 insertions(+), 20 deletions(-)

diff --git a/components/engine/execdriver/native/default_template.go b/components/engine/execdriver/native/default_template.go
index e86a99f02f..6e7d597b7b 100644
--- a/components/engine/execdriver/native/default_template.go
+++ b/components/engine/execdriver/native/default_template.go
@@ -5,6 +5,7 @@ import (
 	"github.com/dotcloud/docker/execdriver"
 	"github.com/dotcloud/docker/pkg/cgroups"
 	"github.com/dotcloud/docker/pkg/libcontainer"
+	"os"
 )
 
 // createContainer populates and configures the container type with the
@@ -44,6 +45,9 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
 		container.Cgroups.Memory = c.Resources.Memory
 		container.Cgroups.MemorySwap = c.Resources.MemorySwap
 	}
+	// check to see if we are running in ramdisk to disable pivot root
+	container.NoPivotRoot = os.Getenv("DOCKER_RAMDISK") != ""
+
 	return container
 }
 
diff --git a/components/engine/pkg/libcontainer/container.go b/components/engine/pkg/libcontainer/container.go
index bd16825d99..a777da58a4 100644
--- a/components/engine/pkg/libcontainer/container.go
+++ b/components/engine/pkg/libcontainer/container.go
@@ -11,17 +11,18 @@ type Context map[string]string
 // Container defines configuration options for how a
 // container is setup inside a directory and how a process should be executed
 type Container struct {
-	Hostname     string          `json:"hostname,omitempty"`     // hostname
-	ReadonlyFs   bool            `json:"readonly_fs,omitempty"`  // set the containers rootfs as readonly
-	User         string          `json:"user,omitempty"`         // user to execute the process as
-	WorkingDir   string          `json:"working_dir,omitempty"`  // current working directory
-	Env          []string        `json:"environment,omitempty"`  // environment to set
-	Tty          bool            `json:"tty,omitempty"`          // setup a proper tty or not
-	Namespaces   Namespaces      `json:"namespaces,omitempty"`   // namespaces to apply
-	Capabilities Capabilities    `json:"capabilities,omitempty"` // capabilities to drop
-	Networks     []*Network      `json:"networks,omitempty"`     // nil for host's network stack
-	Cgroups      *cgroups.Cgroup `json:"cgroups,omitempty"`      // cgroups
-	Context      Context         `json:"context,omitempty"`      // generic context for specific options (apparmor, selinux)
+	Hostname     string          `json:"hostname,omitempty"`      // hostname
+	ReadonlyFs   bool            `json:"readonly_fs,omitempty"`   // set the containers rootfs as readonly
+	NoPivotRoot  bool            `json:"no_pivot_root,omitempty"` // this can be enabled if you are running in ramdisk
+	User         string          `json:"user,omitempty"`          // user to execute the process as
+	WorkingDir   string          `json:"working_dir,omitempty"`   // current working directory
+	Env          []string        `json:"environment,omitempty"`   // environment to set
+	Tty          bool            `json:"tty,omitempty"`           // setup a proper tty or not
+	Namespaces   Namespaces      `json:"namespaces,omitempty"`    // namespaces to apply
+	Capabilities Capabilities    `json:"capabilities,omitempty"`  // capabilities to drop
+	Networks     []*Network      `json:"networks,omitempty"`      // nil for host's network stack
+	Cgroups      *cgroups.Cgroup `json:"cgroups,omitempty"`       // cgroups
+	Context      Context         `json:"context,omitempty"`       // generic context for specific options (apparmor, selinux)
 }
 
 // Network defines configuration for a container's networking stack
diff --git a/components/engine/pkg/libcontainer/nsinit/init.go b/components/engine/pkg/libcontainer/nsinit/init.go
index 8d3f908f17..336fc1eaaf 100644
--- a/components/engine/pkg/libcontainer/nsinit/init.go
+++ b/components/engine/pkg/libcontainer/nsinit/init.go
@@ -51,7 +51,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 	if err := system.ParentDeathSignal(); err != nil {
 		return fmt.Errorf("parent death signal %s", err)
 	}
-	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
+	if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs, container.NoPivotRoot); err != nil {
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
 	if err := setupNetwork(container, context); err != nil {
diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go
index 69d85d66ca..83577cfa8c 100644
--- a/components/engine/pkg/libcontainer/nsinit/mount.go
+++ b/components/engine/pkg/libcontainer/nsinit/mount.go
@@ -19,9 +19,12 @@ const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NOD
 //
 // There is no need to unmount the new mounts because as soon as the mount namespace
 // is no longer in use, the mounts will be removed automatically
-func setupNewMountNamespace(rootfs, console string, readonly bool) error {
-	// mount as slave so that the new mounts do not propagate to the host
-	if err := system.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, ""); err != nil {
+func setupNewMountNamespace(rootfs, console string, readonly, noPivotRoot bool) error {
+	flag := syscall.MS_PRIVATE
+	if noPivotRoot {
+		flag = syscall.MS_SLAVE
+	}
+	if err := system.Mount("", "/", "", uintptr(flag|syscall.MS_REC), ""); err != nil {
 		return fmt.Errorf("mounting / as slave %s", err)
 	}
 	if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {
@@ -52,6 +55,23 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 		return fmt.Errorf("chdir into %s %s", rootfs, err)
 	}
 
+	if noPivotRoot {
+		if err := rootMsMove(rootfs); err != nil {
+			return err
+		}
+	} else {
+		if err := rootPivot(rootfs); err != nil {
+			return err
+		}
+	}
+
+	system.Umask(0022)
+
+	return nil
+}
+
+// use a pivot root to setup the rootfs
+func rootPivot(rootfs string) error {
 	pivotDir, err := ioutil.TempDir(rootfs, ".pivot_root")
 	if err != nil {
 		return fmt.Errorf("can't create pivot_root dir %s", pivotDir, err)
@@ -62,20 +82,28 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error {
 	if err := system.Chdir("/"); err != nil {
 		return fmt.Errorf("chdir / %s", err)
 	}
-
 	// path to pivot dir now changed, update
 	pivotDir = filepath.Join("/", filepath.Base(pivotDir))
-
 	if err := system.Unmount(pivotDir, syscall.MNT_DETACH); err != nil {
 		return fmt.Errorf("unmount pivot_root dir %s", err)
 	}
-
 	if err := os.Remove(pivotDir); err != nil {
 		return fmt.Errorf("remove pivot_root dir %s", err)
 	}
+	return nil
+}
 
-	system.Umask(0022)
-
+// use MS_MOVE and chroot to setup the rootfs
+func rootMsMove(rootfs string) error {
+	if err := system.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
+		return fmt.Errorf("mount move %s into / %s", rootfs, err)
+	}
+	if err := system.Chroot("."); err != nil {
+		return fmt.Errorf("chroot . %s", err)
+	}
+	if err := system.Chdir("/"); err != nil {
+		return fmt.Errorf("chdir / %s", err)
+	}
 	return nil
 }
 

From fa19c6a8955a4a971f3cb085c3a7a74b460006d1 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Thu, 6 Mar 2014 21:22:25 -0700
Subject: [PATCH 395/403] Add new "DOCKER_CLIENTONLY" build variable to allow
 skipping of the dockerinit compilation, especially for Homebrew / Mac OS X
 client-only compilation

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: a40bb2aabc1c0aba8b4de82dc353fae322b8831d
Component: engine
---
 components/engine/hack/PACKAGERS.md   |  6 +++
 components/engine/hack/make/dynbinary | 53 +++++++++++++++------------
 2 files changed, 35 insertions(+), 24 deletions(-)

diff --git a/components/engine/hack/PACKAGERS.md b/components/engine/hack/PACKAGERS.md
index 3948f001b5..5dcb120689 100644
--- a/components/engine/hack/PACKAGERS.md
+++ b/components/engine/hack/PACKAGERS.md
@@ -181,6 +181,12 @@ the file "./VERSION". This binary is usually installed somewhere like
 
 ### Dynamic Daemon / Client-only Binary
 
+If you are only interested in a Docker client binary, set `DOCKER_CLIENTONLY` to a non-empty value using something similar to the following: (which will prevent the extra step of compiling dockerinit)
+
+```bash
+export DOCKER_CLIENTONLY=1
+```
+
 If you need to (due to distro policy, distro library availability, or for other
 reasons) create a dynamically compiled daemon binary, or if you are only
 interested in creating a client binary for Docker, use something similar to the
diff --git a/components/engine/hack/make/dynbinary b/components/engine/hack/make/dynbinary
index b418fc409c..d4f583fb62 100644
--- a/components/engine/hack/make/dynbinary
+++ b/components/engine/hack/make/dynbinary
@@ -2,32 +2,37 @@
 
 DEST=$1
 
-# dockerinit still needs to be a static binary, even if docker is dynamic
-go build \
-	-o $DEST/dockerinit-$VERSION \
-	"${BUILDFLAGS[@]}" \
-	-ldflags "
-		$LDFLAGS
-		$LDFLAGS_STATIC
-		-extldflags \"$EXTLDFLAGS_STATIC\"
-	" \
-	./dockerinit
-echo "Created binary: $DEST/dockerinit-$VERSION"
-ln -sf dockerinit-$VERSION $DEST/dockerinit
-
-sha1sum=
-if command -v sha1sum &> /dev/null; then
-	sha1sum=sha1sum
-elif command -v shasum &> /dev/null; then
-	# Mac OS X - why couldn't they just use the same command name and be happy?
-	sha1sum=shasum
+if [ -z "$DOCKER_CLIENTONLY" ]; then
+	# dockerinit still needs to be a static binary, even if docker is dynamic
+	go build \
+		-o $DEST/dockerinit-$VERSION \
+		"${BUILDFLAGS[@]}" \
+		-ldflags "
+			$LDFLAGS
+			$LDFLAGS_STATIC
+			-extldflags \"$EXTLDFLAGS_STATIC\"
+		" \
+		./dockerinit
+	echo "Created binary: $DEST/dockerinit-$VERSION"
+	ln -sf dockerinit-$VERSION $DEST/dockerinit
+	
+	sha1sum=
+	if command -v sha1sum &> /dev/null; then
+		sha1sum=sha1sum
+	elif command -v shasum &> /dev/null; then
+		# Mac OS X - why couldn't they just use the same command name and be happy?
+		sha1sum=shasum
+	else
+		echo >&2 'error: cannot find sha1sum command or equivalent'
+		exit 1
+	fi
+	
+	# sha1 our new dockerinit to ensure separate docker and dockerinit always run in a perfect pair compiled for one another
+	export DOCKER_INITSHA1="$($sha1sum $DEST/dockerinit-$VERSION | cut -d' ' -f1)"
 else
-	echo >&2 'error: cannot find sha1sum command or equivalent'
-	exit 1
+	# DOCKER_CLIENTONLY must be truthy, so we don't need to bother with dockerinit :)
+	export DOCKER_INITSHA1=""
 fi
-
-# sha1 our new dockerinit to ensure separate docker and dockerinit always run in a perfect pair compiled for one another
-export DOCKER_INITSHA1="$($sha1sum $DEST/dockerinit-$VERSION | cut -d' ' -f1)"
 # exported so that "dyntest" can easily access it later without recalculating it
 
 (

From 4948f76f1050ea9329a73709e450a9fa1e384178 Mon Sep 17 00:00:00 2001
From: bin liu <liubin0329@users.noreply.github.com>
Date: Fri, 7 Mar 2014 18:19:18 +0800
Subject: [PATCH 396/403] removing redundant dot

Maybe it's a typo
Upstream-commit: 29079f03cfb0653316b07c58d24f4d547b3de1cc
Component: engine
---
 components/engine/docs/sources/use/port_redirection.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/use/port_redirection.rst b/components/engine/docs/sources/use/port_redirection.rst
index 437c909bfb..38d6b98841 100644
--- a/components/engine/docs/sources/use/port_redirection.rst
+++ b/components/engine/docs/sources/use/port_redirection.rst
@@ -149,4 +149,4 @@ This tells ``client`` that a service is running on port 80 of
 ``server`` and that ``server`` is accessible at the IP address
 172.17.0.8
 
-Note: Using the ``-p`` parameter also exposes the port..
+Note: Using the ``-p`` parameter also exposes the port.

From b1cd97bc5db4fd9565fb7d3ed8e27c58458c2083 Mon Sep 17 00:00:00 2001
From: Gurjeet Singh <gurjeet@singh.im>
Date: Fri, 7 Mar 2014 08:45:08 -0500
Subject: [PATCH 397/403] Correct typo Upstream-commit:
 6d9a7d6bc3edb8294e05a9903d5fa97239ed12e2 Component: engine

---
 components/engine/docs/sources/use/networking.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/use/networking.rst b/components/engine/docs/sources/use/networking.rst
index 431158cc39..c00c608550 100644
--- a/components/engine/docs/sources/use/networking.rst
+++ b/components/engine/docs/sources/use/networking.rst
@@ -148,6 +148,6 @@ ip link command) and the namespaces infrastructure.
 I want more
 ------------
 
-Jérôme Petazzoni has create ``pipework`` to connect together
+Jérôme Petazzoni has created ``pipework`` to connect together
 containers in arbitrarily complex scenarios :
 https://github.com/jpetazzo/pipework

From f8687ad6621d5c1f726b90b4ef5bd276e912930f Mon Sep 17 00:00:00 2001
From: Tom Fotherby <tom+github@peopleperhour.com>
Date: Fri, 7 Mar 2014 16:41:11 +0000
Subject: [PATCH 398/403] Correct Docker run --host param to --hostname
 Upstream-commit: d61938d2b879fe0ccbf46b4a7ca8dd2eb537eee9 Component: engine

---
 components/engine/docs/sources/reference/commandline/cli.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/docs/sources/reference/commandline/cli.rst b/components/engine/docs/sources/reference/commandline/cli.rst
index 2e49cd5ca5..2404e29b29 100644
--- a/components/engine/docs/sources/reference/commandline/cli.rst
+++ b/components/engine/docs/sources/reference/commandline/cli.rst
@@ -1096,7 +1096,7 @@ image is removed.
       --cidfile="": Write the container ID to the file
       -d, --detach=false: Detached mode: Run container in the background, print new container id
       -e, --env=[]: Set environment variables
-      -h, --host="": Container host name
+      -h, --hostname="": Container host name
       -i, --interactive=false: Keep stdin open even if not attached
       --privileged=false: Give extended privileges to this container
       -m, --memory="": Memory limit (format: <number><optional unit>, where unit = b, k, m or g)

From 926a18e3d95fd87eee89376c9175a00e39a83044 Mon Sep 17 00:00:00 2001
From: Paul Morie <pmorie@gmail.com>
Date: Fri, 7 Mar 2014 12:20:25 -0500
Subject: [PATCH 399/403] Fix typo in devmapper driver_test

Docker-DCO-1.1-Signed-off-by: Paul Morie <pmorie@gmail.com> (github: pmorie)
Upstream-commit: b3e7df48dfbf3d2300877d1e524132624e9493c3
Component: engine
---
 components/engine/graphdriver/devmapper/driver_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/engine/graphdriver/devmapper/driver_test.go b/components/engine/graphdriver/devmapper/driver_test.go
index 7939241987..68699f208e 100644
--- a/components/engine/graphdriver/devmapper/driver_test.go
+++ b/components/engine/graphdriver/devmapper/driver_test.go
@@ -299,7 +299,7 @@ func TestInit(t *testing.T) {
 			}
 		}()
 	}()
-	// Put all tests in a funciton to make sure the garbage collection will
+	// Put all tests in a function to make sure the garbage collection will
 	// occur.
 
 	// Call GC to cleanup runtime.Finalizers

From 3a9e0a7416a963b01ce8b645bbffa373b67002d7 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Fri, 7 Mar 2014 11:51:28 -0800
Subject: [PATCH 400/403] Fix Race when killing the daemon

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: b845ff355a3342ee3fee99196d22194706763182
Component: engine
---
 components/engine/container.go | 22 ++++++++++++----------
 components/engine/server.go    | 24 ++++++++++++++++++++----
 2 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/components/engine/container.go b/components/engine/container.go
index a9a6ca9cf7..50332f27de 100644
--- a/components/engine/container.go
+++ b/components/engine/container.go
@@ -784,17 +784,19 @@ func (container *Container) monitor(callback execdriver.StartCallback) error {
 		utils.Errorf("Error running container: %s", err)
 	}
 
-	container.State.SetStopped(exitCode)
+	if container.runtime.srv.IsRunning() {
+		container.State.SetStopped(exitCode)
 
-	// FIXME: there is a race condition here which causes this to fail during the unit tests.
-	// If another goroutine was waiting for Wait() to return before removing the container's root
-	// from the filesystem... At this point it may already have done so.
-	// This is because State.setStopped() has already been called, and has caused Wait()
-	// to return.
-	// FIXME: why are we serializing running state to disk in the first place?
-	//log.Printf("%s: Failed to dump configuration to the disk: %s", container.ID, err)
-	if err := container.ToDisk(); err != nil {
-		utils.Errorf("Error dumping container state to disk: %s\n", err)
+		// FIXME: there is a race condition here which causes this to fail during the unit tests.
+		// If another goroutine was waiting for Wait() to return before removing the container's root
+		// from the filesystem... At this point it may already have done so.
+		// This is because State.setStopped() has already been called, and has caused Wait()
+		// to return.
+		// FIXME: why are we serializing running state to disk in the first place?
+		//log.Printf("%s: Failed to dump configuration to the disk: %s", container.ID, err)
+		if err := container.ToDisk(); err != nil {
+			utils.Errorf("Error dumping container state to disk: %s\n", err)
+		}
 	}
 
 	// Cleanup
diff --git a/components/engine/server.go b/components/engine/server.go
index 024b8aa3c4..2c8a7ee4f8 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -29,10 +29,6 @@ import (
 	"time"
 )
 
-func (srv *Server) Close() error {
-	return srv.runtime.Close()
-}
-
 // jobInitApi runs the remote api server `srv` as a daemon,
 // Only one api server can run at the same time - this is enforced by a pidfile.
 // The signals SIGINT, SIGQUIT and SIGTERM are intercepted for cleanup.
@@ -2330,6 +2326,7 @@ func NewServer(eng *engine.Engine, config *DaemonConfig) (*Server, error) {
 		pushingPool: make(map[string]chan struct{}),
 		events:      make([]utils.JSONMessage, 0, 64), //only keeps the 64 last events
 		listeners:   make(map[string]chan utils.JSONMessage),
+		running:     true,
 	}
 	runtime.srv = srv
 	return srv, nil
@@ -2379,6 +2376,24 @@ func (srv *Server) GetEvents() []utils.JSONMessage {
 	return srv.events
 }
 
+func (srv *Server) SetRunning(status bool) {
+	srv.Lock()
+	defer srv.Unlock()
+
+	srv.running = status
+}
+
+func (srv *Server) IsRunning() bool {
+	srv.RLock()
+	defer srv.RUnlock()
+	return srv.running
+}
+
+func (srv *Server) Close() error {
+	srv.SetRunning(false)
+	return srv.runtime.Close()
+}
+
 type Server struct {
 	sync.RWMutex
 	runtime     *Runtime
@@ -2387,4 +2402,5 @@ type Server struct {
 	events      []utils.JSONMessage
 	listeners   map[string]chan utils.JSONMessage
 	Eng         *engine.Engine
+	running     bool
 }

From c65746a97c458bc075388c1fdc868fdfe3621c1f Mon Sep 17 00:00:00 2001
From: Victor Vieux <victor.vieux@docker.com>
Date: Fri, 7 Mar 2014 20:07:17 +0000
Subject: [PATCH 401/403] fix string in docker images

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: bc086a9cd61b2d15fbef9db3cb53c7f3650fda48
Component: engine
---
 components/engine/server.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/components/engine/server.go b/components/engine/server.go
index 024b8aa3c4..91c58f62e2 100644
--- a/components/engine/server.go
+++ b/components/engine/server.go
@@ -1011,7 +1011,11 @@ func (srv *Server) Containers(job *engine.Job) engine.Status {
 		out.Set("Id", container.ID)
 		out.SetList("Names", names[container.ID])
 		out.Set("Image", srv.runtime.repositories.ImageName(container.Image))
-		out.Set("Command", fmt.Sprintf("%s %s", container.Path, strings.Join(container.Args, " ")))
+		if len(container.Args) > 0 {
+			out.Set("Command", fmt.Sprintf("\"%s %s\"", container.Path, strings.Join(container.Args, " ")))
+		} else {
+			out.Set("Command", fmt.Sprintf("\"%s\"", container.Path))
+		}
 		out.SetInt64("Created", container.Created.Unix())
 		out.Set("Status", container.State.String())
 		str, err := container.NetworkSettings.PortMappingAPI().ToListString()

From 063107f17f096732875d09893209816eea963640 Mon Sep 17 00:00:00 2001
From: unclejack <unclejacksons@gmail.com>
Date: Sat, 8 Mar 2014 17:36:18 +0200
Subject: [PATCH 402/403] upgrade packages after debootstrap

This makes mkimage-debootstrap upgrade packages after retrieving
updated lists of packages.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: d04f4d836c6b2a9266350a1b0e284949dcc6510a
Component: engine
---
 components/engine/contrib/mkimage-debootstrap.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/components/engine/contrib/mkimage-debootstrap.sh b/components/engine/contrib/mkimage-debootstrap.sh
index bf89600973..33ba7b07cb 100755
--- a/components/engine/contrib/mkimage-debootstrap.sh
+++ b/components/engine/contrib/mkimage-debootstrap.sh
@@ -219,6 +219,7 @@ if [ -z "$strictDebootstrap" ]; then
 	
 	# make sure our packages lists are as up to date as we can get them
 	sudo chroot . apt-get update
+	sudo chroot . apt-get dist-upgrade -y
 fi
 
 if [ "$justTar" ]; then

From a185dfcddd94b8efca7cad2ecb447f83f0593d11 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Sun, 9 Mar 2014 23:16:42 -0600
Subject: [PATCH 403/403] Fix a few packaging bugs, including and especially a
 temporary patch to our upstart script to mount cgroups properly

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 50082f792be22b97dcc79afe666289ecefbc3864
Component: engine
---
 .../init/{sysvinit => sysvinit-debian}/docker |  42 ++++--
 .../init/sysvinit-debian/docker.default       |  13 ++
 .../engine/contrib/init/upstart/docker.conf   |  13 +-
 components/engine/hack/make/ubuntu            | 131 +++++++++---------
 4 files changed, 123 insertions(+), 76 deletions(-)
 rename components/engine/contrib/init/{sysvinit => sysvinit-debian}/docker (61%)
 create mode 100644 components/engine/contrib/init/sysvinit-debian/docker.default

diff --git a/components/engine/contrib/init/sysvinit/docker b/components/engine/contrib/init/sysvinit-debian/docker
similarity index 61%
rename from components/engine/contrib/init/sysvinit/docker
rename to components/engine/contrib/init/sysvinit-debian/docker
index 2d79c4d4c0..510683a459 100755
--- a/components/engine/contrib/init/sysvinit/docker
+++ b/components/engine/contrib/init/sysvinit-debian/docker
@@ -14,13 +14,15 @@
 #  VMs, bare metal, OpenStack clusters, public clouds and more.
 ### END INIT INFO
 
+export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+
 BASE=$(basename $0)
 
+# modify these in /etc/default/$BASE (/etc/default/docker)
 DOCKER=/usr/bin/$BASE
 DOCKER_PIDFILE=/var/run/$BASE.pid
 DOCKER_OPTS=
-
-PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+DOCKER_DESC="Docker"
 
 # Get lsb functions
 . /lib/lsb/init-functions
@@ -30,8 +32,8 @@ if [ -f /etc/default/$BASE ]; then
 fi
 
 # see also init_is_upstart in /lib/lsb/init-functions (which isn't available in Ubuntu 12.04, or we'd use it)
-if [ -x /sbin/initctl ] && /sbin/initctl version 2>/dev/null | /bin/grep -q upstart; then
-	log_failure_msg "Docker is managed via upstart, try using service $BASE $1"
+if [ -x /sbin/initctl ] && /sbin/initctl version 2>/dev/null | grep -q upstart; then
+	log_failure_msg "$DOCKER_DESC is managed via upstart, try using service $BASE $1"
 	exit 1
 fi
 
@@ -43,7 +45,7 @@ fi
 
 fail_unless_root() {
 	if [ "$(id -u)" != '0' ]; then
-		log_failure_msg "Docker must be run as root"
+		log_failure_msg "$DOCKER_DESC must be run as root"
 		exit 1
 	fi
 }
@@ -51,21 +53,37 @@ fail_unless_root() {
 case "$1" in
 	start)
 		fail_unless_root
-		log_begin_msg "Starting Docker: $BASE"
-		mount | grep cgroup >/dev/null || mount -t cgroup none /sys/fs/cgroup 2>/dev/null
+
+		if ! grep -q cgroup /proc/mounts; then
+			# rough approximation of cgroupfs-mount
+			mount -t tmpfs -o uid=0,gid=0,mode=0755 cgroup /sys/fs/cgroup
+			for sys in $(cut -d'	' -f1 /proc/cgroups); do
+				mkdir -p /sys/fs/cgroup/$sys
+				if ! mount -n -t cgroup -o $sys cgroup /sys/fs/cgroup/$sys 2>/dev/null; then
+					rmdir /sys/fs/cgroup/$sys 2>/dev/null || true
+				fi
+			done
+		fi
+
+		touch /var/log/docker.log
+		chgrp docker /var/log/docker.log
+
+		log_begin_msg "Starting $DOCKER_DESC: $BASE"
 		start-stop-daemon --start --background \
+			--no-close \
 			--exec "$DOCKER" \
 			--pidfile "$DOCKER_PIDFILE" \
-			-- -d -p "$DOCKER_PIDFILE" \
-			$DOCKER_OPTS
+			-- \
+				-d -p "$DOCKER_PIDFILE" \
+				$DOCKER_OPTS \
+					> /var/log/docker.log 2>&1
 		log_end_msg $?
 		;;
 
 	stop)
 		fail_unless_root
-		log_begin_msg "Stopping Docker: $BASE"
-		start-stop-daemon --stop \
-			--pidfile "$DOCKER_PIDFILE"
+		log_begin_msg "Stopping $DOCKER_DESC: $BASE"
+		start-stop-daemon --stop --pidfile "$DOCKER_PIDFILE"
 		log_end_msg $?
 		;;
 
diff --git a/components/engine/contrib/init/sysvinit-debian/docker.default b/components/engine/contrib/init/sysvinit-debian/docker.default
new file mode 100644
index 0000000000..d5110b5e2f
--- /dev/null
+++ b/components/engine/contrib/init/sysvinit-debian/docker.default
@@ -0,0 +1,13 @@
+# Docker Upstart and SysVinit configuration file
+
+# Customize location of Docker binary (especially for development testing).
+#DOCKER="/usr/local/bin/docker"
+
+# Use DOCKER_OPTS to modify the daemon startup options.
+#DOCKER_OPTS="-dns 8.8.8.8 -dns 8.8.4.4"
+
+# If you need Docker to use an HTTP proxy, it can also be specified here.
+#export http_proxy="http://127.0.0.1:3128/"
+
+# This is also a handy place to tweak where Docker's temporary files go.
+#export TMPDIR="/mnt/bigdrive/docker-tmp"
diff --git a/components/engine/contrib/init/upstart/docker.conf b/components/engine/contrib/init/upstart/docker.conf
index ee8a447c27..e2cc4536e1 100644
--- a/components/engine/contrib/init/upstart/docker.conf
+++ b/components/engine/contrib/init/upstart/docker.conf
@@ -1,15 +1,26 @@
 description "Docker daemon"
 
-start on filesystem and started lxc-net
+start on filesystem
 stop on runlevel [!2345]
 
 respawn
 
 script
+	# modify these in /etc/default/$UPSTART_JOB (/etc/default/docker)
 	DOCKER=/usr/bin/$UPSTART_JOB
 	DOCKER_OPTS=
 	if [ -f /etc/default/$UPSTART_JOB ]; then
 		. /etc/default/$UPSTART_JOB
 	fi
+	if ! grep -q cgroup /proc/mounts; then
+		# rough approximation of cgroupfs-mount
+		mount -t tmpfs -o uid=0,gid=0,mode=0755 cgroup /sys/fs/cgroup
+		for sys in $(cut -d'	' -f1 /proc/cgroups); do
+			mkdir -p /sys/fs/cgroup/$sys
+			if ! mount -n -t cgroup -o $sys cgroup /sys/fs/cgroup/$sys 2>/dev/null; then
+				rmdir /sys/fs/cgroup/$sys 2>/dev/null || true
+			fi
+		done
+	fi
 	"$DOCKER" -d $DOCKER_OPTS
 end script
diff --git a/components/engine/hack/make/ubuntu b/components/engine/hack/make/ubuntu
index 602d4ac1ad..ebc12f27ec 100644
--- a/components/engine/hack/make/ubuntu
+++ b/components/engine/hack/make/ubuntu
@@ -29,42 +29,36 @@ bundle_ubuntu() {
 	cp contrib/udev/80-docker.rules $DIR/etc/udev/rules.d/
 
 	# Include our init scripts
-	mkdir -p $DIR/etc
-	cp -R contrib/init/upstart $DIR/etc/init
-	cp -R contrib/init/sysvinit $DIR/etc/init.d
-	mkdir -p $DIR/lib/systemd
-	cp -R contrib/init/systemd $DIR/lib/systemd/system
-
+	mkdir -p $DIR/etc/init
+	cp contrib/init/upstart/docker.conf $DIR/etc/init/
+	mkdir -p $DIR/etc/init.d
+	cp contrib/init/sysvinit-debian/docker $DIR/etc/init.d/
 	mkdir -p $DIR/etc/default
-	cat > $DIR/etc/default/docker <<'EOF'
-# Docker Upstart and SysVinit configuration file
-
-# Customize location of Docker binary (especially for development testing).
-#DOCKER="/usr/local/bin/docker"
-
-# Use DOCKER_OPTS to modify the daemon startup options.
-#DOCKER_OPTS="-dns 8.8.8.8"
-
-# If you need Docker to use an HTTP proxy, it can also be specified here.
-#export http_proxy=http://127.0.0.1:3128/
-EOF
+	cp contrib/init/sysvinit-debian/docker.default $DIR/etc/default/docker
+	mkdir -p $DIR/lib/systemd/system
+	cp contrib/init/systemd/docker.service $DIR/lib/systemd/system/
 
 	# Copy the binary
 	# This will fail if the binary bundle hasn't been built
 	mkdir -p $DIR/usr/bin
-	# Copy the binary
-	# This will fail if the binary bundle hasn't been built
 	cp $DEST/../binary/docker-$VERSION $DIR/usr/bin/docker
 
 	# Generate postinst/prerm/postrm scripts
-	cat > /tmp/postinst <<'EOF'
+	cat > $DEST/postinst <<'EOF'
 #!/bin/sh
 set -e
 set -u
 
-getent group docker > /dev/null || groupadd --system docker || true
+if [ "$1" = 'configure' ] && [ -z "$2" ]; then
+	if ! getent group docker > /dev/null; then
+		groupadd --system docker
+	fi
+fi
 
-update-rc.d docker defaults > /dev/null || true
+if ! { [ -x /sbin/initctl ] && /sbin/initctl version 2>/dev/null | grep -q upstart; }; then
+	# we only need to do this if upstart isn't in charge
+	update-rc.d docker defaults > /dev/null || true
+fi
 if [ -n "$2" ]; then
 	_dh_action=restart
 else
@@ -74,7 +68,7 @@ service docker $_dh_action 2>/dev/null || true
 
 #DEBHELPER#
 EOF
-	cat > /tmp/prerm <<'EOF'
+	cat > $DEST/prerm <<'EOF'
 #!/bin/sh
 set -e
 set -u
@@ -83,7 +77,7 @@ service docker stop 2>/dev/null || true
 
 #DEBHELPER#
 EOF
-	cat > /tmp/postrm <<'EOF'
+	cat > $DEST/postrm <<'EOF'
 #!/bin/sh
 set -e
 set -u
@@ -101,50 +95,61 @@ fi
 #DEBHELPER#
 EOF
 	# TODO swaths of these were borrowed from debhelper's auto-inserted stuff, because we're still using fpm - we need to use debhelper instead, and somehow reconcile Ubuntu that way
-	chmod +x /tmp/postinst /tmp/prerm
+	chmod +x $DEST/postinst $DEST/prerm $DEST/postrm
 
 	(
+		# switch directories so we create *.deb in the right folder
 		cd $DEST
+
+		# create lxc-docker-VERSION package
 		fpm -s dir -C $DIR \
-		    --name lxc-docker-$VERSION --version $PKGVERSION \
-		    --after-install /tmp/postinst \
-		    --before-remove /tmp/prerm \
-		    --after-remove /tmp/postrm \
-		    --architecture "$PACKAGE_ARCHITECTURE" \
-		    --prefix / \
-		    --depends iptables \
-		    --deb-recommends aufs-tools \
-		    --deb-recommends ca-certificates \
-		    --deb-recommends git \
-		    --deb-recommends xz-utils \
-		    --description "$PACKAGE_DESCRIPTION" \
-		    --maintainer "$PACKAGE_MAINTAINER" \
-		    --conflicts docker \
-		    --conflicts docker.io \
-		    --conflicts lxc-docker-virtual-package \
-		    --provides lxc-docker \
-		    --provides lxc-docker-virtual-package \
-		    --replaces lxc-docker \
-		    --replaces lxc-docker-virtual-package \
-		    --url "$PACKAGE_URL" \
-		    --license "$PACKAGE_LICENSE" \
-		    --config-files /etc/udev/rules.d/80-docker.rules \
-		    --config-files /etc/init/docker.conf \
-		    --config-files /etc/init.d/docker \
-		    --config-files /etc/default/docker \
-		    --deb-compression gz \
-		    -t deb .
+			--name lxc-docker-$VERSION --version $PKGVERSION \
+			--after-install $DEST/postinst \
+			--before-remove $DEST/prerm \
+			--after-remove $DEST/postrm \
+			--architecture "$PACKAGE_ARCHITECTURE" \
+			--prefix / \
+			--depends iptables \
+			--deb-recommends aufs-tools \
+			--deb-recommends ca-certificates \
+			--deb-recommends git \
+			--deb-recommends xz-utils \
+			--deb-suggests cgroup-lite \
+			--description "$PACKAGE_DESCRIPTION" \
+			--maintainer "$PACKAGE_MAINTAINER" \
+			--conflicts docker \
+			--conflicts docker.io \
+			--conflicts lxc-docker-virtual-package \
+			--provides lxc-docker \
+			--provides lxc-docker-virtual-package \
+			--replaces lxc-docker \
+			--replaces lxc-docker-virtual-package \
+			--url "$PACKAGE_URL" \
+			--license "$PACKAGE_LICENSE" \
+			--config-files /etc/udev/rules.d/80-docker.rules \
+			--config-files /etc/init/docker.conf \
+			--config-files /etc/init.d/docker \
+			--config-files /etc/default/docker \
+			--deb-compression gz \
+			-t deb .
+		# TODO replace "Suggests: cgroup-lite" with "Recommends: cgroupfs-mount | cgroup-lite" once cgroupfs-mount is available
+
+		# create empty lxc-docker wrapper package
 		fpm -s empty \
-		    --name lxc-docker --version $PKGVERSION \
-		    --architecture "$PACKAGE_ARCHITECTURE" \
-		    --depends lxc-docker-$VERSION \
-		    --description "$PACKAGE_DESCRIPTION" \
-		    --maintainer "$PACKAGE_MAINTAINER" \
-		    --url "$PACKAGE_URL" \
-		    --license "$PACKAGE_LICENSE" \
-		    --deb-compression gz \
-		    -t deb
+			--name lxc-docker --version $PKGVERSION \
+			--architecture "$PACKAGE_ARCHITECTURE" \
+			--depends lxc-docker-$VERSION \
+			--description "$PACKAGE_DESCRIPTION" \
+			--maintainer "$PACKAGE_MAINTAINER" \
+			--url "$PACKAGE_URL" \
+			--license "$PACKAGE_LICENSE" \
+			--deb-compression gz \
+			-t deb
 	)
+
+	# clean up after ourselves so we have a clean output directory
+	rm $DEST/postinst $DEST/prerm $DEST/postrm
+	rm -r $DIR
 }
 
 bundle_ubuntu